Real SAC/Telegram tokens and org paths back in example and NETLOGON publish script. Deploy now treats sac.example.com and sac_CHANGE_ME as unconfigured and overwrites from example.
Co-authored-by: Cursor <cursoragent@cursor.com>
Enable Rcm1149 monitoring on servers when RCM journal is available; dedup 1149 notifications like 4624.
Co-authored-by: Cursor <cursoragent@cursor.com>
Production tokens and NETLOGON paths live on kalinamall/papatramp only. Use scripts/Push-PrivateMirror.ps1 after feature pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Real Telegram/SAC tokens, NETLOGON and org hostnames back on kalinamall. GitHub main keeps placeholders; use scripts/Push-PrivateMirror.ps1 after public pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace \\B26\\NETLOGON with \\dc.contoso.local\\NETLOGON.
Remove scripts/ mirror tools and tools/Push-KalinamallOnly.ps1.
Sanitize login_monitor.settings.example (placeholders, no secrets).
Simplify update-rdp-monitor.ps1 to use origin remote only.
Keep dev tooling under tools/ only.
Co-authored-by: Cursor <cursoragent@cursor.com>
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add deploy-time patch when login_monitor.settings.ps1 lacks MaxBackupDays,
enable the setting in example, and remove duplicate default in Login_Monitor.ps1.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add configurable `${Ignore4624-LT3-EmptyIP-Event}` for RDP monitor to suppress noisy 4624 network logons with empty IP (-) on mail/Exchange hosts.
Update settings example and README with usage instructions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deploy overwrites login_monitor.settings.ps1 from the trusted example when
Sac-Client.ps1 or SacApiKey/UseSAC are missing, with a .bak backup. Skips
overwrite when SAC is already configured; continues deploy on version match
if SAC bootstrap is still required.
Секреты, SMTP, 4740 и IP-исключения больше не в Login_Monitor.ps1 —
не слетают при автообновлении с NETLOGON. Deploy создаёт settings из example при первой установке.
PapaTramp