Upload af RDPSign fra arbejde-noter repo

2026-05-22 10:34:36 +02:00
parent a96d376856
commit a22732d38f
17 changed files with 1677 additions and 0 deletions
@@ -0,0 +1,58 @@
+# ============================================================
+# CHANGELOG
+# v1.1 - Added -AllUsers switch to remove signatures from RDP
+#        files on all user desktops instead of only the public
+#        desktop.
+#        Added Get-DesktopPaths helper function.
+# v1.0 - Initial version, clears signing on public desktop only.
+# ============================================================
+
+param(
+    [switch]$AllUsers
+)
+
+function Get-DesktopPaths {
+    if ($AllUsers) {
+        Get-ChildItem "$env:SystemDrive\Users" -Directory | ForEach-Object {
+            $path = Join-Path $_.FullName "Desktop"
+            if (Test-Path $path) { $path }
+        }
+    } else {
+        [Environment]::GetFolderPath("CommonDesktopDirectory")
+    }
+}
+
+$certSubject = "CN=RDPSign"
+
+# 1. Unsign RDP files
+foreach ($desktopPath in (Get-DesktopPaths)) {
+    $rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp"
+    foreach ($file in $rdpFiles) {
+        $content = Get-Content $file.FullName
+        $cleaned = $content | Where-Object { $_ -notmatch "^signscope:s:" -and $_ -notmatch "^signature:s:" }
+        $cleaned | Set-Content $file.FullName -Encoding Unicode
+        Write-Host "Unsigned: $($file.Name) on $desktopPath"
+    }
+}
+
+# 2. Remove certificate from all stores
+foreach ($storeName in @("My", "Root", "TrustedPublisher")) {
+    $store = New-Object System.Security.Cryptography.X509Certificates.X509Store($storeName, "LocalMachine")
+    $store.Open("ReadWrite")
+    $certs = $store.Certificates | Where-Object { $_.Subject -eq $certSubject }
+    foreach ($cert in $certs) {
+        $store.Remove($cert)
+        Write-Host "Removed certificate from store: $storeName"
+    }
+    $store.Close()
+}
+
+# 3. Remove thumbprint from registry
+$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
+Remove-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue
+Write-Host "Removed TrustedCertThumbprints"
+
+# 4. Remove RedirectionWarningDialogVersion
+$clientPath = "HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services\Client"
+Remove-ItemProperty -Path $clientPath -Name "RedirectionWarningDialogVersion" -ErrorAction SilentlyContinue
+Write-Host "Removed RedirectionWarningDialogVersion"