chore(home): mirror from kalinamall (038363c) with papatramp URLs

.gitignore

@@ -1,3 +1,8 @@
-.cursor/
+.cursor/
 tools/*.log
 *.log
+*.bak
+Logs/
+sac-spool/
+login_monitor.settings.ps1
+exchange_monitor.settings.ps1

Deploy-LoginMonitor.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Доставка Login_Monitor.ps1 с файловой шары по версии (домен: ПК и серверы).
 .DESCRIPTION

Diagnose-RdpLoginMonitor.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Диагностика RDP Login Monitor после входа по RDP (или при «тишине» в Telegram/SAC).
 .DESCRIPTION

Docs/exchange-mail-security.md

@@ -1,4 +1,4 @@
-# Exchange Mail Security — руководство
+# Exchange Mail Security — руководство
 
 Скрипт **`Exchange-MailSecurity.ps1`** предназначен **только для сервера Microsoft Exchange** с Exchange Management Shell (EMS). Не устанавливается на все компьютеры домена через GPO RDP-монитора.
 
@@ -68,6 +68,16 @@
 - Каналы: **Telegram** и/или **Email** (модуль **`Notify-Common.ps1`**).
 - Пересылка: **`$AlertOnlyOnNewForwardingFindings = $true`** — алерт при **новой** находке (`Logs\exchange_forwarding_baseline.json`).
 - **Первый скан:** **`$SuppressAlertsOnFirstBaselineRun = $true`** (по умолчанию) — существующие пересылки **только в baseline**, без всплеска алертов; одна **сводка** (`$SendInboxScanSummary`).
+
+### Dry-run перед первым Inbox-сканом
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\dc.contoso.local\NETLOGON\RDP-login-monitor\Exchange-MailSecurity.ps1" -Mode Inbox -WhatIf
+```
+
+`-WhatIf` подключает EMS, считает объём (`Get-Mailbox` / VIP-фильтр), **не вызывает** `Get-InboxRule`, не шлёт уведомления и не пишет baseline. Рекомендуется перед `-InstallTasks` и первым ночным `-Mode Inbox`.
+
+При полном скане без VIP скрипт пишет **WARN** в лог; проблемные ящики — в **`$SkipInboxScanMailboxes`**.
 - Далее — алерт только при **новых** или **изменённых** пересылках (в т.ч. включили ранее отключённое правило).
 - **`$NotifyWhenForwardingScanClean = $false`** — не слать «всё чисто» при нуле находок.
 

Encrypt-DpapiForRdpMonitor.ps1

@@ -1,4 +1,4 @@
-# Запуск: от администратора на ТОМ ЖЕ компьютере, где будет Login_Monitor.ps1.
+# Запуск: от администратора на ТОМ ЖЕ компьютере, где будет Login_Monitor.ps1.
 # Результат (Base64) вставьте в login_monitor.settings.ps1 или exchange_monitor.settings.ps1:
 # $TelegramBotTokenProtectedB64 / $TelegramChatIDProtectedB64 / $MailSmtpPasswordProtectedB64.
 param(

Exchange-MailSecurity.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Мониторинг Exchange: очереди транспорта, пересылка на внешние адреса (Inbox rules + mailbox forwarding + transport rules).
 .DESCRIPTION
@@ -10,12 +10,13 @@
     Опционально: exchange_monitor.settings.ps1 в том же каталоге (секреты, whitelist).
 #>
 
-[CmdletBinding()]
+[CmdletBinding(SupportsShouldProcess = $true)]
 param(
     [ValidateSet('Queues', 'Inbox', 'Watchdog')]
     [string]$Mode = 'Queues',
     [switch]$InstallTasks,
-    [switch]$Watchdog
+    [switch]$Watchdog,
+    [switch]$WhatIf
 )
 
 Set-StrictMode -Version Latest
@@ -25,7 +26,7 @@ $ErrorActionPreference = 'Stop'
 # КОНФИГУРАЦИЯ
 # ============================================
 
-$ScriptVersion = '1.6.7'
+$ScriptVersion = '1.6.8'
 $script:InstallRoot = [System.IO.Path]::GetFullPath("$env:ProgramData\RDP-login-monitor")
 $script:CanonicalScriptName = 'Exchange-MailSecurity.ps1'
 $LogFile = Join-Path $script:InstallRoot 'Logs\exchange_mail_security.log'
@@ -100,6 +101,18 @@ if (Test-Path -LiteralPath $SettingsFile) {
     . $SettingsFile
 }
 
+function Write-ExchangeScanSafetyWarnings {
+    if (-not $SuppressAlertsOnFirstBaselineRun) {
+        Write-ExchLog 'WARN: SuppressAlertsOnFirstBaselineRun=$false — первый Inbox-скан может разослать алерты по всем уже существующим пересылкам.'
+    }
+    if (-not $VipMailboxesOnly -and $MaxMailboxesPerRun -le 0 -and $ScanInboxRules) {
+        Write-ExchLog 'WARN: полный скан Inbox rules по всем ящикам (VipMailboxesOnly=$false). Рекомендуется пилот: VipMailboxesOnly=$true или -Mode Inbox -WhatIf.'
+    }
+    if (@($SkipInboxScanMailboxes | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }).Count -eq 0) {
+        Write-ExchLog 'TIP: добавьте проблемные ящики в $SkipInboxScanMailboxes, если Get-InboxRule падает (corrupt rule store).'
+    }
+}
+
 function Write-NotifyLog {
     param([string]$Message)
     Write-ExchLog $Message
@@ -235,6 +248,7 @@ if ($InstallTasks) {
         Send-ExchangeInstallNotification
         Write-ExchLog 'InstallTasks: install notification sent'
     }
+    Write-ExchLog 'InstallTasks: перед первым ночным Inbox-сканом выполните: Exchange-MailSecurity.ps1 -Mode Inbox -WhatIf'
     exit 0
 }
 
@@ -518,6 +532,15 @@ function Invoke-ExchangeQueueScan {
     Write-ExchLog "Queues: threshold MessageCount > $QueueMessageCountThreshold"
 
