PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
175 Commits 1 Branch 0 Tags
a9ca50bc159002ecdf8b8ca482eb2740eab0afd4
Commit Graph

120 Commits

Author SHA1 Message Date
PapaTramp bf04c8865c feat(deploy): auto-add Exchange WinRM/4624 noise settings on role detect (1.2.26-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:36:00 +10:00
PapaTramp b010ad01eb fix: filter WinRM noise (HealthMailbox, machine accounts, loopback) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:31:30 +10:00
PapaTramp 1ff8dd1a95 fix: init NotifyDedupCache under StrictMode (1.2.24-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:26:07 +10:00
PapaTramp 724baa6c0a feat: monitor RDS Shadow Control and WinRM inbound (warning alerts, 1.2.23-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:20:57 +10:00
PapaTramp 2bbf1face6 fix(deploy): patch DailyReportEnabled hint and invalid false assignment (1.2.22-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 17:50:17 +10:00
PapaTramp d23e99a885 feat: unify Windows daily report with SAC layout; DailyReportEnabled toggle 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 17:18:02 +10:00
PapaTramp c249451eba fix: deploy syncs Sac-Client bundle, SAC dual settings, and ServerDisplayName hint (1.2.20-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 15:55:16 +10:00
PapaTramp 1f27272883 fix: dedup 4624 login alerts and log Skip/dedup reasons (1.2.18-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 15:17:01 +10:00
PapaTramp 49359c07a6 fix: tolerate missing ServerDisplayName and send host.ipv4 (1.2.17-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 13:33:26 +10:00
PapaTramp 611d9c68ca chore: bump RDP monitor version to 1.2.16-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 13:01:20 +10:00
PapaTramp 737da07d6a fix: add Exchange 4624 LT3 empty-IP filter switch 
Add configurable `${Ignore4624-LT3-EmptyIP-Event}` for RDP monitor to suppress noisy 4624 network logons with empty IP (-) on mail/Exchange hosts.
Update settings example and README with usage instructions.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 12:35:40 +10:00
PapaTramp b9d385f51b feat: ServerDisplayName для Telegram и SAC host.display_name (1.2.15-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 11:49:13 +10:00
PapaTramp e7f19e5c92 fix: SAC ingest POST через HttpWebRequest и проверка JSON bytes (1.2.14-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 11:13:43 +10:00
PapaTramp e4f4d1bb1f fix: SAC POST не срезать '{' из-за StartsWith(BOM) в PowerShell (1.2.13-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:57:42 +10:00
PapaTramp 74d1e4db75 fix: SAC POST body null prefix from Write-Log pipeline (1.2.12-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:44:22 +10:00
PapaTramp 5284734092 fix: SAC JSON Cyrillic via JavaScriptSerializer, log 422 body (1.2.11-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:34:21 +10:00
PapaTramp 1c210a40d8 fix: treat HTTP 201/409/202 as SAC success in WebException path (1.2.10-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:27:23 +10:00
PapaTramp 83315cc3b8 fix: SAC 422 no spool loop, truncate title/summary, UTF-8 spool read (1.2.9-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:20:30 +10:00
PapaTramp 6c86e172b9 fix: SAC ingest UTF-8 JSON body for Cyrillic (1.2.8-SAC) 
Invoke-WebRequest now posts application/json; charset=utf-8 bytes

