PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
175 Commits 1 Branch 0 Tags
a9ca50bc159002ecdf8b8ca482eb2740eab0afd4
Commit Graph

175 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
PapaTramp 004a8c0026 fix: deploy graceful recycle writes restart.request directly (no 90s wait) 2026-05-27 14:53:54 +10:00
PapaTramp 904ab13880 chore: bump version to 1.2.2-SAC 2026-05-27 14:44:02 +10:00
PapaTramp 22a32bc1cb feat: graceful restart without Stop-Process; SAC key in settings example 2026-05-27 14:43:04 +10:00
PapaTramp bd8076a1d0 docs: Windows/SAC update checklist; default Telegram in settings example 2026-05-27 14:27:27 +10:00
PapaTramp edbe00ffb3 feat: SAC client 1.2.0-SAC and daily report details for ingest 2026-05-27 14:15:16 +10:00
PapaTramp 577b8bc220 feat(Login): вынести локальные настройки в login_monitor.settings.ps1 
Секреты, SMTP, 4740 и IP-исключения больше не в Login_Monitor.ps1 —
не слетают при автообновлении с NETLOGON. Deploy создаёт settings из example при первой установке.
 2026-05-25 09:44:43 +10:00
PapaTramp 971461accf fix(Exchange): stop Import-ExchangeManagementShell leaking True (v1.6.7) 
return True from EMS import was collected into mailbox lists and domain joins, causing Get-InboxRule on mailbox True. Suppress import output at call sites and log accepted domains via @() enumeration.
 2026-05-22 16:10:36 +10:00
PapaTramp 744f254c09 fix(Exchange): define Get-ExchangeInboxScanScopeLabel before InstallTasks (v1.6.6) 2026-05-22 16:02:05 +10:00
PapaTramp 1584be89e2 feat(Exchange): skip corrupt inbox rule stores (v1.6.5) 
Add SkipInboxScanMailboxes with k.selezneva@kalinamall.ru by default. Filter inbox scan list, log SKIP, and catch Get-InboxRule failures to avoid Watson aborting full scans.
 2026-05-22 16:00:09 +10:00
PapaTramp cdf563cbe9 fix(deploy): copy exchange_monitor.settings.example to ProgramData (v1.6.4) 
Example settings were published to NETLOGON but omitted from Deploy-DomainMonitors file list, so Copy-Item from ProgramData failed on fresh installs.
 2026-05-22 15:00:30 +10:00
PapaTramp 872df98a2c fix: Exchange monitor encoding for PS 5.1 (v1.6.3) 
ASCII runtime strings in Exchange-MailSecurity and Notify-Common avoid parser errors when scripts are copied without UTF-8 BOM. Deploy copies .ps1 to ProgramData with UTF-8 BOM via Copy-ScriptFileWithUtf8Bom.
 2026-05-22 14:57:35 +10:00
PapaTramp 7c13c96622 fix: Deploy-DomainMonitors encoding for PS 5.1 / NETLOGON (v1.6.2) 
- ASCII runtime strings in domain deploy/install scripts
- Publish *.ps1 to NETLOGON with UTF-8 BOM
 2026-05-22 14:53:28 +10:00
PapaTramp 0c916b50c6 feat(Exchange): VIP scan, disabled rules, first-baseline suppress (v1.6.1) 
- VipMailboxes + VipMailboxPatterns; unified VIP scope
- Scan disabled inbox rules with external forward (lower severity)
- Suppress per-finding alerts on first baseline run
- Post-scan summary and install notification
 2026-05-22 14:44:57 +10:00
PapaTramp 9ab6cc64a1 docs: add Docs/ guides; Exchange Mail Security scripts (v1.6.0) 
- Docs: RDP deploy, Exchange mail security, NETLOGON publish
- Exchange-MailSecurity.ps1, Notify-Common, Deploy/Install-DomainMonitors
- DEPLOY.md redirects to Docs/
 2026-05-22 14:32:50 +10:00
PapaTramp 40c557f041 feat: aggregated 4625 burst alerts (two-tier rate limit, v1.5.10) 
- Tier 1: 5 failures per 60s per IP+user
- Tier 2: 12 failures per 60s per IP (spraying)
- Suppress per-event 4625 during burst; no auto-ban
 2026-05-22 14:13:06 +10:00
PapaTramp a324841b7d chore: clarify IIS log line wording for 4740 (v1.5.9) 2026-05-22 11:06:19 +10:00
PapaTramp a29ef8e0f7 config: LockoutMonitorDomainController K6A-DC3 (v1.5.8) 2026-05-22 11:01:38 +10:00
PapaTramp 16d555037f fix: daily report uses full path to quser.exe when System32 missing from PATH (v1.5.7) 2026-05-22 10:54:57 +10:00
PapaTramp ab98eab49c fix: invoke auditpol by full path when System32 is missing from PATH (v1.5.6) 2026-05-22 10:41:59 +10:00
PapaTramp eccffe927a Fixed BOM 2026-05-22 10:28:40 +10:00
PapaTramp 83f5c7de63 config: fifth IIS UNC, NETLOGON publish script (v1.5.5) 2026-05-22 10:13:54 +10:00
PapaTramp 67c33fd4ff config: IIS logs on fifth UNC path (v1.5.5) 2026-05-22 10:05:18 +10:00
PapaTramp 6d7b4874ce config: Kalina Telegram, DC3/B26 lockout, IIS path (v1.5.4) 2026-05-22 09:58:09 +10:00
PapaTramp f4375c2349 readme and docs editing 2026-05-22 09:19:26 +10:00
PapaTramp 52b1723137 feat: ignore.lst for 4740, IIS time window, stale heartbeat alert (v1.5.3) 
- ignore.lst scopes: 4740:/all: prefixes; IP rules match IIS client IPs
- IIS ActiveSync IPs only within minutes before lockout event
- Alert when last_heartbeat.txt is older than 2x HeartbeatInterval
 2026-05-19 20:46:35 +10:00
PapaTramp b7786e8690 feat: AD lockout 4740 with IIS IPs and SMTP notifications (v1.5.2) 
Monitor Security 4740 on a configured domain controller and enrich alerts
with ActiveSync client IPs from IIS logs. Add unified Telegram and email
delivery with NotifyOrder. Update README and DPAPI helper for mail password.
