TWO-PC REMOTE - LOCAL CHANGE LIST
=================================

The normal setup makes these per-user changes:

1. Copies the Two-PC Remote app to:
   %LOCALAPPDATA%\Programs\Two-PC Remote\app

2. Adds exact Two-PC Remote shortcuts to the current user's Desktop and Start menu.

3. Copies this README set, setup helpers, and a local installation receipt beside
   the installed app. Per-user setup logs/results are stored at:
   %LOCALAPPDATA%\Two-PC Remote

Tailscale third-party software
------------------------------

If Tailscale is missing, setup first shows the official Tailscale Terms of Service
and Privacy Policy links. It does not download anything if the user declines.
After acceptance, setup asks for one Windows administrator approval and:

4. Downloads the current architecture-specific Windows MSI only from:
   https://pkgs.tailscale.com/stable/

5. Refuses to execute it unless Windows reports a valid Authenticode signature
   whose organization is Tailscale Inc. The verified MSI is retained under:
   %PROGRAMDATA%\TwoPcRemote\InstallerCache

6. Installs Tailscale's Windows service, network adapter, command-line client,
   and tray application using Windows Installer. The MSI is passed these official
   policy properties:

   TS_NOLAUNCH=1
   TS_UNATTENDEDMODE="always"
   TS_ALLOWINCOMINGCONNECTIONS="always"
   TS_INSTALLUPDATES="always"

   Tailscale account sign-in occurs in the user's browser. Two-PC Remote does not
   receive the password. A missing-Tailscale install and requested host preparation
   share this one administrator approval.

Optional Remote Desktop host preparation
----------------------------------------

If the user explicitly chooses to allow control of this PC, host preparation makes
these machine-wide changes on Windows 11 Professional, Enterprise, or Education:

7. If the original interactive Windows user is neither a local administrator nor
   already a member of the built-in Remote Desktop Users group (SID S-1-5-32-555),
   adds only that user to the group. This remains the original user even when the
   Windows approval prompt uses a different administrator account.

8. Sets this Windows Remote Desktop value to 0 (allow connections):
   HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
   fDenyTSConnections (DWORD)

9. Sets this Microsoft policy value to 0 (allow microphone recording input):
   HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
   fDisableAudioCapture (DWORD)

10. Creates and enables one inbound Windows Firewall rule named:
    TwoPcRemote-Tailscale-RDP-TCP

    It allows TCP port 3389 only from Tailscale IPv4 addresses in 100.64.0.0/10.
    It does not create router port forwarding or expose RDP to the public internet.

11. Starts Windows Remote Desktop Services if it is stopped. It does not change the
    service's configured startup type.

12. When Tailscale is signed in, runs:
    tailscale set --unattended=true --shields-up=false

    This asks Tailscale to stay available after restart and allows permitted incoming
    tailnet connections. Fresh installation also applies the MSI policies listed
    above before browser sign-in.

Before the first host change, original registry/firewall values and every group
membership that this setup itself adds are recorded at:

    %PROGRAMDATA%\TwoPcRemote\host-prep-state.json

Undo and uninstall
------------------

"OPTIONAL - Undo remote access changes.cmd" restores the recorded Remote Desktop,
microphone-policy, and firewall state. It removes only a Remote Desktop Users
membership recorded as having been added by this setup. It keeps the snapshot,
audit log, and installer cache unless full cleanup is requested during uninstall.

"UNINSTALL - Two-PC Remote.cmd" removes the app and only its exact known shortcuts.
By default it offers to undo host changes but preserves:

    %LOCALAPPDATA%\TwoPcRemote             saved computer choices/settings
    %LOCALAPPDATA%\Two-PC Remote           per-user setup logs/results
    %PROGRAMDATA%\TwoPcRemote              snapshot/log/downloaded-MSI cache

Type DELETE at its cleanup question for full local cleanup. Full cleanup first
restores the recorded host changes, then removes those three exact data folders with
link/junction checks. It never uninstalls Tailscale, signs it out, removes peers, or
resets Tailscale's unattended/incoming setting (shields-up=false). For a Tailscale
installation made by this package, the incoming/unattended/automatic-update MSI
policies also remain in place.

Setup DOES NOT:

- include a private IP, computer name, Tailscale auth key, or reusable credential;
- collect or save a Windows password or browser sign-in;
- change a Tailscale account, tailnet access rule, or list of authorized devices;
- disable the clipboard;
- simulate microphone input with copy and paste;
- enable unsupported Remote Desktop hosting on Windows 11 Home;
- prevent other authorized Tailscale computers from connecting;
- uninstall or sign out an existing Tailscale installation.
