# ============================================================
# CHANGELOG
# v1.3 - Added detailed logging for detect failures
# v1.2 - Get-DesktopPaths: Depth 2 search for OneDrive Desktop
# v1.1 - AllUsers switch + Get-DesktopPaths helper
# v1.0 - Initial
# ============================================================

param(
    [switch]$AllUsers
)

# Setup logging
$baseFolder = Join-Path $env:SystemDrive "Intune"
$logFile = Join-Path $baseFolder "RDPSign.log"

if (-not (Test-Path $baseFolder)) {
    New-Item -Path $baseFolder -ItemType Directory -Force | Out-Null
}

function Write-Log {
    param($Message)
    $logMessage = "$(Get-Date -Format 'dd-MM-yyyy HH:mm'): $Message"
    Add-Content -Path $logFile -Value $logMessage
    Write-Host $logMessage
}

function Get-DesktopPaths {
    if ($AllUsers) {
        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
                Select-Object -ExpandProperty FullName
        }
    } else {
        [Environment]::GetFolderPath("CommonDesktopDirectory")
    }
}

try {
    Write-Log "=== SignOnly Detect START ==="
    Write-Log "Running in mode: $(if ($AllUsers) { 'All Users' } else { 'Public Desktop' })"

    $certSubject = "CN=RDPSign"

    # Check certificate exists in all three stores
    Write-Log "Checking certificate: $certSubject..."
    $certInMy   = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq $certSubject }
    $certInRoot = Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -eq $certSubject }
    $certInPub  = Get-ChildItem Cert:\LocalMachine\TrustedPublisher | Where-Object { $_.Subject -eq $certSubject }

    $certOk = $true
    if (-not $certInMy) {
        Write-Log "FAIL: Certificate not found in LocalMachine\My"
        $certOk = $false
    }
    if (-not $certInRoot) {
        Write-Log "FAIL: Certificate not found in LocalMachine\Root"
        $certOk = $false
    }
    if (-not $certInPub) {
        Write-Log "FAIL: Certificate not found in LocalMachine\TrustedPublisher"
        $certOk = $false
    }
    if (-not $certOk) {
        exit 1
    }
    Write-Log "OK: Certificate found in all stores"

    # Check registry thumbprint
    Write-Log "Checking registry thumbprint..."
    $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
    $thumbprintValue = (Get-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue).TrustedCertThumbprints
    if ([string]::IsNullOrWhiteSpace($thumbprintValue)) {
        Write-Log "FAIL: TrustedCertThumbprints not found in registry"
        exit 1
    }
    Write-Log "OK: Thumbprint found in registry"

    # Check that all RDP files on desktop(s) are signed
    Write-Log "Checking RDP file signatures..."
    $desktopsChecked = 0
    $filesChecked = 0

    foreach ($desktopPath in (Get-DesktopPaths)) {
        $rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -ErrorAction SilentlyContinue

        if ($rdpFiles.Count -eq 0) {
            Write-Log "Skip: No .rdp files on $desktopPath"
            continue
        }

        Write-Log "Found $($rdpFiles.Count) file(s) to check on: $desktopPath"

        foreach ($file in $rdpFiles) {
            $filesChecked++
            $content = Get-Content $file.FullName -ErrorAction SilentlyContinue
            $hasSig = $content | Where-Object { $_ -match "^signature:s:" }
            if (-not $hasSig) {
                Write-Log "FAIL: $($file.Name) on $desktopPath is not signed"
                exit 1
            }
        }
        $desktopsChecked++
    }

    Write-Log "OK: All $filesChecked file(s) across $desktopsChecked desktop(s) are signed"
    Write-Log "=== SignOnly Detect END - Installed ==="
    exit 0
}
catch {
    Write-Log "Error: $_"
    exit 1
}