PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
182 Commits 1 Branch 0 Tags
128dd278f628172d7992da0b1d53fe7da1e05774
Commit Graph

112 Commits

Author SHA1 Message Date
PapaTramp 128dd278f6 feat(deploy): sync ServerIPv4 hint and DailyReportEnabled on upgrade (2.1.3-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-22 10:01:16 +10:00
PapaTramp f3a0adb7b8 fix: remove UTF-8 BOM from PowerShell entry scripts 2026-06-20 19:07:52 +10:00
PapaTramp 2c1724fd90 fix: SAC poll URL interpolation in Sac-Client (2.1.2-SAC) 2026-06-19 23:49:44 +10:00
PapaTramp a9ca50bc15 fix: default HeartbeatStaleAlertMultiplier (2.1.1-SAC) 
Startup notification failed when settings lacked the variable; default 2 in script and deploy bootstrap.
 2026-06-19 23:47:48 +10:00
PapaTramp fb50fb3ea7 chore: bump version to 2.1.0-SAC 2026-06-19 23:42:08 +10:00
PapaTramp 5d2b90779c feat: SAC agent command poll qwinsta/logoff (2.0.39-SAC) 
Poll GET /api/v1/agent/commands every SacCommandPollIntervalSec;
execute qwinsta/logoff with run_as from SAC; POST result.
 2026-06-19 23:37:58 +10:00
PapaTramp 37fdeb44c5 feat: deploy bootstrap StartupRebootDetectMinutes in agent settings 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-17 11:02:50 +10:00
PapaTramp 746f9e23b2 feat: detect OS reboot on startup via System log and LastBootUpTime 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-17 10:42:40 +10:00
PapaTramp 1fcd5cb5cf feat: persistent Security poll cursor with lookback replay (2.0.36-SAC) 
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-16 09:40:15 +10:00
PapaTramp d5db38e2ae feat: deploy дописывает HeartbeatInterval при отсутствии в settings (2.0.35-SAC) 
Ранний выход при совпадении версии не пропускает heartbeat; reload settings у работающего монитора.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-12 16:46:43 +10:00
PapaTramp 91cde1668c merge: GitHub main + heartbeat on startup (2.0.34-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-12 11:52:15 +10:00
PapaTramp 09f1b576bf feat: send agent.heartbeat on monitor startup (2.0.34-SAC) 
SAC sees host online immediately after restart; periodic heartbeat every 4h unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-12 11:51:16 +10:00
PapaTramp b6d293d21b fix: normalize ExecutionTimeLimit PT0S and load TaskQuery locally (2.0.33-SAC) 
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 15:27:47 +10:00
PapaTramp 6ee5fdcbf2 fix: normalize ExecutionTimeLimit PT0S and load TaskQuery locally (2.0.33-SAC) 
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 15:27:38 +10:00
PapaTramp 0da1d0f2ac fix: deploy TaskQuery script scope (2.0.32-SAC) 
Publish TaskQuery helpers to script scope after import so ExecutionTimeLimit checks work from nested deploy callers; add RDP_DEPLOY_FUNCTIONS_ONLY early exit for isolated function loading.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 15:23:59 +10:00
PapaTramp 5e9939724c fix: deploy TaskQuery script scope and internal autotests (2.0.32-SAC) 
Publish TaskQuery helpers to script scope after import so deploy checks work from nested callers; add kalinamall-only smoke tests and RDP_DEPLOY_FUNCTIONS_ONLY hook.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 15:15:42 +10:00
PapaTramp 31ebd5d653 fix: deploy task limit check without TaskQuery helper deps (2.0.31-SAC) 
Deploy uses Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved only; no call to Test-RdpMonitorScheduledTaskNeedsUnlimitedExecutionTimeLimit from external module.
 2026-06-11 15:05:02 +10:00
PapaTramp 5c23ac5f36 fix: deploy TaskQuery init must load Resolved helper (2.0.30-SAC) 
Verify TaskQuery module by Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved, prefer share path over stale InstallRoot, and guard verification when init fails.
 2026-06-11 15:02:08 +10:00
PapaTramp 6fa940dd43 fix: SendDeploySacNotice StrictMode and inline deploy task verify (2.0.29-SAC) 