 2026-05-19 19:47:23 +10:00
PapaTramp 938df9bfe0 fix: refresh ignore.lst each monitor loop for log/mtime (v1.4.4) 2026-05-04 10:22:03 +10:00
PapaTramp a3a5b45cf8 fix: ignore list startup line use -f format (avoid $kindLabel: parse), bump 1.4.3 2026-05-04 09:42:32 +10:00
PapaTramp 362318707e fix: PowerShell parse error for ignore list line (), bump 1.4.2 2026-05-04 09:40:34 +10:00
PapaTramp 98031a20a1 fix: InstallTasks before DPAPI, deploy elevation and installtasks logs (1.4.1) 2026-05-04 09:38:02 +10:00
PapaTramp b3da911d51 chore: bump version to 1.4.0 2026-05-04 09:33:54 +10:00
PapaTramp 967e470e39 feat: list ignore.lst rules in startup Telegram notice 2026-05-04 09:30:24 +10:00
PapaTramp ace7220752 feat: log ignore.lst reload with rule counts 2026-05-04 09:11:03 +10:00
PapaTramp bdcf2bdc5f docs: expand ignore.lst section in README and README_eng 2026-05-04 09:02:14 +10:00
PapaTramp 57bc617d26 Sanitize ignore.lst.example placeholders 
Replace sample workstation, domain user, and IP with generic values.
 2026-05-04 08:25:21 +10:00
PapaTramp 17befc867e Document ignore.lst in README and DEPLOY 
Describe optional Security 4624/4625 suppression, UTF-8, and that deploy does not ship ignore.lst.
 2026-05-04 07:56:49 +10:00
PapaTramp d3154ceb1b Add ignore.lst filtering for Security logon alerts 
Support user/workstation/IP rules and Telegram-style lines; add ignore.lst.example; bump to 1.3.14.
 2026-05-04 07:55:24 +10:00
PapaTramp fe600790e8 docs(license): update copyright holder name 2026-05-03 18:55:00 +10:00
PapaTramp 11736501ec chore: add MIT LICENSE 2026-05-03 18:54:16 +10:00
PapaTramp e96131d722 docs: refresh README, add English README_eng.md 
Document daily report, deploy marker, SkipScheduledTaskMaintenance, and legacy watchdog scripts. Add full English translation.
 2026-05-03 18:52:18 +10:00
PapaTramp 99be51467e Refine RD Gateway 303 semantics and show deploy update timestamp 2026-04-30 16:55:30 +10:00
PapaTramp d26784fb7f Refresh README for current ProgramData + Deploy workflow 2026-04-30 16:43:14 +10:00
PapaTramp 02424875fb Add repository search keywords to README 2026-04-30 16:34:26 +10:00
PapaTramp 0e2b3f2534 Clarify manual deploy option for small server fleets 2026-04-30 16:31:33 +10:00
PapaTramp b6ac34a52d Add periodic deploy task installer and docs for rarely rebooted servers 2026-04-30 16:21:42 +10:00
PapaTramp a37a639be1 Fix RD Gateway 302/303 field mapping (XML + updated Properties layout). 
Bump version to 1.3.12.
 2026-04-30 16:05:21 +10:00
PapaTramp 1c14eec3cd Update DEPLOY.md with a tested GPO startup setup and troubleshooting notes. 
Document PowerShell Startup tab usage, security filtering for computer groups, SYSVOL/NETLOGON behavior, reboot expectations, and where to inspect logs.
 2026-04-29 17:47:21 +10:00
PapaTramp cc8925f88a Start main task immediately after InstallTasks and include script version in startup notification. 
Also bump script/version.txt to 1.3.11 for rollout tracking.
 2026-04-29 16:45:13 +10:00
PapaTramp a20055f9d3 Singleton lock: DeleteOnClose, Ctrl+C propagates, release in finally (v1.3.9) 2026-04-29 16:23:16 +10:00
PapaTramp 313cc189e9 v1.3.5: путь скрипта при Start-Process, диагностика watchdog, DEPLOY.md 2026-04-29 16:13:14 +10:00