     $queues = @(Get-Queue -ErrorAction Stop)
+    if ($WhatIf) {
+        $hot = @($queues | Where-Object { $_.MessageCount -gt $QueueMessageCountThreshold })
+        Write-ExchLog "WhatIf: queues total=$($queues.Count), above threshold=$($hot.Count) — alerts skipped"
+        foreach ($q in $hot) {
+            Write-ExchLog "WhatIf: would alert queue=$($q.Identity) messages=$($q.MessageCount)"
+        }
+        return
+    }
+
     $hot = @($queues | Where-Object { $_.MessageCount -gt $QueueMessageCountThreshold })
     $state = Get-QueueAlertState
     $now = Get-Date
@@ -760,6 +783,20 @@ function Send-ExchangeInboxScanSummary {
 function Invoke-ExchangeInboxAndForwardingScan {
     $scopeLabel = Get-ExchangeInboxScanScopeLabel
     Write-ExchLog "Inbox/Forwarding scan v$ScriptVersion; scope: $scopeLabel; notify: $(Get-NotifyChainHuman)"
+    if ($WhatIf) {
+        $null = Import-ExchangeManagementShell
+        $internalDomains = Get-InternalAcceptedDomainNames
+        Write-ExchLog "WhatIf: accepted domains: $(@($internalDomains) -join ', ')"
+        $mailboxCount = 0
+        if ($ScanInboxRules) {
+            $mailboxes = @(Get-MailboxListForScan)
+            $mailboxCount = $mailboxes.Count
+            Write-ExchLog "WhatIf: would scan $mailboxCount mailboxes ($scopeLabel); Get-InboxRule not called"
+        }
+        Write-ExchLog "WhatIf: ScanMailboxForwarding=$ScanMailboxForwarding ScanTransportRules=$ScanTransportRules — no alerts, no baseline write"
+        return
+    }
+
     $null = Import-ExchangeManagementShell
     $internalDomains = Get-InternalAcceptedDomainNames
     Write-ExchLog "Accepted domains (internal): $(@($internalDomains) -join ', ')"
@@ -879,7 +916,8 @@ if (-not (Test-RunningElevated)) {
     Write-ExchLog 'WARNING: not running elevated - EMS/tasks may fail.'
 }
 
-Write-ExchLog "=== Exchange-MailSecurity v$ScriptVersion Mode=$Mode ==="
+Write-ExchLog "=== Exchange-MailSecurity v$ScriptVersion Mode=$Mode$(if ($WhatIf) { ' WhatIf' }) ==="
+Write-ExchangeScanSafetyWarnings
 
 try {
     switch ($Mode) {

Install-DeployScheduledTask.ps1

@@ -1,4 +1,4 @@
-#Requires -RunAsAdministrator
+#Requires -RunAsAdministrator
 [CmdletBinding()]
 param(
     [string]$TaskName = "RDP-Login-Monitor-Deploy",

Install-ScheduledTasks.ps1

@@ -1,87 +0,0 @@
-#Requires -RunAsAdministrator
-<#
-.SYNOPSIS
-    Регистрирует в Планировщике заданий основной монитор и watchdog (как в README).
-.DESCRIPTION
-    Запускайте из повышенной PowerShell. Пути по умолчанию — D:\Soft\.
-    Watchdog использует Watchdog_RDP_Monitor.ps1 из репозитория (проверка процесса и heartbeat).
-#>
-[CmdletBinding()]
-param(
-    [string]$InstallRoot = "D:\Soft",
-    [string]$MainTaskName = "RDP Login Monitor",
-    [string]$WatchdogTaskName = "RDP Login Monitor Watchdog",
-    [int]$WatchdogRepeatMinutes = 5,
-    [int]$MainStartupRandomDelayMinutes = 1,
-    [int]$WatchdogStartupRandomDelayMinutes = 2
-)
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = "Stop"
-
-$LoginScriptPath = Join-Path $InstallRoot "Login_Monitor.ps1"
-$WatchdogScriptPath = Join-Path $InstallRoot "Watchdog_RDP_Monitor.ps1"
-$LogsDir = Join-Path $InstallRoot "Logs"
-
-if (-not (Test-Path -LiteralPath $LoginScriptPath)) {
-    throw "Не найден основной скрипт: $LoginScriptPath"
-}
-if (-not (Test-Path -LiteralPath $WatchdogScriptPath)) {
-    throw "Не найден watchdog: $WatchdogScriptPath"
-}
-if (-not (Test-Path -LiteralPath $LogsDir)) {
-    New-Item -ItemType Directory -Path $LogsDir -Force | Out-Null
-}
-
-$principal = New-ScheduledTaskPrincipal `
-    -UserId "NT AUTHORITY\SYSTEM" `
-    -LogonType ServiceAccount `
-    -RunLevel Highest
-
-# --- Задание 1: основной монитор ---
-$mainArgs = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$LoginScriptPath`""
-$mainAction = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument $mainArgs
-$mainTrigger = New-ScheduledTaskTrigger -AtStartup -RandomDelay (New-TimeSpan -Minutes $MainStartupRandomDelayMinutes)
-$mainSettings = New-ScheduledTaskSettingsSet `
-    -AllowStartIfOnBatteries `
-    -DontStopIfGoingOnBatteries `
-    -StartWhenAvailable `
-    -MultipleInstances IgnoreNew `
-    -ExecutionTimeLimit ([TimeSpan]::Zero)
-
-Register-ScheduledTask `
-    -TaskName $MainTaskName `
-    -Action $mainAction `
-    -Trigger $mainTrigger `
-    -Principal $principal `
-    -Settings $mainSettings `
-    -Force | Out-Null
-
-Write-Host "Создано задание: $MainTaskName" -ForegroundColor Cyan
-
-# --- Задание 2: watchdog (старт + периодический запуск, как в README) ---
-$wdArgs = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$WatchdogScriptPath`""
-$wdAction = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument $wdArgs
-$wdTriggerStartup = New-ScheduledTaskTrigger -AtStartup -RandomDelay (New-TimeSpan -Minutes $WatchdogStartupRandomDelayMinutes)
-$repeatDuration = New-TimeSpan -Days 3650
-$anchor = (Get-Date).AddMinutes([Math]::Max(3, $WatchdogRepeatMinutes))
-$wdTriggerRepeat = New-ScheduledTaskTrigger -Once -At $anchor `
-    -RepetitionInterval (New-TimeSpan -Minutes $WatchdogRepeatMinutes) `
-    -RepetitionDuration $repeatDuration
-
-$wdSettings = New-ScheduledTaskSettingsSet `
-    -AllowStartIfOnBatteries `
-    -DontStopIfGoingOnBatteries `
-    -StartWhenAvailable `
-    -MultipleInstances IgnoreNew
-
-Register-ScheduledTask `
-    -TaskName $WatchdogTaskName `
-    -Action $wdAction `
-    -Trigger @($wdTriggerStartup, $wdTriggerRepeat) `
-    -Principal $principal `
-    -Settings $wdSettings `
-    -Force | Out-Null
-
-Write-Host "Создано задание: $WatchdogTaskName (триггеры: при старте ОС и каждые $WatchdogRepeatMinutes мин.)" -ForegroundColor Cyan
-Write-Host "Готово. При необходимости сразу запустите: Start-ScheduledTask -TaskName '$MainTaskName'" -ForegroundColor Green