Safe ServerDisplayName access for SAC deploy notice; deploy falls back to built-in schtasks XML check when TaskQuery file is missing on NETLOGON.
 2026-06-11 14:59:17 +10:00
PapaTramp 463a3ef08c fix: deploy task verify via schtasks XML and notify SAC on update (2.0.28-SAC) 
Stop false redeploy loops when Get-ScheduledTask fails, push agent version to SAC immediately after deploy, and skip redundant schtasks /Run during task maintenance.
 2026-06-11 14:47:49 +10:00
PapaTramp 365a7113cf feat: heartbeat 4h and deploy rewrites settings (2.0.27-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 17:25:20 +10:00
PapaTramp 01d7525c4a fix(deploy): escape TaskName in log string (PowerShell parser); 2.0.25-SAC 
${TaskName}: after colon was parsed as drive scope — deploy failed at parse time.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-08 11:51:06 +10:00
PapaTramp 1d30ca2284 fix: RDP-Login-Monitor scheduled task unlimited ExecutionTimeLimit (2.0.24-SAC) 
Default PT72H caused Task Scheduler to stop the monitor after 72 hours.
Register main task with PT0S, re-register on deploy and Ensure when limit is set.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-08 11:47:46 +10:00
PapaTramp 80b2337d61 fix(winrm): Exchange strict mode to suppress false 91/4624 alerts 
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-05 11:07:21 +10:00
PapaTramp fe2e6d624f fix: inventory JSON without JavaScriptSerializer WARN (2.0.22-SAC) 
Use ConvertTo-Json after CIM-safe Convert-AnyToJsonSerializable; pre-sanitize inventory details.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-05 10:00:11 +10:00
PapaTramp 82c63fb9a8 feat: host inventory to SAC every 12h (GetInventory) 
Collect CPU/RAM/disks/GPU/OS via agent.inventory; setting $GetInventory (default true); deploy adds missing setting.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-05 09:53:03 +10:00
PapaTramp bd83dc84dc fix: StrictMode-safe File Share audit init (UseGuid key) 
Enable-SecurityAudit crashed on init when checking RU/EN File Share attempts because accessing UseGuid on a hashtable without that key throws under Set-StrictMode -Version Latest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 10:20:17 +10:00
PapaTramp 5fc5f2a9ad feat: monitor admin share access via Security 5140 C$/ADMIN$ (2.0.19-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 10:14:14 +10:00
PapaTramp e3149785dc fix: daily report survives empty quser sessions (2.0.18-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 09:32:43 +10:00
PapaTramp 6384a45395 fix: recognize auditpol RU Success+Failure as otказ not only sboy (2.0.17-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 15:08:20 +10:00
PapaTramp 0acd591c83 fix: PS 5.1 empty SkipEntries breaks monitor loop (2.0.16-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 15:06:35 +10:00
PapaTramp f08a8a8561 fix: allow null SacOccurredAt on lifecycle notifications (2.0.15-SAC) 
PS 5.1 rejects binding null to [datetime]; use optional splatting for SAC occurred_at.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:45:35 +10:00
PapaTramp 550cea9759 fix: RD Gateway startup replay, 1226 benign, SAC occurred_at (2.0.14-SAC) 
Persist RD Gateway poll cursor to avoid replaying 302/303 on monitor restart;
treat ErrorCode 1226 as normal disconnect; pass event TimeCreated to SAC ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:42:03 +10:00
PapaTramp e00513f050 feat: deploy patch for MaxBackupDays default (2.0.13-SAC) 
Add deploy-time patch when login_monitor.settings.ps1 lacks MaxBackupDays,
enable the setting in example, and remove duplicate default in Login_Monitor.ps1.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:25:21 +10:00
PapaTramp 22ac7a32c7 feat: shutdown diagnostics and log backup retention (2.0.12-SAC) 
- Log phase, uptime, batch sizes and shutdown path on unexpected stop

