glennigen/RDPSign
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: glennigen/RDPSign:a5e687ecd19b833fa944e76a10c7e6c66f3d5f89
Branches Tags
glennigen/RDPSign:main
..
compare: glennigen/RDPSign:efaceaa528268e5d6efef79e732a3cf8d2fb72eb
Branches Tags
glennigen/RDPSign:main

4 Commits
a5e687ecd1 .. efaceaa528

Author SHA1 Message Date
glennigen efaceaa528 docs: tilføj README.html - plain HTML version af dokumentation 
- Tilføjer README.html som plain HTML uden farver/darkmode
- Tabeller med border=1 cellpadding=6 cellspacing=0
- Kommandoer, registreringsregler og logik i tabelformat
 2026-05-24 19:46:52 +02:00
glennigen 0593f8c042 feat: opdater Detect.ps1 med specifik fil-tjek og opdater README 
- Implementer $expectedFiles array i Detect.ps1 for at tjekke specifikke .rdp-filnavne
- Opdater beskrivelse af Detect.ps1 i pakkens indhold tabel
- Tilføj afsnit 'Sådan opsætter du Detect.ps1' med eksempel og forklaring
- Opdater indholdsfortegnelse med nyt afsnit
 2026-05-24 19:27:09 +02:00
GCH 13005cf161 Oprettet install.intunewin, og mappen rdp-files under app er oprettet 2026-05-22 11:13:46 +02:00
GCH 2bf216bcc2 Upload af RDPSign fra arbejde-noter repo 2026-05-22 10:34:36 +02:00
9 changed files with 0 additions and 708 deletions
Expand all files Collapse all files
old_app/Clearsigning.ps1
-33
View File
@@ -1,33 +0,0 @@
$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
$certSubject = "CN=RDPSign"
# 1. Unsign RDP files
$rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp"
foreach ($file in $rdpFiles) {
$content = Get-Content $file.FullName
$cleaned = $content | Where-Object { $_ -notmatch "^signscope:s:" -and $_ -notmatch "^signature:s:" }
$cleaned | Set-Content $file.FullName -Encoding Unicode
Write-Host "Unsigned: $($file.Name)"
}
# 2. Remove certificate from all stores
foreach ($storeName in @("My", "Root", "TrustedPublisher")) {
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store($storeName, "LocalMachine")
$store.Open("ReadWrite")
$certs = $store.Certificates | Where-Object { $_.Subject -eq $certSubject }
foreach ($cert in $certs) {
$store.Remove($cert)
Write-Host "Removed certificate from store: $storeName"
}
$store.Close()
}
# 3. Remove thumbprint from registry
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
Remove-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue
Write-Host "Removed TrustedCertThumbprints"
# 4. Remove RedirectionWarningDialogVersion
$clientPath = "HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services\Client"
Remove-ItemProperty -Path $clientPath -Name "RedirectionWarningDialogVersion" -ErrorAction SilentlyContinue
Write-Host "Removed RedirectionWarningDialogVersion"
old_app/Detect.ps1
-43
View File
@@ -1,43 +0,0 @@
# Setup logging
$baseFolder = Join-Path $env:SystemDrive "Intune"
$logFile = Join-Path $baseFolder "DesktopShortcuts.log"
$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
# Create necessary folders
if (-not (Test-Path $baseFolder)) {
New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
}
function Write-Log {
param($Message)
$logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
Add-Content -Path $logFile -Value $logMessage
Write-Host $logMessage
}
$rdpFiles = Get-ChildItem -Path "$desktopPath\*.rdp" -ErrorAction SilentlyContinue
try {
if ($rdpFiles.Count -eq 0) {
Write-Log "DETECT [FAIL]: No .rdp files found on public desktop: $desktopPath"
exit 1
}
$allFound = $true
foreach ($file in $rdpFiles) {
if (-not (Test-Path (Join-Path $desktopPath $file.Name))) {
Write-Log "DETECT [FAIL]: Missing: $($file.Name)"
$allFound = $false
}
}
if ($allFound) {
Write-Log "DETECT [OK]: All .rdp files found on public desktop: $desktopPath"
exit 0
} else {
exit 1
}
} catch {
Write-Log "Detect error: $_"
exit 1
}
old_app/Install.ps1
-139
View File
@@ -1,139 +0,0 @@
