Selective IP ban on cloudy Windows Server 2012 via RDP

The company consists of an office and remote stores. Once an employee took a customer base on a flash drive. After that, everyone immediately went to the remote desktop with the local interface disabled. But you need even more control for admins! Under the cat described a way to slightly improve security and control of the situation.

Windows Server 2012 R2 Standard.


All this was done in haste by the previous administrator, so now the entire infrastructure is on crutches. Then I came to support all this. One of the new tasks is that office managers can enter the cloud desktop only from the office. Houses can not be. At the same time, leave an opportunity to work from home. And do not touch remote stores at all. This is usually done through firewall policies or through a domain. Since the lock is needed selectively, there is no domain, and the server is cloudy, we had to look for unusual solutions.
')
I never wrote to PowerShell, so I made a paid request to our hosting technicians. But while they were thinking, I sketched a quick and working solution. Here is the diagram:

Create a daddy for scripts. Add the script itself:

#saved as UTF8 # $username = "username" #    $localnet = "1.2.3.4" #  IP $lastevent = Get-EventLog Security -Message "*$username*:*.*.*.*" -Newest 1 #     $IP = $lastevent.message.substring($lastevent.message.indexof(" :")+15,$lastevent.message.indexof(":")-$lastevent.message.indexof(" :")-18) $IDbyName = ((query session $username)[1] -split '\s+')[3] #   ""  if ($IDbyName -notlike $null) {if ($IP -notlike $localnet) { #    logoff $IDbyName "`n---------" | Out-File "C:\SCRIPTFOLDER\Scripts\log.txt" -Append Get-Date | Out-File "C:\SCRIPTFOLDER\Scripts\log.txt" -Append " RDP `nUSER: $username `nIP: $ip" | Out-File "C:\SCRIPTFOLDER\Scripts\log.txt" -Append }} 

The script is not the most flexible, but it works with a bang. Now about automation. Go to the task scheduler. We manually create an event, and it is better to import through this task.xml


Do not forget to forward ServerName to the system name of the server, AdminUser to the system name of the executing admin and username to the system name of the user you want to restrict.
After creating a task, a window appears:



Triggers run:

1. When connecting remotely to a user session, username
2. When logging in username

Action: Start the PowerShell program with the argument -File "C: \ SCRIPTFOLDER \ Scripts \ kickUsername.ps1"

Be sure to perform from the admin with the highest rights. Click OK, enter the admin password. The task is ready! Now, when trying to connect a restricted user from someone else's IP addresses, he will be thrown out, and we will write a log to the daddy with the scripts.

To restrict the new user, you need to repeat the process (I wanted to make a list of bans in the file, but I lacked experience and time). That's all.

Criticism is very welcome, because This is my first PowersHell code. I also realize that this method does not protect 100% of valuable information. But dishonest employees will be forced to do their dark things in the workplace, and this is more dangerous for them. Enjoy using!