Intune Detection & Remediation script pair for enforcing RDP Short path configuration on session hosts running Azure Virtual Desktop

# ==========================================
# AVD RDP Shortpath Detection - Enterprise
# ==========================================

$BasePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
$LogPath  = "C:\ProgramData\AVD-Shortpath"
$LogFile  = "$LogPath\Detection.log"

# Ensure log directory exists
if (!(Test-Path $LogPath)) {
    New-Item -Path $LogPath -ItemType Directory -Force | Out-Null
}

Start-Transcript -Path $LogFile -Append -Force

Write-Output "===== AVD Shortpath Detection Started ====="
Write-Output "Timestamp: $(Get-Date)"
Write-Output "Computer: $env:COMPUTERNAME"

$ExpectedSettings = @{
    "fClientDisableUDP"             = 0
    "AVDManagedPrivateUDP"          = 1
    "AVDManagedPrivateUDPWithICE"   = 1
    "AVDPublicUDP"                  = 1
    "AVDRelayUDP"                   = 1
}

$NonCompliant = $false
$Report = @()

foreach ($Setting in $ExpectedSettings.Keys) {
    try {
        $CurrentValue = (Get-ItemProperty -Path $BasePath -Name $Setting -ErrorAction Stop).$Setting
        if ($CurrentValue -ne $ExpectedSettings[$Setting]) {
            $NonCompliant = $true
            $Report += "$Setting Expected: $($ExpectedSettings[$Setting]) Found: $CurrentValue"
        }
        else {
            $Report += "$Setting Compliant"
        }
    }
    catch {
        $NonCompliant = $true
        $Report += "$Setting Missing"
    }
}

# Firewall validation
$FirewallRule = Get-NetFirewallRule -DisplayName "AVD RDP Shortpath UDP" -ErrorAction SilentlyContinue
if (-not $FirewallRule) {
    $NonCompliant = $true
    $Report += "Firewall rule missing"
}
else {
    $Report += "Firewall rule present"
}

# Output results for Intune reporting
$Report | ForEach-Object { Write-Output $_ }

if ($NonCompliant) {
    Write-Output "Overall Status: NON-COMPLIANT"
    Stop-Transcript
    exit 1
}
else {
    Write-Output "Overall Status: COMPLIANT"
    Stop-Transcript
    exit 0
}

# ==========================================
# AVD RDP Shortpath Remediation - Enterprise
# ==========================================

$BasePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
$LogPath  = "C:\ProgramData\AVD-Shortpath"
$LogFile  = "$LogPath\Remediation.log"
$EventSource = "AVD-Shortpath-Remediation"

if (!(Test-Path $LogPath)) {
    New-Item -Path $LogPath -ItemType Directory -Force | Out-Null
}

Start-Transcript -Path $LogFile -Append -Force

Write-Output "===== AVD Shortpath Remediation Started ====="
Write-Output "Timestamp: $(Get-Date)"
Write-Output "Computer: $env:COMPUTERNAME"

# Create registry path if missing
if (!(Test-Path $BasePath)) {
    New-Item -Path $BasePath -Force | Out-Null
    Write-Output "Created registry base path."
}

# Apply configuration
$SettingsToApply = @{
    "fClientDisableUDP"             = 0
    "AVDManagedPrivateUDP"          = 1
    "AVDManagedPrivateUDPWithICE"   = 1
    "AVDPublicUDP"                  = 1
    "AVDRelayUDP"                   = 1
}

foreach ($Setting in $SettingsToApply.Keys) {
    New-ItemProperty -Path $BasePath -Name $Setting -Value $SettingsToApply[$Setting] -PropertyType DWord -Force | Out-Null
    Write-Output "Set $Setting to $($SettingsToApply[$Setting])"
}

# Ensure firewall rule
if (-not (Get-NetFirewallRule -DisplayName "AVD RDP Shortpath UDP" -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule `
        -DisplayName "AVD RDP Shortpath UDP" `
        -Direction Inbound `
        -Protocol UDP `
        -LocalPort 3390 `
        -Action Allow `
        -Profile Any
    Write-Output "Created firewall rule."
}
else {
    Write-Output "Firewall rule already exists."
}

# Restart Remote Desktop Service
Restart-Service TermService -Force
Write-Output "Restarted Remote Desktop Services."

# Write to Event Log
if (-not [System.Diagnostics.EventLog]::SourceExists($EventSource)) {
    New-EventLog -LogName Application -Source $EventSource
}

Write-EventLog `
    -LogName Application `
    -Source $EventSource `
    -EntryType Information `
    -EventId 1001 `
    -Message "RDP Shortpath remediation executed successfully."

Write-Output "Remediation completed successfully."

Stop-Transcript
exit 0