Create a Local User and Grant Remote Desktop Access with PowerShell

#Requires -RunAsAdministrator
# New-RDPUser.ps1
# Creates a local user account and adds it to the Remote Desktop Users group
# Run as Administrator

param(
    [Parameter(Mandatory=$false)]
    [string]$Username,

    [Parameter(Mandatory=$false)]
    [string]$FullName,

    [Parameter(Mandatory=$false)]
    [string]$Description = "Remote Desktop User",

    [Parameter(Mandatory=$false)]
    [switch]$PasswordNeverExpires
)

# Function to create a new RDP user
function New-RDPUser {
    Write-Host "========================================" -ForegroundColor Cyan
    Write-Host "  Create Local User for Remote Desktop  " -ForegroundColor Cyan
    Write-Host "========================================" -ForegroundColor Cyan
    Write-Host ""

    # Get username if not provided
    if (-not $Username) {
        $Username = Read-Host "Enter username"
    }

    # Check if user already exists
    $existingUser = Get-LocalUser -Name $Username -ErrorAction SilentlyContinue
    if ($existingUser) {
        Write-Host "User '$Username' already exists." -ForegroundColor Yellow
        $addToGroup = Read-Host "Add existing user to Remote Desktop Users group? (Y/N)"
        if ($addToGroup -eq 'Y' -or $addToGroup -eq 'y') {
            Add-UserToRDPGroup -Username $Username
        }
        return
    }

    # Get full name if not provided
    if (-not $FullName) {
        $FullName = Read-Host "Enter full name (press Enter to skip)"
        if ([string]::IsNullOrWhiteSpace($FullName)) {
            $FullName = $Username
        }
    }

    # Get password securely
    Write-Host ""
    $Password = Read-Host "Enter password" -AsSecureString
    $ConfirmPassword = Read-Host "Confirm password" -AsSecureString

    # Convert to plain text for comparison
    $BSTR1 = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password)
    $BSTR2 = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($ConfirmPassword)
    $PlainPassword1 = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR1)
    $PlainPassword2 = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR2)

    if ($PlainPassword1 -ne $PlainPassword2) {
        Write-Host "Passwords do not match. Aborting." -ForegroundColor Red
        return
    }

    # Clear plain text passwords from memory
    $PlainPassword1 = $null
    $PlainPassword2 = $null

    # Create the user
    Write-Host ""
    Write-Host "Creating user '$Username'..." -ForegroundColor Cyan

    try {
        $userParams = @{
            Name        = $Username
            Password    = $Password
            FullName    = $FullName
            Description = $Description
        }

        if ($PasswordNeverExpires) {
            $userParams.Add("PasswordNeverExpires", $true)
        }

        New-LocalUser @userParams -ErrorAction Stop
        Write-Host "  User created successfully!" -ForegroundColor Green
    }
    catch {
        Write-Host "  Failed to create user: $_" -ForegroundColor Red
        return
    }

    # Add to Remote Desktop Users group
    Add-UserToRDPGroup -Username $Username

    # Summary
    Write-Host ""
    Write-Host "========================================" -ForegroundColor Green
    Write-Host "  User Setup Complete!" -ForegroundColor Green
    Write-Host "========================================" -ForegroundColor Green
    Write-Host ""
    Write-Host "Username:    $Username"
    Write-Host "Full Name:   $FullName"
    Write-Host "Groups:      Remote Desktop Users"
    Write-Host ""
    Write-Host "The user can now connect via Remote Desktop." -ForegroundColor Cyan
}

function Add-UserToRDPGroup {
    param([string]$Username)

    Write-Host "Adding '$Username' to Remote Desktop Users group..." -ForegroundColor Cyan

    try {
        Add-LocalGroupMember -Group "Remote Desktop Users" -Member $Username -ErrorAction Stop
        Write-Host "  Added to Remote Desktop Users group!" -ForegroundColor Green
    }
    catch {
        if ($_.Exception.Message -like "*already a member*") {
            Write-Host "  User is already a member of Remote Desktop Users." -ForegroundColor Yellow
        }
        else {
            Write-Host "  Failed to add to group: $_" -ForegroundColor Red
        }
    }
}

# Run the function
New-RDPUser

# Create user with parameters
.\New-RDPUser.ps1 -Username "jsmith" -FullName "John Smith" -PasswordNeverExpires

# Create with description
.\New-RDPUser.ps1 -Username "contractor1" -Description "Temporary contractor access"

# Create a new local user
net user newusername P@ssw0rd123 /add /fullname:"New User"

# Add user to Remote Desktop Users group
net localgroup "Remote Desktop Users" newusername /add

# Verify the user was added
net localgroup "Remote Desktop Users"

# Create user and add to RDP group in two commands
$Password = ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force
New-LocalUser -Name "rdpuser" -Password $Password -FullName "RDP User"
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "rdpuser"

# Verify the user is in the group
Get-LocalGroupMember -Group "Remote Desktop Users"

# Enable Remote Desktop
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

# Enable firewall rule
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"