ProHoster > Ibhulogi > Ulawulo > Ukunikezela ngolawulo lweeseshoni zeRDP

Ukunikezela ngolawulo lweeseshoni zeRDP

Ukunikezela ngolawulo lweeseshoni zeRDP
Kwintlangano apho ndisebenza khona, umsebenzi okude unqatshelwe ngokomgaqo. Kwakunjalo. Kude kube kwiveki ephelileyo. Ngoku kwafuneka siphumeze isisombululo ngokukhawuleza. Ukusuka kwishishini - ukulungelelanisa iinkqubo kwifomati entsha yomsebenzi, ukusuka kuthi - i-PKI eneekhowudi ze-PIN kunye namathokheni, i-VPN, ukugawulwa kweenkcukacha kunye nokunye okuninzi.
Phakathi kwezinye izinto, bendiseta i-Remote Desktop Infrastructure aka Iinkonzo zetheminali. Sine-RDS ezininzi zokusasazwa kumaziko ahlukeneyo edatha. Enye yeenjongo yayikukuvumela oogxa bamasebe e-IT anxulumeneyo ukuba baqhagamshelane neeseshini zabasebenzisi ngokunxibelelana. Njengoko usazi, kukho umgangatho we-RDS Shadow mechanism yale nto, kwaye eyona ndlela ilula yokuyinikezela kukunika amalungelo omlawuli wasekhaya kwiiseva ze-RDS.
Ndiyabahlonipha kwaye ndiyabaxabisa abantu endisebenza nabo, kodwa ndiyabawela kakhulu xa kuziwa ekugqithiseni amalungelo olawulo. 🙂 Kwabo bavumelana nam, nceda ulandele ukusikwa.

Ewe, umsebenzi ucacile, ngoku makhe sehle siye kwishishini.

Isinyathelo 1

Masenze iqela lokhuseleko kwi-Active Directory RDP_Operators kwaye ibandakanye kuyo ii-akhawunti zabo basebenzisi esifuna ukunika amalungelo kubo:

$Users = @(
    "UserLogin1",
    "UserLogin2",
    "UserLogin3"
)
$Group = "RDP_Operators"
New-ADGroup -Name $Group -GroupCategory Security -GroupScope DomainLocal
Add-ADGroupMember -Identity $Group -Members $Users

Ukuba uneendawo ezininzi ze-AD, kuya kufuneka ulinde de iphinde iphindwe kubo bonke abalawuli besizinda ngaphambi kokuba udlulele kwinyathelo elilandelayo. Oku kudla ngokuthatha imizuzu engaphezu kwe-15.

Isinyathelo 2

Masinike iqela amalungelo okulawula iiseshini zesiphelo kwiseva nganye ye-RDSH:

Misela-RDSPermissions.ps1

$Group = "RDP_Operators"
$Servers = @(
    "RDSHost01",
    "RDSHost02",
    "RDSHost03"
)
ForEach ($Server in $Servers) {
    #Делегируем право на теневые сессии
    $WMIHandles = Get-WmiObject `
        -Class "Win32_TSPermissionsSetting" `
        -Namespace "rootCIMV2terminalservices" `
        -ComputerName $Server `
        -Authentication PacketPrivacy `
        -Impersonation Impersonate
    ForEach($WMIHandle in $WMIHandles)
    {
        If ($WMIHandle.TerminalName -eq "RDP-Tcp")
        {
        $retVal = $WMIHandle.AddAccount($Group, 2)
        $opstatus = "успешно"
        If ($retVal.ReturnValue -ne 0) {
            $opstatus = "ошибка"
        }
        Write-Host ("Делегирование прав на теневое подключение группе " +
            $Group + " на сервере " + $Server + ": " + $opstatus + "`r`n")
        }
    }
}

Isinyathelo 3

Yongeza iqela kwiqela lendawo Abasebenzisi beDesktop ekude kwiseva nganye ye-RDSH. Ukuba iiseva zakho zidityanisiwe zibe yingqokelela yeseshoni, ngoko sikwenza oku kwinqanaba lokuqokelela:

$Group = "RDP_Operators"
$CollectionName = "MyRDSCollection"
[String[]]$CurrentCollectionGroups = @(Get-RDSessionCollectionConfiguration -CollectionName $CollectionName -UserGroup).UserGroup
Set-RDSessionCollectionConfiguration -CollectionName $CollectionName -UserGroup ($CurrentCollectionGroups + $Group)

Kumncedisi omnye sisebenzisa umgaqo-nkqubo weqela, ilindele ukuba isetyenziswe kumncedisi. Abo banqenayo ukulinda banokukhawulezisa inkqubo usebenzisa i-gpupdate endala, ngokufanelekileyo embindini.

Isinyathelo 4

Masilungiselele le script ilandelayo yePS "yabaphathi":

RDSMUlawulo.ps1

$Servers = @(
    "RDSHost01",
    "RDSHost02",
    "RDSHost03"
)

function Invoke-RDPSessionLogoff {
    Param(
        [parameter(Mandatory=$True, Position=0)][String]$ComputerName,
        [parameter(Mandatory=$true, Position=1)][String]$SessionID
    )
    $ErrorActionPreference = "Stop"
    logoff $SessionID /server:$ComputerName /v 2>&1
}

function Invoke-RDPShadowSession {
    Param(
        [parameter(Mandatory=$True, Position=0)][String]$ComputerName,
        [parameter(Mandatory=$true, Position=1)][String]$SessionID
    )
    $ErrorActionPreference = "Stop"
    mstsc /shadow:$SessionID /v:$ComputerName /control 2>&1
}

