Remote Desktop Services¶

# Check if Remote Desktop is enabled
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections"

# Enable Remote Desktop via registry
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" `
    -Name "fDenyTSConnections" -Value 0 -Type DWord

# Also open the firewall rule
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Read current RDP listening port
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
    -Name "PortNumber"

# Change RDP port to 3390 (for security through obscurity — not a replacement for NLA)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
    -Name "PortNumber" -Value 3390 -Type DWord

# Update the firewall to allow the new port
New-NetFirewallRule -DisplayName "RDP Custom Port 3390" `
    -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow

# Read all RDP-Tcp listener settings
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" |
    Select-Object PortNumber, SecurityLayer, UserAuthentication, MinEncryptionLevel, MaxInstanceCount

# Configure session timeouts on the RDP listener
$rdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"

# Idle timeout: 30 minutes
Set-ItemProperty -Path $rdpPath -Name "MaxIdleTime" -Value 1800000 -Type DWord

# Max session duration: 8 hours
Set-ItemProperty -Path $rdpPath -Name "MaxConnectionTime" -Value 28800000 -Type DWord

# Disconnected session timeout: 15 minutes
Set-ItemProperty -Path $rdpPath -Name "MaxDisconnectionTime" -Value 900000 -Type DWord

# End session (logoff) when connection is broken, allow reconnect from any client
Set-ItemProperty -Path $rdpPath -Name "fResetBroken" -Value 0 -Type DWord
Set-ItemProperty -Path $rdpPath -Name "fReconnectSame" -Value 0 -Type DWord

# Audit current timeout configuration
$rdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
$props = Get-ItemProperty $rdpPath

[PSCustomObject]@{
    MaxIdleTime           = if ($props.MaxIdleTime -gt 0) { "$($props.MaxIdleTime / 60000) min" } else { "Unlimited" }
    MaxConnectionTime     = if ($props.MaxConnectionTime -gt 0) { "$($props.MaxConnectionTime / 60000) min" } else { "Unlimited" }
    MaxDisconnectionTime  = if ($props.MaxDisconnectionTime -gt 0) { "$($props.MaxDisconnectionTime / 60000) min" } else { "Unlimited" }
    ResetBroken           = $props.fResetBroken
    ReconnectSame         = $props.fReconnectSame
} | Format-List

# Check current licensing configuration
$licensePath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core"
Get-ItemProperty $licensePath -ErrorAction SilentlyContinue |
    Select-Object LicensingMode, LicenseServers

# Check if GPO overrides are in place
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
Get-ItemProperty $gpoPath -Name "LicensingMode", "LicenseServers" -ErrorAction SilentlyContinue

# Set licensing mode to Per User and specify license server
$licensePath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core"

Set-ItemProperty -Path $licensePath -Name "LicensingMode" -Value 4 -Type DWord
Set-ItemProperty -Path $licensePath -Name "LicenseServers" -Value "RDLIC01.contoso.com" -Type String

# Check RD Gateway configuration
$gwPath = "HKLM:\SOFTWARE\Microsoft\Terminal Server Gateway\Config\Core"
Get-ItemProperty $gwPath -ErrorAction SilentlyContinue

# Check Connection Broker cluster settings
$cbPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\ClusterSettings"
Get-ItemProperty $cbPath -ErrorAction SilentlyContinue |
    Select-Object SessionDirectoryActive, SessionDirectoryLocation, SessionDirectoryClusterName

# Enable load balancing participation with weight 100
Set-ItemProperty -Path $cbPath -Name "ParticipateInLoadBalancing" -Value 1 -Type DWord
Set-ItemProperty -Path $cbPath -Name "RelativeWeight" -Value 100 -Type DWord

# List all published RemoteApp applications
$appPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList\Applications"
Get-ChildItem $appPath | ForEach-Object {
    $props = Get-ItemProperty $_.PSPath
    [PSCustomObject]@{
        Name        = $_.PSChildName
        Path        = $props.Path
        CommandLine = $props.CommandLineSetting
        IconPath    = $props.IconPath
    }
}

# Publish a new RemoteApp
$appBasePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList\Applications"
$appName = "WordPad"
$appPath = Join-Path $appBasePath $appName

New-Item -Path $appPath -Force | Out-Null
Set-ItemProperty -Path $appPath -Name "Name" -Value "WordPad" -Type String
Set-ItemProperty -Path $appPath -Name "Path" -Value "C:\Program Files\Windows NT\Accessories\wordpad.exe" -Type String
Set-ItemProperty -Path $appPath -Name "CommandLineSetting" -Value 0 -Type DWord
Set-ItemProperty -Path $appPath -Name "IconPath" -Value "C:\Program Files\Windows NT\Accessories\wordpad.exe" -Type String
Set-ItemProperty -Path $appPath -Name "IconIndex" -Value 0 -Type DWord
Set-ItemProperty -Path $appPath -Name "ShowInTSWA" -Value 1 -Type DWord

# Check the TSAppAllowList policy
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList" `
    -Name "fDisabledAllowList" -ErrorAction SilentlyContinue

# Enable NLA on the RDP listener
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
    -Name "UserAuthentication" -Value 1 -Type DWord

# Also set the security layer to TLS
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
    -Name "SecurityLayer" -Value 2 -Type DWord

# Check if NLA is enforced by Group Policy
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
Get-ItemProperty $gpoPath -Name "UserAuthentication" -ErrorAction SilentlyContinue

# Audit NLA and security layer on remote servers
$servers = @("RDSH01", "RDSH02", "RDSH03")
Invoke-Command -ComputerName $servers -ScriptBlock {
    $rdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
    $props = Get-ItemProperty $rdpPath
    [PSCustomObject]@{
        Server             = $env:COMPUTERNAME
        SecurityLayer      = $props.SecurityLayer
        UserAuthentication = $props.UserAuthentication
        MinEncryptionLevel = $props.MinEncryptionLevel
    }
} | Format-Table -AutoSize

