2. \u6ce8\u518c\u8868\u4f18\u5316<\/h3>\n

\u5b9e\u65bd\u8fd9\u4e9b\u5173\u952e\u7684\u6ce8\u518c\u8868\u4fee\u6539\uff1a<\/p>\n

\r\nWindows Registry Editor Version 5.00\r\n\r\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp]\r\n\"SecurityLayer\"=dword:00000002\r\n\"MinEncryptionLevel\"=dword:00000003\r\n\"UserAuthentication\"=dword:00000001\r\n\"MaxConnectionTime\"=dword:00015180\r\n\"MaxDisconnectionTime\"=dword:00015180\r\n\"MaxIdleTime\"=dword:00015180\r\n\r\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System]\r\n\"CredSSP\"=dword:00000000\r\n\"EnableLUA\"=dword:00000001\r\n\r\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]\r\n\"fDenyTSConnections\"=dword:00000000\r\n\"fSingleSessionPerUser\"=dword:00000000\r\n<\/code><\/pre>\n
\u4f01\u4e1a\u7ea7\u5b9e\u65bd\u7b56\u7565<\/strong><\/h2>\n
\u5bf9\u4e8e\u7ba1\u7406\u591a\u4e2a\u670d\u52a1\u5668\u548c\u8fdc\u7a0b\u8fde\u63a5\u7684\u7ec4\u7ec7\uff0c\u5b9e\u65bd\u7cfb\u7edf\u5316\u7684RDP\u7ba1\u7406\u65b9\u6cd5\u81f3\u5173\u91cd\u8981\u3002\u8003\u8651\u4ee5\u4e0b\u4f01\u4e1a\u7ea7\u89e3\u51b3\u65b9\u6848\uff1a<\/p>\n
1. \u8d1f\u8f7d\u5747\u8861\u914d\u7f6e<\/h3>\n
\u5b9e\u65bdRDP\u8d1f\u8f7d\u5747\u8861\u4ee5\u6709\u6548\u5206\u914d\u8fde\u63a5\u8bf7\u6c42\uff1a<\/p>\n
\r\n# PowerShell\u8d1f\u8f7d\u5747\u8861\u5668\u914d\u7f6e\r\nInstall-WindowsFeature Remote-Desktop-Services\r\nInstall-WindowsFeature RDS-Connection-Broker\r\nInstall-WindowsFeature RDS-RD-Server\r\n\r\n# \u90e8\u7f72RD\u4f1a\u8bdd\u4e3b\u673a\u573a\r\nNew-RDSessionDeployment -ConnectionBroker \"broker.domain.com\" `\r\n    -SessionHost \"host1.domain.com\",\"host2.domain.com\" `\r\n    -WebAccessServer \"web.domain.com\"\r\n\r\n# \u914d\u7f6e\u4f1a\u8bdd\u96c6\u5408\r\nNew-RDSessionCollection -CollectionName \"\u4f01\u4e1a\u4f1a\u8bdd\" `\r\n    -SessionHost \"host1.domain.com\",\"host2.domain.com\" `\r\n    -ConnectionBroker \"broker.domain.com\"\r\n\r\n# \u8bbe\u7f6e\u96c6\u5408\u5c5e\u6027\r\nSet-RDSessionCollectionConfiguration -CollectionName \"\u4f01\u4e1a\u4f1a\u8bdd\" `\r\n    -UserGroup \"domain\\RDSUsers\" `\r\n    -ClientDeviceRedirectionOptions \"Drives,Clipboard,Printers,AudioVideoPlayBack,AudioRecording\" `\r\n    -MaxRedirectedMonitors 2\r\n<\/code><\/pre>\n
2. \u9ad8\u53ef\u7528\u6027\u8bbe\u7f6e<\/h3>\n