Function Get-LoggedOnUser {
    Param(
        [parameter(Mandatory=$True, Position=0)][String]$ComputerName="localhost"
    )
    $ErrorActionPreference = "Stop"
    Test-Connection $ComputerName -Count 1 | Out-Null
    quser /server:$ComputerName 2>&1 | Select-Object -Skip 1 | ForEach-Object {
        $CurrentLine = $_.Trim() -Replace "s+"," " -Split "s"
        $HashProps = @{
            UserName = $CurrentLine[0]
            ComputerName = $ComputerName
        }
        If ($CurrentLine[2] -eq "Disc") {
            $HashProps.SessionName = $null
            $HashProps.Id = $CurrentLine[1]
            $HashProps.State = $CurrentLine[2]
            $HashProps.IdleTime = $CurrentLine[3]
            $HashProps.LogonTime = $CurrentLine[4..6] -join " "
            $HashProps.LogonTime = $CurrentLine[4..($CurrentLine.GetUpperBound(0))] -join " "
        }
        else {
            $HashProps.SessionName = $CurrentLine[1]
            $HashProps.Id = $CurrentLine[2]
            $HashProps.State = $CurrentLine[3]
            $HashProps.IdleTime = $CurrentLine[4]
            $HashProps.LogonTime = $CurrentLine[5..($CurrentLine.GetUpperBound(0))] -join " "
        }
        New-Object -TypeName PSCustomObject -Property $HashProps |
        Select-Object -Property UserName, ComputerName, SessionName, Id, State, IdleTime, LogonTime
    }
}

$UserLogin = Read-Host -Prompt "Введите логин пользователя"
Write-Host "Поиск RDP-сессий пользователя на серверах..."
$SessionList = @()
ForEach ($Server in $Servers) {
    $TargetSession = $null
    Write-Host "  Опрос сервера $Server"
    Try {
        $TargetSession = Get-LoggedOnUser -ComputerName $Server | Where-Object {$_.UserName -eq $UserLogin}
    }
    Catch {
        Write-Host "Ошибка: " $Error[0].Exception.Message -ForegroundColor Red
        Continue
    }
    If ($TargetSession) {
        Write-Host "    Найдена сессия с ID $($TargetSession.ID) на сервере $Server" -ForegroundColor Yellow
        Write-Host "    Что будем делать?"
        Write-Host "      1 - подключиться к сессии"
        Write-Host "      2 - завершить сессию"
        Write-Host "      0 - ничего"
        $Action = Read-Host -Prompt "Введите действие"
        If ($Action -eq "1") {
            Invoke-RDPShadowSession -ComputerName $Server -SessionID $TargetSession.ID
        }
        ElseIf ($Action -eq "2") {
            Invoke-RDPSessionLogoff -ComputerName $Server -SessionID $TargetSession.ID
        }
        Break
    }
    Else {
        Write-Host "    сессий не найдено"
    }
}

Ukwenza iskripthi se-PS silungele ukusebenza, siya kudala iqokobhe layo ngendlela yefayile ye-cmd enegama elifanayo neskripthi sePS:

RDSMUlawulo.cmd

@ECHO OFF
powershell -NoLogo -ExecutionPolicy Bypass -File "%~d0%~p0%~n0.ps1" %*

Sibeka zombini iifayile kwifolda eya kufikeleleka "kubaphathi" kwaye sibacele ukuba bangene kwakhona. Ngoku, ngokusebenzisa ifayile ye-cmd, baya kukwazi ukudibanisa kwiiseshoni zabanye abasebenzisi kwimodi ye-RDS Shadow kwaye banyanzelise ukuba baphume (oku kunokuba luncedo xa umsebenzisi engakwazi ukuphelisa ngokuzimeleyo iseshoni "yokuxhoma").

Ijongeka ngolu hlobo:

Ngo "umphathi"Ukunikezela ngolawulo lweeseshoni zeRDP

EyomsebenzisiUkunikezela ngolawulo lweeseshoni zeRDP

Amagqabantshintshi ambalwa okugqibela

Inkcazo 1. Ukuba iseshoni yomsebenzisi esizama ukufumana ulawulo kuyo yaziswa phambi kokuba i-Set-RDSPermissions.ps1 script isetyenziswe kwiseva, ngoko "umphathi" uya kufumana impazamo yofikelelo. Isisombululo apha sicacile: linda de umsebenzisi olawulwayo angene.

Inkcazo 2. Emva kweentsuku ezininzi zokusebenza kunye ne-RDP Shadow, siye sabona i-bug enomdla okanye into enomdla: emva kokuphela kweseshoni yesithunzi, ibha yolwimi kwi-tray iyanyamalala ukuze umsebenzisi aqhagamshelwe kuyo, kwaye ukuyibuyisela, umsebenzisi kufuneka aphinde ayibuyisele. -Ngema. Njengoko kuvela, asithi sodwa: maxesha, два, ezintathu.

Kuko konke. Ndikunqwenelela impilo entle kunye nabancedisi bakho. Njengesiqhelo, ndijonge phambili kwingxelo yakho kwizimvo kwaye ndikucela ukuba uthathe uphando olufutshane olungezantsi.

Imithombo

Ngabasebenzisi ababhalisiweyo kuphela abanokuthatha inxaxheba kuphando. Ngena, ndiyacela.

Usebenzisa ntoni?

  • 8,1%AMMYY Admin5

  • 17,7%Nayiphi na iDesk11

  • 9,7%DameWare6

  • 24,2%Radmin15

  • 14,5%I-RDS Shadow9

  • 1,6%Uncedo oluKhawulezayo / Uncedo lweWindows olukude1

  • 38,7%TeamViewer24

  • 32,3%VNC20

  • 32,3%ezinye20

  • 3,2%LiteManager2

62 abasebenzisi bavoti. Abasebenzisi aba-22 abakhange.

umthombo: www.habr.com

Yongeza izimvo