mirror of https://github.com/stascorp/rdpwrap
Adds a self-contained governance/ops shell (RdpCoexist/) that drives the sergiye/rdpWrapper engine to enable concurrent RDP + local console (AnyDesk) without modifying System32\termsrv.dll on disk (ServiceDll -> TermWrap proxy). Closes the 5 gaps the bare engine leaves open: 1. No license grant to redistribute the engine -> engine is fetched from its official release and SHA256-pinned; nothing binary is committed here (.gitignore blocks engine/, *.exe, *.dll). 2. No self-heal after Windows Update swaps termsrv.dll -> -Heal action plus a SYSTEM at-startup scheduled task: verify, re-install only if listener dropped. 3. Verification was GUI-only -> -Verify returns a machine-checkable verdict; COEXIST-OK requires a real 3389 listener AND >=2 active sessions, not just registry values. 4. Engine phones home / version drift -> engine always invoked with -offline and the version pinned in config.psd1. 5. Engine DLL flagged HackTool:Win32/RDPWrap -> idempotent Windows Defender exclusion for the engine folder, skipped gracefully if policy-locked. Also includes: self-elevating .cmd launcher, GPO-override warning for fSingleSessionPerUser/fDenyTSConnections, and an optional dedicated local RDP account (avoids same-user dual-session license traps in OneDrive/Outlook/Office). All shipped values are neutral placeholders; no environment-specific data. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>pull/4441/head
P.Choco
3 weeks ago
parent
a5c64a4331
commit
94aeba992d
@ -0,0 +1,6 @@
|
|||||||
|
# Never commit the engine binary (upstream has no redistribution license) or runtime state.
|
||||||
|
engine/
|
||||||
|
logs/
|
||||||
|
state.json
|
||||||
|
*.exe
|
||||||
|
*.dll
|
||||||
@ -0,0 +1,79 @@
|
|||||||
|
# RdpCoexist
|
||||||
|
|
||||||
|
A small, portable **governance/ops shell** that lets **AnyDesk and RDP run side by
|
||||||
|
side** (concurrent RDP sessions + local console) on modern Windows — **without
|
||||||
|
modifying `System32\termsrv.dll` on disk**.
|
||||||
|
|
||||||
|
It does *not* reimplement the wrapper. It drives
|
||||||
|
[`sergiye/rdpWrapper`](https://github.com/sergiye/rdpWrapper) (a portable, .NET
|
||||||
|
Framework 4.7.2, single-file rewrite of RDP Wrapper that redirects the
|
||||||
|
`TermService` `ServiceDll` to a non-destructive proxy — `TermWrap` — with a
|
||||||
|
built-in offset engine) and wraps it with the operational pieces it lacks.
|
||||||
|
|
||||||
|
> Approach: stop RDP service → point `TermService` `ServiceDll` at a wrapper in a
|
||||||
|
> portable folder → set `fDenyTSConnections=0`, `fSingleSessionPerUser=0`,
|
||||||
|
> `EnableConcurrentSessions=1` → start service. The original `termsrv.dll` is
|
||||||
|
> **never touched**, so SFC / WRP / Windows Update leave it alone.
