---

# Read-only. Run on the AFFECTED Windows VPS, not the client PC.
# Checks whether the listener registration/tree was deleted. No repairs/restarts.
& {
    $ErrorActionPreference='Stop'
    function Show-RdpCheck([string]$Title,[scriptblock]$Read) {
        Write-Output ("`n--- "+$Title+' ---')
        try { & $Read | Out-String -Width 220 | Write-Output }
        catch { Write-Output ('READ ERROR: '+$_.Exception.Message) }
    }
    Show-RdpCheck 'Windows version' {
        Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
            Select-Object ProductName,EditionID,CurrentBuild,UBR,InstallationType | Format-List
    }
    Show-RdpCheck 'Service state' {
        Get-CimInstance Win32_Service -Filter "Name='TermService' OR Name='UmRdpService'" -OperationTimeoutSec 15 |
            Select-Object Name,State,StartMode,ProcessId | Format-Table -AutoSize
    }
    Show-RdpCheck 'Current listener and alternative control sets' {
        $sets=@('CurrentControlSet')+@(Get-ChildItem 'HKLM:\SYSTEM' | Where-Object PSChildName -match '^ControlSet\d{3}$' | Select-Object -ExpandProperty PSChildName)
        foreach($set in $sets){
            $root='HKLM:\SYSTEM\'+$set+'\Control\Terminal Server'
            $listener=$root+'\WinStations\RDP-Tcp'
            'CONTROL SET: '+$set
            if(Test-Path -LiteralPath $root){
                'Terminal Server subkeys: '+((Get-ChildItem -LiteralPath $root | Select-Object -ExpandProperty PSChildName) -join ', ')
            } else { 'Terminal Server ROOT ABSENT' }
            if(Test-Path -LiteralPath $listener){
                $key=Get-Item -LiteralPath $listener
                try {
                    'Listener value count: '+$key.GetValueNames().Count
                    foreach($name in @('LoadableProtocol_Object','WdName','PdName','LanAdapter','PortNumber','fEnableWinStation','fLogonDisabled','UserAuthentication','SecurityLayer','MinEncryptionLevel')){
                        if($key.GetValueNames() -contains $name){ '{0} = {1} [{2}]' -f $name,$key.GetValue($name),$key.GetValueKind($name) }
                        else { $name+' = ABSENT' }
                    }
                } finally { $key.Close() }
            } else { 'RDP-Tcp ABSENT' }
        }
    }
    Show-RdpCheck 'Installation state (read only)' {
        Get-ItemProperty 'HKLM:\SYSTEM\Setup' | Select-Object SystemSetupInProgress,OOBEInProgress | Format-List
    }
    Show-RdpCheck 'SYSTEM backup availability' {
        foreach($path in @("$env:SystemRoot\System32\config\RegBack\SYSTEM", "$env:SystemDrive\Windows.old\Windows\System32\config\SYSTEM")){
            if(Test-Path -LiteralPath $path){Get-Item -LiteralPath $path | Select-Object FullName,Length,LastWriteTime | Format-List}
            else {'ABSENT: '+$path}
        }
    }
    Write-Output 'END. No registry values, services or firewall settings changed.'
}