```powershell
#Requires -Version 5.1

<#
.SYNOPSIS
    Configuración inicial de Windows 10.

.DESCRIPTION
    Este script configura una cuenta técnica llamada "tecnica" y
    habilita Escritorio Remoto.

    Características:

      - Se autoeleva a Administrador.
      - Crea el usuario "tecnica" si no existe.
      - Solicita la contraseña dos veces al crear el usuario.
      - NO cambia la contraseña si el usuario ya existe.
      - Añade el usuario al grupo Administradores.
      - Activa Escritorio Remoto.
      - Configura el Firewall para RDP.
      - Añade el usuario al grupo Usuarios de escritorio remoto.
      - Oculta el usuario de la pantalla de inicio de sesión.
      - Verifica al final que cada configuración está realmente aplicada.
      - Devuelve código de salida 0 si todo está correcto.
      - Devuelve código de salida 1 si hay algún error.

.NOTES
    Diseñado para Windows 10 / PowerShell 5.1.

    IMPORTANTE:
      Ocultar una cuenta de la pantalla de login NO es una medida
      de seguridad. La cuenta sigue existiendo.

      Este script NO cambia la configuración de Network Level
      Authentication ni abre RDP fuera del Firewall de Windows.
#>

# ============================================================
# CONFIGURACIÓN
# ============================================================

$Username = "tecnica"

# ============================================================
# CONFIGURACIÓN DE ERRORES
# ============================================================

$ErrorActionPreference = "Stop"

# ============================================================
# FUNCIONES AUXILIARES
# ============================================================

function Write-Step {
    param (
        [string]$Message
    )

    Write-Host ""
    Write-Host "--------------------------------------------------" `
        -ForegroundColor DarkGray

    Write-Host $Message `
        -ForegroundColor Cyan

    Write-Host "--------------------------------------------------" `
        -ForegroundColor DarkGray
}

function Write-Ok {
    param (
        [string]$Message
    )

    Write-Host "[OK] $Message" `
        -ForegroundColor Green
}

function Write-WarningMessage {
    param (
        [string]$Message
    )

    Write-Host "[AVISO] $Message" `
        -ForegroundColor Yellow
}

function Write-ErrorMessage {
    param (
        [string]$Message
    )

    Write-Host "[ERROR] $Message" `
        -ForegroundColor Red
}

# ============================================================
# COMPROBAR ADMINISTRADOR
# ============================================================

function Test-IsAdministrator {

    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()

    $principal = New-Object Security.Principal.WindowsPrincipal($identity)

    return $principal.IsInRole(
        [Security.Principal.WindowsBuiltInRole]::Administrator
    )
}

# ============================================================
# AUTOELEVAR
# ============================================================

function Ensure-Administrator {

    if (Test-IsAdministrator) {
        return
    }

    Write-Host ""
    Write-WarningMessage "Este script necesita permisos de Administrador."
    Write-Host "Solicitando elevación..." -ForegroundColor Yellow
    Write-Host ""

    # Si el script está siendo ejecutado desde un archivo .ps1,
    # volvemos a abrir el mismo archivo como Administrador.
    if (-not $PSCommandPath) {

        Write-ErrorMessage `
            "No se puede determinar la ruta del script."

        exit 1
    }

    $arguments = @(
        "-NoProfile"
        "-ExecutionPolicy"
        "Bypass"
        "-File"
        "`"$PSCommandPath`""
    )

    try {

        $process = Start-Process `
            -FilePath "powershell.exe" `
            -ArgumentList $arguments `
            -Verb RunAs `
            -Wait `
            -PassThru

        # Propagamos el código de salida de la instancia elevada.
        exit $process.ExitCode
    }
    catch {

        Write-ErrorMessage `
            "No se pudo obtener permisos de Administrador."

