diff --git a/.gitignore b/.gitignore
index d95ff27..dd5f811 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 .cursor/
+tools/*.log
 *.log
diff --git a/Deploy-LoginMonitor.ps1 b/Deploy-LoginMonitor.ps1
index ead24f8..dc603dd 100644
--- a/Deploy-LoginMonitor.ps1
+++ b/Deploy-LoginMonitor.ps1
@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Доставка Login_Monitor.ps1 с файловой шары по версии (домен: ПК и серверы).
 .DESCRIPTION
@@ -828,7 +828,7 @@ function Get-RdpMonitorSacBlockFromExample {
     return @(
         '# --- Security Alert Center (SAC) ---'
         '$UseSAC = ''fallback'''
-        '$SacUrl = ''https://sac.kalinamall.ru'''
+        '$SacUrl = ''https://sac.example.com'''
         '$SacApiKey = ''sac_CHANGE_ME'''
     ) -join "`r`n"
 }
diff --git a/Diagnose-RdpLoginMonitor.ps1 b/Diagnose-RdpLoginMonitor.ps1
index 0c862cc..4587192 100644
--- a/Diagnose-RdpLoginMonitor.ps1
+++ b/Diagnose-RdpLoginMonitor.ps1
@@ -6,7 +6,7 @@
     Security 4624/4625/4778/4634, симуляцию фильтров монитора, SAC spool, сессии RDP.
     Отчёт: C:\ProgramData\RDP-login-monitor\Logs\diagnose_YYYYMMDD_HHmmss.txt
 .EXAMPLE
-    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Diagnose-RdpLoginMonitor.ps1 -MinutesBack 15 -ExpectedUser papatramp
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Diagnose-RdpLoginMonitor.ps1 -MinutesBack 15 -ExpectedUser jdoe
 .NOTES
     Рекомендуется запуск от администратора. Без прав Security-журнал может быть неполным.
 #>
diff --git a/Docs/deploy-netlogon-publish.md b/Docs/deploy-netlogon-publish.md
index c43015d..18e9c05 100644
--- a/Docs/deploy-netlogon-publish.md
+++ b/Docs/deploy-netlogon-publish.md
@@ -7,7 +7,7 @@
 | Параметр | Значение |
 |----------|----------|
 | `$RepoPath` | `C:\Soft\Git\RDP-login-monitor` |
-| `$NetlogonDest` | `\\b26\NETLOGON\RDP-login-monitor` |
+| `$NetlogonDest` | `\\dc.contoso.local\NETLOGON\RDP-login-monitor` |
 | `$GitUrl` | `https://github.com/PTah/RDP-login-monitor.git` |
 | `$GitBranch` | `main` |
 | `$LogFile` | `C:\soft\Logs\update-rdp-monitor.log` |
diff --git a/Docs/deploy-rdp-login-monitor.md b/Docs/deploy-rdp-login-monitor.md
index c85f264..744597d 100644
--- a/Docs/deploy-rdp-login-monitor.md
+++ b/Docs/deploy-rdp-login-monitor.md
@@ -83,7 +83,7 @@ flowchart TD
 **Мониторинг очередей транспорта и правил пересылки** — другой скрипт, **не** через GPO RDP-монитора:
 
 ```powershell
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\B26\NETLOGON\RDP-login-monitor\Deploy-DomainMonitors.ps1" -Target Exchange
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\dc.contoso.local\NETLOGON\RDP-login-monitor\Deploy-DomainMonitors.ps1" -Target Exchange
 ```
 
 Подробно: [exchange-mail-security.md](exchange-mail-security.md).
@@ -105,7 +105,7 @@ powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\B26\NETLOGON\RDP-logi
 
 ```powershell
 $root = 'C:\ProgramData\RDP-login-monitor'
-Copy-Item '\\B26\NETLOGON\RDP-login-monitor\login_monitor.settings.example.ps1' `
+Copy-Item '\\dc.contoso.local\NETLOGON\RDP-login-monitor\login_monitor.settings.example.ps1' `
     (Join-Path $root 'login_monitor.settings.ps1')
 notepad (Join-Path $root 'login_monitor.settings.ps1')
 ```
@@ -116,7 +116,7 @@ DPAPI: **`Encrypt-DpapiForRdpMonitor.ps1`**.
