Authyo RDP Guard — Windows Install Guide

dotnet --list-runtimes

Microsoft.WindowsDesktop.App 8.0.27 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

winget install Microsoft.DotNet.DesktopRuntime.8 `
    --accept-source-agreements --accept-package-agreements

$pw = Read-Host -AsSecureString 'Password for rescue admin (write it down!)'
New-LocalUser -Name 'gk-rescue' -Password $pw `
              -PasswordNeverExpires `
              -Description 'Authyo RDP Guard emergency rescue admin'
Add-LocalGroupMember -Group 'Administrators' -Member 'gk-rescue'

# DNS resolution
Resolve-DnsName app.authyo.io

# HTTPS reachability
$r = Invoke-WebRequest 'https://app.authyo.io/' -UseBasicParsing -TimeoutSec 5
"HTTP status: $($r.StatusCode)"   # expect 200 (or 404 — both prove reachability)

(Get-CimInstance -Class Win32_TSGeneralSetting `
    -Namespace root\cimv2\TerminalServices `
    -Filter "TerminalName='RDP-tcp'").UserAuthenticationRequired
# 1 = NLA on  (bypasses Authyo)
# 0 = NLA off (Authyo tile fires)

(Get-WmiObject -class Win32_TSGeneralSetting `
    -Namespace root\cimv2\TerminalServices `
    -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)

Get-NetFirewallRule -DisplayGroup 'Remote Desktop' |
    Select DisplayName, Enabled, Profile

# 1. Add the firewall rule for the new port FIRST
New-NetFirewallRule -DisplayName 'RDP (custom port 33899)' `
    -Direction Inbound -Protocol TCP -LocalPort 33899 -Action Allow

# 2. THEN change the port
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
    -Name PortNumber -Value 33899

# 3. Test from a SECOND mstsc window BEFORE restarting TermService
mstsc /v:server-ip:33899

# 4. Once the new port works, restart the service
Restart-Service -Name TermService -Force

Install-WindowsFeature Windows-Server-Backup -IncludeManagementTools
# Then Server Manager → Tools → Windows Server Backup → Backup Once → System State

# ============================================================
# Authyo RDP Guard — pre-install self-check
# Paste this whole block into an elevated PowerShell window.
# ============================================================

$results = New-Object System.Collections.ArrayList
function Test-Item {
    param([string]$Name, [scriptblock]$Check)
    try {
        $ok, $detail = & $Check
        $results.Add([PSCustomObject]@{
            Item   = $Name
            Status = if ($ok) { 'PASS' } else { 'FAIL' }
            Detail = $detail
        }) | Out-Null
    } catch {
        $results.Add([PSCustomObject]@{
            Item = $Name; Status = 'FAIL'; Detail = "ERROR: $_"
        }) | Out-Null
    }
}

# 1. OS & arch
Test-Item 'Supported Windows version' {
    $caption = (Get-CimInstance Win32_OperatingSystem).Caption
    $build   = [int](Get-CimInstance Win32_OperatingSystem).BuildNumber
    @($build -ge 17763), "$caption (build $build)"
}
Test-Item '64-bit OS' {
    @([Environment]::Is64BitOperatingSystem),
        "x64: $([Environment]::Is64BitOperatingSystem)"
}
Test-Item 'Administrator rights' {
    $id = [Security.Principal.WindowsIdentity]::GetCurrent()
    $isAdmin = (New-Object Security.Principal.WindowsPrincipal($id)).IsInRole(
        [Security.Principal.WindowsBuiltInRole]::Administrator)
    @($isAdmin), "Elevated: $isAdmin"
}
Test-Item 'Free disk > 50 MB on C:' {
    $free = (Get-PSDrive C).Free / 1MB
    @($free -gt 50), "$([math]::Round($free, 0)) MB free"
}

# 2. .NET 8 Desktop Runtime
Test-Item '.NET 8 Desktop Runtime' {
    $runtimes = (& dotnet --list-runtimes 2>$null) -join "`n"
    $has = $runtimes -match 'Microsoft\.WindowsDesktop\.App\s+8\.'
    @($has), $(if ($has) { 'WindowsDesktop.App 8.x present' } else { 'MISSING - install from https://dotnet.microsoft.com/download/dotnet/8.0' })
}