\u4e3a\u5173\u952e\u8fdc\u7a0b\u8bbf\u95ee\u670d\u52a1\u914d\u7f6e\u9ad8\u53ef\u7528\u6027\uff1a<\/p>\n
\n
\u5b9e\u65bd\u5177\u6709\u5730\u7406\u5206\u5e03\u7684RDP\u7f51\u5173\u5197\u4f59<\/li>\n
\u4e3a\u8fde\u63a5\u4ee3\u7406\u914d\u7f6e\u6545\u969c\u8f6c\u79fb\u7fa4\u96c6<\/li>\n
\u4e3a\u4f1a\u8bdd\u4e3b\u673a\u573a\u8bbe\u7f6e\u6570\u636e\u5e93\u955c\u50cf<\/li>\n
\u90e8\u7f72\u7528\u4e8e\u707e\u96be\u6062\u590d\u7684\u5730\u7406\u5197\u4f59<\/li>\n
\u5b9e\u65bd\u81ea\u52a8\u6545\u969c\u8f6c\u79fb\u7a0b\u5e8f<\/li>\n
\u914d\u7f6e\u8282\u70b9\u6545\u969c\u65f6\u7684\u4f1a\u8bdd\u6301\u4e45\u6027<\/li>\n<\/ul>\n
\u9ad8\u7ea7\u5b89\u5168\u914d\u7f6e<\/strong><\/h2>\n
\u4f01\u4e1a\u73af\u5883\u7684\u589e\u5f3a\u5b89\u5168\u63aa\u65bd\uff1a<\/p>\n
1. \u591a\u56e0\u7d20\u8ba4\u8bc1\u96c6\u6210<\/h3>\n
\r\n# \u914d\u7f6eMFA\u8981\u6c42\r\n$PolicyName = \"RDP-MFA-Policy\"\r\nNew-AzureADPolicy -Definition @(\"{\r\n    `\"SignInFrequency`\":{\r\n        `\"Type`\":`\"hours`\",\r\n        `\"Value`\":8,\r\n        `\"AuthType`\":`\"primaryAndSecondaryAuthentication`\"\r\n    },\r\n    `\"PersistentBrowserMode`\":`\"never`\"\r\n}\") -DisplayName $PolicyName -IsOrganizationDefault $true\r\n\r\n# \u914d\u7f6e\u6761\u4ef6\u8bbf\u95ee\r\nNew-AzureADMSConditionalAccessPolicy -Name \"RDP-CA-Policy\" `\r\n    -State \"enabled\" `\r\n    -Conditions @{\r\n        \"ClientAppTypes\" = @(\"all\");\r\n        \"Applications\" = @{\r\n            \"IncludeApplications\" = @(\"RDWeb\")\r\n        }\r\n    } `\r\n    -GrantControls @{\r\n        \"BuiltInControls\" = @(\"mfa\")\r\n    }\r\n<\/code><\/pre>\n
2. \u5373\u65f6\u8bbf\u95ee\u63a7\u5236<\/h3>\n
\u5b9e\u65bd\u4e34\u65f6\u8bbf\u95ee\u6743\u9650\uff1a<\/p>\n
\r\n# PowerShell\u5373\u65f6\u8bbf\u95ee\u811a\u672c\r\n$TimeWindow = (Get-Date).AddHours(4)\r\n$UserPrincipal = \"username@domain.com\"\r\n\r\nNew-AzureADMSPrivilegedAccessRequest `\r\n    -ProviderId \"RDP\" `\r\n    -ResourceId \"server01\" `\r\n    -SubjectId $UserPrincipal `\r\n    -AssignmentState \"Active\" `\r\n    -Schedule @{\r\n        \"startDateTime\" = (Get-Date).ToUniversalTime();\r\n        \"endDateTime\" = $TimeWindow.ToUniversalTime()\r\n    }\r\n\r\n# \u914d\u7f6e\u8bbf\u95ee\u5ba1\u67e5\r\nNew-AzureADMSPrivilegedAccessReview `\r\n    -Name \"RDP\u8bbf\u95ee\u5ba1\u67e5\" `\r\n    -Scope \"All\" `\r\n    -ReviewerType \"Self\" `\r\n    -StartDateTime (Get-Date) `\r\n    -Duration \"P1D\"\r\n<\/code><\/pre>\n