 
 ```powershell
 $UseSAC = 'dual'          # off | exclusive | dual | fallback
-$SacUrl = 'https://sac.kalinamall.ru'
+$SacUrl = 'https://sac.example.com'
 $SacApiKey = 'sac_...'
 ```
 
@@ -137,7 +137,7 @@ $SacApiKey = 'sac_...'
 
 ## GPO и периодический deploy
 
-1. Файлы на `\\B26\NETLOGON\RDP-login-monitor\` (`update-rdp-monitor.ps1` на DC публикации).
+1. Файлы на `\\dc.contoso.local\NETLOGON\RDP-login-monitor\` (`update-rdp-monitor.ps1` на DC публикации).
 2. GPO на OU **компьютеров** → **Сценарии PowerShell** автозагрузки → `Deploy-LoginMonitor.ps1`.
 3. Security Filtering: группа компьютеров; на шару — Read для **SYSTEM** / Domain Computers.
 4. После смены membership — **перезагрузка** (не только `gpupdate`).
@@ -149,7 +149,7 @@ Deploy после `-InstallTasks` запускает монитор; задач
 ```powershell
 powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\Install-DeployScheduledTask.ps1" `
   -TaskName "RDP-Login-Monitor-Deploy" `
-  -DeployScriptPath "\\B26\NETLOGON\RDP-login-monitor\Deploy-LoginMonitor.ps1" `
+  -DeployScriptPath "\\dc.contoso.local\NETLOGON\RDP-login-monitor\Deploy-LoginMonitor.ps1" `
   -RepeatMinutes 60 `
   -RunNow
 ```
@@ -157,7 +157,7 @@ powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\Install-DeploySchedul
 **Ручной deploy** (от администратора):
 
 ```powershell
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\B26\NETLOGON\RDP-login-monitor\Deploy-LoginMonitor.ps1"
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\dc.contoso.local\NETLOGON\RDP-login-monitor\Deploy-LoginMonitor.ps1"
 ```
 
 Параметры: **`-WhatIf`**, **`-SkipStartMonitorAfterUpdate`**, **`-AllowDowngrade`**.
diff --git a/Docs/exchange-mail-security.md b/Docs/exchange-mail-security.md
index 094d4b2..065733c 100644
--- a/Docs/exchange-mail-security.md
+++ b/Docs/exchange-mail-security.md
@@ -106,7 +106,7 @@ $VipMailboxPatterns = @('*@domain.ru')   # опционально
 ### 2. Деплой на Exchange (от администратора)
 
 ```powershell
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\B26\NETLOGON\RDP-login-monitor\Deploy-DomainMonitors.ps1" -Target Exchange
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\dc.contoso.local\NETLOGON\RDP-login-monitor\Deploy-DomainMonitors.ps1" -Target Exchange
 ```
 
 Скрипт копирует файлы в `C:\ProgramData\RDP-login-monitor\`, вызывает **`Install-DomainMonitors.ps1 -Target Exchange`**, который регистрирует задачи планировщика.
@@ -120,7 +120,7 @@ powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\B26\NETLOGON\RDP-logi
 $ex = 'C:\ProgramData\RDP-login-monitor'
 $src = Join-Path $ex 'exchange_monitor.settings.example.ps1'
 if (-not (Test-Path -LiteralPath $src)) {
-    $src = '\\B26\NETLOGON\RDP-login-monitor\exchange_monitor.settings.example.ps1'
+    $src = '\\dc.contoso.local\NETLOGON\RDP-login-monitor\exchange_monitor.settings.example.ps1'
 }
 Copy-Item -LiteralPath $src -Destination (Join-Path $ex 'exchange_monitor.settings.ps1')
 notepad (Join-Path $ex 'exchange_monitor.settings.ps1')
@@ -212,7 +212,7 @@ schtasks /Query /TN "RDP-Exchange-MailSecurity-Watchdog" /V /FO LIST
 | `$InboxScanBatchSize` | 50 | Пауза каждые N ящиков |
 | `$InboxScanBatchDelaySeconds` | 3 | Задержка между батчами |
 | `$ExcludeMailboxPatterns` | HealthMailbox*, … | Исключения |
-| `$SkipInboxScanMailboxes` | `k.selezneva@kalinamall.ru` | Не вызывать `Get-InboxRule` (битый rule store) |
+| `$SkipInboxScanMailboxes` | `k.selezneva@example.com` | Не вызывать `Get-InboxRule` (битый rule store) |
 
 Переопределение — в **`exchange_monitor.settings.ps1`**.
