Upload af RDPSign fra arbejde-noter repo

2026-05-22 10:34:36 +02:00
parent a96d376856
commit a22732d38f
17 changed files with 1677 additions and 0 deletions
@@ -0,0 +1,176 @@
+# ============================================================
+# INSTALL + DETECT - Sandbox test script
+# ============================================================
+
+# Setup logging
+$baseFolder = Join-Path $env:SystemDrive "Intune"
+$logFile = Join-Path $baseFolder "DesktopShortcuts.log"
+$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
+
+# Check if Sysnative exists (means script is running in 32-bit mode on x64 OS)
+if (Test-Path "$($env:windir)\Sysnative") {
+    $rdpSignPath = "$($env:windir)\Sysnative\rdpsign.exe"
+} else {
+    $rdpSignPath = "$($env:windir)\System32\rdpsign.exe"
+}
+
+if (-not (Test-Path $baseFolder)) {
+    New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
+}
+
+function Write-Log {
+    param($Message)
+    $logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
+    Add-Content -Path $logFile -Value $logMessage
+    Write-Host $logMessage
+}
+
+# ============================================================
+# INSTALL
+# ============================================================
+Write-Log "=== START INSTALL ==="
+
+try {
+    # Copy RDP files to public desktop
+    Get-ChildItem -Path ".\rdp-files\*.rdp" | ForEach-Object {
+        try {
+            Copy-Item -Path $_.FullName -Destination $desktopPath -Force
+        } catch {
+            Write-Log "Error copying file: $_"
+        }
+    }
+
+    Start-Sleep -Seconds 2 # Wait for files to be fully copied before signing
+    Write-Log "Copied .rdp files to public desktop: $desktopPath"
+
+    # Get RDP files from public desktop for signing
+    $rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -Recurse -ErrorAction SilentlyContinue
+    $certSubjectName = "RDPSign"
+    $certSubject = "CN=$certSubjectName"
+
+    Write-Log "Searching for existing certificate: $certSubjectName..."
+
+    $existingCert = Get-ChildItem Cert:\LocalMachine\My |
+        Where-Object { $_.Subject -eq $certSubject } |
+        Select-Object -First 1
+
+    if ($existingCert) {
+        Write-Log "Found existing certificate with Thumbprint: $($existingCert.Thumbprint)"
+        $thumbprint = $existingCert.Thumbprint
+    } else {
+        Write-Log "No existing certificate found. Creating new one..."
+
+        $cert = New-SelfSignedCertificate `
+            -Subject $certSubject `
+            -CertStoreLocation "Cert:\LocalMachine\My" `
+            -Type CodeSigningCert `
+            -KeyExportPolicy NonExportable `
+            -NotAfter (Get-Date).AddYears(25)
+
+        $thumbprint = $cert.Thumbprint
+
+        # Add to Trusted Root
+        $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
+        $rootStore.Open("ReadWrite")
+        $rootStore.Add($cert)
+        $rootStore.Close()
+
+        # Add to Trusted Publishers
+        $pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")
+        $pubStore.Open("ReadWrite")
+        $pubStore.Add($cert)
+        $pubStore.Close()
+
+        # Add thumbprint to RDP trusted certs in registry
+        $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
+        $keyName = "TrustedCertThumbprints"
+
+        if (-not (Test-Path $gpoPath)) {
+            New-Item -Path $gpoPath -Force | Out-Null
+        }
+
+        $currentValue = (Get-ItemProperty -Path $gpoPath -Name $keyName -ErrorAction SilentlyContinue).$keyName
+
+        if ($currentValue -notmatch [regex]::Escape($thumbprint)) {
+            $newValue = if ([string]::IsNullOrWhiteSpace($currentValue)) { $thumbprint } else { "$currentValue,$thumbprint" }
+
+            if ($null -eq $currentValue) {
+                New-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue -PropertyType String -Force | Out-Null
+            } else {
+                Set-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue
+            }
+            Write-Log "Updated TrustedCertThumbprints registry value."
+        } else {
+            Write-Log "Thumbprint already exists in registry. Skipping update."
+        }
+
+        Write-Log "Certificate created and trusted successfully."
+    }
+
+    if ($rdpFiles.Count -eq 0) {
+        Write-Log "No .rdp files found on Desktop: $desktopPath"
+        exit 0
+    }
+
+    Write-Log "Found $($rdpFiles.Count) file(s) to sign."
+
+    $successCount = 0
+    $failCount = 0
+
+    foreach ($rdpFile in $rdpFiles) {
+        Write-Log "Signing: $($rdpFile.Name)"
+        & $rdpSignPath /sha256 $thumbprint $rdpFile.FullName
+
+        if ($LASTEXITCODE -eq 0) {
+            Write-Log "  [OK] $($rdpFile.Name)"
+            $successCount++
+        } else {
+            Write-Log "  [FAILED] $($rdpFile.Name) - rdpsign exit code: $LASTEXITCODE"
+            $failCount++
+        }
+    }
+
+    # Set registry key to suppress RDP warning dialogs
+    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" /v RedirectionWarningDialogVersion /t REG_DWORD /d 1 /f
+
+    if ($failCount -eq 0) {
+        Write-Log "All $successCount file(s) signed successfully."
+    } else {
+        Write-Log "$successCount file(s) signed successfully, $failCount file(s) failed."
+    }
+
+} catch {
+    Write-Log "Install error: $_"
+}
+
+# ============================================================
+# DETECT
+# ============================================================
+Write-Log "=== START DETECT ==="
+
+$rdpFilesOnDesktop = Get-ChildItem -Path "$desktopPath\*.rdp" -ErrorAction SilentlyContinue
+
+try {
+    if ($rdpFilesOnDesktop.Count -eq 0) {
+        Write-Log "DETECT [FAIL]: No .rdp files found on public desktop: $desktopPath"
+        exit 1
+    }
+
+    $allFound = $true
+    foreach ($file in $rdpFilesOnDesktop) {
+        if (-not (Test-Path (Join-Path $desktopPath $file.Name))) {
+            Write-Log "DETECT [FAIL]: Missing: $($file.Name)"
+            $allFound = $false
+        }
+    }
+
+    if ($allFound) {
+        Write-Log "DETECT [OK]: All .rdp files found on public desktop: $desktopPath"
+        exit 0
+    } else {
+        exit 1
+    }
+} catch {
+    Write-Log "Detect error: $_"
+    exit 1
+}