fix(winrm): Exchange strict mode to suppress false 91/4624 alerts

On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.

Co-authored-by: Cursor <cursoragent@cursor.com>

Deploy-LoginMonitor.ps1

@@ -409,6 +409,10 @@ function Get-RdpMonitorExchangeNoiseSettingDefinitions {
         @{
             Pattern = '(?m)^\s*(\#\s*)?\$WinRmIgnoreMachineAccounts\s*='
             Line    = '$WinRmIgnoreMachineAccounts = 1'
+        },
+        @{
+            Pattern = '(?m)^\s*(\#\s*)?\$WinRmExchangeStrictMode\s*='
+            Line    = '$WinRmExchangeStrictMode = 1'
         }
     )
 }
@@ -514,7 +518,8 @@ function Repair-RdpMonitorSettingsWinRmLinesIfInvalid {
         'WinRmCorrelateSecurity4624',
         'WinRm4624CorrelationWindowSeconds',
         'WinRmIgnoreLocalSource',
-        'WinRmIgnoreMachineAccounts'
+        'WinRmIgnoreMachineAccounts',
+        'WinRmExchangeStrictMode'
     )
     $newContent = $c
     $fixed = $false