enable-av-redirection.ps1

$ErrorActionPreference = "Stop"; $scriptArgs = $args

function ArgValue($name) {
    for ($i = 0; $i -lt $scriptArgs.Count; $i++) {
        if ($scriptArgs[$i] -in @("-$name", "--$name")) {
            if ($i + 1 -ge $scriptArgs.Count) { throw "Argument '$($scriptArgs[$i])' requires a value." }
            return $scriptArgs[$i + 1]
        }
    }
    return ""
}

function AssertKnownArguments {
    for ($i = 0; $i -lt $scriptArgs.Count; $i++) {
        $argument = [string]$scriptArgs[$i]
        if ($argument -in @("-config", "--config")) {
            if ($i + 1 -ge $scriptArgs.Count) { throw "Argument '$argument' requires a value." }
            $i++
            continue
        }
        throw "Unknown argument '$argument'."
    }
}

function FullPath($path) {
    $path = [Environment]::ExpandEnvironmentVariables([string]$path)
    if ($path -match '^~[\\/](.*)$') { return (Join-Path $HOME $Matches[1]) }
    if ([IO.Path]::IsPathRooted($path)) { return $path }
    return (Join-Path $PSScriptRoot $path)
}

function Default($cfg, $name, $value) {
    if ($null -eq $cfg.$name) { $cfg | Add-Member -Force NoteProperty $name $value }
}

function SecureText($text) {
    $secure = [Security.SecureString]::new()
    foreach ($character in ([string]$text).ToCharArray()) { $secure.AppendChar($character) }
    $secure.MakeReadOnly()
    return $secure
}

function GuestCredential($baseDir) {
    $path = Join-Path $baseDir "credentials.txt"
    if (-not (Test-Path -LiteralPath $path)) { throw "Credentials file '$path' was not found." }

    $content = Get-Content -LiteralPath $path
    $user = [regex]::Match(($content | Where-Object { $_ -match '^User:\s*' } | Select-Object -First 1), '^User:\s*(.+)$').Groups[1].Value
    $password = [regex]::Match(($content | Where-Object { $_ -match '^Password:\s*' } | Select-Object -First 1), '^Password:\s*(.+)$').Groups[1].Value
    if ([string]::IsNullOrWhiteSpace($user) -or [string]::IsNullOrWhiteSpace($password)) {
        throw "Credentials file '$path' does not contain User and Password lines."
    }

    return [pscredential]::new($user, (SecureText $password))
}

function GuestBootTime($vmName, $credential) {
    Invoke-Command -VMName $vmName -Credential $credential -ScriptBlock {
        (Get-CimInstance Win32_OperatingSystem).LastBootUpTime.ToUniversalTime().ToString("o")
    } -ErrorAction Stop
}

function WaitForGuest($vmName, $credential, $timeoutSeconds = 300) {
    $deadline = (Get-Date).AddSeconds($timeoutSeconds)
    while ((Get-Date) -lt $deadline) {
        try {
            GuestBootTime $vmName $credential | Out-Null
            return
        } catch {
            Start-Sleep -Seconds 5
        }
    }
    throw "VM '$vmName' did not answer over PowerShell Direct within $timeoutSeconds seconds."
}

function EnsureVmRunning($vmName, $credential) {
    $vm = Get-VM -Name $vmName -ErrorAction Stop
    switch ([string]$vm.State) {
        "Off" {
            Start-VM -Name $vmName | Out-Null
            Write-Host "Configured: VM started"
        }
        "Saved" {
            Start-VM -Name $vmName | Out-Null
            Write-Host "Configured: VM resumed"
        }
        "Paused" {
            Resume-VM -Name $vmName | Out-Null
            Write-Host "Configured: VM resumed"
        }
        "Running" {
            Write-Host "Already configured: VM running"
        }
        default {
            throw "VM '$vmName' is in unsupported state '$($vm.State)'."
        }
    }
    WaitForGuest $vmName $credential
}

function ConfigureGuest($vmName, $credential) {
    Invoke-Command -VMName $vmName -Credential $credential -ScriptBlock {
        $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
        $winStationsPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations"
        $listenerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
        if (-not (Test-Path -LiteralPath $policyPath)) { New-Item -Path $policyPath -Force | Out-Null }
        if (-not (Test-Path -LiteralPath $winStationsPath)) { throw "RDP WinStations registry path '$winStationsPath' was not found." }
        if (-not (Test-Path -LiteralPath $listenerPath)) { throw "RDP listener registry path '$listenerPath' was not found." }

        function ConvertFrom-HexString([string]$hex) {
            [byte[]]$bytes = for ($i = 0; $i -lt $hex.Length; $i += 2) {
                [Convert]::ToByte($hex.Substring($i, 2), 16)
            }
            return $bytes
        }

        $settings = @(
            [pscustomobject]@{ Path = $policyPath; Name = "fDisableCam"; Type = "DWord"; Value = 0; Label = "RDP audio playback policy" }
            [pscustomobject]@{ Path = $policyPath; Name = "fDisableAudioCapture"; Type = "DWord"; Value = 0; Label = "RDP microphone policy" }
            [pscustomobject]@{ Path = $policyPath; Name = "fDisableCameraRedir"; Type = "DWord"; Value = 0; Label = "RDP camera policy" }
            [pscustomobject]@{ Path = $listenerPath; Name = "fDisableCam"; Type = "DWord"; Value = 0; Label = "RDP audio playback listener" }
            [pscustomobject]@{ Path = $listenerPath; Name = "fDisableAudioCapture"; Type = "DWord"; Value = 0; Label = "RDP microphone listener" }
            [pscustomobject]@{ Path = $listenerPath; Name = "AudioEnumeratorDll"; Type = "String"; Value = "rdpendp.dll"; Label = "RDP audio endpoint enumerator" }
        )

        foreach ($setting in $settings) {
            $current = Get-ItemProperty -LiteralPath $setting.Path -Name $setting.Name -ErrorAction SilentlyContinue
            $changed = $null -eq $current -or [string]$current.$($setting.Name) -ne [string]$setting.Value
            if ($changed) {
                New-ItemProperty -Path $setting.Path -Name $setting.Name -PropertyType $setting.Type -Value $setting.Value -Force | Out-Null
            }
            [pscustomobject]@{ Label = $setting.Label; Changed = $changed; RestartRequired = $changed }
        }