# Configure RDS roaming profile path via registry
$tsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"

if (-not (Test-Path $tsPath)) {
    New-Item -Path $tsPath -Force | Out-Null
}

Set-ItemProperty -Path $tsPath -Name "WFProfilePath" -Value "\\NAS01\RDSProfiles$\%username%" -Type String
Set-ItemProperty -Path $tsPath -Name "WFHomeDirDrive" -Value "H:" -Type String
Set-ItemProperty -Path $tsPath -Name "WFHomeDir" -Value "\\NAS01\RDSHome$\%username%" -Type String

# Check UPD configuration on the RDS session host
$clusterPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\ClusterSettings"
Get-ItemProperty $clusterPath -Name "UvhdEnabled", "UvhdShareUrl" -ErrorAction SilentlyContinue

# Harden RDS: disable clipboard and drive redirection (prevent data exfiltration)
$rdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
Set-ItemProperty -Path $rdpPath -Name "fDisableClip" -Value 1 -Type DWord
Set-ItemProperty -Path $rdpPath -Name "fDisableCdm" -Value 1 -Type DWord

# Check licensing configuration on all Session Hosts
$sessionHosts = @("RDSH01", "RDSH02", "RDSH03", "RDSH04", "RDSH05")

Invoke-Command -ComputerName $sessionHosts -ScriptBlock {
    # Check local registry
    $localPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core"
    $local = Get-ItemProperty $localPath -ErrorAction SilentlyContinue

    # Check GPO registry
    $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
    $gpo = Get-ItemProperty $gpoPath -Name "LicensingMode", "LicenseServers" -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        Server           = $env:COMPUTERNAME
        LocalMode        = $local.LicensingMode
        LocalLicServer   = $local.LicenseServers
        GPOMode          = $gpo.LicensingMode
        GPOLicServer     = $gpo.LicenseServers
    }
} | Format-Table -AutoSize

# Test connectivity to the license server from each session host
Invoke-Command -ComputerName $sessionHosts -ScriptBlock {
    $licServer = "RDLIC01.contoso.com"
    $dns = Resolve-DnsName $licServer -ErrorAction SilentlyContinue
    $tcp = Test-NetConnection $licServer -Port 135 -WarningAction SilentlyContinue

    [PSCustomObject]@{
        Server      = $env:COMPUTERNAME
        DNS         = if ($dns) { "OK" } else { "FAIL" }
        RPC_Port135 = if ($tcp.TcpTestSucceeded) { "OK" } else { "FAIL" }
    }
}

# Apply licensing configuration on all session hosts
$sessionHosts = @("RDSH01", "RDSH02", "RDSH03", "RDSH04", "RDSH05")
$licServer = "RDLIC01.contoso.com"
$licMode = 4  # Per User

Invoke-Command -ComputerName $sessionHosts -ScriptBlock {
    param($mode, $server)

    # Set local registry configuration
    $localPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core"
    Set-ItemProperty -Path $localPath -Name "LicensingMode" -Value $mode -Type DWord
    Set-ItemProperty -Path $localPath -Name "LicenseServers" -Value $server -Type String

    # Also set via the GPO path to ensure consistency
    $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
    if (-not (Test-Path $gpoPath)) {
        New-Item -Path $gpoPath -Force | Out-Null
    }
    Set-ItemProperty -Path $gpoPath -Name "LicensingMode" -Value $mode -Type DWord
    Set-ItemProperty -Path $gpoPath -Name "LicenseServers" -Value $server -Type String

    Write-Output "$env:COMPUTERNAME : Licensing configured (Mode=$mode, Server=$server)"
} -ArgumentList $licMode, $licServer

# Fix the firewall issue on RDSH04
Invoke-Command -ComputerName "RDSH04" -ScriptBlock {
    # Enable RPC communication for RD Licensing
    Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

    # Verify the license server is now reachable
    $test = Test-NetConnection "RDLIC01.contoso.com" -Port 135 -WarningAction SilentlyContinue
    Write-Output "RDSH04 : RPC Port 135 = $($test.TcpTestSucceeded)"
}

# Delete the grace period timer (requires SYSTEM privileges via PsExec or scheduled task)
# WARNING: only use this if the grace period has expired and you have valid CALs

Invoke-Command -ComputerName $sessionHosts -ScriptBlock {
    $gracePath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod"

    if (Test-Path $gracePath) {
        # Take ownership and grant full control
        $acl = Get-Acl $gracePath
        $rule = New-Object System.Security.AccessControl.RegistryAccessRule(
            "BUILTIN\Administrators", "FullControl", "Allow")
        $acl.SetAccessRule($rule)
        Set-Acl $gracePath $acl

        # Delete the grace period key
        Remove-Item $gracePath -Force
        Write-Output "$env:COMPUTERNAME : Grace period reset"
    }
    else {
        Write-Output "$env:COMPUTERNAME : No grace period key found"
    }
}

# Validate licensing is working after restart
Invoke-Command -ComputerName $sessionHosts -ScriptBlock {
    # Check licensing events
    $events = Get-WinEvent -FilterHashtable @{
        LogName = 'System'
        ProviderName = 'TermServLicensing'
    } -MaxEvents 3 -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        Server      = $env:COMPUTERNAME
        LastEvent   = if ($events) { $events[0].Message.Substring(0, [Math]::Min(80, $events[0].Message.Length)) } else { "No events" }
        EventId     = if ($events) { $events[0].Id } else { "N/A" }
    }
} | Format-Table -AutoSize