text

chore: fjern output/Install.intunewin (build artifact)

README.html

@@ -153,7 +153,8 @@
 <h2 id="hvad-install.ps1-gør">Hvad Install.ps1 gør</h2>
 <ol type="1">
     <li>Finder målskrivebord(e) — offentligt skrivebord som standard, alle
-        brugeres skriveborde med <code>-AllUsers</code></li>
+        brugeres skriveborde med <code>-AllUsers</code>. Med <code>-AllUsers</code>
+        søges 2 mapper ned så OneDrive-omdirigeret Desktop også fanges</li>
     <li>Kopierer alle <code>.rdp</code>-filer fra <code>.\rdp-files\</code>
         til de fundne skrivebord(e)</li>
     <li>Søger efter eksisterende selvsigneret certifikat
@@ -180,9 +181,10 @@
     standard — uden <code>-AllUsers</code> — køres alle scripts kun mod det
     <strong>offentlige skrivebord</strong>
     (<code>C:\Users\Public\Desktop</code>). Når <code>-AllUsers</code>
-    angives, itererer scriptet i stedet over alle brugerprofiler under
+    angives, søger scriptet i stedet på tværs af alle brugerprofiler under
-    <code>C:\Users\</code> og behandler hver brugers
+    <code>C:\Users\</code> (ekskl. <code>Public</code>/<code>Default</code>).
-    <code>Desktop</code>-mappe.
+    Der søges 2 mapper ned (<code>-Depth 2</code>) for at fange både standard
+    <code>Desktop</code> og OneDrive-omdirigeret <code>Desktop</code>.
 </p>
 <div class="sourceCode" id="cb2">
     <pre

README.md

@@ -90,7 +90,7 @@ Registreringslogik:
 
 ## Hvad Install.ps1 gør
 
-1. Finder målskrivebord(e) — offentligt skrivebord som standard, alle brugeres skriveborde med `-AllUsers`
+1. Finder målskrivebord(e) — offentligt skrivebord som standard, alle brugeres skriveborde med `-AllUsers`. Med `-AllUsers` søges 2 mapper ned så OneDrive-omdirigeret Desktop også fanges
 2. Kopierer alle `.rdp`-filer fra `.\rdp-files\` til de fundne skrivebord(e)
 3. Søger efter eksisterende selvsigneret certifikat (`CN=RDPSign`) i `Cert:\LocalMachine\My`
 4. Opretter et nyt selvsigneret kodesigneringscertifikat hvis intet findes (gyldigt i 25 år, ikke-eksporterbart)
@@ -105,7 +105,7 @@ Registreringslogik:
 
 ## AllUsers Switch
 
-Alle scripts understøtter `-AllUsers` switchen. Som standard — uden `-AllUsers` — køres alle scripts kun mod det **offentlige skrivebord** (`C:\Users\Public\Desktop`). Når `-AllUsers` angives, itererer scriptet i stedet over alle brugerprofiler under `C:\Users\` og behandler hver brugers `Desktop`-mappe.
+Alle scripts understøtter `-AllUsers` switchen. Som standard — uden `-AllUsers` — køres alle scripts kun mod det **offentlige skrivebord** (`C:\Users\Public\Desktop`). Når `-AllUsers` angives, søger scriptet i stedet på tværs af alle brugerprofiler under `C:\Users\` (ekskl. `Public`/`Default`). Der søges 2 mapper ned (`-Depth 2`) for at fange både standard `Desktop` og OneDrive-omdirigeret `Desktop`.
 
 ```powershell
 # Kun offentligt skrivebord (standard)

app/Clearsigning.ps1

@@ -1,10 +1,8 @@
 # ============================================================
 # CHANGELOG
-# v1.1 - Added -AllUsers switch to remove signatures from RDP
+# v1.2 - Get-DesktopPaths: Depth 2 search for OneDrive Desktop
-#        files on all user desktops instead of only the public
+# v1.1 - AllUsers switch + Get-DesktopPaths helper
-#        desktop.
+# v1.0 - Initial
-#        Added Get-DesktopPaths helper function.
-# v1.0 - Initial version, clears signing on public desktop only.
