DSCResources/DSC_RemoteDesktopAdmin/DSC_RemoteDesktopAdmin.psm1
|
$modulePath = Join-Path -Path (Split-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -Parent) -ChildPath 'Modules' # Import the ComputerManagementDsc Common Modules Import-Module -Name (Join-Path -Path $modulePath ` -ChildPath (Join-Path -Path 'ComputerManagementDsc.Common' ` -ChildPath 'ComputerManagementDsc.Common.psm1')) Import-Module -Name (Join-Path -Path $modulePath -ChildPath 'DscResource.Common') # Import Localization Strings $script:localizedData = Get-LocalizedData -DefaultUICulture 'en-US' $script:tSRegistryKey = 'HKLM:\System\CurrentControlSet\Control\Terminal Server' $script:winStationsRegistryKey = 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' <# .SYNOPSIS Returns the current Remote Desktop Admin Settings. .PARAMETER IsSingleInstance Specifies the resource is a single instance, the value must be 'Yes'. #> function Get-TargetResource { [CmdletBinding()] [OutputType([System.Collections.Hashtable])] param ( [Parameter(Mandatory = $true)] [ValidateSet('Yes')] [System.String] $IsSingleInstance ) Write-Verbose -Message $script:localizedData.GettingRemoteDesktopAdminSettingsMessage $fDenyTSConnectionsRegistry = (Get-ItemProperty -Path $script:tSRegistryKey -Name 'fDenyTSConnections').fDenyTSConnections $UserAuthenticationRegistry = (Get-ItemProperty -Path $script:winStationsRegistryKey -Name 'UserAuthentication').UserAuthentication if ($fDenyTSConnectionsRegistry -eq 0) { $ensure = 'Present' } else { $ensure = 'Absent' } if ($UserAuthenticationRegistry -eq 1) { $userAuthentication = 'Secure' } else { $userAuthentication = 'NonSecure' } $targetResource = @{ IsSingleInstance = $IsSingleInstance Ensure = $ensure UserAuthentication = $userAuthentication } return $targetResource } <# .SYNOPSIS Tests the state of the Remote Desktop Admin Settings. .PARAMETER IsSingleInstance Specifies the resource is a single instance, the value must be 'Yes'. .PARAMETER Ensure Specifies whether Remote Desktop connections should be allowed (Present) or denied (Absent). .PARAMETER UserAuthentication Specifies whether Remote Desktop connnections will require Network Level Authentication (Secure) or not (NonSecure). #> function Test-TargetResource { [CmdletBinding()] [OutputType([System.Boolean])] param ( [Parameter(Mandatory = $true)] [ValidateSet('Yes')] [String] $IsSingleInstance, [Parameter()] [ValidateSet('Present', 'Absent')] [System.String] $Ensure = 'Present', [Parameter()] [ValidateSet('NonSecure', 'Secure')] [System.String] $UserAuthentication ) $targetResource = Get-TargetResource -IsSingleInstance 'Yes' $inDesiredState = $true if ($targetResource.Ensure -ne $Ensure) { Write-Verbose -Message ($script:localizedData.NotInDesiredStateMessage ` -f $Ensure, $targetResource.Ensure) $inDesiredState = $false } if ($PSBoundParameters.ContainsKey('UserAuthentication') -and $targetResource.UserAuthentication -ne $UserAuthentication) { Write-Verbose -Message ($script:localizedData.ParameterNeedsUpdateMessage ` -f 'UserAuthentication', $UserAuthentication, $targetResource.UserAuthentication) $inDesiredState = $false } return $inDesiredState } <# .SYNOPSIS Sets the Remote Desktop Admin Settings. .PARAMETER IsSingleInstance Specifies the resource is a single instance, the value must be 'Yes'. .PARAMETER Ensure Specifies whether Remote Desktop connections should be allowed (Present) or denied (Absent). .PARAMETER UserAuthentication Specifies whether Remote Desktop connnections will require Network Level Authentication (Secure) or not (NonSecure). #> function Set-TargetResource { [CmdletBinding()] param ( [Parameter(Mandatory = $true)] [ValidateSet('Yes')] [String] $IsSingleInstance, [Parameter()] [ValidateSet('Present', 'Absent')] [System.String] $Ensure = 'Present', [Parameter()] [ValidateSet('NonSecure', 'Secure')] [System.String] $UserAuthentication ) $fDenyTSConnectionsRegistry = @{ Present = 0 Absent = 1 }[$Ensure] $UserAuthenticationRegistry = @{ NonSecure = 0 Secure = 1 }[$UserAuthentication] $targetResource = Get-TargetResource -IsSingleInstance 'Yes' if ($Ensure -ne $targetResource.Ensure) { Write-Verbose -Message ($script:localizedData.SettingRemoteDesktopAdminMessage -f $Ensure) Set-ItemProperty -Path $script:tSRegistryKey -Name "fDenyTSConnections" -Value $fDenyTSConnectionsRegistry } if ($UserAuthentication -ne $targetResource.UserAuthentication) { Write-Verbose -Message ($script:localizedData.SettingUserAuthenticationMessage -f $UserAuthentication) Set-ItemProperty -Path $script:winStationsRegistryKey -Name "UserAuthentication" -Value $UserAuthenticationRegistry } } |