# Turns on the remote desktop on this machine.
#
#   tools\enable-rdp.ps1 [-Disable] [-OpenFirewall]
#
# The remote desktop is reached through the tunnel, so the connection comes
# from the loopback and the port does not have to be open on the local
# network. The firewall rule is therefore only added when it is asked for.
#
# The user of the remote desktop has to have a password: a Windows account
# without one is not let in.
#
# ASCII only: PowerShell 5.1 reads a .ps1 without a byte order mark using the
# system ANSI code page.

param(
  [switch]$Disable,
  [switch]$OpenFirewall
)

$ErrorActionPreference = 'Stop'

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
    ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  throw 'run this from an elevated powershell'
}

$key = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
$winlogon = 'HKLM:\SYSTEM\CurrentControlSet\Control\Winlogon'

if ($Disable) {
  Set-ItemProperty -Path $key -Name fDenyTSConnections -Value 1
  Write-Host 'the remote desktop is off'
  return
}

Set-ItemProperty -Path $key -Name fDenyTSConnections -Value 0
# a session of the remote desktop is not let to drive the console at the same
# time, so that the two do not fight over the mouse
Set-ItemProperty -Path $winlogon -Name fSingleSessionPerUser -Value 1 -ErrorAction SilentlyContinue

Set-Service -Name TermService -StartupType Automatic
Start-Service -Name TermService

if ($OpenFirewall) {
  if (-not (Get-NetFirewallRule -DisplayName 'RustNotMC remote desktop' -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -DisplayName 'RustNotMC remote desktop' `
      -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow -Profile Private | Out-Null
    Write-Host 'the port 3389 is open on the private network'
  }
} else {
  Write-Host 'the port 3389 is not open on the network: the tunnel reaches it through the loopback'
}

Write-Host ''
Write-Host 'the remote desktop is on. To reach it:'
Write-Host '  tools\tunnel.ps1 -LocalPort 3389 -Remote 3389'
Write-Host '  mstsc <address>:<port>'