Enable Remote Desktop firewall rule locale-independently (netsh -28752)

[isss802]

Problem

Unattended installs reach the desktop, but RDP (port 3389) is unreachable on any non-English (localized) Windows — even though Remote Desktop itself is enabled.

The specialize pass opens the Remote Desktop firewall group by its display name:

<FirewallGroups>
    <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
        <Active>true</Active>
        <Group>Remote Desktop</Group>
        <Profile>all</Profile>
    </FirewallGroup>
</FirewallGroups>

<Group> matches by the group's localized display name. On Japanese Windows that group is "リモート デスクトップ", so the literal Remote Desktop matches nothing and the inbound RDP rule is never enabled. fDenyTSConnections=false has already switched RDP on, so the service listens — but the OS firewall drops the connection. English Windows is unaffected only because its display name happens to be Remote Desktop.

Fix

Add a FirstLogonCommands entry that enables the same group by its numeric resource id, which is identical on every UI language:

netsh advfirewall firewall set rule group="@FirewallAPI.dll,-28752" new enable=Yes

@FirewallAPI.dll,-28752 is the resource id of the "Remote Desktop" group; netsh resolves it the same regardless of localization. Added to both autounattend templates (w11 and 2k22). The existing <Group> block is left in place — it is harmless and still works on English media.

Testing

Deployed on Linode (jp-tyo-3, g6-standard-4) from this StackScript.

• Discriminating A/B (Japanese Windows 11), one variable: two builds identical except for this exact FirstLogonCommands block (git diff = these 7 lines only).
  • Without it: RDP stays closed; the firewall had to be opened by hand.
  • With it: RDP auto-opens ~16 min after first boot, no manual step.
• English Windows 11 25H2: RDP reachable — raw X.224 Connection Confirm 03 00 00 13 0e d0 …. Non-discriminating on en-US (the English display name also matches), so this only confirms the change is non-breaking there.
• Japanese Windows Server 2022 (eval): RDP reachable — X.224 CC 03 00 00 13 0e d0 00 00 12 34 00 02 1f …. Confirms the fix works on the Server SKU and on a localized OS, where the display-name approach fails.

(X.224 = an RDP client connection request. A 0e d0 Connection Confirm proves the Windows RDP service — not just an open TCP port — is answering.)

🤖 Generated with Claude Code