 
@@ -225,7 +225,7 @@ schtasks /Query /TN "RDP-Exchange-MailSecurity-Watchdog" /V /FO LIST
 ```text
 📧 Exchange: пересылка на внешний адрес
 Тип: InboxRule | MailboxForwarding | TransportRule
-Ящик: user@kalinamall.ru
+Ящик: user@example.com
 Правило: …
 Куда: attacker@gmail.com (внешний)
 Важность: Критическая | Высокая
@@ -238,7 +238,7 @@ schtasks /Query /TN "RDP-Exchange-MailSecurity-Watchdog" /V /FO LIST
 3. На Exchange:
 
 ```powershell
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\B26\NETLOGON\RDP-login-monitor\Deploy-DomainMonitors.ps1" -Target Exchange
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\dc.contoso.local\NETLOGON\RDP-login-monitor\Deploy-DomainMonitors.ps1" -Target Exchange
 ```
 
 ## Устранение неполадок
diff --git a/Exchange-MailSecurity.ps1 b/Exchange-MailSecurity.ps1
index eede346..4065e8d 100644
--- a/Exchange-MailSecurity.ps1
+++ b/Exchange-MailSecurity.ps1
@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Мониторинг Exchange: очереди транспорта, пересылка на внешние адреса (Inbox rules + mailbox forwarding + transport rules).
 .DESCRIPTION
@@ -63,11 +63,11 @@ $ScanTransportRules = $true
 # VIP: только перечисленные ящики и/или шаблоны (пилот перед полным сканом).
 $VipMailboxesOnly = $false
 $VipMailboxes = @()              # точные PrimarySmtpAddress: user@domain.com
-$VipMailboxPatterns = @()        # wildcard: *@kalinamall.ru, director*, finance*
+$VipMailboxPatterns = @()        # wildcard: *@example.com, director*, finance*
 $ExcludeMailboxPatterns = @('HealthMailbox*', 'DiscoveryMailbox*', 'SystemMailbox*')
 # Skip Inbox rules scan (corrupt rule store / Get-InboxRule fails). Override in exchange_monitor.settings.ps1
 $SkipInboxScanMailboxes = @(
-    'k.selezneva@kalinamall.ru'
+    'broken-mailbox@example.com'
 )
 $ScanDisabledInboxRulesWithExternalForward = $true   # отключённые правила с внешней пересылкой
 $SuppressAlertsOnFirstBaselineRun = $true            # первый скан: baseline без всплеска алертов
diff --git a/Install-DeployScheduledTask.ps1 b/Install-DeployScheduledTask.ps1
index c3a5549..06a670e 100644
--- a/Install-DeployScheduledTask.ps1
+++ b/Install-DeployScheduledTask.ps1
@@ -2,7 +2,7 @@
 [CmdletBinding()]
 param(
     [string]$TaskName = "RDP-Login-Monitor-Deploy",
-    [string]$DeployScriptPath = "\\B26\NETLOGON\RDP-login-monitor\Deploy-LoginMonitor.ps1",
+    [string]$DeployScriptPath = "\\dc.contoso.local\NETLOGON\RDP-login-monitor\Deploy-LoginMonitor.ps1",
     [ValidateRange(5, 1440)][int]$RepeatMinutes = 60,
     [switch]$RunNow
 )
diff --git a/exchange_monitor.settings.example.ps1 b/exchange_monitor.settings.example.ps1
index f0fdcc3..f276584 100644
--- a/exchange_monitor.settings.example.ps1
+++ b/exchange_monitor.settings.example.ps1
@@ -29,11 +29,11 @@ $QueueMessageCountThreshold = 150
 # --- Пилот VIP (рекомендуется для первого запуска) ---
 # $VipMailboxesOnly = $true
 # $VipMailboxes = @(
-#     'director@kalinamall.ru',
-#     'cfo@kalinamall.ru'
+#     'director@example.com',
+#     'cfo@example.com'