Login_Monitor.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Мониторинг логинов/попыток входа с уведомлениями в Telegram
 .DESCRIPTION
@@ -90,7 +90,7 @@ $script:SkipLogDetailLimit = 15
 # строки ниже, если правки «мелкие» и вы не хотите менять отображаемую версию в логах).
 # Рекомендация: при значимых релизах меняйте и $ScriptVersion, и version.txt одинаково; при только
 # исправлениях на шаре — достаточно поднять patch в version.txt (например 1.3.0.1).
-$ScriptVersion = "2.1.9-SAC"
+$ScriptVersion = "2.1.15-SAC"
 
 # Логи (все под InstallRoot)
 $LogFile = Join-Path $script:InstallRoot "Logs\login_monitor.log"
@@ -1140,6 +1140,9 @@ if (-not (Test-Administrator)) {
 Write-Log "Скрипт запущен с правами администратора, версия $ScriptVersion"
 if ($script:LoginMonitorSettingsLoaded) {
     Write-Log "Настройки: login_monitor.settings.ps1 загружен."
+    if ($SacTlsSkipVerify) {
+        Write-Log 'CRITICAL: SacTlsSkipVerify=$true — проверка TLS для SAC отключена (риск MITM). Только для краткого отладочного окна в lab.'
+    }
 } else {
     Write-Log "Предупреждение: login_monitor.settings.ps1 не найден — Telegram/SMTP/4740 не настроены (скопируйте login_monitor.settings.example.ps1)."
 }
@@ -1536,6 +1539,122 @@ function Test-RcmLogAvailable {
     }
 }
 