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:05:49 +10:00
PapaTramp ef237f345b chore: release 1.2.7-SAC — SAC ingest HTTP 201/409/202 
Bump version.txt and ScriptVersion for Deploy-LoginMonitor on NETLOGON.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 09:34:19 +10:00
PapaTramp 9030fb3c30 fix: heartbeat only to SAC, never Telegram/email 
agent.heartbeat in Send-NotifyOrSac skips local channels in dual/fallback/off.
Bump to 1.2.6-SAC.
 2026-05-28 07:56:18 +10:00
PapaTramp 3ed20b130f chore: bump release to 1.2.5-SAC 
Raise ScriptVersion/version.txt for Sac-Client payload product_version and
update README release reference to keep docs aligned.
 2026-05-27 15:53:29 +10:00
PapaTramp a1a3bca0c3 fix: do not stop monitor when SAC /health is temporarily down 2026-05-27 15:02:07 +10:00
PapaTramp 004a8c0026 fix: deploy graceful recycle writes restart.request directly (no 90s wait) 2026-05-27 14:53:54 +10:00
PapaTramp 904ab13880 chore: bump version to 1.2.2-SAC 2026-05-27 14:44:02 +10:00
PapaTramp 22a32bc1cb feat: graceful restart without Stop-Process; SAC key in settings example 2026-05-27 14:43:04 +10:00
PapaTramp edbe00ffb3 feat: SAC client 1.2.0-SAC and daily report details for ingest 2026-05-27 14:15:16 +10:00
PapaTramp 577b8bc220 feat(Login): вынести локальные настройки в login_monitor.settings.ps1 
Секреты, SMTP, 4740 и IP-исключения больше не в Login_Monitor.ps1 —
не слетают при автообновлении с NETLOGON. Deploy создаёт settings из example при первой установке.
 2026-05-25 09:44:43 +10:00
PapaTramp 40c557f041 feat: aggregated 4625 burst alerts (two-tier rate limit, v1.5.10) 
- Tier 1: 5 failures per 60s per IP+user
- Tier 2: 12 failures per 60s per IP (spraying)
- Suppress per-event 4625 during burst; no auto-ban
 2026-05-22 14:13:06 +10:00
PapaTramp a324841b7d chore: clarify IIS log line wording for 4740 (v1.5.9) 2026-05-22 11:06:19 +10:00
PapaTramp a29ef8e0f7 config: LockoutMonitorDomainController K6A-DC3 (v1.5.8) 2026-05-22 11:01:38 +10:00
PapaTramp 16d555037f fix: daily report uses full path to quser.exe when System32 missing from PATH (v1.5.7) 2026-05-22 10:54:57 +10:00
PapaTramp ab98eab49c fix: invoke auditpol by full path when System32 is missing from PATH (v1.5.6) 2026-05-22 10:41:59 +10:00
PapaTramp 67c33fd4ff config: IIS logs on fifth UNC path (v1.5.5) 2026-05-22 10:05:18 +10:00
PapaTramp 6d7b4874ce config: Kalina Telegram, DC3/B26 lockout, IIS path (v1.5.4) 2026-05-22 09:58:09 +10:00
PapaTramp 52b1723137 feat: ignore.lst for 4740, IIS time window, stale heartbeat alert (v1.5.3) 
- ignore.lst scopes: 4740:/all: prefixes; IP rules match IIS client IPs
- IIS ActiveSync IPs only within minutes before lockout event
- Alert when last_heartbeat.txt is older than 2x HeartbeatInterval
 2026-05-19 20:46:35 +10:00
PapaTramp b7786e8690 feat: AD lockout 4740 with IIS IPs and SMTP notifications (v1.5.2) 
Monitor Security 4740 on a configured domain controller and enrich alerts
with ActiveSync client IPs from IIS logs. Add unified Telegram and email
delivery with NotifyOrder. Update README and DPAPI helper for mail password.
 2026-05-19 19:47:23 +10:00
PapaTramp 938df9bfe0 fix: refresh ignore.lst each monitor loop for log/mtime (v1.4.4) 2026-05-04 10:22:03 +10:00
PapaTramp a3a5b45cf8 fix: ignore list startup line use -f format (avoid $kindLabel: parse), bump 1.4.3 2026-05-04 09:42:32 +10:00
PapaTramp 362318707e fix: PowerShell parse error for ignore list line (), bump 1.4.2 2026-05-04 09:40:34 +10:00
PapaTramp 98031a20a1 fix: InstallTasks before DPAPI, deploy elevation and installtasks logs (1.4.1) 2026-05-04 09:38:02 +10:00
PapaTramp b3da911d51 chore: bump version to 1.4.0 2026-05-04 09:33:54 +10:00
PapaTramp 967e470e39 feat: list ignore.lst rules in startup Telegram notice 2026-05-04 09:30:24 +10:00
PapaTramp ace7220752 feat: log ignore.lst reload with rule counts 2026-05-04 09:11:03 +10:00
PapaTramp d3154ceb1b Add ignore.lst filtering for Security logon alerts 
Support user/workstation/IP rules and Telegram-style lines; add ignore.lst.example; bump to 1.3.14.
 2026-05-04 07:55:24 +10:00
PapaTramp 99be51467e Refine RD Gateway 303 semantics and show deploy update timestamp 2026-04-30 16:55:30 +10:00
PapaTramp a37a639be1 Fix RD Gateway 302/303 field mapping (XML + updated Properties layout). 
Bump version to 1.3.12.
 2026-04-30 16:05:21 +10:00
PapaTramp cc8925f88a Start main task immediately after InstallTasks and include script version in startup notification. 
Also bump script/version.txt to 1.3.11 for rollout tracking.
 2026-04-29 16:45:13 +10:00
PapaTramp a20055f9d3 Singleton lock: DeleteOnClose, Ctrl+C propagates, release in finally (v1.3.9) 2026-04-29 16:23:16 +10:00
PapaTramp 313cc189e9 v1.3.5: путь скрипта при Start-Process, диагностика watchdog, DEPLOY.md 2026-04-29 16:13:14 +10:00