 # )
 # $VipMailboxPatterns = @(
-#     '*@kalinamall.ru'   # опционально: все ящики домена из Get-Mailbox
+#     '*@example.com'   # опционально: все ящики домена из Get-Mailbox
 # )
 
 # Первый ночной скан: не слать сотни алертов по уже существующим пересылкам
@@ -46,9 +46,9 @@ $QueueMessageCountThreshold = 150
 # $SendInboxScanSummary = $true
 
 # Удалённый EMS (если скрипт не на Exchange)
-# $ExchangeServerFqdn = 'fifth.kalinamall.ru'
+# $ExchangeServerFqdn = 'mail.example.com'
 
 # Не сканировать Inbox rules (битое хранилище правил / Watson на Get-InboxRule)
 # $SkipInboxScanMailboxes = @(
-#     'k.selezneva@kalinamall.ru'
+#     'k.selezneva@example.com'
 # )
diff --git a/login_monitor.settings.example.ps1 b/login_monitor.settings.example.ps1
index 00c2f0b..b57cf5c 100644
--- a/login_monitor.settings.example.ps1
+++ b/login_monitor.settings.example.ps1
@@ -9,9 +9,8 @@
 #>
 
 # --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
-# Закрытое зеркало Gitea — доверенный инстанс; в публичном GitHub используйте example без секретов.
-$TelegramBotToken = '8239219522:AAEyOZX3cwNfgGOMDkf-mgjTIuoaOh5gF7I'
-$TelegramChatID = '2843230'
+$TelegramBotToken = 'YOUR_BOT_TOKEN'
+$TelegramChatID = 'YOUR_CHAT_ID'
 # $TelegramBotTokenProtectedB64 = ''
 # $TelegramChatIDProtectedB64 = ''
 
@@ -30,13 +29,13 @@ $NotifyOrder = 'tg'
 # --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
 # $ServerDisplayName = 'UNMS Kalina'
 # --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
-# $ServerIPv4 = '192.168.160.57'
+# $ServerIPv4 = '10.0.0.10'
 
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
 $UseSAC = 'fallback'
-$SacUrl = 'https://sac.kalinamall.ru'
-$SacApiKey = 'sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8'
+$SacUrl = 'https://sac.example.com'
+$SacApiKey = 'sac_CHANGE_ME'
 # $SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
 # $SacTimeoutSec = 12
 # $SacTlsSkipVerify = $false
@@ -63,7 +62,7 @@ $GetInventory = $true
 
 # --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
 $IgnoreAdvapiNetworkLogonSourceIps = @(
-    '192.168.160.57'
+    '10.0.0.1'
 )
 # --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
 # Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
@@ -76,9 +75,9 @@ $MaxBackupDays = 31
 
 # --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
 # Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
-$LockoutMonitorDomainController = 'K6A-DC3'
-$NetBiosDomainName = 'B26'
-$ExchangeIisLogPath = '\\fifth.kalinamall.ru\c$\inetpub\logs\LogFiles\W3SVC1'
+$LockoutMonitorDomainController = 'DC01'
+$NetBiosDomainName = 'CONTOSO'
+$ExchangeIisLogPath = '\\mail.example.com\c$\inetpub\logs\LogFiles\W3SVC1'
 $ExchangeServerHostForIisExclude = ''
 $ExchangeIisLogTailLines = 5000
 $ExchangeIisLogMinutesBeforeLockout = 30
diff --git a/scripts/Push-Mirror.ps1 b/scripts/Push-Mirror.ps1
deleted file mode 100644
index 4602a60..0000000
--- a/scripts/Push-Mirror.ps1
+++ /dev/null
@@ -1,41 +0,0 @@
-# Push main to a mirror remote with host-specific doc URLs, without leaving URL churn on main.