+function Get-Rcm1149UserDataEventInfoMap {
+    param($Event)
+
+    $map = @{}
+    try {
+        $xml = [xml]$Event.ToXml()
+        $userData = $xml.Event.UserData
+        if ($null -eq $userData) { return $map }
+
+        $eventXml = $userData.EventXML
+        if ($null -eq $eventXml) {
+            foreach ($child in @($userData.ChildNodes)) {
+                if ($null -ne $child -and $child.LocalName -eq 'EventXML') {
+                    $eventXml = $child
+                    break
+                }
+            }
+        }
+        if ($null -eq $eventXml) { return $map }
+
+        foreach ($node in @($eventXml.ChildNodes)) {
+            if ($null -eq $node -or $node.NodeType -ne [System.Xml.XmlNodeType]::Element) { continue }
+            $map[$node.LocalName] = [string]$node.InnerText
+        }
+    } catch { }
+    return $map
+}
+
+function Resolve-Rcm1149UsernameFromParts {
+    param(
+        [string]$Param1,
+        [string]$Param2
+    )
+
+    $p1 = if ($null -ne $Param1) { $Param1.Trim() } else { '' }
+    $p2 = if ($null -ne $Param2) { $Param2.Trim() } else { '' }
+    if ([string]::IsNullOrWhiteSpace($p1)) { return $null }
+    if ($p1 -match '[\\@]') { return $p1 }
+    if (-not [string]::IsNullOrWhiteSpace($p2)) {
+        return "$p2\$p1"
+    }
+    return $p1
+}
+
+function Get-Rcm1149UsernameFromQwinsta {
+    <#
+      На части ПК (наблюдалось на Win10 Pro) RCM 1149 пишет пустые Param1/Param2,
+      хотя сеанс уже есть в qwinsta. Берём единственную RDP-сессию (rdp-tcp#N / Disc).
+      Состояния локализованы (Активно/Listen/…) — не завязываемся на английский STATE.
+    #>
+    $qwExe = Join-Path $env:SystemRoot 'System32\qwinsta.exe'
+    if (-not (Test-Path -LiteralPath $qwExe)) { return $null }
+
+    $prevEa = $ErrorActionPreference
+    $rawLines = @()
+    try {
+        $ErrorActionPreference = 'SilentlyContinue'
+        $rawLines = @(& $qwExe 2>&1 | ForEach-Object { [string]$_ })
+    } catch {
+        return $null
+    } finally {
+        $ErrorActionPreference = $prevEa
+    }
+
+    $candidates = [System.Collections.Generic.List[string]]::new()
+    foreach ($raw in $rawLines) {
+        $text = if ($null -ne $raw) { $raw.Trim() } else { '' }
+        if ([string]::IsNullOrWhiteSpace($text)) { continue }
+        if ($text -match '(?i)^SESSION') { continue }
+        if ($text -match '^-+$') { continue }
+
+        $parts = @($text -split '\s+' | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+        if ($parts.Count -lt 2) { continue }
+
+        $idIdx = -1
+        $sid = -1
+        for ($i = 0; $i -lt $parts.Count; $i++) {
+            $token = $parts[$i].TrimStart('>')
+            if ($token -match '^\d+$') {
+                $idIdx = $i
+                $sid = [int]$token
+                break
+            }
+        }
+        if ($idIdx -lt 1) { continue }
+        # Listener «rdp-tcp» / ID 65536 — не пользовательская сессия.
+        if ($sid -eq 65536) { continue }
+
+        $before = @($parts[0..($idIdx - 1)])
+        if ($before.Count -eq 1) {
+            $sessionName = ''
+            $userName = $before[0].TrimStart('>')
+        } else {
+            $sessionName = $before[0].TrimStart('>')
+            $userName = $before[1]
+        }
+        if ([string]::IsNullOrWhiteSpace($userName)) { continue }
+        if ($userName -match '(?i)^(services|console|rdp-tcp)$') { continue }
+        if ($sessionName -match '(?i)^console$') { continue }
+        if ($sessionName -match '(?i)^rdp-tcp$' -and $sessionName -notmatch '#') { continue }
+
+        $isRdpNamed = $sessionName -match '(?i)^rdp-tcp#\d+'
+        $isDiscBare = [string]::IsNullOrWhiteSpace($sessionName)
+        if (-not ($isRdpNamed -or $isDiscBare)) { continue }
+
+        if (-not $candidates.Contains($userName)) {
+            [void]$candidates.Add($userName)
+        }
+    }
+
+    if ($candidates.Count -eq 1) {
+        return $candidates[0]
+    }
+    return $null
+}
+
 function Get-Rcm1149EventInfo {
     param($Event)
     $eventData = @{
@@ -1545,25 +1664,49 @@ function Get-Rcm1149EventInfo {
     }
     try {
         $map = Get-EventDataMap -Event $Event
+        $userDataMap = Get-Rcm1149UserDataEventInfoMap -Event $Event
         $user = Get-FirstNonEmptyMapValue -DataMap $map -Keys @(
             "TargetUser","User","Domain User","Param1","AccountName","ConnectionUser","SubjectUserName"
         )
         $ip = Get-FirstNonEmptyMapValue -DataMap $map -Keys @(
             "ClientIP","Client Address","IpAddress","Ip","Param3","Address","CallingStationId"
         )
-        if (-not [string]::IsNullOrWhiteSpace($user)) { $eventData.Username = [string]$user }
-        if (-not [string]::IsNullOrWhiteSpace($ip)) { $eventData.ClientIP = [string]$ip }
-
-        if ($eventData.Username -eq '-' -and $Event.Properties.Count -gt 0) {
-            $eventData.Username = [string]$Event.Properties[0].Value
+        if ([string]::IsNullOrWhiteSpace($user)) {
+            $user = Resolve-Rcm1149UsernameFromParts -Param1 $userDataMap['Param1'] -Param2 $userDataMap['Param2']
         }
-        if ($eventData.ClientIP -eq '-') {
-            if ($Event.Properties.Count -gt 2) {
-                $eventData.ClientIP = [string]$Event.Properties[2].Value
-            } elseif ($Event.Properties.Count -gt 1) {
-                $eventData.ClientIP = [string]$Event.Properties[1].Value
+        if ([string]::IsNullOrWhiteSpace($ip)) {
+            $ip = Get-FirstNonEmptyMapValue -DataMap $userDataMap -Keys @('Param3', 'Param2', 'Param1')
+        }
+        if (-not [string]::IsNullOrWhiteSpace($user)) { $eventData.Username = [string]$user }
+        if (-not [string]::IsNullOrWhiteSpace($ip)) {
+            $eventData.ClientIP = Get-RdpMonitorNormalizedClientIp -Value ([string]$ip)
+        }
+
+        if (($eventData.Username -eq '-' -or [string]::IsNullOrWhiteSpace($eventData.Username)) -and $Event.Properties.Count -gt 0) {
+            $p0 = [string]$Event.Properties[0].Value
+            if (-not [string]::IsNullOrWhiteSpace($p0)) {
+                $eventData.Username = $p0
             }
         }
+        if ($eventData.ClientIP -eq '-' -or [string]::IsNullOrWhiteSpace($eventData.ClientIP)) {
+            if ($Event.Properties.Count -gt 2) {
+                $p2 = [string]$Event.Properties[2].Value
+                if (-not [string]::IsNullOrWhiteSpace($p2)) {
+                    $eventData.ClientIP = Get-RdpMonitorNormalizedClientIp -Value $p2
+                }
+            } elseif ($Event.Properties.Count -gt 1) {
+                $p1 = [string]$Event.Properties[1].Value
+                if (-not [string]::IsNullOrWhiteSpace($p1)) {
+                    $eventData.ClientIP = Get-RdpMonitorNormalizedClientIp -Value $p1
+                }
+            }
+        }
+        if ([string]::IsNullOrWhiteSpace($eventData.Username) -or $eventData.Username -eq '-') {
+            $eventData.Username = '-'
+        }
+        if ([string]::IsNullOrWhiteSpace($eventData.ClientIP) -or $eventData.ClientIP -eq '-') {
+            $eventData.ClientIP = '-'
+        }
     } catch {
         Write-Log "Ошибка разбора события RCM 1149: $($_.Exception.Message)"
     }
@@ -3036,10 +3179,13 @@ function Parse-RdpMonitorIgnoreListLine {
     if ($line[0] -eq '#' -or $line[0] -eq ';') { return $null }
     if ($line.StartsWith([char]0xFEFF)) { $line = $line.TrimStart([char]0xFEFF) }
 
-    $scopes = @('4624', '4625')
+    $scopes = @('4624', '4625', '4634', '4647')
     if ($line -match '^(?i)(4740|lockout|блокир)\s*:\s*(.+)$') {
         $scopes = @('4740')
         $line = $Matches[2].Trim()
+    } elseif ($line -match '^(?i)(logoff|logout|4634|4647)\s*:\s*(.+)$') {
+        $scopes = @('4634', '4647')
+        $line = $Matches[2].Trim()
     } elseif ($line -match '^(?i)(shadow|20506)\s*:\s*(.+)$') {
         $scopes = @('20506', '20507', '20510')
         $line = $Matches[2].Trim()
@@ -3050,7 +3196,7 @@ function Parse-RdpMonitorIgnoreListLine {
         $scopes = @('5140')
         $line = $Matches[2].Trim()
     } elseif ($line -match '^(?i)(all|\*)\s*:\s*(.+)$') {
-        $scopes = @('4624', '4625', '4740', '20506', '20507', '20510', 'winrm', '5140')
+        $scopes = @('4624', '4625', '4634', '4647', '4740', '20506', '20507', '20510', 'winrm', '5140')
         $line = $Matches[2].Trim()
     }
     if ([string]::IsNullOrWhiteSpace($line)) { return $null }
@@ -3235,7 +3381,7 @@ function Should-IgnoreEvent {
         if ($Username -like $p) { return $true }
     }
 