        Write-ErrorMessage $_.Exception.Message

        exit 1
    }
}

# ============================================================
# COMPROBAR EXISTENCIA DEL USUARIO
# ============================================================

function Get-LocalUserSafe {

    param (
        [Parameter(Mandatory)]
        [string]$Name
    )

    try {

        return Get-LocalUser `
            -Name $Name `
            -ErrorAction Stop
    }
    catch {

        return $null
    }
}

# ============================================================
# COMPROBAR SI UN USUARIO EXISTE
# ============================================================

function Test-LocalUserExists {

    param (
        [Parameter(Mandatory)]
        [string]$Name
    )

    $user = Get-LocalUserSafe -Name $Name

    return ($null -ne $user)
}

# ============================================================
# OBTENER GRUPO LOCAL MEDIANTE SID
#
# Los grupos integrados de Windows tienen SIDs conocidos:
#
#   Administradores:
#       S-1-5-32-544
#
#   Usuarios de escritorio remoto:
#       S-1-5-32-555
#
# De esta forma no dependemos del idioma de Windows.
# ============================================================

function Get-LocalGroupBySid {

    param (
        [Parameter(Mandatory)]
        [string]$Sid
    )

    try {

        $group = Get-LocalGroup |
            Where-Object {
                $_.SID.Value -eq $Sid
            } |
            Select-Object -First 1

        if ($null -eq $group) {

            throw "No se encontró el grupo con SID $Sid."
        }

        return $group
    }
    catch {

        throw $_
    }
}

# ============================================================
# COMPROBAR SI UN USUARIO ESTÁ EN UN GRUPO
# ============================================================

function Test-UserInGroup {

    param (
        [Parameter(Mandatory)]
        [string]$Username,

        [Parameter(Mandatory)]
        [Microsoft.PowerShell.Commands.LocalGroup]$Group
    )

    try {

        $members = Get-LocalGroupMember `
            -Group $Group.Name `
            -ErrorAction Stop

        foreach ($member in $members) {

            # El miembro normalmente aparece como:
            #
            # EQUIPO\tecnica
            #
            # Comparamos la parte final.

            $memberName = $member.Name.Split("\")[-1]

            if ($memberName -ieq $Username) {

                return $true
            }
        }

        return $false
    }
    catch {

        return $false
    }
}

# ============================================================
# AÑADIR USUARIO A GRUPO DE FORMA IDEMPOTENTE
# ============================================================

function Ensure-UserInGroup {

    param (
        [Parameter(Mandatory)]
        [string]$Username,

        [Parameter(Mandatory)]
        [Microsoft.PowerShell.Commands.LocalGroup]$Group
    )

    if (Test-UserInGroup `
        -Username $Username `
        -Group $Group) {

        Write-Ok `
            "'$Username' ya pertenece a '$($Group.Name)'."

        return
    }

    Write-Host `
        "Añadiendo '$Username' a '$($Group.Name)'..." `
        -ForegroundColor Cyan

    Add-LocalGroupMember `
        -Group $Group.Name `
        -Member $Username `
        -ErrorAction Stop

    # VERIFICACIÓN INMEDIATA

    if (-not (
        Test-UserInGroup `
            -Username $Username `
            -Group $Group
    )) {

        throw `
            "El usuario no aparece en el grupo después de añadirlo."
    }

    Write-Ok `
        "'$Username' pertenece ahora a '$($Group.Name)'."
}

# ============================================================
# PEDIR CONTRASEÑA Y CONFIRMARLA
# ============================================================

function Read-ConfirmedPassword {

    while ($true) {

        Write-Host ""
        Write-Host `
            "Introduce la contraseña para '$Username'." `
            -ForegroundColor Cyan

        $password1 = Read-Host `
            "Contraseña" `
            -AsSecureString

        $password2 = Read-Host `
            "Repite la contraseña" `
            -AsSecureString

        $ptr1 = [IntPtr]::Zero
        $ptr2 = [IntPtr]::Zero

        try {

            $ptr1 =
                [Runtime.InteropServices.Marshal]::SecureStringToBSTR(
                    $password1
                )

            $ptr2 =
                [Runtime.InteropServices.Marshal]::SecureStringToBSTR(
                    $password2
                )

            $plain1 =
                [Runtime.InteropServices.Marshal]::PtrToStringBSTR(
                    $ptr1
                )

            $plain2 =
                [Runtime.InteropServices.Marshal]::PtrToStringBSTR(
                    $ptr2
                )

            if ([string]::IsNullOrWhiteSpace($plain1)) {

                Write-ErrorMessage `
                    "La contraseña no puede estar vacía."