# Setup logging
$baseFolder = Join-Path $env:SystemDrive "Intune"
$logFile = Join-Path $baseFolder "DesktopShortcuts.log"
$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
# Check if Sysnative exists (means script is running in 32-bit mode on x64 OS)
if (Test-Path "$($env:windir)\Sysnative") {
$rdpSignPath = "$($env:windir)\Sysnative\rdpsign.exe"
} else {
$rdpSignPath = "$($env:windir)\System32\rdpsign.exe"
}
# Create necessary folders
if (-not (Test-Path $baseFolder)) {
New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
}
function Write-Log {
param($Message)
$logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
Add-Content -Path $logFile -Value $logMessage
Write-Host $logMessage
}
try {
# Copy RDP files to public desktop
Get-ChildItem -Path ".\rdp-files\*.rdp" | ForEach-Object {
try {
Copy-Item -Path $_.FullName -Destination $desktopPath -Force
} catch {
Write-Log "Error copying file: $_"
exit 1
}
}
Start-Sleep -Seconds 2 # Wait for files to be fully copied before signing
Write-Log "Copied .rdp files to public desktop: $desktopPath"
# Get RDP files from public desktop for signing
$rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -Recurse -ErrorAction SilentlyContinue
$certSubjectName = "RDPSign"
$certSubject = "CN=$certSubjectName"
Write-Log "Searching for existing certificate: $certSubjectName..."
$existingCert = Get-ChildItem Cert:\LocalMachine\My |
Where-Object { $_.Subject -eq $certSubject } |
Select-Object -First 1
if ($existingCert) {
Write-Log "Found existing certificate with Thumbprint: $($existingCert.Thumbprint)"
$thumbprint = $existingCert.Thumbprint
} else {
Write-Log "No existing certificate found. Creating new one..."
$cert = New-SelfSignedCertificate `
-Subject $certSubject `
-CertStoreLocation "Cert:\LocalMachine\My" `
-Type CodeSigningCert `
-KeyExportPolicy NonExportable `
-NotAfter (Get-Date).AddYears(25)
$thumbprint = $cert.Thumbprint
# Add to Trusted Root
$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
$rootStore.Open("ReadWrite")
$rootStore.Add($cert)
$rootStore.Close()
# Add to Trusted Publishers
$pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")
$pubStore.Open("ReadWrite")
$pubStore.Add($cert)
$pubStore.Close()
# Add thumbprint to RDP trusted certs in registry
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
$keyName = "TrustedCertThumbprints"
if (-not (Test-Path $gpoPath)) {
New-Item -Path $gpoPath -Force | Out-Null
}
$currentValue = (Get-ItemProperty -Path $gpoPath -Name $keyName -ErrorAction SilentlyContinue).$keyName
if ($currentValue -notmatch [regex]::Escape($thumbprint)) {
$newValue = if ([string]::IsNullOrWhiteSpace($currentValue)) { $thumbprint } else { "$currentValue,$thumbprint" }
if ($null -eq $currentValue) {
New-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue -PropertyType String -Force | Out-Null
} else {
Set-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue
}
Write-Log "Updated TrustedCertThumbprints registry value."
} else {
Write-Log "Thumbprint already exists in registry. Skipping update."
}
Write-Log "Certificate created and trusted successfully."
}
if ($rdpFiles.Count -eq 0) {
Write-Log "No .rdp files found on Desktop: $desktopPath"
exit 0
}
Write-Log "Found $($rdpFiles.Count) file(s) to sign."
$successCount = 0
$failCount = 0
foreach ($rdpFile in $rdpFiles) {
Write-Log "Signing: $($rdpFile.Name)"
& $rdpSignPath /sha256 $thumbprint $rdpFile.FullName
if ($LASTEXITCODE -eq 0) {
Write-Log " [OK] $($rdpFile.Name)"
$successCount++
} else {
Write-Log " [FAILED] $($rdpFile.Name) - rdpsign exit code: $LASTEXITCODE"
$failCount++
}
}
# Set registry key to suppress RDP warning dialogs
reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" /v RedirectionWarningDialogVersion /t REG_DWORD /d 1 /f
if ($failCount -eq 0) {
Write-Log "All $successCount file(s) signed successfully."
