feat: SAC agent command poll qwinsta/logoff (2.0.39-SAC)

Poll GET /api/v1/agent/commands every SacCommandPollIntervalSec;
execute qwinsta/logoff with run_as from SAC; POST result.
This commit is contained in:
2026-06-19 23:37:58 +10:00
parent 7f38c00094
commit 5d2b90779c
4 changed files with 236 additions and 3 deletions
+2
View File
@@ -47,6 +47,8 @@ $DailyReportEnabled = 1
# --- Heartbeat SAC (agent.heartbeat): интервал в секундах; 14400 = 4 ч ---
$HeartbeatInterval = 14400
# Poll SAC на команды qwinsta/logoff (сек); см. security-alert-center/docs/agent-control-plane.md
# $SacCommandPollIntervalSec = 60
# Окно (мин): LastBootUpTime + System 41/1074/6005/6008/6009 → «старт после перезагрузки ОС»
$StartupRebootDetectMinutes = 5