. "$PSScriptRoot\_common.ps1"

Section 'rdp-enable-3389' {
  Set-RegValue 'HKLM:\System\CurrentControlSet\Control\Terminal Server' 'fDenyTSConnections' 0
  Set-RegValue 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' 'UserAuthentication' 1

  # Windows 內建的 'Remote Desktop' display group 在某些 SKU/精簡版中不存在，
  # 改自建顯式規則確保 3389 通（Profile Any 涵蓋 Domain/Private/Public）
  Remove-NetFirewallRule -DisplayName 'RDP TCP 3389 (Allow Inbound)' -ErrorAction SilentlyContinue
  New-NetFirewallRule -DisplayName 'RDP TCP 3389 (Allow Inbound)' `
    -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow -Profile Any -Enabled True | Out-Null
  Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue

  # 改完 fDenyTSConnections 需要重啟 TermService 才會立刻 listen
  Restart-Service TermService -Force -ErrorAction SilentlyContinue
}