} else {
Write-Log "$successCount file(s) signed successfully, $failCount file(s) failed."
exit 1
}
exit 0
} catch {
Write-Log "Error: $_"
exit 1
}
old_app/README.md
-118
View File
@@ -1,118 +0,0 @@
# RDP - IntuneWin Package
## Package Contents
| File | Purpose |
|------|---------|
| `Install.ps1` | Copies RDP files to public desktop, creates self-signed certificate and signs all RDP files |
| `Detect.ps1` | Detects whether all RDP files from the package are present on the public desktop |
| `Uninstall.ps1` | Removes RDP files from the public desktop |
| `SignOnly.ps1` | Signs existing RDP files on the public desktop — no file copy (standalone use) |
| `SignOnly_detect.ps1` | Detects whether certificate is present and all RDP files on the desktop are signed |
| `Clearsigning.ps1` | Removes signatures from RDP files and cleans up certificate and registry (cleanup/debug use) |
| `sandbox.ps1` | Combined install + detect script for local sandbox testing |
| `rdp-files\*.rdp` | Source RDP files deployed to the public desktop |
---
## Intune App Configuration
### Program
- **Install command:**
`powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File .\Install.ps1`
- **Uninstall command:**
`powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File .\Uninstall.ps1`
- **Install behavior:** System
### Detection Rule
Use a custom detection script:
- **Script file:** `Detect.ps1`
- **Run script as 32-bit process on 64-bit clients:** No
- **Enforce script signature check:** No
Detection logic:
- Checks that all `.rdp` files from `rdp-files\` are present on the public desktop (`C:\Users\Public\Desktop`)
- Returns `exit 0` = installed
- Returns `exit 1` = not installed
---
## What Install.ps1 Does
1. Copies all `.rdp` files from `.\rdp-files\` to the public desktop
2. Searches for an existing self-signed certificate (`CN=RDPSign`) in `Cert:\LocalMachine\My`
3. If not found, creates a new self-signed code signing certificate (valid 25 years, non-exportable)
4. Adds the certificate to `Trusted Root` and `Trusted Publishers` in the local machine store
5. Adds the certificate thumbprint to the registry key `TrustedCertThumbprints`
6. Signs all `.rdp` files on the public desktop using `rdpsign.exe /sha256`
7. Sets `RedirectionWarningDialogVersion = 1` in registry to suppress RDP warning dialogs
---
## Registry Changes
| Path | Value | Type | Data |
|------|-------|------|------|
| `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services` | `TrustedCertThumbprints` | String | Certificate thumbprint |
| `HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client` | `RedirectionWarningDialogVersion` | DWORD | `1` |
---
## Logging and Troubleshooting
| Script | Log file |
|--------|----------|
| `Install.ps1` | `C:\Intune\DesktopShortcuts.log` |
| `Detect.ps1` | `C:\Intune\DesktopShortcuts.log` |
| `Uninstall.ps1` | `C:\Intune\DesktopShortcuts.log` |
| `SignOnly.ps1` | `C:\Intune\RDPSign.log` |
---
## SignOnly Intune App Configuration
### Program
- **Install command:**
`powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File .\SignOnly.ps1`
- **Uninstall command:**
`powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File .\Clearsigning.ps1`
- **Install behavior:** System
### Detection Rule
Use a custom detection script:
- **Script file:** `SignOnly_detect.ps1`
- **Run script as 32-bit process on 64-bit clients:** No
- **Enforce script signature check:** No
Detection logic:
- Checks that `CN=RDPSign` certificate exists in `My`, `Root`, and `TrustedPublisher` stores
- Checks that thumbprint is present in registry
- Checks that all `.rdp` files on the public desktop contain a valid signature
- Returns `exit 0` + `"Detected"` = installed
- Returns `exit 1` = not installed
---
## Utility Scripts (not part of Intune package)
### `SignOnly.ps1`
Signs all existing `.rdp` files on the public desktop without copying any files. Useful for re-signing after an update or if files are already deployed.
Run as administrator.