|
||||||
|
|
||||||
|
## Why a shell (the 5 gaps this closes)
|
||||||
|
|
||||||
|
| # | Gap in the bare engine | What this shell adds |
|
||||||
|
|---|------------------------|----------------------|
|
||||||
|
| 1 | No license grant → cannot repackage/redistribute the engine binary | Engine is **fetched from its official release** and **SHA256-pinned**; nothing is bundled here (`.gitignore` blocks `*.exe`/`*.dll`) |
|
||||||
|
| 2 | No self-heal after Windows Update replaces `termsrv.dll` | `-Heal` + a **SYSTEM startup scheduled task**: verify, and only re-install if the listener dropped |
|
||||||
|
| 3 | Verification is GUI-only | `-Verify` returns a **machine-checkable verdict** (`COEXIST-OK` requires a real listener **and** ≥2 active sessions, not just registry values) |
|
||||||
|
| 4 | Engine phones home for updates → version drift | Engine is **always** invoked with `-offline`; version is pinned in `config.psd1` |
|
||||||
|
| 5 | Engine DLL is commonly flagged `HackTool:Win32/RDPWrap` | Idempotent **Defender exclusion** for the engine folder (skipped gracefully if exclusions are policy-locked) |
|
||||||
|
|
||||||
|
## Layout
|
||||||
|
|
||||||
|
```
|
||||||
|
RdpCoexist/
|
||||||
|
├─ RdpCoexist.cmd self-elevating launcher (UAC)
|
||||||
|
├─ RdpCoexist.ps1 -Apply | -Revert | -Verify | -Heal | -Status
|
||||||
|
├─ config.psd1 version pin, SHA256 pin, paths, options
|
||||||
|
└─ modules/
|
||||||
|
├─ Common.psm1 logging, admin check, GPO-override warning
|
||||||
|
├─ Engine.psm1 download + hash-verify + drive the engine
|
||||||
|
├─ Defender.psm1 idempotent exclusion add/remove
|
||||||
|
├─ Verify.psm1 listener + active-session verdict
|
||||||
|
├─ Heal.psm1 scheduled-task register/unregister
|
||||||
|
└─ LocalUser.psm1 optional dedicated RDP account
|
||||||
|
```
|
||||||
|
Engine binary, logs, and state live under `%ProgramData%\RdpCoexist\` — never in this repo.
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
1. Edit `config.psd1`. At minimum set **`EngineSha256`** to the hash of the engine
|
||||||
|
release you vetted (or run the first `-Apply` with `-TrustOnFirstUse`, which
|
||||||
|
prints the observed hash for you to paste back and lock).
|
||||||
|
2. Run:
|
||||||
|
|
||||||
|
```
|
||||||
|
RdpCoexist.cmd -Apply :: fetch+verify engine, install, register heal task, verify
|
||||||
|
RdpCoexist.cmd -Verify :: print current verdict
|
||||||
|
RdpCoexist.cmd -Revert :: uninstall engine, remove task + exclusion
|
||||||
|
```
|
||||||
|
|
||||||
|
`COEXIST-OK` only appears once **two** sessions are actually active (e.g. console +
|
||||||
|
one RDP), because a listener alone does not prove coexistence.
|
||||||
|
|
||||||
|
## Requirements & caveats
|
||||||
|
|
||||||
|
- **Admin** required (the launcher elevates).
|
||||||
|
- **.NET Framework 4.7.2** — built into supported Windows 10/11; no install needed.
|
||||||
|
- **Domain GPO**: if `fSingleSessionPerUser` / `fDenyTSConnections` are enforced by
|
||||||
|
policy, they revert on GP refresh. The shell warns; resolve with IT.
|
||||||
|
- **Same-user dual session** trips license locks in OneDrive/Outlook/Office. Prefer
|
||||||
|
the optional dedicated RDP account (`CreateRdpUser`), keeping the console user for AnyDesk.
|
||||||
|
- **Portability vs. resilience**: the engine is copied under `%ProgramData%` by
|
||||||
|
default. Pointing `ServiceDll` at removable media means RDP dies if the media is
|
||||||
|
pulled — don't.
|
||||||
|
- Concurrent-session enablement changes the effective RDP session limit; confirm your
|
||||||
|
own licensing position before use.
|
||||||
|
|
||||||
|
## Configuration keys
|
||||||
|
|
||||||
|
See `config.psd1` for the annotated list. Values shipped here are **neutral
|
||||||
|
placeholders** — set the version pin, hash pin, and (if used) the RDP user name to
|
||||||
|
your own before running.
|
||||||
@ -0,0 +1,12 @@
|
|||||||
|
@echo off
|
||||||
|
setlocal
|
||||||
|
set "PS1=%~dp0RdpCoexist.ps1"
|
||||||
|
net session >nul 2>&1
|
||||||
|
if %errorlevel%==0 (
|
||||||
|
powershell -NoProfile -ExecutionPolicy Bypass -File "%PS1%" %*
|
||||||
|
) else (
|
||||||
|
echo Requesting administrator elevation...
