PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
162 Commits 1 Branch 0 Tags
f48aee1d9394ded68d0500a2045f0ec9b9f09f50
Commit Graph

7 Commits

Author SHA1 Message Date
PapaTramp f48aee1d93 feat: persistent Security poll cursor with lookback replay (2.0.36-SAC) 
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-16 09:39:43 +10:00
PapaTramp 6ee5fdcbf2 fix: normalize ExecutionTimeLimit PT0S and load TaskQuery locally (2.0.33-SAC) 
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 15:27:38 +10:00
PapaTramp 5e9939724c fix: deploy TaskQuery script scope and internal autotests (2.0.32-SAC) 
Publish TaskQuery helpers to script scope after import so deploy checks work from nested callers; add kalinamall-only smoke tests and RDP_DEPLOY_FUNCTIONS_ONLY hook.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 15:15:42 +10:00
PapaTramp 550cea9759 fix: RD Gateway startup replay, 1226 benign, SAC occurred_at (2.0.14-SAC) 
Persist RD Gateway poll cursor to avoid replaying 302/303 on monitor restart;
treat ErrorCode 1226 as normal disconnect; pass event TimeCreated to SAC ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:42:03 +10:00
PapaTramp 33367b05a8 fix: parse RD Gateway EventInfo XML and skip ephemeral 303 alerts 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:07:51 +10:00
PapaTramp c249451eba fix: deploy syncs Sac-Client bundle, SAC dual settings, and ServerDisplayName hint (1.2.20-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 15:55:16 +10:00
PapaTramp 1f27272883 fix: dedup 4624 login alerts and log Skip/dedup reasons (1.2.18-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 15:17:01 +10:00