### `SignOnly_detect.ps1`
Detection script for use with `SignOnly.ps1` as an Intune package. Checks:
- Certificate exists in `My`, `Root`, and `TrustedPublisher` stores
- Thumbprint is present in registry
- All `.rdp` files on the desktop contain a valid signature
### `Clearsigning.ps1`
Removes all signing artifacts. Useful for testing or cleanup. Run as administrator.
- Strips `signscope` and `signature` lines from all `.rdp` files on the public desktop
- Removes `CN=RDPSign` certificate from `My`, `Root`, and `TrustedPublisher` stores
- Removes `TrustedCertThumbprints` from registry
- Removes `RedirectionWarningDialogVersion` from registry
### `sandbox.ps1`
Combines install and detect into a single script for local sandbox testing.
Run from the folder containing `rdp-files\` as administrator.
Output is written to both the console and `C:\Intune\DesktopShortcuts.log`.
old_app/SignOnly.ps1
-125
View File
@@ -1,125 +0,0 @@
# Setup logging
$baseFolder = Join-Path $env:SystemDrive "Intune"
$logFile = Join-Path $baseFolder "RDPSign.log"
$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
# Check if Sysnative exists (means script is running in 32-bit mode on x64 OS)
if (Test-Path "$($env:windir)\Sysnative") {
$rdpSignPath = "$($env:windir)\Sysnative\rdpsign.exe"
} else {
$rdpSignPath = "$($env:windir)\System32\rdpsign.exe"
}
if (-not (Test-Path $baseFolder)) {
New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
}
function Write-Log {
param($Message)
$logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
Add-Content -Path $logFile -Value $logMessage
Write-Host $logMessage
}
try {
# Get RDP files from public desktop for signing
$rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -Recurse -ErrorAction SilentlyContinue
$certSubjectName = "RDPSign"
$certSubject = "CN=$certSubjectName"
Write-Log "Searching for existing certificate: $certSubjectName..."
$existingCert = Get-ChildItem Cert:\LocalMachine\My |
Where-Object { $_.Subject -eq $certSubject } |
Select-Object -First 1
if ($existingCert) {
Write-Log "Found existing certificate with Thumbprint: $($existingCert.Thumbprint)"
$thumbprint = $existingCert.Thumbprint
} else {
Write-Log "No existing certificate found. Creating new one..."
$cert = New-SelfSignedCertificate `
-Subject $certSubject `
-CertStoreLocation "Cert:\LocalMachine\My" `
-Type CodeSigningCert `
-KeyExportPolicy NonExportable `
-NotAfter (Get-Date).AddYears(25)
$thumbprint = $cert.Thumbprint
# Add to Trusted Root
$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
$rootStore.Open("ReadWrite")
$rootStore.Add($cert)
$rootStore.Close()
# Add to Trusted Publishers
$pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")
$pubStore.Open("ReadWrite")
$pubStore.Add($cert)
$pubStore.Close()
# Add thumbprint to RDP trusted certs in registry
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
$keyName = "TrustedCertThumbprints"
if (-not (Test-Path $gpoPath)) {
New-Item -Path $gpoPath -Force | Out-Null
}
$currentValue = (Get-ItemProperty -Path $gpoPath -Name $keyName -ErrorAction SilentlyContinue).$keyName
if ($currentValue -notmatch [regex]::Escape($thumbprint)) {
$newValue = if ([string]::IsNullOrWhiteSpace($currentValue)) { $thumbprint } else { "$currentValue,$thumbprint" }
if ($null -eq $currentValue) {
New-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue -PropertyType String -Force | Out-Null
} else {
Set-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue
}
Write-Log "Updated TrustedCertThumbprints registry value."
} else {
Write-Log "Thumbprint already exists in registry. Skipping update."
}
Write-Log "Certificate created and trusted successfully."
}
if ($rdpFiles.Count -eq 0) {
Write-Log "No .rdp files found on Desktop: $desktopPath"
exit 0
}
Write-Log "Found $($rdpFiles.Count) file(s) to sign."