                continue
            }

            if ($plain1 -cne $plain2) {

                Write-ErrorMessage `
                    "Las contraseñas no coinciden."

                continue
            }

            return $password1
        }
        finally {

            if ($ptr1 -ne [IntPtr]::Zero) {

                [Runtime.InteropServices.Marshal]::ZeroFreeBSTR(
                    $ptr1
                )
            }

            if ($ptr2 -ne [IntPtr]::Zero) {

                [Runtime.InteropServices.Marshal]::ZeroFreeBSTR(
                    $ptr2
                )
            }

            $plain1 = $null
            $plain2 = $null
        }
    }
}

# ============================================================
# CREAR USUARIO
# ============================================================

function Ensure-TechnicalUser {

    param (
        [Parameter(Mandatory)]
        [string]$Name
    )

    $existingUser = Get-LocalUserSafe -Name $Name

    # --------------------------------------------------------
    # EL USUARIO YA EXISTE
    # --------------------------------------------------------

    if ($null -ne $existingUser) {

        Write-Ok `
            "El usuario '$Name' ya existe."

        return $existingUser
    }

    # --------------------------------------------------------
    # CREAR USUARIO
    # --------------------------------------------------------

    Write-Host ""
    Write-Host `
        "El usuario '$Name' no existe." `
        -ForegroundColor Yellow

    $password = Read-ConfirmedPassword

    Write-Host ""
    Write-Host `
        "Creando usuario '$Name'..." `
        -ForegroundColor Cyan

    try {

        $newUser = New-LocalUser `
            -Name $Name `
            -Password $password `
            -Description "Cuenta técnica de administración" `
            -AccountNeverExpires `
            -PasswordNeverExpires:$true `
            -ErrorAction Stop

        # VERIFICACIÓN INMEDIATA

        $verifiedUser = Get-LocalUserSafe -Name $Name

        if ($null -eq $verifiedUser) {

            throw `
                "New-LocalUser terminó correctamente pero el usuario no aparece."
        }

        Write-Ok `
            "Usuario '$Name' creado correctamente."

        return $verifiedUser
    }
    catch {

        throw `
            "No se pudo crear el usuario '$Name': $($_.Exception.Message)"
    }
}

# ============================================================
# ACTIVAR ESCRITORIO REMOTO
# ============================================================

function Enable-RemoteDesktop {

    Write-Host ""
    Write-Host `
        "Activando Escritorio remoto..." `
        -ForegroundColor Cyan

    # --------------------------------------------------------
    # REGISTRO DE WINDOWS
    #
    # fDenyTSConnections:
    #
    #   1 = RDP desactivado
    #   0 = RDP activado
    # --------------------------------------------------------

    $rdpRegistryPath =
        "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server"

    Set-ItemProperty `
        -Path $rdpRegistryPath `
        -Name "fDenyTSConnections" `
        -Type DWord `
        -Value 0 `
        -ErrorAction Stop

    # Verificación.

    $rdpValue = (
        Get-ItemProperty `
            -Path $rdpRegistryPath `
            -Name "fDenyTSConnections" `
            -ErrorAction Stop
    ).fDenyTSConnections

    if ($rdpValue -ne 0) {

        throw `
            "No se pudo activar RDP en el registro."
    }

    Write-Ok `
        "Windows tiene Escritorio remoto activado."

