Replace \\B26\\NETLOGON with \\dc.contoso.local\\NETLOGON.
Remove scripts/ mirror tools and tools/Push-KalinamallOnly.ps1.
Sanitize login_monitor.settings.example (placeholders, no secrets).
Simplify update-rdp-monitor.ps1 to use origin remote only.
Keep dev tooling under tools/ only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publish TaskQuery helpers to script scope after import so ExecutionTimeLimit checks work from nested deploy callers; add RDP_DEPLOY_FUNCTIONS_ONLY early exit for isolated function loading.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publish TaskQuery helpers to script scope after import so deploy checks work from nested callers; add kalinamall-only smoke tests and RDP_DEPLOY_FUNCTIONS_ONLY hook.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deploy uses Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved only; no call to Test-RdpMonitorScheduledTaskNeedsUnlimitedExecutionTimeLimit from external module.
Verify TaskQuery module by Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved, prefer share path over stale InstallRoot, and guard verification when init fails.
Stop false redeploy loops when Get-ScheduledTask fails, push agent version to SAC immediately after deploy, and skip redundant schtasks /Run during task maintenance.
Default PT72H caused Task Scheduler to stop the monitor after 72 hours.
Register main task with PT0S, re-register on deploy and Ensure when limit is set.
Co-authored-by: Cursor <cursoragent@cursor.com>
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Enable-SecurityAudit crashed on init when checking RU/EN File Share attempts because accessing UseGuid on a hashtable without that key throws under Set-StrictMode -Version Latest.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add deploy-time patch when login_monitor.settings.ps1 lacks MaxBackupDays,
enable the setting in example, and remove duplicate default in Login_Monitor.ps1.
Co-authored-by: Cursor <cursoragent@cursor.com>
2.0.9 dot-sourced settings inside Import-LoginMonitorSettingsFile left UseSAC/Telegram in function scope; monitor ran with defaults off and no SAC ingest.
Co-authored-by: Cursor <cursoragent@cursor.com>
Put NETLOGON deploy flow at the top of README so initial setup is straightforward: run one command and verify with log tail.
Co-authored-by: Cursor <cursoragent@cursor.com>
Update current RDP monitor version and document recent WinRM parsing, deploy self-heal, and skip reason diagnostics behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize WinRM source IP candidate before loopback/link-local checks and use explicit -Ip binding in WinRM ignore reason path to avoid false local-or-linklocal-ip skips.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deploy now ensures required WinRM inbound settings exist in login_monitor.settings.ps1 and attempts to enable Microsoft-Windows-WinRM/Operational via wevtutil when disabled.
Co-authored-by: Cursor <cursoragent@cursor.com>
PapaTramp