$successCount = 0
$failCount = 0
foreach ($rdpFile in $rdpFiles) {
Write-Log "Signing: $($rdpFile.Name)"
& $rdpSignPath /sha256 $thumbprint $rdpFile.FullName
if ($LASTEXITCODE -eq 0) {
Write-Log " [OK] $($rdpFile.Name)"
$successCount++
} else {
Write-Log " [FAILED] $($rdpFile.Name) - rdpsign exit code: $LASTEXITCODE"
$failCount++
}
}
# Set registry key to suppress RDP warning dialogs
reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" /v RedirectionWarningDialogVersion /t REG_DWORD /d 1 /f
if ($failCount -eq 0) {
Write-Log "All $successCount file(s) signed successfully."
} else {
Write-Log "$successCount file(s) signed successfully, $failCount file(s) failed."
exit 1
}
exit 0
} catch {
Write-Log "Error: $_"
exit 1
}
old_app/SignOnly_detect.ps1
-36
View File
@@ -1,36 +0,0 @@
$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
$certSubject = "CN=RDPSign"
# Check certificate exists in all three stores
$certInMy = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq $certSubject }
$certInRoot = Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -eq $certSubject }
$certInPub = Get-ChildItem Cert:\LocalMachine\TrustedPublisher | Where-Object { $_.Subject -eq $certSubject }
if (-not $certInMy -or -not $certInRoot -or -not $certInPub) {
exit 1
}
# Check registry thumbprint
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
$thumbprintValue = (Get-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue).TrustedCertThumbprints
if ([string]::IsNullOrWhiteSpace($thumbprintValue)) {
exit 1
}
# Check that all RDP files on desktop are signed
$rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -ErrorAction SilentlyContinue
if ($rdpFiles.Count -eq 0) {
exit 1
}
foreach ($file in $rdpFiles) {
$content = Get-Content $file.FullName -ErrorAction SilentlyContinue
$hasSig = $content | Where-Object { $_ -match "^signature:s:" }
if (-not $hasSig) {
exit 1
}
}
Write-Host "Detected"
exit 0
old_app/Uninstall.ps1
-38
View File
@@ -1,38 +0,0 @@
# Setup logging
$baseFolder = Join-Path $env:SystemDrive "Intune"
$logFile = Join-Path $baseFolder "DesktopShortcuts.log"
$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
# Create necessary folders
$folders = @(
$baseFolder
)
foreach ($folder in $folders) {
if (-not (Test-Path $folder)) {
New-Item -Path $folder -ItemType Directory -Force | Out-Null
}
}
function Write-Log {
param($Message)
$logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
Add-Content -Path $logFile -Value $logMessage
Write-Host $logMessage
}
try {
Get-ChildItem -Path ".\rdp-files\*.rdp" | ForEach-Object {
$targetFile = Join-Path $desktopPath $_.Name
if (Test-Path $targetFile) {
Remove-Item -Path $targetFile -Force
Write-Log "Removed: $($_.Name)"
} else {
Write-Log "Not found, skipping: $($_.Name)"
}
}
Write-Log "Uninstall completed from public desktop: $desktopPath"
exit 0
} catch {
Write-Log "An error occurred: $_"
exit 1
}
old_app/rdp-files/PUT_RDP_FILES_HERE
View File
old_app/sandbox.ps1
-176
View File
@@ -1,176 +0,0 @@
# ============================================================
# INSTALL + DETECT - Sandbox test script
# ============================================================
# Setup logging
$baseFolder = Join-Path $env:SystemDrive "Intune"
$logFile = Join-Path $baseFolder "DesktopShortcuts.log"
$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
# Check if Sysnative exists (means script is running in 32-bit mode on x64 OS)
if (Test-Path "$($env:windir)\Sysnative") {
$rdpSignPath = "$($env:windir)\Sysnative\rdpsign.exe"
} else {
$rdpSignPath = "$($env:windir)\System32\rdpsign.exe"
}
if (-not (Test-Path $baseFolder)) {
New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
}
function Write-Log {
param($Message)
$logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
Add-Content -Path $logFile -Value $logMessage
Write-Host $logMessage
}
# ============================================================
# INSTALL
# ============================================================
Write-Log "=== START INSTALL ==="
try {
# Copy RDP files to public desktop
Get-ChildItem -Path ".\rdp-files\*.rdp" | ForEach-Object {
try {
Copy-Item -Path $_.FullName -Destination $desktopPath -Force
} catch {
Write-Log "Error copying file: $_"
}
}
Start-Sleep -Seconds 2 # Wait for files to be fully copied before signing
Write-Log "Copied .rdp files to public desktop: $desktopPath"
# Get RDP files from public desktop for signing
$rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -Recurse -ErrorAction SilentlyContinue
$certSubjectName = "RDPSign"
$certSubject = "CN=$certSubjectName"
Write-Log "Searching for existing certificate: $certSubjectName..."
