feat(windows): ship templates with RDP enabled - #33
Open
gabbelitoV2 wants to merge 1 commit into
Open
Conversation
Windows Server ships with RDP off and nothing in the build changed that, so a clone's only first contact was the noVNC console. That path breaks in practice: the console types against the guest's en-US layout, so a --cipassword containing symbols typed on a non-US client keyboard arrives as different characters. Observed live 2026-08-18 on a 2025 clone: '=' typed on a Swedish layout never matched, the Security log filled with 0xC000006A (wrong password), while the very same string passed an in-guest LogonUser type 2. Convoy provisions clones with only --cipassword, so RDP is the expected first door in. Finalize.ps1 sets fDenyTSConnections=0 and enables the inbox Remote Desktop firewall group in the post-generalize block -- the same slot as the WU-policy restore, for the same reason: registry writes after /quit land in the sealed image, and the Remote Desktop rules are disjoint from the WinRM rules the teardown removes, so packer's session survives. The group is matched by its locale-independent id (@FirewallAPI.dll,-28752), not the DisplayGroup string. NLA stays at its Server default (required), so nothing is reachable pre-auth. The tradeoff is deliberate and documented: every clone exposes 3389 on whatever network it lands on, including public ones, guarded by NLA plus the strength of --cipassword. The new rdp-enabled verify check asserts enabled + listening on 3389 + NLA on for every clone, so a regression in either direction fails verify by name. Verified live on a 2025 clone (runtime enablement: listener up instantly, external connect to 3389 OK); untested on a full build as of 2026-08-19 -- recorded as such in docs/windows.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows Server ships with RDP off and nothing in the build changed that, so a clone's only first contact was the noVNC console. That path breaks in practice: the console types against the guest's en-US layout, so a --cipassword containing symbols typed on a non-US client keyboard arrives as different characters. Observed live 2026-08-18 on a 2025 clone: '=' typed on a Swedish layout never matched, the Security log filled with 0xC000006A (wrong password), while the very same string passed an in-guest LogonUser type 2. Convoy provisions clones with only --cipassword, so RDP is the expected first door in.
Finalize.ps1 sets fDenyTSConnections=0 and enables the inbox Remote Desktop firewall group in the post-generalize block -- the same slot as the WU-policy restore, for the same reason: registry writes after /quit land in the sealed image, and the Remote Desktop rules are disjoint from the WinRM rules the teardown removes, so packer's session survives. The group is matched by its locale-independent id (@FirewallAPI.dll,-28752), not the DisplayGroup string. NLA stays at its Server default (required), so nothing is reachable pre-auth.
The tradeoff is deliberate and documented: every clone exposes 3389 on whatever network it lands on, including public ones, guarded by NLA plus the strength of --cipassword. The new rdp-enabled verify check asserts enabled + listening on 3389 + NLA on for every clone, so a regression in either direction fails verify by name.
Verified live on a 2025 clone (runtime enablement: listener up instantly, external connect to 3389 OK); untested on a full build as of 2026-08-19 -- recorded as such in docs/windows.md.