# 3. Rescue admin
Test-Item 'At least 2 local administrators' {
    $adminCount = (Get-LocalGroupMember Administrators |
                   Where-Object { $_.PrincipalSource -eq 'Local' }).Count
    @($adminCount -ge 2), "$adminCount local admin(s) - recommend gk-rescue as a 2nd account"
}

# 4. Network reachability
Test-Item 'DNS resolves app.authyo.io' {
    try {
        $null = Resolve-DnsName app.authyo.io -ErrorAction Stop
        @($true), 'OK'
    } catch { @($false), "DNS failure: $_" }
}
Test-Item 'HTTPS reachable to app.authyo.io' {
    try {
        $r = Invoke-WebRequest 'https://app.authyo.io/' `
                -UseBasicParsing -TimeoutSec 5 -ErrorAction Stop
        @($true), "HTTP $($r.StatusCode)"
    } catch {
        if ($_.Exception.Response) {
            @($true), "HTTP $([int]$_.Exception.Response.StatusCode) (reachable)"
        } else {
            @($false), "Unreachable: $($_.Exception.Message)"
        }
    }
}

# 5. RDP / NLA
Test-Item 'NLA disabled for RDP (required for MFA gate)' {
    $nla = (Get-CimInstance -Class Win32_TSGeneralSetting `
        -Namespace root\cimv2\TerminalServices `
        -Filter "TerminalName='RDP-tcp'").UserAuthenticationRequired
    $msg = if ($nla -eq 0) {
        'NLA off - Authyo tile will fire on RDP'
    } else {
        "NLA ON - RDP will BYPASS Authyo OTP gate. Disable with: (Get-WmiObject Win32_TSGeneralSetting -Namespace root\cimv2\TerminalServices -Filter `"TerminalName='RDP-tcp'`").SetUserAuthenticationRequired(0)"
    }
    @($nla -eq 0), $msg
}
Test-Item 'Remote Desktop service running' {
    $svc = Get-Service TermService -ErrorAction SilentlyContinue
    @($svc -and $svc.Status -eq 'Running'),
        $(if ($svc) { $svc.Status } else { 'Service missing' })
}

# Summary
Write-Host ''
Write-Host '=== Authyo RDP Guard pre-install self-check ===' -ForegroundColor Cyan
$results | Format-Table Item, Status, Detail -AutoSize -Wrap

$failed = ($results | Where-Object Status -eq 'FAIL').Count
if ($failed -eq 0) {
    Write-Host "ALL CHECKS PASSED - safe to install the MSI." -ForegroundColor Green
} else {
    Write-Host "$failed CHECK(S) FAILED - fix above before installing." -ForegroundColor Red
}

Get-Content 'C:\ProgramData\Authyo\Gatekeeper\logs\gatekeeper.log' -Tail 10

INFO   user=naveen ip=console GATE_START
INFO   user=naveen ip=console SENDOTP_OK contact='Primary' via=Email to=nav***com maskId=...
INFO   user=naveen ip=console JWT_VERIFIED
INFO   user=naveen ip=console GATE_PASS

(Get-WmiObject -class Win32_TSGeneralSetting `
    -Namespace root\cimv2\TerminalServices `
    -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)

mstsc /v:your-server.example.com

# Confirm the config exists and is readable
Get-Content 'C:\ProgramData\Authyo\Gatekeeper\config.json'

# Confirm the Credential Provider is registered
$clsid = '{B251F0AF-6D20-4C4D-90ED-4ADE0D8256D7}'
Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\$clsid"

Compress-Archive `
    -Path 'C:\ProgramData\Authyo\Gatekeeper\logs',
          'C:\ProgramData\Authyo\Gatekeeper\config.json' `
    -DestinationPath "C:\authyo-diagnostics-$(Get-Date -Format yyyyMMdd-HHmmss).zip"

$app = Get-WmiObject Win32_Product -Filter "Name='Authyo RDP Guard'"
$app.Uninstall()

Remove-Item 'C:\ProgramData\Authyo' -Recurse -Force

(Get-WmiObject -class Win32_TSGeneralSetting `
    -Namespace root\cimv2\TerminalServices `
    -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(1)