# ============================================================
# CHANGELOG
# v1.1 - Added -AllUsers switch to check certificate and signed
#        RDP files across all user desktops instead of only the
#        public desktop.
#        Added Get-DesktopPaths helper function.
# v1.0 - Initial version, checks public desktop only.
# ============================================================

param(
    [switch]$AllUsers
)

function Get-DesktopPaths {
    if ($AllUsers) {
        Get-ChildItem "$env:SystemDrive\Users" -Directory -Exclude "Public","Default" | ForEach-Object {
            Get-ChildItem $_.FullName -Directory -Filter "Desktop" -Depth 2 -ErrorAction SilentlyContinue |
                Select-Object -ExpandProperty FullName
        }
    } else {
        [Environment]::GetFolderPath("CommonDesktopDirectory")
    }
}
$certSubject = "CN=RDPSign"

# Check certificate exists in all three stores
$certInMy   = Get-ChildItem Cert:\LocalMachine\My               | Where-Object { $_.Subject -eq $certSubject }
$certInRoot = Get-ChildItem Cert:\LocalMachine\Root             | Where-Object { $_.Subject -eq $certSubject }
$certInPub  = Get-ChildItem Cert:\LocalMachine\TrustedPublisher | Where-Object { $_.Subject -eq $certSubject }

if (-not $certInMy -or -not $certInRoot -or -not $certInPub) {
    exit 1
}

# Check registry thumbprint
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
$thumbprintValue = (Get-ItemProperty -Path $gpoPath -Name "TrustedCertThumbprints" -ErrorAction SilentlyContinue).TrustedCertThumbprints
if ([string]::IsNullOrWhiteSpace($thumbprintValue)) {
    exit 1
}

# Check that all RDP files on desktop(s) are signed
foreach ($desktopPath in (Get-DesktopPaths)) {
    $rdpFiles = Get-ChildItem -Path $desktopPath -Filter "*.rdp" -ErrorAction SilentlyContinue

    if ($rdpFiles.Count -eq 0) {
        exit 1
    }

    foreach ($file in $rdpFiles) {
        $content = Get-Content $file.FullName -ErrorAction SilentlyContinue
        $hasSig = $content | Where-Object { $_ -match "^signature:s:" }
        if (-not $hasSig) {
            exit 1
        }
    }
}

Write-Host "Detected"
exit 0