    # --------------------------------------------------------
    # SERVICIO TermService
    # --------------------------------------------------------

    $service = Get-Service `
        -Name "TermService" `
        -ErrorAction Stop

    # No necesitamos forzar "Automático".
    # Manual es suficiente y Windows lo inicia cuando corresponde.

    Set-Service `
        -Name "TermService" `
        -StartupType Manual `
        -ErrorAction Stop

    # Arrancamos el servicio si está parado.

    $service = Get-Service `
        -Name "TermService" `
        -ErrorAction Stop

    if ($service.Status -ne "Running") {

        Start-Service `
            -Name "TermService" `
            -ErrorAction Stop
    }

    # Verificación.

    $service = Get-Service `
        -Name "TermService" `
        -ErrorAction Stop

    if ($service.Status -ne "Running") {

        throw `
            "El servicio TermService no está ejecutándose."
    }

    Write-Ok `
        "Servicio de Escritorio remoto funcionando."

    # --------------------------------------------------------
    # FIREWALL
    # --------------------------------------------------------

    $firewallRules = Get-NetFirewallRule `
        -ErrorAction Stop |
        Where-Object {

            $_.DisplayGroup -eq "Remote Desktop" -or
            $_.DisplayGroup -eq "Escritorio remoto"
        }

    if ($null -eq $firewallRules) {

        throw `
            "No se encontraron las reglas de Firewall de Escritorio remoto."
    }

    $firewallRules |
        Enable-NetFirewallRule `
            -ErrorAction Stop

    # Verificar que al menos una regla está habilitada.

    $enabledRules = $firewallRules |
        Where-Object {
            $_.Enabled -eq "True"
        }

    if ($null -eq $enabledRules) {

        throw `
            "No se pudo habilitar ninguna regla de Firewall de RDP."
    }

    Write-Ok `
        "Firewall de Escritorio remoto configurado."
}

# ============================================================
# OCULTAR USUARIO DEL LOGIN
# ============================================================

function Hide-UserFromLogin {

    param (
        [Parameter(Mandatory)]
        [string]$Username
    )

    Write-Host ""
    Write-Host `
        "Ocultando '$Username' de la pantalla de login..." `
        -ForegroundColor Cyan

    $registryPath =
        "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"

    # Crear la clave si no existe.

    if (-not (Test-Path $registryPath)) {

        New-Item `
            -Path $registryPath `
            -Force `
            -ErrorAction Stop |
            Out-Null
    }

    # 0 = no mostrar el usuario en la lista.

    New-ItemProperty `
        -Path $registryPath `
        -Name $Username `
        -PropertyType DWord `
        -Value 0 `
        -Force `
        -ErrorAction Stop |
        Out-Null

    # VERIFICACIÓN

    $value = (
        Get-ItemProperty `
            -Path $registryPath `
            -Name $Username `
            -ErrorAction Stop
    ).$Username

    if ($value -ne 0) {

        throw `
            "No se pudo ocultar '$Username' de la pantalla de login."
    }

    Write-Ok `
        "'$Username' está oculto de la lista de usuarios del login."
}

# ============================================================
# VERIFICACIÓN FINAL COMPLETA
# ============================================================

function Test-FinalConfiguration {

    Write-Step `
        "VERIFICACIÓN FINAL DEL SISTEMA"

    $allOk = $true

    # --------------------------------------------------------
    # USUARIO
    # --------------------------------------------------------

    $user = Get-LocalUserSafe -Name $Username

    if ($null -ne $user) {

        Write-Ok "Usuario '$Username': EXISTE"
    }
    else {

        Write-ErrorMessage "Usuario '$Username': NO EXISTE"
        $allOk = $false
    }

    # --------------------------------------------------------
    # GRUPO ADMINISTRADORES
    # --------------------------------------------------------

    try {

        $administratorsGroup =
            Get-LocalGroupBySid "S-1-5-32-544"

        if (Test-UserInGroup `
            -Username $Username `
            -Group $administratorsGroup) {

            Write-Ok `
                "Administrador: SI"
        }
        else {

            Write-ErrorMessage `
                "Administrador: NO"

            $allOk = $false
        }
    }
    catch {

        Write-ErrorMessage `
            "No se pudo comprobar el grupo Administradores."