 # ============================================================
 
 param(
@@ -13,15 +11,14 @@ param(
 
 function Get-DesktopPaths {
     if ($AllUsers) {
-        Get-ChildItem "$env:SystemDrive\Users" -Directory | ForEach-Object {
+        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
-            $path = Join-Path $_.FullName "Desktop"
+            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
-            if (Test-Path $path) { $path }
+                Select-Object -ExpandProperty FullName
         }
     } else {
         [Environment]::GetFolderPath("CommonDesktopDirectory")
     }
 }
-
 $certSubject = "CN=RDPSign"
 
 # 1. Unsign RDP files

app/Detect.ps1

@@ -1,17 +1,9 @@
 # ============================================================
 # CHANGELOG
-# v1.2 - Checks for specific expected .rdp filenames instead
+# v1.3 - Get-DesktopPaths: Depth 2 search for OneDrive Desktop
-#        of just "any .rdp file exists on desktop".
+# v1.2 - Detect by expected filename list
-# v1.1 - Added -AllUsers switch to check all user desktops
+# v1.1 - AllUsers switch + Get-DesktopPaths helper
-#        instead of only the public desktop.
+# v1.0 - Initial
-#        Added Get-DesktopPaths helper function.
-# v1.0 - Initial version, checks public desktop only.
-# ============================================================
-
-param(
-    [switch]$AllUsers
-)
-
 # ============================================================
 # Update this list whenever .rdp files are added or removed
 # from the rdp-files\\ folder.
@@ -39,9 +31,9 @@ function Write-Log {
 
 function Get-DesktopPaths {
     if ($AllUsers) {
-        Get-ChildItem "$env:SystemDrive\Users" -Directory | ForEach-Object {
+        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
-            $path = Join-Path $_.FullName "Desktop"
+            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
-            if (Test-Path $path) { $path }
+                Select-Object -ExpandProperty FullName
         }
     } else {
         [Environment]::GetFolderPath("CommonDesktopDirectory")

app/Install.ps1

@@ -1,9 +1,8 @@
 # ============================================================
 # CHANGELOG
-# v1.1 - Added -AllUsers switch to deploy to all user desktops
+# v1.2 - Get-DesktopPaths: Depth 2 search for OneDrive Desktop
-#        instead of only the public desktop.
+# v1.1 - AllUsers switch + Get-DesktopPaths helper
-#        Added Get-DesktopPaths helper function.
+# v1.0 - Initial
-# v1.0 - Initial version, deploys to public desktop only.
 # ============================================================
 
 param(
@@ -34,16 +33,14 @@ function Write-Log {
 
 function Get-DesktopPaths {
     if ($AllUsers) {
-        # Return desktop path for each user profile found
+        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
-        Get-ChildItem "$env:SystemDrive\Users" -Directory | ForEach-Object {
+            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
-            $path = Join-Path $_.FullName "Desktop"
+                Select-Object -ExpandProperty FullName
-            if (Test-Path $path) { $path }
         }
     } else {
         [Environment]::GetFolderPath("CommonDesktopDirectory")
     }
 }
-
 try {
     $desktopPaths = Get-DesktopPaths
     Write-Log "Running in mode: $(if ($AllUsers) { 'All Users' } else { 'Public Desktop' })"

app/SignOnly.ps1

@@ -1,9 +1,8 @@
 # ============================================================
 # CHANGELOG
-# v1.1 - Added -AllUsers switch to sign RDP files on all user
+# v1.2 - Get-DesktopPaths: Depth 2 search for OneDrive Desktop
-#        desktops instead of only the public desktop.
+# v1.1 - AllUsers switch + Get-DesktopPaths helper
-#        Added Get-DesktopPaths helper function.
+# v1.0 - Initial
-# v1.0 - Initial version, signs on public desktop only.
 # ============================================================
 
 param(
@@ -34,15 +33,14 @@ function Write-Log {
 
 function Get-DesktopPaths {
     if ($AllUsers) {
-        Get-ChildItem "$env:SystemDrive\Users" -Directory | ForEach-Object {
+        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
-            $path = Join-Path $_.FullName "Desktop"
+            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
-            if (Test-Path $path) { $path }
+                Select-Object -ExpandProperty FullName
         }
     } else {
         [Environment]::GetFolderPath("CommonDesktopDirectory")
     }
 }
-
 try {
     $certSubjectName = "RDPSign"
     $certSubject = "CN=$certSubjectName"

app/SignOnly_detect.ps1

@@ -1,61 +1,113 @@
 # ============================================================
 # CHANGELOG
-# v1.1 - Added -AllUsers switch to check certificate and signed
+# v1.3 - Added detailed logging for detect failures
-#        RDP files across all user desktops instead of only the
+# v1.2 - Get-DesktopPaths: Depth 2 search for OneDrive Desktop
-#        public desktop.