        # Older bootstrap versions recreated WinStations with New-Item -Force and
        # removed these stock security descriptors. Without them, Audiosrv cannot
        # classify an RDP session and exposes no redirected playback or mic endpoint.
        $stockSecurityDescriptors = @(
            [pscustomobject]@{
                Name = "ConsoleSecurity"
                Label = "RDP console security descriptor"
                Hex = "010014809C000000A800000000000000140000000200880006000000000014000100000001010000000000050400000000001400BF030F000101000000000005120000000000140089000F00010100000000000513000000000014008100000001010000000000051400000000001800BF030F000102000000000005200000002002000000001800210100000102000000000005200000002B020000010100000000000512000000010100000000000512000000"
            }
            [pscustomobject]@{
                Name = "DefaultSecurity"
                Label = "RDP default security descriptor"
                Hex = "01001480B8000000C4000000140000003000000002001C000100000002801400210100000101000000000001000000000200880006000000000014000100000001010000000000050400000000001400BF030F000101000000000005120000000000140089000F00010100000000000513000000000014008100000001010000000000051400000000001800BF030F000102000000000005200000002002000000001800210100000102000000000005200000002B020000010100000000000512000000010100000000000512000000"
            }
        )

        foreach ($descriptor in $stockSecurityDescriptors) {
            $winStationsProperties = Get-ItemProperty -LiteralPath $winStationsPath
            $currentProperty = $winStationsProperties.PSObject.Properties[$descriptor.Name]
            $current = if ($null -ne $currentProperty) { $currentProperty.Value } else { $null }
            $changed = $null -eq $current -or $current.Length -eq 0
            if ($changed) {
                New-ItemProperty -Path $winStationsPath -Name $descriptor.Name -PropertyType Binary -Value (ConvertFrom-HexString $descriptor.Hex) -Force | Out-Null
            }
            [pscustomobject]@{ Label = $descriptor.Label; Changed = $changed; RestartRequired = $changed }
        }

        foreach ($serviceName in @("AudioEndpointBuilder", "Audiosrv")) {
            $service = Get-Service -Name $serviceName -ErrorAction Stop
            $changed = $service.Status -ne "Running"
            if ($changed) { Start-Service -Name $serviceName }
            [pscustomobject]@{ Label = "Guest service $serviceName"; Changed = $changed; RestartRequired = $false }
        }
    }
}

function RestartGuest($vmName, $credential, $bootTimeBefore, $timeoutSeconds = 600) {
    Write-Host "Configured: restarting VM to apply RDP policy"
    try {
        Invoke-Command -VMName $vmName -Credential $credential -ScriptBlock { Restart-Computer -Force } -ErrorAction Stop | Out-Null
    } catch {
    }

    $deadline = (Get-Date).AddSeconds($timeoutSeconds)
    $restartDeadline = (Get-Date).AddSeconds(30)
    $unavailable = $false
    while ((Get-Date) -lt $deadline) {
        Start-Sleep -Seconds 5
        try {
            $bootTimeAfter = [string](GuestBootTime $vmName $credential)
            if ($bootTimeAfter -ne $bootTimeBefore) { return }
            if (-not $unavailable -and (Get-Date) -ge $restartDeadline) {
                throw "VM '$vmName' did not begin restarting within 30 seconds."
            }
        } catch {
            if ($_.Exception.Message -like "VM '$vmName' did not begin restarting*") { throw }
            $unavailable = $true
        }
    }
    throw "VM '$vmName' did not complete a verified restart within $timeoutSeconds seconds."
}

AssertKnownArguments

$configPath = ArgValue "config"
if ([string]::IsNullOrWhiteSpace($configPath)) {
    throw "Usage: .\enable-av-redirection.ps1 --config config\windows.json"
}
$configPath = FullPath $configPath
$cfg = Get-Content -Raw -LiteralPath $configPath | ConvertFrom-Json
@{
    vmName = "WorkstationW11"
    baseDir = "~/VMs/WorkstationW11"
}.GetEnumerator() | ForEach-Object { Default $cfg $_.Key $_.Value }
if ($null -eq $cfg.avRedirection -or -not [bool]$cfg.avRedirection.enabled) {
    throw "Set avRedirection.enabled to true in '$configPath' before running this helper."
}

$credential = GuestCredential (FullPath $cfg.baseDir)
EnsureVmRunning $cfg.vmName $credential
$bootTimeBefore = [string](GuestBootTime $cfg.vmName $credential)
$results = @(ConfigureGuest $cfg.vmName $credential)

foreach ($result in $results) {
    $prefix = if ([bool]$result.Changed) { "Configured" } else { "Already configured" }
    Write-Host "${prefix}: $($result.Label)"
}

if (@($results | Where-Object { [bool]$_.RestartRequired }).Count -gt 0) {
    RestartGuest $cfg.vmName $credential $bootTimeBefore
    WaitForGuest $cfg.vmName $credential
} else {
    Write-Host "Already configured: guest restart not required"
}

$writer = Join-Path $PSScriptRoot "write-rdp-file.ps1"
& $writer --config $configPath
Write-Host "RDP audio, microphone and all cameras are ready for VM '$($cfg.vmName)'."