diff --git a/tools/enable-rdp.ps1 b/tools/enable-rdp.ps1
new file mode 100644
index 0000000..e738e56
--- /dev/null
+++ b/tools/enable-rdp.ps1
@@ -0,0 +1,57 @@
+# Turns on the remote desktop on this machine.
+#
+#   tools\enable-rdp.ps1 [-Disable] [-OpenFirewall]
+#
+# The remote desktop is reached through the tunnel, so the connection comes
+# from the loopback and the port does not have to be open on the local
+# network. The firewall rule is therefore only added when it is asked for.
+#
+# The user of the remote desktop has to have a password: a Windows account
+# without one is not let in.
+#
+# ASCII only: PowerShell 5.1 reads a .ps1 without a byte order mark using the
+# system ANSI code page.
+
+param(
+  [switch]$Disable,
+  [switch]$OpenFirewall
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
+    ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+  throw 'run this from an elevated powershell'
+}
+
+$key = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
+$winlogon = 'HKLM:\SYSTEM\CurrentControlSet\Control\Winlogon'
+
+if ($Disable) {
+  Set-ItemProperty -Path $key -Name fDenyTSConnections -Value 1
+  Write-Host 'the remote desktop is off'
+  return
+}
+
+Set-ItemProperty -Path $key -Name fDenyTSConnections -Value 0
+# a session of the remote desktop is not let to drive the console at the same
+# time, so that the two do not fight over the mouse
+Set-ItemProperty -Path $winlogon -Name fSingleSessionPerUser -Value 1 -ErrorAction SilentlyContinue
+
+Set-Service -Name TermService -StartupType Automatic
+Start-Service -Name TermService
+
+if ($OpenFirewall) {
+  if (-not (Get-NetFirewallRule -DisplayName 'RustNotMC remote desktop' -ErrorAction SilentlyContinue)) {
+    New-NetFirewallRule -DisplayName 'RustNotMC remote desktop' `
+      -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow -Profile Private | Out-Null
+    Write-Host 'the port 3389 is open on the private network'
+  }
+} else {
+  Write-Host 'the port 3389 is not open on the network: the tunnel reaches it through the loopback'
+}
+
+Write-Host ''
+Write-Host 'the remote desktop is on. To reach it:'
+Write-Host '  tools\tunnel.ps1 -LocalPort 3389 -Remote 3389'
+Write-Host '  mstsc <address>:<port>'
diff --git a/tools/tunnel-game.ps1 b/tools/tunnel.ps1
similarity index 70%
rename from tools/tunnel-game.ps1
rename to tools/tunnel.ps1
index 50927d4..05c18cc 100644
--- a/tools/tunnel-game.ps1
+++ b/tools/tunnel.ps1
@@ -1,10 +1,14 @@
-# Opens the game server to the internet through a tunnel.
+# Opens a port of this machine to the outside through a tunnel.
 #
-#   tools\tunnel-game.ps1 [-Port 25599] [-Remote 9000] [-Tool bore|chisel]
+#   tools\tunnel.ps1 [-LocalPort 3389] [-Remote 3389] [-Tool bore|chisel]
 #
-# The tunnel runs on this machine, the game server listens on the loopback,
-# and the far side gets a port it can connect to. The address to put into the
-# launcher is printed at the end.
+# The tunnel runs here, the far side gets a port it can connect to, and the
+# address to enter on the other machine is printed at the end.
+#
+# The usual use is the remote desktop: the port 3389 is forwarded and the
+# remote desktop client connects to the address of the tunnel. The connection
+# comes from the loopback, so the port of the remote desktop service does not
+# have to be open on the local network.
 #
 # The bore server that serves ru.zern.cc listens on 7835 and holds the secret
 # that the client and the server share. The old bat file on the desktop points
@@ -14,8 +18,8 @@
 # system ANSI code page.
 
 param(
-  [int]$Port = 25599,
-  [int]$Remote = 9000,
+  [int]$LocalPort = 3389,
+  [int]$Remote = 3389,
   [string]$Tool = 'bore',
   [string]$Host_ = 'ru.zern.cc',
   [string]$Secret = 'skyzernvintageforever',
@@ -39,20 +43,18 @@ Start-Sleep -Seconds 1
 
 if ($Tool -eq 'chisel') {
   if (-not (Test-Path $Chisel)) { throw "no chisel at $Chisel" }
-  # chisel client --server ssh://user:pass@host:port --remote-forward ...
   $user = 'tunnel'
   $args = @(
     'client',
     "--server=ssh://$user`:$Secret@$Host_`:7835",
-    '--remote-forward', "tcp:0.0.0.0`:$Remote`:127.0.0.1`:$Port",
+    '--remote-forward', "tcp:0.0.0.0`:$Remote`:127.0.0.1`:$LocalPort",
     '--keepalive-interval', '10'
   )
-  Write-Host "chisel: $($args -join ' ')"
 } else {
   if (-not (Test-Path $Bore)) { throw "no bore at $Bore" }
-  $args = @('local', "$Port", '--secret', $Secret, '--to', $Host_, '-p', "$Remote")
-  Write-Host "bore: $($args -join ' ')"
+  $args = @('local', "$LocalPort", '--secret', $Secret, '--to', $Host_, '-p', "$Remote")
 }
+Write-Host "$Tool : $($args -join ' ')"
 
 Remove-Item $Log, "$Log.err" -ErrorAction SilentlyContinue
 $proc = Start-Process -FilePath $(if ($Tool -eq 'chisel') { $Chisel } else { $Bore }) `
@@ -75,9 +77,8 @@ if (-not $up) {
 }
 
 Write-Host ''
-Write-Host "  the game is at $Host_`:$Remote"
-Write-Host "  the local port is $Port, the server must listen on 127.0.0.1"
-Write-Host "  the game client asks for the host and the port; the token must be"
-Write-Host "  for the audience the server expects (by default 'default')"
+Write-Host "  the local port $LocalPort is now $Host_`:$Remote"
+Write-Host "  connect to that address; for the remote desktop it is"
+Write-Host "  mstsc $Host_`:$Remote"
 Write-Host ''
 Get-Content $Log -ErrorAction SilentlyContinue