+# v1.1 - AllUsers switch + Get-DesktopPaths helper
-#        Added Get-DesktopPaths helper function.
+# v1.0 - Initial
-# v1.0 - Initial version, checks public desktop only.
 # ============================================================
 
 param(
     [switch]$AllUsers
 )
 
+# Setup logging
+$baseFolder = Join-Path $env:SystemDrive "Intune"
+$logFile = Join-Path $baseFolder "RDPSign.log"
+
+if (-not (Test-Path $baseFolder)) {
+    New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
+}
+
+function Write-Log {
+    param($Message)
+    $logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
+    Add-Content -Path $logFile -Value $logMessage
+    Write-Host $logMessage
+}
+
 function Get-DesktopPaths {
     if ($AllUsers) {
-        Get-ChildItem "$env:SystemDrive\Users" -Directory | ForEach-Object {
+        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
-            $path = Join-Path $_.FullName "Desktop"
+            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
-            if (Test-Path $path) { $path }
+                Select-Object -ExpandProperty FullName
         }
     } else {
         [Environment]::GetFolderPath("CommonDesktopDirectory")
     }
 }
 
-$certSubject = "CN=RDPSign"
+try {
+    Write-Log "=== SignOnly Detect START ==="
+    Write-Log "Running in mode: $(if ($AllUsers) { 'All Users' } else { 'Public Desktop' })"
 
-# Check certificate exists in all three stores
+    $certSubject = "CN=RDPSign"
-$certInMy   = Get-ChildItem Cert:\LocalMachine\My               | Where-Object { $_.Subject -eq $certSubject }
-$certInRoot = Get-ChildItem Cert:\LocalMachine\Root             | Where-Object { $_.Subject -eq $certSubject }
-$certInPub  = Get-ChildItem Cert:\LocalMachine\TrustedPublisher | Where-Object { $_.Subject -eq $certSubject }
 
-if (-not $certInMy -or -not $certInRoot -or -not $certInPub) {
+    # Check certificate exists in all three stores
+    Write-Log "Checking certificate: $certSubject..."
+    $certInMy   = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq $certSubject }
+    $certInRoot = Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -eq $certSubject }
+    $certInPub  = Get-ChildItem Cert:\LocalMachine\TrustedPublisher | Where-Object { $_.Subject -eq $certSubject }
+
+    $certOk = $true
+    if (-not $certInMy) {
+        Write-Log "FAIL: Certificate not found in LocalMachine\My"
+        $certOk = $false
+    }
+    if (-not $certInRoot) {
+        Write-Log "FAIL: Certificate not found in LocalMachine\Root"
+        $certOk = $false
+    }
+    if (-not $certInPub) {
+        Write-Log "FAIL: Certificate not found in LocalMachine\TrustedPublisher"
+        $certOk = $false
+    }
+    if (-not $certOk) {
         exit 1
-}
+    }
+    Write-Log "OK: Certificate found in all stores"
 
-# Check registry thumbprint
+    # Check registry thumbprint
-$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
+    Write-Log "Checking registry thumbprint..."
-$thumbprintValue = (Get-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue).TrustedCertThumbprints
+    $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
-if ([string]::IsNullOrWhiteSpace($thumbprintValue)) {
+    $thumbprintValue = (Get-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue).TrustedCertThumbprints
+    if ([string]::IsNullOrWhiteSpace($thumbprintValue)) {
+        Write-Log "FAIL: TrustedCertThumbprints not found in registry"
         exit 1
-}
+    }
+    Write-Log "OK: Thumbprint found in registry"
 
-# Check that all RDP files on desktop(s) are signed
+    # Check that all RDP files on desktop(s) are signed
-foreach ($desktopPath in (Get-DesktopPaths)) {
+    Write-Log "Checking RDP file signatures..."
