@echo off
title LocalVhost - Correction certificat RDP-TLS (Windows 7)
setlocal

REM ============================================================
REM  LocalVhost - Corrige le certificat RDP-TLS d'un hote Windows
REM  Remplace le certificat RDP signe en SHA-1 par un SHA-256 et
REM  le lie a l'ecouteur RDP-Tcp. A lancer SUR le poste Windows.
REM  Le certificat et sa cle privee sont generes LOCALEMENT et ne
REM  quittent jamais la machine. Inspectez ce script avant usage.
REM ============================================================

REM --- Auto-elevation en administrateur ---
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo Demande des privileges administrateur...
    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
    exit /b
)

echo.
echo === 1/2  Generation du certificat SHA-256 (RSA 2048) ===
set "INF=%TEMP%\lvh_rdpcert.inf"
set "CER=%TEMP%\lvh_rdpcert.cer"
> "%INF%" echo [Version]
>> "%INF%" echo Signature="$Windows NT$"
>> "%INF%" echo.
>> "%INF%" echo [NewRequest]
>> "%INF%" echo Subject = "CN=%COMPUTERNAME%"
>> "%INF%" echo KeyLength = 2048
>> "%INF%" echo KeySpec = 1
>> "%INF%" echo KeyUsage = 0xA0
>> "%INF%" echo MachineKeySet = True
>> "%INF%" echo ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
>> "%INF%" echo ProviderType = 12
>> "%INF%" echo RequestType = Cert
>> "%INF%" echo HashAlgorithm = SHA256
>> "%INF%" echo ValidityPeriod = Years
>> "%INF%" echo ValidityPeriodUnits = 3
>> "%INF%" echo.
>> "%INF%" echo [EnhancedKeyUsageExtension]
>> "%INF%" echo OID = 1.3.6.1.5.5.7.3.1
certreq -new "%INF%" "%CER%"
if %errorlevel% neq 0 (
    echo.
    echo ECHEC de la generation du certificat ^(certreq^).
    del "%INF%" "%CER%" >nul 2>&1
    pause
    exit /b 1
)

echo.
echo === 2/2  Liaison a RDP-Tcp + permission de la cle + redemarrage ===
powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $name='CN='+$env:COMPUTERNAME; $c=@(Get-ChildItem Cert:\LocalMachine\My | ? { $_.Subject -eq $name -and $_.SignatureAlgorithm.FriendlyName -like 'sha256*' } | Sort-Object NotAfter -Descending)[0]; if(-not $c){ Write-Host 'ERREUR: certificat SHA-256 introuvable'; exit 1 }; $p=(Get-WmiObject -Namespace root\cimv2\terminalservices -Class Win32_TSGeneralSetting | ? { $_.TerminalName -eq 'RDP-Tcp' }).__path; Set-WmiInstance -Path $p -Argument @{ SSLCertificateSHA1Hash=$c.Thumbprint } | Out-Null; try { $fn=$c.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName; $kf=Join-Path $env:ProgramData ('Microsoft\Crypto\RSA\MachineKeys\'+$fn); icacls $kf /grant '*S-1-5-20:(R)' | Out-Null } catch { Write-Host 'ACL a definir a la main: mmc Certificats > Personnel > le cert > Gerer les cles privees > SERVICE RESEAU > Lecture' }; Restart-Service TermService -Force; Write-Host ('SUCCES - certificat RDP lie: '+$c.Thumbprint); Write-Host ('Signature: '+$c.SignatureAlgorithm.FriendlyName) "
set PSRESULT=%errorlevel%

del "%INF%" "%CER%" >nul 2>&1
echo.
if "%PSRESULT%"=="0" (
    echo Termine. Le certificat RDP est desormais en SHA-256.
    echo Reconnectez-vous avec Remmina ou mstsc ^(niveau de securite par defaut^).
) else (
    echo Une etape a echoue. Relancez en administrateur ou voir les messages ci-dessus.
)
echo.
pause
endlocal