-# Usage: .\scripts\Push-Mirror.ps1 github|kalinamall|papatramp
-param(
-    [Parameter(Mandatory = $true)]
-    [ValidateSet('github', 'kalinamall', 'papatramp')]
-    [string]$Target
-)
-
-$ErrorActionPreference = 'Stop'
-$Root = Split-Path -Parent $PSScriptRoot
-Set-Location $Root
-
-$remote = switch ($Target) {
-    'github' { 'github' }
-    'kalinamall' { 'kalinamall' }
-    'papatramp' { 'papatramp' }
-}
-
-git remote get-url $remote 2>$null | Out-Null
-if ($LASTEXITCODE -ne 0) {
-    throw "remote not configured: $remote"
-}
-
-if ((git status --porcelain)) {
-    throw 'working tree not clean; commit or stash first'
-}
-
-$before = (git rev-parse HEAD).Trim()
-& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target $Target
-
-if (-not (git status --porcelain)) {
-    Write-Output "no URL changes for $Target; pushing as-is"
-    git push $remote main
-    exit 0
-}
-
-git add -A
-git commit -m "chore(docs): sync repository URLs for ${Target} mirror"
-git push $remote main
-git reset --hard $before
-Write-Output "pushed $remote with ${Target} URLs; local main reset to $before"
diff --git a/scripts/Rewrite-GitHostUrls.ps1 b/scripts/Rewrite-GitHostUrls.ps1
deleted file mode 100644
index 87a40f5..0000000
--- a/scripts/Rewrite-GitHostUrls.ps1
+++ /dev/null
@@ -1,57 +0,0 @@
-# Rewrite cross-repo URLs in tracked docs/config for the target Git host.
-# Usage: .\scripts\Rewrite-GitHostUrls.ps1 github|kalinamall|papatramp
-param(
-    [Parameter(Mandatory = $true)]
-    [ValidateSet('github', 'kalinamall', 'papatramp')]
-    [string]$Target
-)
-
-$ErrorActionPreference = 'Stop'
-$Root = Split-Path -Parent $PSScriptRoot
-Set-Location $Root
-
-switch ($Target) {
-    'github' {
-        $Base = 'https://github.com/PTah'
-        $BlobSuffix = '/blob/main'
-    }
-    'kalinamall' {
-        $Base = 'https://git.kalinamall.ru/PapaTramp'
-        $BlobSuffix = '/src/branch/main'
-    }
-    'papatramp' {
-        $Base = 'https://git.papatramp.ru/PTah'
-        $BlobSuffix = '/src/branch/main'
-    }
-}
-
-$BaseHost = $Base -replace '^https://', ''
-
-$patterns = @(
-    @{ From = 'https://github.com/PTah/([^)/''"\s]+)/blob/main/'; To = "$Base/`$1$BlobSuffix/" }
-    @{ From = 'https://git.kalinamall.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PTah/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
-    @{ From = 'https://github.com/PTah/'; To = "$Base/" }
-    @{ From = 'https://git.kalinamall.ru/PapaTramp/'; To = "$Base/" }
-    @{ From = 'https://git.papatramp.ru/PTah/'; To = "$Base/" }
-    @{ From = 'github.com/PTah/'; To = "$BaseHost/" }
-    @{ From = 'git.kalinamall.ru/PapaTramp/'; To = "$BaseHost/" }
-    @{ From = 'git.papatramp.ru/PTah/'; To = "$BaseHost/" }
-)
-
-$extensions = @('*.md', '*.json', '*.service', '*.example', '*.sh', '*.ps1', '*.yml', '*.yaml')
-$files = git ls-files $extensions 2>$null | Where-Object { $_ -and (Test-Path $_) }
-
-foreach ($file in $files) {
-    $content = [System.IO.File]::ReadAllText((Join-Path $Root $file))
-    $updated = $content
-    foreach ($p in $patterns) {
-        $updated = [regex]::Replace($updated, $p.From, $p.To)
-    }
-    if ($updated -ne $content) {
-        [System.IO.File]::WriteAllText((Join-Path $Root $file), $updated, [System.Text.UTF8Encoding]::new($false))
-        Write-Output "updated: $file"
-    }
-}
-
-Write-Output "Rewrite-GitHostUrls: target=$Target base=$Base"
diff --git a/tools/Push-KalinamallOnly.ps1 b/tools/Push-KalinamallOnly.ps1
deleted file mode 100644
index 04420fe..0000000
--- a/tools/Push-KalinamallOnly.ps1
+++ /dev/null
@@ -1,20 +0,0 @@
-<#
-.SYNOPSIS
-    Push main to kalinamall only (skip public GitHub origin).