+    $desktopsChecked = 0
+    $filesChecked = 0
+
+    foreach ($desktopPath in (Get-DesktopPaths)) {
         $rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -ErrorAction SilentlyContinue
 
         if ($rdpFiles.Count -eq 0) {
-        exit 1
+            Write-Log "Skip: No .rdp files on $desktopPath"
+            continue
         }
 
+        Write-Log "Found $($rdpFiles.Count) file(s) to check on: $desktopPath"
+
         foreach ($file in $rdpFiles) {
+            $filesChecked++
             $content = Get-Content $file.FullName -ErrorAction SilentlyContinue
             $hasSig = $content | Where-Object { $_ -match "^signature:s:" }
             if (-not $hasSig) {
+                Write-Log "FAIL: $($file.Name) on $desktopPath is not signed"
                 exit 1
             }
         }
-}
+        $desktopsChecked++
+    }
 
-Write-Host "Detected"
+    Write-Log "OK: All $filesChecked file(s) across $desktopsChecked desktop(s) are signed"
-exit 0
+    Write-Log "=== SignOnly Detect END - Installed ==="
+    exit 0
+}
+catch {
+    Write-Log "Error: $_"
+    exit 1
+}

app/Uninstall.ps1

@@ -1,9 +1,8 @@
 # ============================================================
 # CHANGELOG
-# v1.1 - Added -AllUsers switch to remove files from all user
+# v1.2 - Get-DesktopPaths: Depth 2 search for OneDrive Desktop
-#        desktops instead of only the public desktop.
+# v1.1 - AllUsers switch + Get-DesktopPaths helper
-#        Added Get-DesktopPaths helper function.
+# v1.0 - Initial
-# v1.0 - Initial version, removes from public desktop only.
 # ============================================================
 
 param(
@@ -27,15 +26,14 @@ function Write-Log {
 
 function Get-DesktopPaths {
     if ($AllUsers) {
-        Get-ChildItem "$env:SystemDrive\Users" -Directory | ForEach-Object {
+        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
-            $path = Join-Path $_.FullName "Desktop"
+            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
-            if (Test-Path $path) { $path }
+                Select-Object -ExpandProperty FullName
         }
     } else {
         [Environment]::GetFolderPath("CommonDesktopDirectory")
     }
 }
-
 try {
     $desktopPaths = Get-DesktopPaths
     Write-Log "Running in mode: $(if ($AllUsers) { 'All Users' } else { 'Public Desktop' })"

app/sandbox.ps1

@@ -2,49 +2,9 @@
 # INSTALL + DETECT - Sandbox test script
 # ============================================================
 # CHANGELOG
-# v1.1 - Added -AllUsers switch to deploy and detect across all
+# v1.2 - Get-DesktopPaths: Depth 2 search for OneDrive Desktop
-#        user desktops instead of only the public desktop.
+# v1.1 - AllUsers switch + Get-DesktopPaths helper
-#        Added Get-DesktopPaths helper function.
+# v1.0 - Initial
-# v1.0 - Initial version, public desktop only.
