Solved

Powershell to check Remote desktop with the latest feature enabled or not ?

Posted on 2012-03-14
8
1,746 Views
Last Modified: 2013-11-21
Hi People,

Is there any way to test if Remote Desktop is available in a list of server ?

I'm in the process of filtering and searching through hundreds of Windows Server VM which could be affected with this issue: http://technet.microsoft.com/en-us/security/bulletin/ms12-020

so If anyone can come up with powershell script to identify which RDP version or feature is installed (with NLA or not) that'd be great.

Thanks.
0
Comment
  • 3
  • 3
8 Comments
 
LVL 10

Expert Comment

by:JoeKlimis
Comment Utility
Hi ,
This will give you what you want except the NLA information

 $servers = get-content servers.txt
 $results = @()
 

 ForEach ($server in $servers)
{
#  get the TS Setting object for current server
 $result = @()
 $result = "" | select ServerName, RDPenabled, Logons, LicenseType
 $ts = get-WMIObject Win32_TerminalServiceSetting  -computername $server -Namespace ROOT\CIMV2\TerminalServices
 $result.ServerName  = $ts.ServerName
 $result.RDPenabled  = $ts.AllowTSConnections
 $result.Logons      = $ts.Logons
 $result.LicenseType = $ts.LicensingType
 $results +=  $result
}

$results

Open in new window


Can you confirm which version of powershell you are using as there may be a way of using remote registry call to find out the NLa info.

Regards
Joe
0
 
LVL 10

Accepted Solution

by:
JoeKlimis earned 500 total points
Comment Utility
I have tested the following that works in Powershell 2.0

 $servers = get-content servers.txt
 #$servers = "Localhost","Localhost" # for testing
 $results = @()
 

 ForEach ($server in $servers)
{
#  get the TS Setting object for current server
 $result = @()
 $result = "" | select ServerName, RDPenabled, Logons, LicenseType,NLA
 $ts = get-WMIObject Win32_TerminalServiceSetting  -computername $server -Namespace ROOT\CIMV2\TerminalServices
 $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $ServerName)
 $result.NLA         = ($reg.OpenSubKey("System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp" )).GetValue("UserAuthentication")
 $result.ServerName  = $ts.ServerName
 $result.RDPenabled  = $ts.AllowTSConnections
 $result.Logons      = $ts.Logons
 $result.LicenseType = $ts.LicensingType
 $results +=  $result
}

$results
# $results | Export-Csv "results.csv" -NoTypeInformation     #    uncomment to write results to CSV

Open in new window

0
 
LVL 7

Author Comment

by:Senior IT System Engineer
Comment Utility
hi Joe,

I'm using PS 2.0
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 7

Author Comment

by:Senior IT System Engineer
Comment Utility
ok, I got this error:


Get-WmiObject : Invalid namespace 
At C:\Temp\bdb4988c-8ce2-4322-8e4f-ee32d4b61a01.ps1:11 char:22
+      $ts = get-WMIObject <<<<  Win32_TerminalServiceSetting  -computername $server -Namespace ROOT\CIMV2\TerminalServices
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

Open in new window


is there anything that I need to do to make it run as per your suggestion ?
0
 
LVL 7

Author Comment

by:Senior IT System Engineer
Comment Utility
ok, I've just found this URL: http://blogs.technet.com/b/jamesone/archive/2009/01/31/checking-and-enabling-remote-desktop-with-powershell.aspx

which tells you about the type of RDP connection, so how do I incorporate that into the script above that you mention ?

Function Get-RemoteDesktopConfig {

if ((Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 1)
    {"Connections not allowed"}
 elseif ((Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication -eq 1)
    {"Only Secure Connections allowed"} 
 else     
 	{"All Connections allowed"}

} 

Get-RemoteDesktopConfig

Open in new window

0
 
LVL 10

Expert Comment

by:JoeKlimis
Comment Utility
Hi

The problem you may be having is that the format of servers.txt  i have attached an example with localhost in it twice.

sorry for the delay in replying, let me know how you get on,



Joe
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Resolve DNS query failed errors for Exchange
Create and license users in Office 365 in bulk based on a CSV file. A step-by-step guide with PowerShell script examples.
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now