|
||||||
|
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
|
||||||
|
"Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File','%PS1%' %*"
|
||||||
|
)
|
||||||
|
endlocal
|
||||||
@ -0,0 +1,94 @@
|
|||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
Portable AnyDesk + RDP coexistence orchestrator (governance shell around
|
||||||
|
sergiye/rdpWrapper). Enables concurrent RDP sessions without touching
|
||||||
|
System32\termsrv.dll on disk (ServiceDll redirection + TermWrap backend).
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This shell adds the operational pieces the engine does not provide:
|
||||||
|
1. Engine is fetched from its official release and SHA256-pinned (no
|
||||||
|
redistribution here; upstream has no license grant).
|
||||||
|
2. Post-Windows-Update self-heal via a SYSTEM startup scheduled task.
|
||||||
|
3. A machine-checkable verdict (listener + >=2 active sessions), not GUI.
|
||||||
|
4. The engine is always run with -offline (no phone-home / version drift).
|
||||||
|
5. Windows Defender exclusion handled idempotently.
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
RdpCoexist.cmd -Apply
|
||||||
|
RdpCoexist.cmd -Verify
|
||||||
|
RdpCoexist.cmd -Revert
|
||||||
|
#>
|
||||||
|
[CmdletBinding(DefaultParameterSetName = 'Verify')]
|
||||||
|
param(
|
||||||
|
[Parameter(ParameterSetName = 'Apply')] [switch]$Apply,
|
||||||
|
[Parameter(ParameterSetName = 'Revert')] [switch]$Revert,
|
||||||
|
[Parameter(ParameterSetName = 'Verify')] [switch]$Verify,
|
||||||
|
[Parameter(ParameterSetName = 'Heal')] [switch]$Heal,
|
||||||
|
[Parameter(ParameterSetName = 'Status')] [switch]$Status,
|
||||||
|
[switch]$TrustOnFirstUse
|
||||||
|
)
|
||||||
|
|
||||||
|
Set-StrictMode -Version Latest
|
||||||
|
$ErrorActionPreference = 'Stop'
|
||||||
|
$here = Split-Path -Parent $MyInvocation.MyCommand.Path
|
||||||
|
|
||||||
|
Import-Module (Join-Path $here 'modules\Common.psm1') -Force
|
||||||
|
Import-Module (Join-Path $here 'modules\Engine.psm1') -Force
|
||||||
|
Import-Module (Join-Path $here 'modules\Defender.psm1') -Force
|
||||||
|
Import-Module (Join-Path $here 'modules\Verify.psm1') -Force
|
||||||
|
Import-Module (Join-Path $here 'modules\Heal.psm1') -Force
|
||||||
|
Import-Module (Join-Path $here 'modules\LocalUser.psm1') -Force
|
||||||
|
|
||||||
|
$cfg = Import-PowerShellDataFile (Join-Path $here 'config.psd1')
|
||||||
|
New-Item -ItemType Directory -Path $cfg.InstallRoot -Force | Out-Null
|
||||||
|
Initialize-Log -Root $cfg.InstallRoot
|
||||||
|
|
||||||
|
function Do-Apply {
|
||||||
|
Assert-Admin
|
||||||
|
Test-DomainPolicyOverride
|
||||||
|
