diff --git a/README.md b/README.md
index 43774cf..5944d50 100644
--- a/README.md
+++ b/README.md
@@ -15,10 +15,16 @@ Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
 cd C:\path\to\fix-DAK-PC\scripts
 ```
 
-4. **Самотесты** (обязательно):
+4. **Самотесты** (обязательно, с правами администратора):
 
 ```powershell
-.\Invoke-RdpRepairSelfTest.ps1
+.\Invoke-RdpRepairSelfTest.ps1 -IncludeAdminTests
+```
+
+Ожидание: `FAIL=0`. Если `Set-ExecutionPolicy` ругается на GPO — для сессии достаточно `Process=Bypass` или запуск:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Invoke-RdpRepairSelfTest.ps1 -IncludeAdminTests
 ```
 
 5. **Полный интерактивный ремонт**:
diff --git a/scripts/Fix-RdpTls.ps1 b/scripts/Fix-RdpTls.ps1
index 83b21b4..2cae616 100644
--- a/scripts/Fix-RdpTls.ps1
+++ b/scripts/Fix-RdpTls.ps1
@@ -66,7 +66,7 @@ try {
 
     if ($RestoreTls) {
         Write-RdpRepairLog 'Возврат SecurityLayer=2 (TLS)' 'STEP' $logPath
-        $certs = Get-RdpRepairRemoteDesktopCertificates
+        $certs = @(Get-RdpRepairRemoteDesktopCertificates)
         if ($certs.Count -eq 0) {
             Write-RdpRepairLog 'No cert in Remote Desktop store - run full repair or repair install first' 'ERROR' $logPath
             exit 2
diff --git a/scripts/Invoke-RdpRepairSelfTest.ps1 b/scripts/Invoke-RdpRepairSelfTest.ps1
index 0f856ba..fc6beca 100644
--- a/scripts/Invoke-RdpRepairSelfTest.ps1
+++ b/scripts/Invoke-RdpRepairSelfTest.ps1
@@ -67,10 +67,15 @@ Assert-Test 'Initialize-RdpRepairDataRoot returns path' {
 }
 
 Assert-Test 'Get-RdpRepairComputerDnsNames non-empty' {
-    $n = Get-RdpRepairComputerDnsNames
+    $n = @(Get-RdpRepairComputerDnsNames)
     if ($n.Count -lt 1) { throw 'no dns names' }
 }
 
+Assert-Test 'Get-RdpRepairRemoteDesktopCertificates exposes Count' {
+    $certs = @(Get-RdpRepairRemoteDesktopCertificates)
+    $null = $certs.Count
+}
+
 Assert-Test 'Get-RdpRepairDiagnosticSnapshot object shape' {
     if (-not (Test-RdpRepairIsAdministrator)) {
         Write-Host '  (skip snapshot fields - not admin)' -ForegroundColor DarkYellow
diff --git a/scripts/lib/RdpRepair.Common.ps1 b/scripts/lib/RdpRepair.Common.ps1
index 246e30b..28eeb09 100644
--- a/scripts/lib/RdpRepair.Common.ps1
+++ b/scripts/lib/RdpRepair.Common.ps1
@@ -86,7 +86,8 @@ function Get-RdpRepairRemoteDesktopCertificates {
     } finally {
         $store.Close()
     }
-    return $list
+    # Запятая перед return: иначе PS 5.1 разворачивает массив из одного cert и ломает .Count
+    return ,[object[]]$list.ToArray()
 }
 
 function Clear-RdpRepairCertificateStores {
@@ -253,7 +254,7 @@ function Invoke-RdpRepairNativeReset {
     }
     Start-Service TermService -ErrorAction SilentlyContinue
     Start-Sleep -Seconds 5
-    $certs = Get-RdpRepairRemoteDesktopCertificates
+    $certs = @(Get-RdpRepairRemoteDesktopCertificates)
     return [PSCustomObject]@{
         RebootScheduled = $false
         CertCount       = $certs.Count
@@ -265,7 +266,7 @@ function Get-RdpRepairDiagnosticSnapshot {
     $polPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
     $pol = if (Test-Path $polPath) { Get-ItemProperty $polPath -ErrorAction SilentlyContinue } else { $null }
     $fips = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy' -Name Enabled -ErrorAction SilentlyContinue).Enabled
-    $certs = Get-RdpRepairRemoteDesktopCertificates
+    $certs = @(Get-RdpRepairRemoteDesktopCertificates)
     $ev1057 = @(Get-WinEvent -FilterHashtable @{
         LogName   = 'System'
         Id        = 1057, 36870