feat: RCM 1149 on RDS servers and login dedup (2.1.4-SAC)

Enable Rcm1149 monitoring on servers when RCM journal is available; dedup 1149 notifications like 4624. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-23 15:01:09 +10:00
parent eecc0e1619
commit ab53d47329
4 changed files with 25 additions and 9 deletions
@@ -58,6 +58,7 @@ $StartupRebootDetectMinutes = 5
 $GetInventory = $true

 # --- RDS Shadow Control + WinRM inbound (Enter-PSSession), severity warning ---
+# $EnableRcm1149Monitoring = 1            # RCM Operational 1149 (RDP auth; workstation + RDS server)
 # $EnableRcmShadowControlMonitoring = 1   # RCM Operational 20506/20507/20510
 # $EnableWinRmInboundMonitoring = 1       # WinRM Operational 91 (+ correlate Security 4624)
 # $EnableAdminShareMonitoring = 1         # Security 5140 C$/ADMIN$ (audit File Share)