if ($cfg.AddDefenderExclusion) { Add-DefenderExclusion -Path (Join-Path $cfg.InstallRoot 'engine') }
|
||||||
|
|
||||||
|
$exe = Resolve-Engine -Config $cfg -TrustOnFirstUse:$TrustOnFirstUse
|
||||||
|
Set-PreferredWrapper -Wrapper $cfg.PreferredWrapper
|
||||||
|
$rc = Invoke-Engine -Exe $exe -EngineArgs @('-install') -Offline:$cfg.AlwaysOffline
|
||||||
|
if ($rc -ne 0) { throw "Engine install failed (exit=$rc)." }
|
||||||
|
|
||||||
|
if ($cfg.CreateRdpUser) { New-RdpLocalUser -UserName $cfg.RdpUserName }
|
||||||
|
if ($cfg.RegisterHealTask) { Register-HealTask -Config $cfg -ScriptPath $PSCommandPath }
|
||||||
|
|
||||||
|
$v = Test-Coexist -ActiveSessionPattern $cfg.ActiveSessionPattern
|
||||||
|
$v | Format-List | Out-String | Write-Host
|
||||||
|
if ($v.Verdict -eq 'FAIL') { Write-Log 'Apply finished but listener is down.' 'Error' }
|
||||||
|
elseif ($v.Verdict -eq 'LISTENING-UNVERIFIED') {
|
||||||
|
Write-Log 'Listener up. Open a second concurrent session to confirm COEXIST-OK.' 'Warn'
|
||||||
|
}
|
||||||
|
else { Write-Log 'COEXIST-OK.' 'Ok' }
|
||||||
|
}
|
||||||
|
|
||||||
|
function Do-Revert {
|
||||||
|
Assert-Admin
|
||||||
|
$exe = Join-Path (Join-Path $cfg.InstallRoot 'engine') $cfg.EngineAsset
|
||||||
|
if (Test-Path $exe) { Invoke-Engine -Exe $exe -EngineArgs @('-uninstall') -Offline:$cfg.AlwaysOffline | Out-Null }
|
||||||
|
Unregister-HealTask -Config $cfg
|
||||||
|
if ($cfg.AddDefenderExclusion) { Remove-DefenderExclusion -Path (Join-Path $cfg.InstallRoot 'engine') }
|
||||||
|
if ($cfg.CreateRdpUser) { Write-Log "Local user '$($cfg.RdpUserName)' left intact; remove manually if desired." 'Warn' }
|
||||||
|
Write-Log 'Revert complete.' 'Ok'
|
||||||
|
}
|
||||||
|
|
||||||
|
function Do-Heal {
|
||||||
|
Assert-Admin
|
||||||
|
$v = Test-Coexist -ActiveSessionPattern $cfg.ActiveSessionPattern
|
||||||
|
if ($v.Verdict -ne 'FAIL') { Write-Log "Heal: healthy ($($v.Verdict)); nothing to do." 'Ok'; return }
|
||||||
|
Write-Log 'Heal: listener down (likely post-update). Re-installing engine.' 'Warn'
|
||||||
|
$exe = Resolve-Engine -Config $cfg -TrustOnFirstUse:$TrustOnFirstUse
|
||||||
|
Set-PreferredWrapper -Wrapper $cfg.PreferredWrapper
|
||||||
|
Invoke-Engine -Exe $exe -EngineArgs @('-install') -Offline:$cfg.AlwaysOffline | Out-Null
|
||||||
|
(Test-Coexist -ActiveSessionPattern $cfg.ActiveSessionPattern) | Format-List | Out-String | Write-Host
|
||||||
|
}
|
||||||
|
|
||||||
|
switch ($PSCmdlet.ParameterSetName) {
|
||||||
|
'Apply' { Do-Apply }
|
||||||
|
'Revert' { Do-Revert }
|
||||||
|
'Heal' { Do-Heal }
|
||||||
|
default { (Test-Coexist -ActiveSessionPattern $cfg.ActiveSessionPattern) | Format-List }
