RemoteDesk Host configures the Microsoft Remote Desktop service already included with supported Windows editions and installs the separate RemoteDesk Windows Agent capability probe. The Agent is a native capture/input path and does not use RDP; its full authenticated session runtime is not yet enabled by this package.

For a no-install portable package, run package-portable-host.ps1. Extract the generated ZIP and double-click RemoteDesk-Host.exe. This is the Rust Agent binary packaged under a launcher alias; it invokes the local configuration script, which requests administrator permission and enables Remote Desktop. It does not automatically start an unauthenticated Agent network listener. No MSI installation or service registration is required.

Installation does not change RDP, firewall, NLA, or service settings. Open Configure RemoteDesk Host from the Start menu, review the change summary, and type ENABLE. Windows then displays an administrator elevation prompt.

The configuration action:

rejects Windows Home/Core editions that cannot host Microsoft RDP;
saves the original RDP, NLA, TermService, and built-in firewall-rule state once;
enables Remote Desktop and the built-in TCP/UDP firewall rules;
keeps Network Level Authentication enabled;
starts TermService, changing a disabled service to manual start only when required.

Use RemoteDesk Host Status for a read-only readiness check. Use Restore pre-RemoteDesk settings to restore the saved state. A normal MSI uninstall also restores it; a major-version upgrade preserves the active configuration and backup.

Use RemoteDesk Windows Agent Status to inspect the native Agent backend. It reports Desktop Duplication/D3D11 capture and Windows SendInput support. Run is intentionally unavailable until the authenticated native session transport is installed.

To enable the Windows Agent application's connection mode, create %ProgramData%\RemoteDesk\Host\applications.json using the format documented in docs/windows-agent-applications.md. The controller only sends configured application IDs; it does not accept arbitrary executable paths.

Local and ordinary CI packages are intentionally unsigned. package-host.ps1 accepts -SigningCertificateThumbprint and -TimestampUrl; that production path signs and verifies both PowerShell payloads before WiX, then signs and verifies the final MSI before hashing. The protected Windows release workflow requires this path.