-# ============================================================
-
-param(
-    [switch]$AllUsers
-)
-
-# Setup logging
-$baseFolder = Join-Path $env:SystemDrive "Intune"
-$logFile = Join-Path $baseFolder "DesktopShortcuts.log"
-
-# Check if Sysnative exists (means script is running in 32-bit mode on x64 OS)
-if (Test-Path "$($env:windir)\Sysnative") {
-    $rdpSignPath = "$($env:windir)\Sysnative\rdpsign.exe"
-} else {
-    $rdpSignPath = "$($env:windir)\System32\rdpsign.exe"
-}
-
-if (-not (Test-Path $baseFolder)) {
-    New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
-}
-
-function Write-Log {
-    param($Message)
-    $logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
-    Add-Content -Path $logFile -Value $logMessage
-    Write-Host $logMessage
-}
-
-function Get-DesktopPaths {
-    if ($AllUsers) {
-        Get-ChildItem "$env:SystemDrive\Users" -Directory | ForEach-Object {
-            $path = Join-Path $_.FullName "Desktop"
-            if (Test-Path $path) { $path }
-        }
-    } else {
-        [Environment]::GetFolderPath("CommonDesktopDirectory")
-    }
-}
-
 # ============================================================
 # INSTALL
 # ============================================================

app/sandbox_signonly.ps1

@@ -0,0 +1,234 @@
+# ============================================================
+# SIGNONLY + DETECT - Sandbox test script
+# ============================================================
+# CHANGELOG
+# v1.0 - Initial
+# ============================================================
+
+param(
+    [switch]$AllUsers
+)
+Start-Sleep -Seconds 10
+# Setup logging
+$baseFolder = Join-Path $env:SystemDrive "Intune"
+$logFile = Join-Path $baseFolder "RDPSign.log"
+
+# Check if Sysnative exists (means script is running in 32-bit mode on x64 OS)
+if (Test-Path "$($env:windir)\Sysnative") {
+    $rdpSignPath = "$($env:windir)\Sysnative\rdpsign.exe"
+} else {
+    $rdpSignPath = "$($env:windir)\System32\rdpsign.exe"
+}
+
+if (-not (Test-Path $baseFolder)) {
+    New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
+}
+
+function Write-Log {
+    param($Message)
+    $logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
+    Add-Content -Path $logFile -Value $logMessage
+    Write-Host $logMessage
+}
+
+function Get-DesktopPaths {
+    if ($AllUsers) {
+        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
+            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
+                Select-Object -ExpandProperty FullName
+        }
+    } else {
+        [Environment]::GetFolderPath("CommonDesktopDirectory")
+    }
+}
+
+# ============================================================
+# SIGNONLY
+# ============================================================
+Write-Log "=== START SIGNONLY ==="
+Write-Log "Running in mode: $(if ($AllUsers) { 'All Users' } else { 'Public Desktop' })"
+
+try {
+    $certSubjectName = "RDPSign"
+    $certSubject = "CN=$certSubjectName"
+
+    Write-Log "Searching for existing certificate: $certSubjectName..."
+    $existingCert = Get-ChildItem Cert:\LocalMachine\My |
+        Where-Object { $_.Subject -eq $certSubject } |
+        Select-Object -First 1
+
+    if ($existingCert) {
+        Write-Log "Found existing certificate with Thumbprint: $($existingCert.Thumbprint)"
+        $thumbprint = $existingCert.Thumbprint
+    } else {
+        Write-Log "No existing certificate found. Creating new one..."
+
+        $cert = New-SelfSignedCertificate `
+            -Subject $certSubject `
+            -CertStoreLocation "Cert:\LocalMachine\My" `
+            -Type CodeSigningCert `
+            -KeyExportPolicy NonExportable `
+            -NotAfter (Get-Date).AddYears(25)
+
+        $thumbprint = $cert.Thumbprint
+
+        # Add to Trusted Root
+        $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
+        $rootStore.Open("ReadWrite")
+        $rootStore.Add($cert)
+        $rootStore.Close()
+
+        # Add to Trusted Publishers
+        $pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")
+        $pubStore.Open("ReadWrite")
+        $pubStore.Add($cert)
+        $pubStore.Close()
+
+        # Add thumbprint to RDP trusted certs in registry
+        $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
+        $keyName = "TrustedCertThumbprints"
+
+        if (-not (Test-Path $gpoPath)) {
+            New-Item -Path $gpoPath -Force | Out-Null
+        }
+
+        $currentValue = (Get-ItemProperty -Path $gpoPath -Name $keyName -ErrorAction SilentlyContinue).$keyName
+
+        if ($currentValue -notmatch [regex]::Escape($thumbprint)) {
+            $newValue = if ([string]::IsNullOrWhiteSpace($currentValue)) { $thumbprint } else { "$currentValue,$thumbprint" }
+
+            if ($null -eq $currentValue) {
+                New-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue -PropertyType String -Force | Out-Null
+            } else {
+                Set-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue
+            }
+            Write-Log "Updated TrustedCertThumbprints registry value."
+        } else {
+            Write-Log "Thumbprint already exists in registry. Skipping update."
+        }
+
+        Write-Log "Certificate created and trusted successfully."