|
||||||
|
}
|
||||||
@ -0,0 +1,35 @@
|
|||||||
|
@{
|
||||||
|
# =========================================================================
|
||||||
|
# RdpCoexist configuration
|
||||||
|
# Values below are neutral defaults / placeholders. Fill EngineSha256
|
||||||
|
# before the first -Apply (or use -TrustOnFirstUse to pin interactively).
|
||||||
|
# =========================================================================
|
||||||
|
|
||||||
|
# ---- Engine: sergiye/rdpWrapper (used as-is; not redistributed here) ----
|
||||||
|
EngineRepo = 'sergiye/rdpWrapper'
|
||||||
|
EngineVersion = '2.15' # pin ONE vetted release; never float to "latest"
|
||||||
|
EngineAsset = 'rdpWrapper_x64.exe'
|
||||||
|
|
||||||
|
# REQUIRED before first Apply. SHA256 of the vetted asset, uppercase hex.
|
||||||
|
# Empty => -Apply refuses unless you pass -TrustOnFirstUse (prints the hash
|
||||||
|
# so you can paste it back here and re-run).
|
||||||
|
EngineSha256 = ''
|
||||||
|
|
||||||
|
# ---- Paths ----
|
||||||
|
InstallRoot = 'C:\ProgramData\RdpCoexist'
|
||||||
|
|
||||||
|
# ---- Behaviour ----
|
||||||
|
PreferredWrapper = 'TermWrap' # TermWrap = offset-engine backend, no ini/offset dance
|
||||||
|
AlwaysOffline = $true # always pass -offline so the engine never phones home
|
||||||
|
AddDefenderExclusion = $true # engine dll is commonly flagged HackTool:Win32/RDPWrap
|
||||||
|
RegisterHealTask = $true # self-heal after Windows Update (re-install if listener drops)
|
||||||
|
HealTaskName = 'RdpCoexist-Heal'
|
||||||
|
|
||||||
|
# ---- Optional: dedicated local account for RDP (avoids same-user dual-session
|
||||||
|
# license traps in OneDrive/Outlook/Office). Off by default. ----
|
||||||
|
CreateRdpUser = $false
|
||||||
|
RdpUserName = 'rdpuser' # placeholder; change before enabling
|
||||||
|
|
||||||
|
# ---- Verify: locales that render session state as "Active" in qwinsta ----
|
||||||
|
ActiveSessionPattern = 'Active|使用中|アクティブ|활성'
|
||||||
|
}
|
||||||
@ -0,0 +1,46 @@
|
|||||||
|
Set-StrictMode -Version Latest
|
||||||
|
|
||||||
|
$script:LogPath = $null
|
||||||
|
|
||||||
|
function Initialize-Log {
|
||||||
|
param([string]$Root)
|
||||||
|
$dir = Join-Path $Root 'logs'
|
||||||
|
New-Item -ItemType Directory -Path $dir -Force | Out-Null
|
||||||
|
$script:LogPath = Join-Path $dir ('rdpcoexist-{0:yyyyMMdd}.log' -f (Get-Date))
|
||||||
|
}
|
||||||
|
|
||||||
|
function Write-Log {
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory)][string]$Message,
|
||||||
|
[ValidateSet('Info', 'Warn', 'Error', 'Ok')][string]$Level = 'Info'
|
||||||
|
)
|
||||||
|
$stamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
|
||||||
|
$line = "[$stamp] [$Level] $Message"
|
||||||
|
$color = switch ($Level) { 'Warn' { 'Yellow' } 'Error' { 'Red' } 'Ok' { 'Green' } default { 'Gray' } }
|
||||||
|
Write-Host $line -ForegroundColor $color
|
||||||
|
if ($script:LogPath) { Add-Content -Path $script:LogPath -Value $line -Encoding UTF8 }
|
||||||
|
}
|
||||||
|
|
||||||
|
function Assert-Admin {
|
||||||
|
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
|
||||||
|
$pr = New-Object Security.Principal.WindowsPrincipal($id)
|
||||||
|
if (-not $pr.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
||||||
|
throw 'Administrator rights required. Launch via RdpCoexist.cmd (UAC) or an elevated shell.'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function Test-DomainPolicyOverride {