-    if ($EventID -ne 1149) {
+    if ($EventID -ne 1149 -and $EventID -notin 4634, 4647) {
         if ($ComputerName -eq "Authz" -or $ComputerName -like "Authz*") { return $true }
         if ($ComputerName -eq "NtLmSsp" -or $ComputerName -like "NtLmSsp*" -or $ComputerName -like "*NtLmSsp*") { return $true }
     }
@@ -3248,14 +3394,14 @@ function Should-IgnoreEvent {
     }
 
     if ($SourceIP -eq "127.0.0.1" -or $SourceIP -like "fe80:*") { return $true }
-    # RCM 1149 не содержит WorkstationName; caller передаёт ComputerName='-'.
-    if ($EventID -ne 1149 -and ($ComputerName -eq "-" -or $ComputerName -eq "N/A")) { return $true }
+    # RCM 1149 и logoff 4634/4647 часто без WorkstationName в EventData.
+    if ($EventID -notin 1149, 4634, 4647 -and ($ComputerName -eq "-" -or $ComputerName -eq "N/A")) { return $true }
 
     foreach ($pattern in $ExcludedComputerPatterns) {
         if ($ComputerName -like $pattern) { return $true }
     }
 
-    if ($EventID -in 4624, 4625, 1149) {
+    if ($EventID -in 4624, 4625, 4634, 4647, 1149) {
         if (Test-RdpMonitorIgnoreListMatch -EventId ([string]$EventID) -Username $Username `
                 -ComputerName $ComputerName -SourceIP $SourceIP) {
             return $true
@@ -3275,6 +3421,7 @@ function Get-LoginEventInfo {
         SourceIP = "-"
         ProcessName = "-"
         LogonType = 0
+        SessionId = $null
     }
 
     try {
@@ -3292,6 +3439,17 @@ function Get-LoginEventInfo {
             $eventData.ProcessName = Get-FirstNonEmptyMapValue -DataMap $map -Keys @(
                 "SubStatus","Status","FailureReason","FailureReasonCode"
             )
+        } elseif ($Event.Id -in 4634, 4647) {
+            if ($Event.Id -eq 4647) {
+                $subjectUser = Get-FirstNonEmptyMapValue -DataMap $map -Keys @("SubjectUserName","AccountName")
+                if (-not [string]::IsNullOrWhiteSpace($subjectUser)) {
+                    $eventData.Username = $subjectUser
+                }
+            }
+            $sidRaw = Get-FirstNonEmptyMapValue -DataMap $map -Keys @("TargetLogonId","SubjectLogonId","LogonId")
+            if (-not [string]::IsNullOrWhiteSpace($sidRaw)) {
+                $eventData.SessionId = [string]$sidRaw.Trim()
+            }
         }
     } catch {
         Write-Log "Ошибка при извлечении данных события: $($_.Exception.Message)"
@@ -3364,6 +3522,8 @@ function Format-LoginEvent {
     $message = "<b>"
     if ($EventID -eq 4624) { $message += "✅ УСПЕШНЫЙ ВХОД" }
     elseif ($EventID -eq 4625) { $message += "❌ НЕУДАЧНАЯ ПОПЫТКА" }
+    elseif ($EventID -eq 4634) { $message += "🚪 ВЫХОД ИЗ СЕССИИ" }
+    elseif ($EventID -eq 4647) { $message += "🚪 ВЫХОД ПОЛЬЗОВАТЕЛЯ" }
     else { $message += "⚠️ СОБЫТИЕ" }
     $message += "</b>`r`n"
 
@@ -3384,6 +3544,7 @@ function Format-LoginEvent {
 
 $script:FailedLogonBuckets = @{}
 $script:LoginSuccessNotifyDedup = @{}
+$script:LogoffNotifyDedup = @{}
 
 function Get-RdpLoginNotifyDedupHostPart {
     param([string]$SecurityLogComputerName)
@@ -3442,6 +3603,33 @@ function Test-RdpLoginSuccessNotifyDedupAllow {
     return $true
 }
 
+function Get-RdpLogoffNotifyDedupKey {
+    param(
+        [string]$SecurityLogComputerName,
+        [string]$Username,
+        [int]$LogonType
+    )
+    $hostPart = Get-RdpLoginNotifyDedupHostPart -SecurityLogComputerName $SecurityLogComputerName
+    $userPart = Get-RdpLoginNotifyDedupUsernamePart -Username $Username
+    return "$hostPart|logoff|$userPart|$LogonType"
+}
+
+function Test-RdpLogoffNotifyDedupAllow {
+    param([string]$DedupKey)
+
+    if ($LoginSuccessNotifyDedupSeconds -le 0) { return $true }
+    $nowUtc = (Get-Date).ToUniversalTime()
+    if ($script:LogoffNotifyDedup.ContainsKey($DedupKey)) {
+        $lastUtc = $script:LogoffNotifyDedup[$DedupKey]
+        $delta = ($nowUtc - $lastUtc).TotalSeconds
+        if ($delta -ge 0 -and $delta -lt $LoginSuccessNotifyDedupSeconds) {
+            return $false
+        }
+    }
+    $script:LogoffNotifyDedup[$DedupKey] = $nowUtc
+    return $true
+}
+
 function Get-FailedLogonSourceKeyPart {
     param(
         [string]$SourceIP,
@@ -4500,7 +4688,7 @@ function Start-LoginMonitor {
         $lastWinRmCheckTime = (Get-Date).AddSeconds(-10)
         $lastAdminShare5140CheckTime = (Get-Date).AddSeconds(-10)
         $lastLockout4740CheckTime = (Get-Date).AddSeconds(-10)
-        $monitorEvents = @(4624, 4625, 4648)
+        $monitorEvents = @(4624, 4625, 4634, 4647, 4648)
 
         $script:MonitorInMainLoop = $true
         while ($true) {
@@ -4566,6 +4754,24 @@ function Start-LoginMonitor {
                         if ($event.Id -eq 4648) {
                             $shouldIgnore = $true
                             $ignoreReason = 'EventID 4648 excluded (MonitorInteractiveOnly)'
+                        } elseif ($event.Id -in 4634, 4647) {
+                            if (-not $osKind.IsWorkstation) {
+                                $shouldIgnore = $true
+                                $ignoreReason = 'logoff 4634/4647 only on workstations (server LT3 is Kerberos/LDAP noise)'
+                            } else {
+                                $interactiveTypes = @(10)
+                                $modeLabel = 'workstation logoff LT10'
+                                if ($interactiveTypes -notcontains $eventInfo.LogonType) {
+                                    $allow4647Workstation = (
+                                        $event.Id -eq 4647 -and
+                                        $eventInfo.LogonType -eq 0
+                                    )
+                                    if (-not $allow4647Workstation) {
+                                        $shouldIgnore = $true
+                                        $ignoreReason = "LogonType $($eventInfo.LogonType) not in $modeLabel"
+                                    }
+                                }
+                            }
                         } elseif ($event.Id -in 4624, 4625) {
                             if ($osKind.IsWorkstation) {
                                 $interactiveTypes = @(10)
@@ -4617,6 +4823,46 @@ function Start-LoginMonitor {
                         }
                     }
 