+    }
+
+    $successCount = 0
+    $failCount = 0
+
+    foreach ($desktopPath in (Get-DesktopPaths)) {
+        $rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -Recurse -ErrorAction SilentlyContinue
+
+        if ($rdpFiles.Count -eq 0) {
+            Write-Log "Skip: No .rdp files on $desktopPath"
+            continue
+        }
+
+        Write-Log "Found $($rdpFiles.Count) file(s) to sign on: $desktopPath"
+
+        foreach ($rdpFile in $rdpFiles) {
+            Write-Log "Signing: $($rdpFile.Name)"
+            & $rdpSignPath /sha256 $thumbprint $rdpFile.FullName
+
+            if ($LASTEXITCODE -eq 0) {
+                Write-Log "  [OK] $($rdpFile.Name)"
+                $successCount++
+            } else {
+                Write-Log "  [FAILED] $($rdpFile.Name) - rdpsign exit code: $LASTEXITCODE"
+                $failCount++
+            }
+        }
+    }
+
+    # Set registry key to suppress RDP warning dialogs
+    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" /v RedirectionWarningDialogVersion /t REG_DWORD /d 1 /f
+
+    if ($failCount -eq 0) {
+        Write-Log "All $successCount file(s) signed successfully."
+    } else {
+        Write-Log "$successCount file(s) signed successfully, $failCount file(s) failed."
+    }
+
+} catch {
+    Write-Log "SIGNONLY error: $_"
+}
+
+# ============================================================
+# DETECT
+# ============================================================
+Write-Log "=== START DETECT ==="
+
+try {
+    $certSubject = "CN=RDPSign"
+
+    Write-Log "Checking certificate: $certSubject..."
+    $certInMy   = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq $certSubject }
+    $certInRoot = Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -eq $certSubject }
+    $certInPub  = Get-ChildItem Cert:\LocalMachine\TrustedPublisher | Where-Object { $_.Subject -eq $certSubject }
+
+    $certOk = $true
+    if (-not $certInMy) {
+        Write-Log "FAIL: Certificate not found in LocalMachine\My"
+        $certOk = $false
+    }
+    if (-not $certInRoot) {
+        Write-Log "FAIL: Certificate not found in LocalMachine\Root"
+        $certOk = $false
+    }
+    if (-not $certInPub) {
+        Write-Log "FAIL: Certificate not found in LocalMachine\TrustedPublisher"
+        $certOk = $false
+    }
+    if (-not $certOk) {
+        Write-Log "DETECT [FAIL]: Certificate missing"
+    } else {
+        Write-Log "OK: Certificate found in all stores"
+    }
+
+    # Check registry thumbprint
+    Write-Log "Checking registry thumbprint..."
+    $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
+    $thumbprintValue = (Get-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue).TrustedCertThumbprints
+    if ([string]::IsNullOrWhiteSpace($thumbprintValue)) {
+        Write-Log "FAIL: TrustedCertThumbprints not found in registry"
+        $certOk = $false
+    } else {
+        Write-Log "OK: Thumbprint found in registry"
+    }
+
+    # Check that all RDP files on desktop(s) are signed
+    Write-Log "Checking RDP file signatures..."
+    $desktopsChecked = 0
+    $filesChecked = 0
+    $allSigned = $true
+
+    foreach ($desktopPath in (Get-DesktopPaths)) {
+        $rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -ErrorAction SilentlyContinue
+
+        if ($rdpFiles.Count -eq 0) {
+            Write-Log "Skip: No .rdp files on $desktopPath"
+            continue
+        }
+
+        Write-Log "Found $($rdpFiles.Count) file(s) to check on: $desktopPath"
+
+        foreach ($file in $rdpFiles) {
+            $filesChecked++
+            $content = Get-Content $file.FullName -ErrorAction SilentlyContinue
+            $hasSig = $content | Where-Object { $_ -match "^signature:s:" }
+            if (-not $hasSig) {
+                Write-Log "FAIL: $($file.Name) on $desktopPath is not signed"
+                $allSigned = $false
+            }
+        }
+        $desktopsChecked++
+    }
+
+    if ($allSigned -and $certOk) {
+        Write-Log "DETECT [OK]: $filesChecked file(s) across $desktopsChecked desktop(s) - all signed and configured"
+        exit 0
+    } else {
+        Write-Log "DETECT [FAIL]: Check log for details"
+        exit 1
+    }
+} catch {
+    Write-Log "Detect error: $_"
+    exit 1
+}