|
||||||
|
# fSingleSessionPerUser / fDenyTSConnections may be enforced by GPO and will
|
||||||
|
# silently revert local changes on the next GP refresh. Warn, do not fail.
|
||||||
|
$p = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
|
||||||
|
if (Test-Path $p) {
|
||||||
|
$k = Get-ItemProperty $p -ErrorAction SilentlyContinue
|
||||||
|
foreach ($v in 'fSingleSessionPerUser', 'fDenyTSConnections') {
|
||||||
|
if ($null -ne $k.$v) {
|
||||||
|
Write-Log "GPO sets $v=$($k.$v); it may override local settings on GP refresh. Check with IT." 'Warn'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Export-ModuleMember -Function Initialize-Log, Write-Log, Assert-Admin, Test-DomainPolicyOverride
|
||||||
@ -0,0 +1,25 @@
|
|||||||
|
Set-StrictMode -Version Latest
|
||||||
|
|
||||||
|
function Add-DefenderExclusion {
|
||||||
|
param([Parameter(Mandatory)][string]$Path)
|
||||||
|
try {
|
||||||
|
$cur = @((Get-MpPreference).ExclusionPath)
|
||||||
|
if ($cur -notcontains $Path) {
|
||||||
|
Add-MpPreference -ExclusionPath $Path
|
||||||
|
Write-Log "Defender exclusion added: $Path" 'Ok'
|
||||||
|
}
|
||||||
|
else { Write-Log "Defender exclusion already present: $Path" }
|
||||||
|
}
|
||||||
|
catch {
|
||||||
|
# If exclusions are locked by Intune/Tenant, only IT can add them.
|
||||||
|
Write-Log "Could not add Defender exclusion (managed by policy?): $_" 'Warn'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function Remove-DefenderExclusion {
|
||||||
|
param([Parameter(Mandatory)][string]$Path)
|
||||||
|
try { Remove-MpPreference -ExclusionPath $Path -ErrorAction SilentlyContinue }
|
||||||
|
catch { Write-Log "Could not remove Defender exclusion: $_" 'Warn' }
|
||||||
|
}
|
||||||
|
|
||||||
|
Export-ModuleMember -Function Add-DefenderExclusion, Remove-DefenderExclusion
|
||||||
@ -0,0 +1,71 @@
|
|||||||
|
Set-StrictMode -Version Latest
|
||||||
|
|
||||||
|
function Resolve-Engine {
|
||||||
|
<#
|
||||||
|
Ensures the sergiye/rdpWrapper engine exe is present under <InstallRoot>\engine
|
||||||
|
and its SHA256 matches the pin. The engine is downloaded from its official
|
||||||
|
GitHub release (not redistributed in this repo, which has no license grant).
|
||||||
|
#>
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory)]$Config,
|
||||||
|
[switch]$TrustOnFirstUse
|
||||||
|
)
|
||||||
|
$dir = Join-Path $Config.InstallRoot 'engine'
|
||||||
|
$exe = Join-Path $dir $Config.EngineAsset
|
||||||
|
New-Item -ItemType Directory -Path $dir -Force | Out-Null
|
||||||
|
|
||||||
|
if (-not (Test-Path $exe)) {
|
||||||
|
$url = "https://github.com/$($Config.EngineRepo)/releases/download/$($Config.EngineVersion)/$($Config.EngineAsset)"
|
||||||
|
Write-Log "Downloading engine: $url"
|
||||||
|
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||||
|
Invoke-WebRequest -Uri $url -OutFile $exe -UseBasicParsing
|
||||||
|
}
|
||||||
|
|
||||||
|
$hash = (Get-FileHash $exe -Algorithm SHA256).Hash.ToUpper()
|
||||||
|
$pin = ($Config.EngineSha256 | Out-String).Trim().ToUpper()
|
||||||
|
|
||||||
|
if ([string]::IsNullOrWhiteSpace($pin)) {
|
||||||
|
if ($TrustOnFirstUse) {
|
||||||
|
Write-Log "TOFU pin: $hash <-- paste into config.psd1 EngineSha256 to lock it." 'Warn'
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Remove-Item $exe -Force -ErrorAction SilentlyContinue
|
||||||
|
throw "EngineSha256 is not pinned. Verify the asset out-of-band, set the pin, or re-run with -TrustOnFirstUse. Observed: $hash"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
elseif ($hash -ne $pin) {
|
||||||