+                    if ($event.Id -in 4634, 4647) {
+                        $dedupKeyLogoff = Get-RdpLogoffNotifyDedupKey -SecurityLogComputerName $event.MachineName `
+                            -Username $eventInfo.Username -LogonType $eventInfo.LogonType
+                        if (-not (Test-RdpLogoffNotifyDedupAllow -DedupKey $dedupKeyLogoff)) {
+                            Write-Log "Notify dedup logoff $($event.Id): User=$($eventInfo.Username) LT=$($eventInfo.LogonType) (window ${LoginSuccessNotifyDedupSeconds}s)"
+                            continue
+                        }
+
+                        $formattedMessage = Format-LoginEvent -EventID $event.Id `
+                            -Username $eventInfo.Username `
+                            -ComputerName $eventInfo.ComputerName `
+                            -SourceIP $eventInfo.SourceIP `
+                            -ProcessName $eventInfo.ProcessName `
+                            -TimeCreated $eventInfo.TimeCreated `
+                            -LogonType $eventInfo.LogonType `
+                            -LogonTypeName $logonTypeName `
+                            -SecurityLogComputerName $event.MachineName
+
+                        $sacDetails = @{
+                            user = $eventInfo.Username
+                            ip_address = $eventInfo.SourceIP
+                            logon_type = $eventInfo.LogonType
+                            event_id_windows = [int]$event.Id
+                            workstation_name = $eventInfo.ComputerName
+                        }
+                        if ($null -ne $eventInfo.SessionId -and -not [string]::IsNullOrWhiteSpace([string]$eventInfo.SessionId)) {
+                            $sacDetails['session_id'] = [string]$eventInfo.SessionId
+                        }
+
+                        Write-Log "Notify logoff: ID=$($event.Id) User=$($eventInfo.Username) LT=$($eventInfo.LogonType) IP=$($eventInfo.SourceIP)"
+                        Send-MonitorNotification -Message $formattedMessage `
+                            -EmailSubject "RDP Login Monitor: выход (ID $($event.Id))" `
+                            -SacEventType 'rdp.session.logoff' -SacSeverity 'info' `
+                            -SacTitle "RDP session logoff $($event.Id)" `
+                            -SacSummary "Logoff $($event.Id) $($eventInfo.Username)" `
+                            -SacOccurredAt $eventInfo.TimeCreated `
+                            -SacDetails $sacDetails | Out-Null
+                        continue
+                    }
+
                     if ($event.Id -eq 4625 -and $FailedLogonRateLimitEnabled) {
                             $rl = Get-FailedLogonRateLimitDecision4625 -SourceIP $eventInfo.SourceIP `
                                 -ComputerName $eventInfo.ComputerName -Username $eventInfo.Username `
@@ -4779,6 +5025,13 @@ function Start-LoginMonitor {
                     foreach ($event in $rcmEvents) {
                         if ($event.TimeCreated -le $lastRcmCheckTime) { continue }
                         $rcmInfo = Get-Rcm1149EventInfo -Event $event
+                        if ($rcmInfo.Username -eq '-' -or [string]::IsNullOrWhiteSpace($rcmInfo.Username)) {
+                            $fromQw = Get-Rcm1149UsernameFromQwinsta
+                            if (-not [string]::IsNullOrWhiteSpace($fromQw)) {
+                                Write-Log "RCM 1149: EventLog user empty — qwinsta fallback User=$fromQw"
+                                $rcmInfo.Username = $fromQw
+                            }
+                        }
                         if ($rcmInfo.Username -like "*$") {
                             $rcmSkipped++
                             Write-Log "Skip 1149: User=$($rcmInfo.Username) IP=$($rcmInfo.ClientIP) — machine account"
@@ -4787,7 +5040,11 @@ function Start-LoginMonitor {
                         if (Should-IgnoreEvent -Username $rcmInfo.Username -ProcessName "-" `
                                 -ComputerName "-" -EventID 1149 -LogonType 10 -SourceIP $rcmInfo.ClientIP) {
                             $rcmSkipped++
-                            Write-Log "Skip 1149: User=$($rcmInfo.Username) IP=$($rcmInfo.ClientIP) — built-in exclusion or ignore.lst"
+                            $ud = Get-Rcm1149UserDataEventInfoMap -Event $event
+                            $p1 = if ($ud.ContainsKey('Param1')) { $ud['Param1'] } else { '' }
+                            $p2 = if ($ud.ContainsKey('Param2')) { $ud['Param2'] } else { '' }
+                            $p3 = if ($ud.ContainsKey('Param3')) { $ud['Param3'] } else { '' }
+                            Write-Log "Skip 1149: User=$($rcmInfo.Username) IP=$($rcmInfo.ClientIP) — built-in exclusion or ignore.lst (EventXML Param1=$p1 Param2=$p2 Param3=$p3)"
                             continue
                         }
 

README.md

@@ -1,6 +1,6 @@
 # RDP Login Monitor
 
-**Версия:** `2.1.5-SAC` (`$ScriptVersion` + `version.txt`)
+**Версия:** `2.1.14-SAC` (`$ScriptVersion` + `version.txt`)
 
 PowerShell-мониторинг Windows: RDP/RDS, RD Gateway, WinRM, admin share, блокировки УЗ, heartbeat, отчёты.
 
@@ -27,6 +27,7 @@ powershell -NoProfile -ExecutionPolicy Bypass -File "\\<DC>\NETLOGON\RDP-login-m
 | Источник | Тип SAC |
 |----------|---------|
 | Security 4624/4625 | `rdp.login.*` |
+| Security 4634/4647 (прямой RDP, **только рабочая станция**, LT10) | `rdp.session.logoff` → закрытие сессии в SAC |
 | Security 5140 | `smb.admin_share.access` |
 | WinRM Operational 91 | `winrm.session.started` |
 | RD Gateway 302/303 | `rdg.connection.*` → flap 302→303 в SAC |

README_eng.md

@@ -1,6 +1,6 @@
 # RDP Login Monitor
 
-**Version:** `2.1.5-SAC` (`$ScriptVersion` + `version.txt`)
+**Version:** `2.1.14-SAC` (`$ScriptVersion` + `version.txt`)
 
 PowerShell toolkit for monitoring Windows logons with Telegram and/or Email (SMTP) notifications.
 