-#>
-[CmdletBinding()]
-param(
-    [string]$Branch = 'main'
-)
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = 'Stop'
-
-$repoRoot = Split-Path -Parent $PSScriptRoot
-Push-Location -LiteralPath $repoRoot
-try {
-    git push kalinamall $Branch
-    Write-Host "Pushed to kalinamall/$Branch (origin/GitHub skipped intentionally)."
-} finally {
-    Pop-Location
-}
diff --git a/tools/Run-RdpMonitorTests.ps1 b/tools/Run-RdpMonitorTests.ps1
index 827264a..07192f9 100644
--- a/tools/Run-RdpMonitorTests.ps1
+++ b/tools/Run-RdpMonitorTests.ps1
@@ -1,6 +1,6 @@
 <#
 .SYNOPSIS
-    Smoke/autotests for RDP-login-monitor deploy and SAC paths (kalinamall internal).
+    Smoke/autotests for RDP-login-monitor deploy and SAC paths.
 .EXAMPLE
     powershell.exe -NoProfile -ExecutionPolicy Bypass -File tools\Run-RdpMonitorTests.ps1
 #>
diff --git a/tools/Show-Rdp4624Recent.ps1 b/tools/Show-Rdp4624Recent.ps1
index 07f1c18..a47d82d 100644
--- a/tools/Show-Rdp4624Recent.ps1
+++ b/tools/Show-Rdp4624Recent.ps1
@@ -3,7 +3,7 @@
     Просмотр недавних 4624 с полями для диагностики RDP-login-monitor.
 .EXAMPLE
     .\Show-Rdp4624Recent.ps1
-    .\Show-Rdp4624Recent.ps1 -Minutes 30 -User papatramp
+    .\Show-Rdp4624Recent.ps1 -Minutes 30 -User jdoe
 #>
 [CmdletBinding()]
 param(
diff --git a/tools/Test-RDGatewayEventInfo.ps1 b/tools/Test-RDGatewayEventInfo.ps1
index bd562fb..e1ccdc7 100644
--- a/tools/Test-RDGatewayEventInfo.ps1
+++ b/tools/Test-RDGatewayEventInfo.ps1
@@ -11,7 +11,7 @@ $sample303 = @'
   </System>
   <UserData>
     <EventInfo xmlns="aag">
-      <Username>B26\TSA</Username>
+      <Username>CONTOSO\TSA</Username>
       <IpAddress>95.154.72.73</IpAddress>
       <Resource>192.168.164.43</Resource>
       <BytesReceived>1991</BytesReceived>
diff --git a/tools/tests/INTERNAL.md b/tools/tests/INTERNAL.md
deleted file mode 100644
index ccc2795..0000000
--- a/tools/tests/INTERNAL.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# Autotests (kalinamall only)
-
-Каталог `tools/tests/` и `tools/Run-RdpMonitorTests.ps1` — **внутренние** smoke-тесты.
-
-## Запуск
-
-```powershell
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File tools\Run-RdpMonitorTests.ps1
-```
-
-Перед push правок `Deploy-LoginMonitor.ps1` / `Login_Monitor.ps1` / `RdpMonitor-TaskQuery.ps1`.