|
Remove-Item $exe -Force -ErrorAction SilentlyContinue
|
||||||
|
throw "Engine hash mismatch (deleted). expected=$pin actual=$hash"
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Write-Log "Engine hash verified." 'Ok'
|
||||||
|
}
|
||||||
|
return $exe
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-Engine {
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory)][string]$Exe,
|
||||||
|
[Parameter(Mandatory)][string[]]$EngineArgs,
|
||||||
|
[bool]$Offline = $true
|
||||||
|
)
|
||||||
|
$a = @($EngineArgs)
|
||||||
|
if ($Offline) { $a += '-offline' } # -offline must be the LAST parameter
|
||||||
|
Write-Log "engine $($a -join ' ')"
|
||||||
|
$p = Start-Process -FilePath $Exe -ArgumentList $a -Wait -PassThru -NoNewWindow
|
||||||
|
Write-Log "engine exit=$($p.ExitCode)"
|
||||||
|
return $p.ExitCode
|
||||||
|
}
|
||||||
|
|
||||||
|
function Set-PreferredWrapper {
|
||||||
|
# The engine reads preferredWrapper from its own persistent settings; default
|
||||||
|
# is already TermWrap. Mirror the choice into that store so -install is unattended.
|
||||||
|
param([Parameter(Mandatory)][string]$Wrapper)
|
||||||
|
$key = 'HKCU:\Software\rdpWrapper'
|
||||||
|
try {
|
||||||
|
New-Item $key -Force | Out-Null
|
||||||
|
Set-ItemProperty $key -Name 'preferredWrapper' -Value $Wrapper
|
||||||
|
} catch { Write-Log "Could not preset preferredWrapper: $_" 'Warn' }
|
||||||
|
}
|
||||||
|
|
||||||
|
Export-ModuleMember -Function Resolve-Engine, Invoke-Engine, Set-PreferredWrapper
|
||||||
@ -0,0 +1,30 @@
|
|||||||
|
Set-StrictMode -Version Latest
|
||||||
|
|
||||||
|
function Register-HealTask {
|
||||||
|
<#
|
||||||
|
Windows Update replaces termsrv.dll, which can break memory offsets and drop
|
||||||
|
the listener. This registers a SYSTEM startup task that runs -Heal: verify,
|
||||||
|
and only if not COEXIST-OK re-run the engine install (offset engine re-adapts).
|
||||||
|
#>
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory)]$Config,
|
||||||
|
[Parameter(Mandatory)][string]$ScriptPath
|
||||||
|
)
|
||||||
|
$arg = '-NoProfile -ExecutionPolicy Bypass -File "{0}" -Heal' -f $ScriptPath
|
||||||
|
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument $arg
|
||||||
|
$trigger = New-ScheduledTaskTrigger -AtStartup
|
||||||
|
$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -RunLevel Highest
|
||||||
|
$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -AllowStartIfOnBatteries `
|
||||||
|
-DontStopIfGoingOnBatteries
|
||||||
|
Register-ScheduledTask -TaskName $Config.HealTaskName -Action $action -Trigger $trigger `
|
||||||
|
-Principal $principal -Settings $settings -Force | Out-Null
|
||||||
|
Write-Log "Heal task registered: $($Config.HealTaskName)" 'Ok'
|
||||||
|
}
|
||||||
|
|
||||||
|
function Unregister-HealTask {
|
||||||
|
param([Parameter(Mandatory)]$Config)
|
||||||
|
Unregister-ScheduledTask -TaskName $Config.HealTaskName -Confirm:$false -ErrorAction SilentlyContinue
|
||||||
|
Write-Log "Heal task removed: $($Config.HealTaskName)"
|
||||||
|
}
|
||||||
|
|
||||||
|
Export-ModuleMember -Function Register-HealTask, Unregister-HealTask
|
||||||
@ -0,0 +1,30 @@
|
|||||||
|
Set-StrictMode -Version Latest
|
||||||
|
|
||||||
|
function New-RdpLocalUser {
|
||||||
|
<#
|
||||||
|
Optional: a dedicated local account for RDP so the interactive (console)
|
||||||
|
user and the RDP user are different principals. Avoids single-session
|
||||||
|
license locks in OneDrive/Outlook/Office. Prompts for the password; this
|
||||||
|
tool never bakes or transmits credentials.