\u6027\u80fd\u4f18\u5316\u548c\u76d1\u63a7<\/strong><\/h2>\n
\u5b9e\u65bd\u5168\u9762\u7684\u76d1\u63a7\u89e3\u51b3\u65b9\u6848\uff1a<\/p>\n
1. \u6027\u80fd\u6307\u6807\u6536\u96c6<\/h3>\n
\r\n# \u9ad8\u7ea7\u6027\u80fd\u76d1\u63a7\u811a\u672c\r\n$LogPath = \"C:\\RDPLogs\\performance_metrics.log\"\r\n$ErrorActionPreference = \"SilentlyContinue\"\r\n\r\nwhile ($true) {\r\n    $timestamp = Get-Date -Format \"yyyy-MM-dd HH:mm:ss\"\r\n    $cpuLoad = (Get-Counter '\\Processor(_Total)\\% Processor Time').CounterSamples.CookedValue\r\n    $memory = (Get-Counter '\\Memory\\Available MBytes').CounterSamples.CookedValue\r\n    $networkUtilization = (Get-Counter '\\Network Interface(*)\\Bytes Total\/sec').CounterSamples.CookedValue\r\n    $activeSessions = (Get-RDUserSession).Count\r\n    \r\n    $metrics = @\"\r\n$timestamp\r\nCPU\u8d1f\u8f7d: $([math]::Round($cpuLoad,2))%\r\n\u53ef\u7528\u5185\u5b58: $memory MB\r\n\u7f51\u7edc\u4f7f\u7528\u7387: $([math]::Round($networkUtilization\/1MB,2)) MB\/s\r\n\u6d3b\u52a8RDP\u4f1a\u8bdd: $activeSessions\r\n----------------------------------------\r\n\"@\r\n    \r\n    $metrics | Out-File -FilePath $LogPath -Append\r\n    Start-Sleep -Seconds 300\r\n}\r\n<\/code><\/pre>\n
2. \u81ea\u52a8\u5316\u5065\u5eb7\u68c0\u67e5<\/h3>\n
\r\n# \u5065\u5eb7\u68c0\u67e5\u529f\u80fd\r\nfunction Test-RDPHealth {\r\n    param (\r\n        [string]$ServerName,\r\n        [int]$WarningThreshold = 80\r\n    )\r\n    \r\n    $results = @{\r\n        Timestamp = Get-Date\r\n        ServerName = $ServerName\r\n        RDPService = $false\r\n        CertificateValid = $false\r\n        PortAccessible = $false\r\n        ResourceUtilization = @{}\r\n    }\r\n    \r\n    # \u68c0\u67e5RDP\u670d\u52a1\r\n    $service = Get-Service TermService -ComputerName $ServerName\r\n    $results.RDPService = ($service.Status -eq 'Running')\r\n    \r\n    # \u68c0\u67e5\u8bc1\u4e66\r\n    $cert = Get-ChildItem -Path \"Cert:\\LocalMachine\\Remote Desktop\" |\r\n        Where-Object {$_.NotAfter -gt (Get-Date)}\r\n    $results.CertificateValid = ($null -ne $cert)\r\n    \r\n    # \u68c0\u67e5\u7aef\u53e3\r\n    $port = Test-NetConnection -ComputerName $ServerName -Port 3389 -WarningAction SilentlyContinue\r\n    $results.PortAccessible = $port.TcpTestSucceeded\r\n    \r\n    # \u8d44\u6e90\u4f7f\u7528\u60c5\u51b5\r\n    $cpu = (Get-Counter '\\Processor(_Total)\\% Processor Time').CounterSamples.CookedValue\r\n    $memory = (Get-Counter '\\Memory\\% Committed Bytes In Use').CounterSamples.CookedValue\r\n    \r\n    $results.ResourceUtilization = @{\r\n        CPU = $cpu\r\n        Memory = $memory\r\n        Status = if (($cpu -gt $WarningThreshold) -or ($memory -gt $WarningThreshold)) { '\u8b66\u544a' } else { '\u5065\u5eb7' }\r\n    }\r\n    \r\n    return $results\r\n}\r\n<\/code><\/pre>\n
\u707e\u96be\u6062\u590d\u548c\u4e1a\u52a1\u8fde\u7eed\u6027<\/strong><\/h2>\n
\u5efa\u7acb\u5065\u5168\u7684\u707e\u96be\u6062\u590d\u7a0b\u5e8f\uff1a<\/p>\n
\n
\u521b\u5efaRDP\u914d\u7f6e\u7684\u81ea\u52a8\u5907\u4efd\u7a0b\u5e8f<\/li>\n
\u8bb0\u5f55\u6545\u969c\u8f6c\u79fb\u7a0b\u5e8f\u548c\u6062\u590d\u6b65\u9aa4<\/li>\n
\u7ef4\u62a4\u5197\u4f59\u8fde\u63a5\u8def\u5f84\u548c\u5907\u4efd\u8ba4\u8bc1\u65b9\u6cd5<\/li>\n
\u5b9a\u671f\u6d4b\u8bd5\u707e\u96be\u6062\u590d\u7a0b\u5e8f<\/li>\n
\u5b9e\u65bd\u81ea\u52a8\u7cfb\u7edf\u72b6\u6001\u5907\u4efd<\/li>\n
\u4e3a\u5173\u952e\u670d\u52a1\u914d\u7f6e\u8de8\u533a\u57df\u590d\u5236<\/li>\n<\/ul>\n
\u7ed3\u8bba<\/strong><\/h2>\n
\u6210\u529f\u89e3\u51b3Windows RDP\u9519\u8bef\u4ee3\u78010x112f\u9700\u8981\u91c7\u7528\u7cfb\u7edf\u7684\u65b9\u6cd5\u548c\u5bf9\u8fdc\u7a0b\u684c\u9762\u534f\u8bae\u7684\u6df1\u5165\u7406\u89e3\u3002\u5bf9\u4e8e\u7f8e\u56fd\u670d\u52a1\u5668\u79df\u7528\u548c\u670d\u52a1\u5668\u6258\u7ba1\u670d\u52a1\uff0c\u7ef4\u62a4\u6700\u4f73\u7f51\u7edc\u914d\u7f6e\u548c\u5b9a\u671f\u76d1\u63a7\u5bf9\u4e8e\u9632\u6b62\u5c06\u6765\u51fa\u73b0\u7c7b\u4f3c\u95ee\u9898\u81f3\u5173\u91cd\u8981\u3002\u672c\u6307\u5357\u63d0\u4f9b\u7684\u5168\u9762\u89e3\u51b3\u65b9\u6848\u65e2\u89e3\u51b3\u4e86\u5373\u65f6\u6545\u969c\u6392\u9664\u9700\u6c42\uff0c\u4e5f\u6ee1\u8db3\u4e86\u957f\u671f\u7a33\u5b9a\u6027\u8981\u6c42\u3002<\/p>\n
\u8bf7\u8bb0\u4f4f\u8981\u4fdd\u6301\u5bf9\u6545\u969c\u6392\u9664\u6b65\u9aa4\u7684\u5b8c\u6574\u8bb0\u5f55\uff0c\u5e76\u5b9a\u671f\u6d4b\u8bd5\u60a8\u7684\u8fdc\u7a0b\u8bbf\u95ee\u529f\u80fd\u4ee5\u786e\u4fdd\u4e1a\u52a1\u8fde\u7eed\u6027\u3002\u901a\u8fc7\u5b9e\u65bd\u4e0a\u8ff0\u9ad8\u7ea7\u5b89\u5168\u63aa\u65bd\u3001\u76d1\u63a7\u89e3\u51b3\u65b9\u6848\u548c\u707e\u96be\u6062\u590d\u7a0b\u5e8f\uff0c\u7ec4\u7ec7\u53ef\u4ee5\u5728\u6ee1\u8db3\u73b0\u4ee3\u5b89\u5168\u8981\u6c42\u7684\u540c\u65f6\u7ef4\u62a4\u5f3a\u5927\u548c\u53ef\u9760\u7684\u8fdc\u7a0b\u8bbf\u95ee\u57fa\u7840\u8bbe\u65bd\u3002<\/p>\n