        $allOk = $false
    }

    # --------------------------------------------------------
    # RDP
    # --------------------------------------------------------

    try {

        $rdpRegistryPath =
            "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server"

        $rdpValue = (
            Get-ItemProperty `
                -Path $rdpRegistryPath `
                -Name "fDenyTSConnections" `
                -ErrorAction Stop
        ).fDenyTSConnections

        if ($rdpValue -eq 0) {

            Write-Ok `
                "Escritorio remoto de Windows: ACTIVADO"
        }
        else {

            Write-ErrorMessage `
                "Escritorio remoto de Windows: DESACTIVADO"

            $allOk = $false
        }
    }
    catch {

        Write-ErrorMessage `
            "No se pudo comprobar la configuración RDP."

        $allOk = $false
    }

    # --------------------------------------------------------
    # SERVICIO RDP
    # --------------------------------------------------------

    try {

        $service = Get-Service `
            -Name "TermService" `
            -ErrorAction Stop

        if ($service.Status -eq "Running") {

            Write-Ok `
                "Servicio TermService: EJECUTÁNDOSE"
        }
        else {

            Write-ErrorMessage `
                "Servicio TermService: $($service.Status)"

            $allOk = $false
        }
    }
    catch {

        Write-ErrorMessage `
            "No se pudo comprobar TermService."

        $allOk = $false
    }

    # --------------------------------------------------------
    # USUARIO EN GRUPO RDP
    # --------------------------------------------------------

    try {

        $rdpGroup =
            Get-LocalGroupBySid "S-1-5-32-555"

        if (Test-UserInGroup `
            -Username $Username `
            -Group $rdpGroup) {

            Write-Ok `
                "Usuario autorizado para RDP: SI"
        }
        else {

            Write-ErrorMessage `
                "Usuario autorizado para RDP: NO"

            $allOk = $false
        }
    }
    catch {

        Write-ErrorMessage `
            "No se pudo comprobar el grupo de usuarios RDP."

        $allOk = $false
    }

    # --------------------------------------------------------
    # USUARIO OCULTO
    # --------------------------------------------------------

    try {

        $loginPath =
            "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"

        $hiddenValue = (
            Get-ItemProperty `
                -Path $loginPath `
                -Name $Username `
                -ErrorAction Stop
        ).$Username

        if ($hiddenValue -eq 0) {

            Write-Ok `
                "Usuario oculto del login: SI"
        }
        else {

            Write-ErrorMessage `
                "Usuario oculto del login: NO"

            $allOk = $false
        }
    }
    catch {

        Write-ErrorMessage `
            "No se pudo comprobar la ocultación del usuario."

        $allOk = $false
    }

    # --------------------------------------------------------
    # RESULTADO
    # --------------------------------------------------------

    Write-Host ""

    if ($allOk) {

        Write-Host `
            "==================================================" `
            -ForegroundColor Green

        Write-Host `
            "             TODO CORRECTO" `
            -ForegroundColor Green

        Write-Host `
            "==================================================" `
            -ForegroundColor Green

        return $true
    }
    else {

        Write-Host `
            "==================================================" `
            -ForegroundColor Red

        Write-Host `
            "             HAY ERRORES" `
            -ForegroundColor Red

        Write-Host `
            "==================================================" `
            -ForegroundColor Red

        return $false
    }
}

# ============================================================
# PROGRAMA PRINCIPAL
# ============================================================

try {

    Clear-Host

    Write-Host ""
    Write-Host `
        "==================================================" `
        -ForegroundColor Cyan

    Write-Host `
        "       WINDOWS 10 - CONFIGURACIÓN INICIAL" `
        -ForegroundColor Cyan

    Write-Host `
        "==================================================" `
        -ForegroundColor Cyan

    Write-Host ""
    Write-Host "Usuario técnico: $Username"
    Write-Host ""

    # --------------------------------------------------------
    # 0. ADMINISTRADOR
    # --------------------------------------------------------

    Ensure-Administrator

    Write-Ok `
        "El script se está ejecutando como Administrador."