@@ -92,7 +92,7 @@ For domain deployment from a share you do not configure the scheduler on clients
 
 - **`-SkipScheduledTaskMaintenance`**: during normal monitor startup, skip verification/recreation of scheduled tasks (if you manage tasks only via **`-InstallTasks`** or manually).
 - **`Install-DeployScheduledTask.ps1`** — helper to run **`Deploy-LoginMonitor.ps1`** from a share on a schedule (see **[DEPLOY.md](DEPLOY.md)**).
-- **`Watchdog_RDP_Monitor.ps1`** and **`Install-ScheduledTasks.ps1`** — **alternate** layout with a separate watchdog script and default paths under **`D:\Soft`**. For new installs, prefer the built-in **`-Watchdog`** in **`Login_Monitor.ps1`** and tasks **`RDP-Login-Monitor`** / **`RDP-Login-Monitor-Watchdog`**.
+- Watchdog is built into **`Login_Monitor.ps1`** (`-Watchdog`); scheduled tasks **`RDP-Login-Monitor`** / **`RDP-Login-Monitor-Watchdog`** are registered by **`-InstallTasks`**.
 - **`ignore.lst.example`** in the repo is a template for **`ignore.lst`** to suppress selected Security notifications (see section 7).
 - **`login_monitor.settings.example.ps1`** — template for **`login_monitor.settings.ps1`** (Telegram, SMTP, 4740, local IP exclusions). Deploy may create `login_monitor.settings.ps1` from the example on first install.
 

RdpMonitor-TaskQuery.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Запрос задач планировщика RDP-login-monitor через schtasks /Query /XML (fallback для Get-ScheduledTask).
 #>

Restart-RdpLoginMonitor.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Graceful restart RDP Login Monitor без Stop-Process.
 .DESCRIPTION

Sac-Client.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Клиент Security Alert Center для RDP-login-monitor.
 .DESCRIPTION
@@ -420,6 +420,7 @@ function Test-SacShouldAttemptSend {
 function Invoke-SacTlsPrep {
     if (-not $SacTlsSkipVerify) { return }
     if (-not $script:SacTlsCallbackRegistered) {
+        Write-SacLog 'CRITICAL: SacTlsSkipVerify=$true — TLS certificate validation disabled for SAC (MITM risk). Use only for short-lived lab debugging.'
         [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
         $script:SacTlsCallbackRegistered = $true
     }

Watchdog_RDP_Monitor.ps1

@@ -1,117 +0,0 @@
-<#
-.SYNOPSIS
-    Watchdog для Login_Monitor.ps1
-.DESCRIPTION
-    Проверяет, запущен ли основной скрипт Login_Monitor.ps1.
-    Если нет — запускает его и пишет лог.
-    Дополнительно проверяет heartbeat-файл и перезапускает скрипт, если heartbeat "протух".
-#>
-
-[CmdletBinding()]
-param(
-    [string]$MainScriptPath = "D:\Soft\Login_Monitor.ps1",
-    [string]$HeartbeatFile = "D:\Soft\Logs\last_heartbeat.txt",
-    [int]$HeartbeatStaleMinutes = 90,
-    [string]$WatchdogLog = "D:\Soft\Logs\watchdog.log"
-)
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = "Stop"
-
-$script:Utf8BomEncoding = New-Object System.Text.UTF8Encoding $true
-$script:WatchdogLogBomChecked = $false
-
-function Ensure-FileStartsWithUtf8Bom {
-    param([Parameter(Mandatory = $true)][string]$Path)
-    if (-not (Test-Path -LiteralPath $Path)) { return }
-    $bytes = [System.IO.File]::ReadAllBytes($Path)
-    if ($bytes.Length -ge 3 -and $bytes[0] -eq 0xEF -and $bytes[1] -eq 0xBB -and $bytes[2] -eq 0xBF) { return }
-    $bom = [byte[]](0xEF, 0xBB, 0xBF)
-    $combined = New-Object byte[] ($bom.Length + $bytes.Length)
-    [Buffer]::BlockCopy($bom, 0, $combined, 0, $bom.Length)
-    if ($bytes.Length -gt 0) {
-        [Buffer]::BlockCopy($bytes, 0, $combined, $bom.Length, $bytes.Length)
-    }
-    [System.IO.File]::WriteAllBytes($Path, $combined)
-}
-
-function Write-WatchdogLog {
-    param([string]$Message)
-    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
-    $line = "$ts - $Message" + [Environment]::NewLine
-    $dir = Split-Path -Parent $WatchdogLog
-    if ($dir -and -not (Test-Path $dir)) {
-        New-Item -ItemType Directory -Path $dir -Force | Out-Null
-    }
-    if (-not $script:WatchdogLogBomChecked) {
-        Ensure-FileStartsWithUtf8Bom -Path $WatchdogLog
-        $script:WatchdogLogBomChecked = $true
-    }
-    [System.IO.File]::AppendAllText($WatchdogLog, $line, $script:Utf8BomEncoding)
-}
-
-function Get-MainScriptProcesses {
-    try {
-        $procs = Get-CimInstance Win32_Process -Filter "Name = 'powershell.exe' OR Name = 'pwsh.exe'" -ErrorAction Stop
-        return $procs | Where-Object { $_.CommandLine -and ($_.CommandLine -like "*$MainScriptPath*") }
-    } catch {
-        Write-WatchdogLog "Ошибка проверки процессов: $($_.Exception.Message)"
-        return @()
-    }
-}
-
-function Start-MainScript {
-    if (-not (Test-Path $MainScriptPath)) {
-        Write-WatchdogLog "Основной скрипт не найден: $MainScriptPath"
-        return
-    }
-    $args = "-NoProfile -ExecutionPolicy Bypass -File `"$MainScriptPath`""
-    Start-Process -FilePath "powershell.exe" -ArgumentList $args -WindowStyle Hidden | Out-Null
-    Write-WatchdogLog "Основной скрипт запущен: $MainScriptPath"
-}
-
-function Stop-MainScript {
-    $procs = Get-MainScriptProcesses
-    foreach ($p in $procs) {
-        try {
-            Stop-Process -Id $p.ProcessId -Force -ErrorAction Stop
-            Write-WatchdogLog "Остановлен зависший экземпляр PID=$($p.ProcessId)"
-        } catch {
-            Write-WatchdogLog "Ошибка остановки PID=$($p.ProcessId): $($_.Exception.Message)"
-        }
-    }
-}
-
-function Is-HeartbeatStale {
-    if (-not (Test-Path $HeartbeatFile)) {
-        Write-WatchdogLog "Heartbeat файл отсутствует: $HeartbeatFile"
-        return $true
-    }
-    try {
-        $raw = (Get-Content $HeartbeatFile -ErrorAction Stop | Select-Object -First 1).Trim()
-        if (-not $raw) { return $true }
-        $hb = [datetime]::ParseExact($raw, "dd.MM.yyyy HH:mm:ss", $null)
-        $age = (Get-Date) - $hb
-        return ($age.TotalMinutes -gt $HeartbeatStaleMinutes)
-    } catch {
-        Write-WatchdogLog "Ошибка чтения heartbeat: $($_.Exception.Message)"
-        return $true
-    }
-}
-
-$running = Get-MainScriptProcesses
-if (-not $running -or $running.Count -eq 0) {
-    Write-WatchdogLog "Основной скрипт не запущен, выполняю старт."
-    Start-MainScript
-    exit 0
-}
-
-if (Is-HeartbeatStale) {
-    Write-WatchdogLog "Heartbeat устарел, перезапускаю основной скрипт."
-    Stop-MainScript
-    Start-Sleep -Seconds 2
-    Start-MainScript
-} else {
-    Write-WatchdogLog "Проверка пройдена: процесс запущен, heartbeat свежий."
-}
-

