PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
182 Commits 1 Branch 0 Tags
128dd278f628172d7992da0b1d53fe7da1e05774
Commit Graph

8 Commits

Author SHA1 Message Date
PapaTramp 35e25063e3 chore(github): generic NETLOGON paths, remove mirror scripts 
Replace \\B26\\NETLOGON with \\dc.contoso.local\\NETLOGON.
Remove scripts/ mirror tools and tools/Push-KalinamallOnly.ps1.
Sanitize login_monitor.settings.example (placeholders, no secrets).
Simplify update-rdp-monitor.ps1 to use origin remote only.
Keep dev tooling under tools/ only.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-16 11:57:35 +10:00
PapaTramp ae86cb3ea7 feat: persistent Security poll cursor with lookback replay (2.0.36-SAC) 
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-16 11:37:48 +10:00
PapaTramp 6ee5fdcbf2 fix: normalize ExecutionTimeLimit PT0S and load TaskQuery locally (2.0.33-SAC) 
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 15:27:38 +10:00
PapaTramp 5e9939724c fix: deploy TaskQuery script scope and internal autotests (2.0.32-SAC) 
Publish TaskQuery helpers to script scope after import so deploy checks work from nested callers; add kalinamall-only smoke tests and RDP_DEPLOY_FUNCTIONS_ONLY hook.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 15:15:42 +10:00
PapaTramp 550cea9759 fix: RD Gateway startup replay, 1226 benign, SAC occurred_at (2.0.14-SAC) 
Persist RD Gateway poll cursor to avoid replaying 302/303 on monitor restart;
treat ErrorCode 1226 as normal disconnect; pass event TimeCreated to SAC ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:42:03 +10:00
PapaTramp 33367b05a8 fix: parse RD Gateway EventInfo XML and skip ephemeral 303 alerts 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:07:51 +10:00
PapaTramp c249451eba fix: deploy syncs Sac-Client bundle, SAC dual settings, and ServerDisplayName hint (1.2.20-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 15:55:16 +10:00
PapaTramp 1f27272883 fix: dedup 4624 login alerts and log Skip/dedup reasons (1.2.18-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 15:17:01 +10:00