    # --------------------------------------------------------
    # 1. OBTENER GRUPOS
    # --------------------------------------------------------

    Write-Step `
        "COMPROBANDO GRUPOS LOCALES"

    $administratorsGroup =
        Get-LocalGroupBySid "S-1-5-32-544"

    $rdpGroup =
        Get-LocalGroupBySid "S-1-5-32-555"

    Write-Ok `
        "Grupo Administradores: $($administratorsGroup.Name)"

    Write-Ok `
        "Grupo Escritorio remoto: $($rdpGroup.Name)"

    # --------------------------------------------------------
    # 2. CREAR USUARIO
    # --------------------------------------------------------

    Write-Step `
        "CREANDO / COMPROBANDO USUARIO"

    Ensure-TechnicalUser `
        -Name $Username |
        Out-Null

    # --------------------------------------------------------
    # 3. ADMINISTRADORES
    # --------------------------------------------------------

    Write-Step `
        "CONFIGURANDO PRIVILEGIOS DE ADMINISTRADOR"

    Ensure-UserInGroup `
        -Username $Username `
        -Group $administratorsGroup

    # --------------------------------------------------------
    # 4. ESCRITORIO REMOTO
    # --------------------------------------------------------

    Write-Step `
        "ACTIVANDO ESCRITORIO REMOTO"

    Enable-RemoteDesktop

    # --------------------------------------------------------
    # 5. AUTORIZAR USUARIO PARA RDP
    # --------------------------------------------------------

    Write-Step `
        "AUTORIZANDO USUARIO PARA ESCRITORIO REMOTO"

    Ensure-UserInGroup `
        -Username $Username `
        -Group $rdpGroup

    # --------------------------------------------------------
    # 6. OCULTAR USUARIO
    # --------------------------------------------------------

    Write-Step `
        "OCULTANDO USUARIO DE LA PANTALLA DE LOGIN"

    Hide-UserFromLogin `
        -Username $Username

    # --------------------------------------------------------
    # 7. VERIFICACIÓN FINAL
    # --------------------------------------------------------

    $result = Test-FinalConfiguration

    # --------------------------------------------------------
    # SALIDA
    # --------------------------------------------------------

    Write-Host ""

    if ($result) {

        Write-Host `
            "La configuración se ha completado correctamente." `
            -ForegroundColor Green

        Write-Host ""
        Write-Host `
            "Puedes volver a ejecutar este script sin problema." `
            -ForegroundColor Green

        Write-Host ""

        exit 0
    }
    else {

        Write-Host ""
        Write-Host `
            "La configuración NO se ha completado correctamente." `
            -ForegroundColor Red

        Write-Host ""
        Write-Host `
            "Revisa los errores mostrados arriba." `
            -ForegroundColor Yellow

        Write-Host ""

        exit 1
    }
}
catch {

    # ========================================================
    # ERROR NO CONTROLADO
    # ========================================================

    Write-Host ""
    Write-Host `
        "==================================================" `
        -ForegroundColor Red

    Write-Host `
        "             ERROR FATAL" `
        -ForegroundColor Red

    Write-Host `
        "==================================================" `
        -ForegroundColor Red

    Write-Host ""

    Write-ErrorMessage `
        $_.Exception.Message

    Write-Host ""

    Write-Host `
        "El script se ha detenido para evitar continuar" `
        -ForegroundColor Yellow

    Write-Host `
        "con una configuración incompleta." `
        -ForegroundColor Yellow

    Write-Host ""

    exit 1
}
```