- PipelineStopped sends SAC alert with diagnostics; fix StopNotificationSent on settings reload

- Summarize large Skip 4624 batches; Remove-LogBackupsBeyondRetention uses MaxBackupDays from settings

- Purge LoginLog_*.bak on rotation, daily rotation check and startup

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:07:03 +10:00
PapaTramp 92773948a7 fix: apply login_monitor.settings.ps1 to script scope (2.0.10-SAC) 
2.0.9 dot-sourced settings inside Import-LoginMonitorSettingsFile left UseSAC/Telegram in function scope; monitor ran with defaults off and no SAC ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:33:27 +10:00
PapaTramp 7b83a19db0 fix: InstallTasks fails when settings WinRM lines lack dollar sign (2.0.9-SAC) 
Defer login_monitor.settings.ps1 dot-source until after -InstallTasks so broken WinRM assignments cannot abort task registration. Deploy repairs settings lines missing $ before variable names.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:14:17 +10:00
PapaTramp 33367b05a8 fix: parse RD Gateway EventInfo XML and skip ephemeral 303 alerts 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:07:51 +10:00
PapaTramp 47f95ba186 chore: bump release to 2.0.7-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 09:17:28 +10:00
PapaTramp fae185421a fix: harden WinRM local IP detection and bump to 2.0.6-SAC 
Normalize WinRM source IP candidate before loopback/link-local checks and use explicit -Ip binding in WinRM ignore reason path to avoid false local-or-linklocal-ip skips.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:20:38 +10:00
PapaTramp afc7bf9dca fix: log exact WinRM skip reason and bump to 2.0.5-SAC 
Add Get-WinRmIgnoreReason to expose precise built-in/ignore decision path (empty user, excluded pattern, machine account, local IP, ignore-list match) for WinRM 91 diagnostics.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:17:48 +10:00
PapaTramp ac095fe1a0 fix: parse WinRM 91 user/ip correctly and bump to 2.0.4-SAC 
Improve WinRM Operational event parsing to extract username and clientIP from EventData/Message fallback, preventing false Skip for valid Enter-PSSession events.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:05:14 +10:00
PapaTramp 81323e8596 chore: bump RDP monitor version to 2.0.3-SAC 
Increase ScriptVersion and version.txt after deploy-side reliability updates affecting WinRM monitoring behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 12:58:40 +10:00
PapaTramp d54d04623f fix: PS 5.1 Sac-Client JSON types without uint alias 2.0.2-SAC 
Replace [uint]/[ulong] -is checks with GetType().IsPrimitive for Windows PowerShell 5.1 on domain hosts.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:13:19 +10:00
PapaTramp 084494cfa8 fix: SAC JSON serialize daily report without PSMethod cycle 2.0.1-SAC 
Convert-AnyToJsonSerializable returns plain arrays and skips PSMethod/ScriptBlock instead of Generic.List objects that broke JavaScriptSerializer.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:08:14 +10:00
PapaTramp 1a1467f910 chore: bump release to 2.0.0-SAC 
Major version line so Deploy upgrades agents stuck on 1.6.x and older 1.2.x-SAC builds from NETLOGON.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:03:48 +10:00
PapaTramp 543369832a fix: restore RD Gateway 302/303 polling and SAC ingest 1.2.35-SAC 
Fix poll cursor skipping events at time boundary, add 60min lookback on start, parse RU gateway messages, and map 303 disconnect to rdg.connection.disconnected.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 08:14:37 +10:00
PapaTramp f970e284ac fix: stronger 4624 login dedup and logon type label 1.2.34-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 19:14:05 +10:00
PapaTramp 6a9b2b70dc fix: use full path to schtasks.exe in deploy post-update start 1.2.33-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 19:03:28 +10:00
PapaTramp 2118d4a4a0 fix: hide redundant workstation line in RDP login alerts 1.2.32-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:55:11 +10:00