From 23bfcf8c2fdcfc98964e55272cbf9eb67c92e81e Mon Sep 17 00:00:00 2001
From: Hiroyuki Sato <hisat@tyo-mp2fg.tailc8b03.ts.net>
Date: Fri, 7 Aug 2026 01:44:22 +0900
Subject: [PATCH] Enable Remote Desktop firewall rule locale-independently
 (netsh -28752)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Problem

Unattended installs reach the desktop, but **RDP (port 3389) is unreachable on
any non-English (localized) Windows** — even though Remote Desktop itself is
enabled.

The `specialize` pass opens the Remote Desktop firewall group by its **display
name**:

```xml
<FirewallGroups>
    <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
        <Active>true</Active>
        <Group>Remote Desktop</Group>
        <Profile>all</Profile>
    </FirewallGroup>
</FirewallGroups>
```

`<Group>` matches by the group's **localized** display name. On Japanese Windows
that group is "リモート デスクトップ", so the literal `Remote Desktop` matches
nothing and the inbound RDP rule is never enabled. `fDenyTSConnections=false`
has already switched RDP on, so the service listens — but the OS firewall drops
the connection. English Windows is unaffected only because its display name
happens to be `Remote Desktop`.

## Fix

Add a `FirstLogonCommands` entry that enables the same group by its **numeric
resource id**, which is identical on every UI language:

```
netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes
```

`@FirewallAPI.dll,-28752` is the resource id of the "Remote Desktop" group;
`netsh` resolves it the same regardless of localization. Added to **both**
autounattend templates (`w11` and `2k22`). The existing `<Group>` block is left
in place — it is harmless and still works on English media.

## Testing

Deployed on Linode (`jp-tyo-3`, `g6-standard-4`) from this StackScript.

- **Discriminating A/B (Japanese Windows 11), one variable:** two builds
  identical except for this exact `FirstLogonCommands` block (`git diff` = these
  7 lines only).
  - **Without it:** RDP stays closed; the firewall had to be opened by hand.
  - **With it:** RDP auto-opens ~16 min after first boot, no manual step.
- **English Windows 11 25H2:** RDP reachable — raw X.224 Connection Confirm
  `03 00 00 13 0e d0 …`. Non-discriminating on en-US (the English display name
  also matches), so this only confirms the change is non-breaking there.
- **Japanese Windows Server 2022 (eval):** RDP reachable — X.224 CC
  `03 00 00 13 0e d0 00 00 12 34 00 02 1f …`. Confirms the fix works on the
  **Server** SKU and on a **localized** OS, where the display-name approach fails.

(X.224 = an RDP client connection request. A `0e d0` Connection Confirm proves
the Windows RDP service — not just an open TCP port — is answering.)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 install-windows.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/install-windows.sh b/install-windows.sh
index 9ae7f79..f6b5078 100644
--- a/install-windows.sh
+++ b/install-windows.sh
@@ -828,6 +828,13 @@ cat > /root/autounattend.xml<<EOF
                     <PlainText>true</PlainText>
                 </AdministratorPassword>
             </UserAccounts>
+            <FirstLogonCommands>
+                <SynchronousCommand wcm:action="add">
+                    <Order>1</Order>
+                    <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
+                    <Description>Enable Remote Desktop firewall group (locale-independent)</Description>
+                </SynchronousCommand>
+            </FirstLogonCommands>
         </component>
     </settings>
     <cpi:offlineImage cpi:source="wim:c:/wims/install.wim#Windows Server 2022 SERVERDATACENTER" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
@@ -942,6 +949,13 @@ cat > /root/autounattend.xml<<EOF
                 <SkipUserOOBE>true</SkipUserOOBE>
                 <SkipMachineOOBE>true</SkipMachineOOBE>
             </OOBE>
+            <FirstLogonCommands>
+                <SynchronousCommand wcm:action="add">
+                    <Order>1</Order>
+                    <CommandLine>netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes</CommandLine>
+                    <Description>Enable Remote Desktop firewall group (locale-independent)</Description>
+                </SynchronousCommand>
+            </FirstLogonCommands>
         </component>
     </settings>
     <settings pass="specialize">