$desktopPath = [Environment]::GetFolderPath("CommonDesktopDirectory")
$certSubject = "CN=RDPSign"

# 1. Unsign RDP files
$rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp"
foreach ($file in $rdpFiles) {
    $content = Get-Content $file.FullName
    $cleaned = $content | Where-Object { $_ -notmatch "^signscope:s:" -and $_ -notmatch "^signature:s:" }
    $cleaned | Set-Content $file.FullName -Encoding Unicode
    Write-Host "Unsigned: $($file.Name)"
}

# 2. Remove certificate from all stores
foreach ($storeName in @("My", "Root", "TrustedPublisher")) {
    $store = New-Object System.Security.Cryptography.X509Certificates.X509Store($storeName, "LocalMachine")
    $store.Open("ReadWrite")
    $certs = $store.Certificates | Where-Object { $_.Subject -eq $certSubject }
    foreach ($cert in $certs) {
        $store.Remove($cert)
        Write-Host "Removed certificate from store: $storeName"
    }
    $store.Close()
}

# 3. Remove thumbprint from registry
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
Remove-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue
Write-Host "Removed TrustedCertThumbprints"

# 4. Remove RedirectionWarningDialogVersion
$clientPath = "HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services\Client"
Remove-ItemProperty -Path $clientPath -Name "RedirectionWarningDialogVersion" -ErrorAction SilentlyContinue
Write-Host "Removed RedirectionWarningDialogVersion"