|
||||||
|
#>
|
||||||
|
param([Parameter(Mandatory)][string]$UserName)
|
||||||
|
|
||||||
|
if (Get-LocalUser -Name $UserName -ErrorAction SilentlyContinue) {
|
||||||
|
Write-Log "Local user '$UserName' already exists." ; return
|
||||||
|
}
|
||||||
|
$sec = Read-Host "Set password for new RDP user '$UserName'" -AsSecureString
|
||||||
|
New-LocalUser -Name $UserName -Password $sec -PasswordNeverExpires:$true `
|
||||||
|
-Description 'RdpCoexist dedicated RDP account' | Out-Null
|
||||||
|
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member $UserName -ErrorAction SilentlyContinue
|
||||||
|
Write-Log "Local user '$UserName' created and added to Remote Desktop Users." 'Ok'
|
||||||
|
}
|
||||||
|
|
||||||
|
function Remove-RdpLocalUser {
|
||||||
|
param([Parameter(Mandatory)][string]$UserName)
|
||||||
|
if (Get-LocalUser -Name $UserName -ErrorAction SilentlyContinue) {
|
||||||
|
Remove-LocalUser -Name $UserName
|
||||||
|
Write-Log "Local user '$UserName' removed."
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Export-ModuleMember -Function New-RdpLocalUser, Remove-RdpLocalUser
|
||||||
@ -0,0 +1,37 @@
|
|||||||
|
Set-StrictMode -Version Latest
|
||||||
|
|
||||||
|
function Get-ActiveSessionCount {
|
||||||
|
param([string]$Pattern = 'Active|使用中|アクティブ|활성')
|
||||||
|
$out = & qwinsta.exe 2>$null
|
||||||
|
if (-not $out) { return 0 }
|
||||||
|
return @($out | Select-String -Pattern $Pattern).Count
|
||||||
|
}
|
||||||
|
|
||||||
|
function Test-Coexist {
|
||||||
|
<#
|
||||||
|
COEXIST-OK requires an actual listener AND >=2 concurrent active sessions,
|
||||||
|
not merely the registry values. Registry-only checks lie.
|
||||||
|
#>
|
||||||
|
param([string]$ActiveSessionPattern = 'Active|使用中|アクティブ|활성')
|
||||||
|
|
||||||
|
$svc = (Get-Service TermService -ErrorAction SilentlyContinue).Status
|
||||||
|
$listen = @(Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue).Count -gt 0
|
||||||
|
$dll = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\TermService\Parameters' `
|
||||||
|
-Name ServiceDll -ErrorAction SilentlyContinue).ServiceDll
|
||||||
|
$active = Get-ActiveSessionCount -Pattern $ActiveSessionPattern
|
||||||
|
|
||||||
|
$verdict =
|
||||||
|
if ($listen -and $active -ge 2) { 'COEXIST-OK' }
|
||||||
|
elseif ($listen) { 'LISTENING-UNVERIFIED' }
|
||||||
|
else { 'FAIL' }
|
||||||
|
|
||||||
|
[pscustomobject]@{
|
||||||
|
TermService = $svc
|
||||||
|
Listening = $listen
|
||||||
|
ServiceDll = $dll
|
||||||
|
ActiveSessions = $active
|
||||||
|
Verdict = $verdict
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Export-ModuleMember -Function Test-Coexist, Get-ActiveSessionCount
|
||||||
Loading…
Reference in new issue