-
-## Git remotes
-
-- **kalinamall** — публиковать можно (`git push kalinamall main`)
-- **GitHub (origin)** — **не пушить** коммиты с этими тестами на публичный remote
-
-После работы с тестами:
-
-```powershell
-git push kalinamall main
-```
-
-На `origin` (GitHub) не выполнять push, если в коммите есть `tools/tests/` или `tools/Run-RdpMonitorTests.ps1`.
diff --git a/update-rdp-monitor.ps1 b/update-rdp-monitor.ps1
index 009c474..2d98340 100644
--- a/update-rdp-monitor.ps1
+++ b/update-rdp-monitor.ps1
@@ -4,7 +4,7 @@
 .DESCRIPTION
     Dlya servera publikatsii (napr. DC3). Po umolchaniyu GitHub (github.com/PTah).
     Na zakrytom zerkale ukazhite -GitUrl URL vashego Gitea.
-    Posle fetch: vsegda reset --hard na kalinamall/main (bez merge), zatem clean -fd.
+    Posle fetch: vsegda reset --hard na origin/main (bez merge), zatem clean -fd.
     Kopiruyutsya: polnyj spisok v Docs/deploy-netlogon-publish.md.
 .EXAMPLE
     powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\soft\update-rdp-monitor.ps1
@@ -14,7 +14,7 @@
 [CmdletBinding(SupportsShouldProcess = $true)]
 param(
     [string]$RepoPath = 'C:\Soft\Git\RDP-login-monitor',
-    [string]$NetlogonDest = '\\b26\NETLOGON\RDP-login-monitor',
+    [string]$NetlogonDest = '\\dc.contoso.local\NETLOGON\RDP-login-monitor',
     [string]$GitUrl = 'https://github.com/PTah/RDP-login-monitor.git',
     [string]$GitBranch = 'main',
     [string]$LogFile = 'C:\soft\Logs\update-rdp-monitor.log',
@@ -112,38 +112,25 @@ function Ensure-GitRepository {
 function Get-ConfiguredGitRemoteName {
     $names = @(Invoke-GitCommand -Arguments @('remote') | ForEach-Object { "$_".Trim() } | Where-Object { $_ })
     if ($names.Count -eq 0) { return $null }
-    if ('kalinamall' -in $names) { return 'kalinamall' }
-    foreach ($n in $names) {
-        $url = (& git -C $RepoPath remote get-url $n 2>$null)
-        if ($url -match 'git\.kalinamall\.ru') { return $n }
-    }
     if ('origin' -in $names) { return 'origin' }
     return $names[0]
 }
 
-function Ensure-GitKalinamallRemote {
+function Ensure-GitUpstreamRemote {
     $name = Get-ConfiguredGitRemoteName
     if ($null -ne $name) {
         $url = (& git -C $RepoPath remote get-url $name 2>$null)
-        if ($url -match 'git\.kalinamall\.ru') {
-            Write-UpdateLog "Using remote: $name ($url)"
-            return $name
-        }
-        Write-UpdateLog "Remote $name is not kalinamall ($url); adding kalinamall -> $GitUrl"
-    } else {
-        Write-UpdateLog "No remotes; adding kalinamall -> $GitUrl"
+        Write-UpdateLog "Using remote: $name ($url)"
+        return $name
     }
-    if ('kalinamall' -in @(& git -C $RepoPath remote 2>$null)) {
-        Invoke-GitCommand -Arguments @('remote', 'set-url', 'kalinamall', $GitUrl)
-        return 'kalinamall'
-    }
-    Invoke-GitCommand -Arguments @('remote', 'add', 'kalinamall', $GitUrl)
-    return 'kalinamall'
+    Write-UpdateLog "No remotes; adding origin -> $GitUrl"
+    Invoke-GitCommand -Arguments @('remote', 'add', 'origin', $GitUrl)
+    return 'origin'
 }
 
 function Update-Repository {
     Ensure-GitRepository
-    $remote = Ensure-GitKalinamallRemote
+    $remote = Ensure-GitUpstreamRemote
     Invoke-GitCommand -Arguments @('fetch', '--prune', $remote, $GitBranch)
     $upstream = "${remote}/${GitBranch}"