$existingCert = Get-ChildItem Cert:\LocalMachine\My |
Where-Object { $_.Subject -eq $certSubject } |
Select-Object -First 1
if ($existingCert) {
Write-Log "Found existing certificate with Thumbprint: $($existingCert.Thumbprint)"
$thumbprint = $existingCert.Thumbprint
} else {
Write-Log "No existing certificate found. Creating new one..."
$cert = New-SelfSignedCertificate `
-Subject $certSubject `
-CertStoreLocation "Cert:\LocalMachine\My" `
-Type CodeSigningCert `
-KeyExportPolicy NonExportable `
-NotAfter (Get-Date).AddYears(25)
$thumbprint = $cert.Thumbprint
# Add to Trusted Root
$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
$rootStore.Open("ReadWrite")
$rootStore.Add($cert)
$rootStore.Close()
# Add to Trusted Publishers
$pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")
$pubStore.Open("ReadWrite")
$pubStore.Add($cert)
$pubStore.Close()
# Add thumbprint to RDP trusted certs in registry
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
$keyName = "TrustedCertThumbprints"
if (-not (Test-Path $gpoPath)) {
New-Item -Path $gpoPath -Force | Out-Null
}
$currentValue = (Get-ItemProperty -Path $gpoPath -Name $keyName -ErrorAction SilentlyContinue).$keyName
if ($currentValue -notmatch [regex]::Escape($thumbprint)) {
$newValue = if ([string]::IsNullOrWhiteSpace($currentValue)) { $thumbprint } else { "$currentValue,$thumbprint" }
if ($null -eq $currentValue) {
New-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue -PropertyType String -Force | Out-Null
} else {
Set-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue
}
Write-Log "Updated TrustedCertThumbprints registry value."
} else {
Write-Log "Thumbprint already exists in registry. Skipping update."
}
Write-Log "Certificate created and trusted successfully."
}
if ($rdpFiles.Count -eq 0) {
Write-Log "No .rdp files found on Desktop: $desktopPath"
exit 0
}
Write-Log "Found $($rdpFiles.Count) file(s) to sign."
$successCount = 0
$failCount = 0
foreach ($rdpFile in $rdpFiles) {
Write-Log "Signing: $($rdpFile.Name)"
& $rdpSignPath /sha256 $thumbprint $rdpFile.FullName
if ($LASTEXITCODE -eq 0) {
Write-Log " [OK] $($rdpFile.Name)"
$successCount++
} else {
Write-Log " [FAILED] $($rdpFile.Name) - rdpsign exit code: $LASTEXITCODE"
$failCount++
}
}
# Set registry key to suppress RDP warning dialogs
reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" /v RedirectionWarningDialogVersion /t REG_DWORD /d 1 /f
if ($failCount -eq 0) {
Write-Log "All $successCount file(s) signed successfully."
} else {
Write-Log "$successCount file(s) signed successfully, $failCount file(s) failed."
}
} catch {
Write-Log "Install error: $_"
}
# ============================================================
# DETECT
# ============================================================
Write-Log "=== START DETECT ==="
$rdpFilesOnDesktop = Get-ChildItem -Path "$desktopPath\*.rdp" -ErrorAction SilentlyContinue
try {
if ($rdpFilesOnDesktop.Count -eq 0) {
Write-Log "DETECT [FAIL]: No .rdp files found on public desktop: $desktopPath"
exit 1
}
$allFound = $true
foreach ($file in $rdpFilesOnDesktop) {
if (-not (Test-Path (Join-Path $desktopPath $file.Name))) {
Write-Log "DETECT [FAIL]: Missing: $($file.Name)"
$allFound = $false
}
}
if ($allFound) {
Write-Log "DETECT [OK]: All .rdp files found on public desktop: $desktopPath"
exit 0
} else {
exit 1
}
} catch {
Write-Log "Detect error: $_"
exit 1
}