\u4e3a\u4e86\u6301\u7eed\u652f\u6301\u548c\u7ef4\u62a4\uff0c\u5efa\u7acbRDP\u57fa\u7840\u8bbe\u65bd\u7684\u5b9a\u671f\u5ba1\u67e5\u5468\u671f\uff0c\u53ca\u65f6\u4e86\u89e3\u6700\u65b0\u7684\u5b89\u5168\u66f4\u65b0\u548c\u6700\u4f73\u5b9e\u8df5\uff0c\u5e76\u4e0e\u60a8\u7684\u6280\u672f\u56e2\u961f\u548c\u670d\u52a1\u63d0\u4f9b\u5546\u4fdd\u6301\u7545\u901a\u7684\u6c9f\u901a\u6e20\u9053\u3002\u8fd9\u79cd\u4e3b\u52a8\u7684\u65b9\u6cd5\u5c06\u6709\u52a9\u4e8e\u6700\u5927\u9650\u5ea6\u5730\u51cf\u5c11\u505c\u673a\u65f6\u95f4\u5e76\u786e\u4fdd\u8fdc\u7a0b\u8bbf\u95ee\u7cfb\u7edf\u7684\u6700\u4f73\u6027\u80fd\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
[vc_row][vc_column][vc_column_text css=””] \u5728\u8fdc\u7a0b\u7ba1\u7406\u7f8e\u56fd\u670d\u52a1\u5668\u65f6\u9047\u5230Windows\u8fdc\u7a0b\u684c\u9762\u534f\u8bae(RDP)\u9519\u8bef\u4ee3\u78010x112f\u53ef\u80fd\u4f1a\u6210\u4e3a\u4e00\u4e2a\u91cd\u5927\u969c\u788d\u3002\u8fd9\u4efd\u5168\u9762\u7684\u6307\u5357\u6df1\u5165\u63a2\u8ba8\u4e86\u9488\u5bf9IT\u4e13\u4e1a\u4eba\u5458\u5904\u7406\u8fd9\u79cd\u6301\u7eed\u8fde\u63a5\u95ee\u9898\u7684\u5feb\u901f\u4fee\u590d\u65b9\u6848\u548c\u9ad8\u7ea7\u89e3\u51b3\u65b9\u6848\u3002\u65e0\u8bba\u60a8\u662f\u7ba1\u7406\u5c0f\u578b\u4f01\u4e1a\u57fa\u7840\u8bbe\u65bd\u8fd8\u662f\u4f01\u4e1a\u7ea7\u7cfb\u7edf\uff0c\u8fd9\u4e9b\u89e3\u51b3\u65b9\u6848\u90fd\u5c06\u5e2e\u52a9\u60a8\u9ad8\u6548\u4e14\u5b89\u5168\u5730\u6062\u590d\u8fdc\u7a0b\u8bbf\u95ee\u529f\u80fd\u3002 \u7406\u89e3\u9519\u8bef\u4ee3\u78010x112f \u9519\u8bef\u4ee3\u78010x112f\u901a\u5e38\u5728\u5c1d\u8bd5\u5efa\u7acb\u5230Windows\u670d\u52a1\u5668\u7684\u8fdc\u7a0b\u684c\u9762\u8fde\u63a5\u65f6\u51fa\u73b0\u3002\u8fd9\u4e2a\u9519\u8bef\u901a\u5e38\u4e0e\u534f\u8bae\u4e0d\u5339\u914d\u3001\u5b89\u5168\u8bc1\u4e66\u95ee\u9898\u6216\u7f51\u7edc\u914d\u7f6e\u95ee\u9898\u6709\u5173\u3002\u5bf9\u4e8e\u7f8e\u56fd\u670d\u52a1\u5668\u79df\u7528\u73af\u5883\uff0c\u7531\u4e8e\u8de8\u5883\u8fde\u63a5\u6311\u6218\u548c\u5404\u79cd\u5408\u89c4\u8981\u6c42\uff0c\u8fd9\u4e2a\u9519\u8bef\u53ef\u80fd\u7279\u522b\u68d8\u624b\u3002\u7406\u89e3\u9519\u8bef\u7684\u80cc\u666f\u5bf9\u4e8e\u5b9e\u65bd\u6709\u6548\u7684\u89e3\u51b3\u65b9\u6848\u548c\u7ef4\u62a4\u7a33\u5b9a\u7684\u8fdc\u7a0b\u8bbf\u95ee\u64cd\u4f5c\u81f3\u5173\u91cd\u8981\u3002 \u6839\u672c\u539f\u56e0\u5206\u6790 \u51e0\u4e2a\u6280\u672f\u56e0\u7d20\u53ef\u80fd\u89e6\u53d10x112f\u9519\u8bef\uff1a TLS\/SSL\u8bc1\u4e66\u9a8c\u8bc1\u5931\u8d25\u6216\u8bc1\u4e66\u8fc7\u671f \u8fc7\u65f6\u7684RDP\u5ba2\u6237\u7aef\u8f6f\u4ef6\u6216\u4e0d\u517c\u5bb9\u7684\u7248\u672c \u7f51\u7edc\u5c42\u5b89\u5168(NLA)\u914d\u7f6e\u9519\u8bef\u548c\u8ba4\u8bc1\u95ee\u9898 \u7ec4\u7b56\u7565\u51b2\u7a81\u548c\u7ee7\u627f\u95ee\u9898 \u9632\u706b\u5899\u89c4\u5219\u9650\u5236\u548c\u5b89\u5168\u7b56\u7565\u51b2\u7a81 \u5f71\u54cd\u8fde\u63a5\u5efa\u7acb\u7684DNS\u89e3\u6790\u95ee\u9898 \u5e26\u5bbd\u9650\u5236\u6216\u7f51\u7edc\u670d\u52a1\u8d28\u91cf(QoS)\u95ee\u9898 \u8fdc\u7a0b\u670d\u52a1\u5668\u8d44\u6e90\u9650\u5236\u6216\u8fc7\u5ea6\u4f7f\u7528 \u865a\u62df\u4e13\u7528\u7f51\u7edc(VPN)\u96a7\u9053\u4e0d\u7a33\u5b9a \u5b89\u5168\u534f\u8bae\u7248\u672c\u4e0d\u5339\u914d \u5168\u9762\u8bca\u65ad\u7a0b\u5e8f \u5728\u5b9e\u65bd\u590d\u6742\u7684\u89e3\u51b3\u65b9\u6848\u4e4b\u524d\uff0c\u8bf7\u6267\u884c\u4ee5\u4e0b\u57fa\u672c\u8bca\u65ad\u6b65\u9aa4\uff1a # \u68c0\u67e5RDP\u670d\u52a1\u72b6\u6001\u548c\u4f9d\u8d56\u9879 Get-Service TermService,UmRdpService,SessionEnv | Select Status,Name,DisplayName # \u9a8c\u8bc1RDP\u7aef\u53e3\u53ef\u7528\u6027\u548c\u8fde\u63a5\u8d28\u91cf Test-NetConnection -ComputerName your-server-ip -Port 3389 ping your-server-ip -n 50 # \u68c0\u67e5\u8bc1\u4e66\u72b6\u6001\u548c\u6709\u6548\u6027 certutil -store “Remote Desktop” Get-ChildItem -Path Cert:\\LocalMachine\\Remote Desktop -Recurse # \u5206\u6790RDP\u76f8\u5173\u7684\u4e8b\u4ef6\u65e5\u5fd7 Get-WinEvent -LogName “Microsoft-Windows-RemoteDesktopServices-RdpCoreTS\/Operational” -MaxEvents 50 […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":2,"featured_media":22094,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4816],"tags":[6349,6351,6348,6350,6352],"class_list":["post-22098","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-america-dedicated-server-sc","tag-6349","tag-windows","tag-windows-rdp0x112f","tag-6350","tag-rdp-sc"],"acf":[],"yoast_head":"\n