GCH
9534e8f7d2
- Erstat Join-Path/Test-Path med Get-ChildItem -Filter "Desktop" -Depth 2
så OneDrive-omdirigeret Desktop også fanges
- Tilføj -Exclude "Public","Default" for at springe systemprofiler over
- Anvendt i app/Install.ps1, Detect.ps1, Uninstall.ps1, SignOnly.ps1,
SignOnly_detect.ps1, Clearsigning.ps1, sandbox.ps1
61 lines
2.1 KiB
PowerShell
61 lines
2.1 KiB
PowerShell
# ============================================================
|
|
# CHANGELOG
|
|
# v1.1 - Added -AllUsers switch to check certificate and signed
|
|
# RDP files across all user desktops instead of only the
|
|
# public desktop.
|
|
# Added Get-DesktopPaths helper function.
|
|
# v1.0 - Initial version, checks public desktop only.
|
|
# ============================================================
|
|
|
|
param(
|
|
[switch]$AllUsers
|
|
)
|
|
|
|
function Get-DesktopPaths {
|
|
if ($AllUsers) {
|
|
Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
|
|
Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
|
|
Select-Object -ExpandProperty FullName
|
|
}
|
|
} else {
|
|
[Environment]::GetFolderPath("CommonDesktopDirectory")
|
|
}
|
|
}
|
|
$certSubject = "CN=RDPSign"
|
|
|
|
# Check certificate exists in all three stores
|
|
$certInMy = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq $certSubject }
|
|
$certInRoot = Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -eq $certSubject }
|
|
$certInPub = Get-ChildItem Cert:\LocalMachine\TrustedPublisher | Where-Object { $_.Subject -eq $certSubject }
|
|
|
|
if (-not $certInMy -or -not $certInRoot -or -not $certInPub) {
|
|
exit 1
|
|
}
|
|
|
|
# Check registry thumbprint
|
|
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
|
|
$thumbprintValue = (Get-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue).TrustedCertThumbprints
|
|
if ([string]::IsNullOrWhiteSpace($thumbprintValue)) {
|
|
exit 1
|
|
}
|
|
|
|
# Check that all RDP files on desktop(s) are signed
|
|
foreach ($desktopPath in (Get-DesktopPaths)) {
|
|
$rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -ErrorAction SilentlyContinue
|
|
|
|
if ($rdpFiles.Count -eq 0) {
|
|
exit 1
|
|
}
|
|
|
|
foreach ($file in $rdpFiles) {
|
|
$content = Get-Content $file.FullName -ErrorAction SilentlyContinue
|
|
$hasSig = $content | Where-Object { $_ -match "^signature:s:" }
|
|
if (-not $hasSig) {
|
|
exit 1
|
|
}
|
|
}
|
|
}
|
|
|
|
Write-Host "Detected"
|
|
exit 0
|