exchange_monitor.settings.example.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Пример локальных настроек Exchange-MailSecurity.ps1
 .DESCRIPTION
@@ -29,11 +29,11 @@ $QueueMessageCountThreshold = 150
 # --- Пилот VIP (рекомендуется для первого запуска) ---
 # $VipMailboxesOnly = $true
 # $VipMailboxes = @(
-#     'director@example.com',
-#     'cfo@example.com'
+#     'director@kalinamall.ru',
+#     'cfo@kalinamall.ru'
 # )
 # $VipMailboxPatterns = @(
-#     '*@example.com'   # опционально: все ящики домена из Get-Mailbox
+#     '*@kalinamall.ru'   # опционально: все ящики домена из Get-Mailbox
 # )
 
 # Первый ночной скан: не слать сотни алертов по уже существующим пересылкам
@@ -46,9 +46,9 @@ $QueueMessageCountThreshold = 150
 # $SendInboxScanSummary = $true
 
 # Удалённый EMS (если скрипт не на Exchange)
-# $ExchangeServerFqdn = 'mail.example.com'
+# $ExchangeServerFqdn = 'fifth.kalinamall.ru'
 
 # Не сканировать Inbox rules (битое хранилище правил / Watson на Get-InboxRule)
 # $SkipInboxScanMailboxes = @(
-#     'k.selezneva@example.com'
+#     'k.selezneva@kalinamall.ru'
 # )

login_monitor.settings.example.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Локальные настройки Login_Monitor.ps1
 .DESCRIPTION
@@ -9,8 +9,8 @@
 #>
 
 # --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
-$TelegramBotToken = 'YOUR_BOT_TOKEN'
-$TelegramChatID = 'YOUR_CHAT_ID'
+$TelegramBotToken = '8239219522:AAEyOZX3cwNfgGOMDkf-mgjTIuoaOh5gF7I'
+$TelegramChatID = '2843230'
 # $TelegramBotTokenProtectedB64 = ''
 # $TelegramChatIDProtectedB64 = ''
 
@@ -29,15 +29,17 @@ $NotifyOrder = 'tg'
 # --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
 # $ServerDisplayName = 'UNMS Kalina'
 # --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
-# $ServerIPv4 = '10.0.0.10'
+# $ServerIPv4 = '192.168.160.57'
 
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
 $UseSAC = 'fallback'
-$SacUrl = 'https://sac.example.com'
-$SacApiKey = 'sac_CHANGE_ME'
-# $SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
-# $SacTimeoutSec = 12
+$SacUrl = 'https://sac.kalinamall.ru'
+$SacApiKey = 'sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8'
+$SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
+$SacTimeoutSec = 45
+$SacSpoolFlushMaxFiles = 50
+$SacSpoolMaxAgeHours = 72
 # $SacTlsSkipVerify = $false
 # $SacFallbackFailures = 5
 # $false = не слать report.daily.rdp с агента (суточный отчёт только из SAC)
@@ -58,6 +60,7 @@ $StartupRebootDetectMinutes = 5
 $GetInventory = $true
 
 # --- RDS Shadow Control + WinRM inbound (Enter-PSSession), severity warning ---
+# $EnableRcm1149Monitoring = 1            # RCM Operational 1149 (RDP auth; workstation + RDS server)
 # $EnableRcmShadowControlMonitoring = 1   # RCM Operational 20506/20507/20510
 # $EnableWinRmInboundMonitoring = 1       # WinRM Operational 91 (+ correlate Security 4624)
 # $EnableAdminShareMonitoring = 1         # Security 5140 C$/ADMIN$ (audit File Share)
@@ -69,7 +72,7 @@ $GetInventory = $true
 
 # --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
 $IgnoreAdvapiNetworkLogonSourceIps = @(
-    '10.0.0.1'
+    '192.168.160.57'
 )
 # --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
 # Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
@@ -82,9 +85,9 @@ $MaxBackupDays = 31
 
 # --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
 # Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
-$LockoutMonitorDomainController = 'DC01'
-$NetBiosDomainName = 'CONTOSO'
-$ExchangeIisLogPath = '\\mail.example.com\c$\inetpub\logs\LogFiles\W3SVC1'
+$LockoutMonitorDomainController = 'K6A-DC3'
+$NetBiosDomainName = 'B26'
+$ExchangeIisLogPath = '\\fifth.kalinamall.ru\c$\inetpub\logs\LogFiles\W3SVC1'
 $ExchangeServerHostForIisExclude = ''
 $ExchangeIisLogTailLines = 5000
 $ExchangeIisLogMinutesBeforeLockout = 30

scripts/Push-GitHubMirror.ps1

@@ -0,0 +1,39 @@
+# Push sanitized main to GitHub without leaving secrets on local main (kalinamall workflow).
+# Usage: .\scripts\Push-GitHubMirror.ps1
+param(
+    [string]$Remote = 'github',
+    [string]$Branch = 'main'
+)
+
+$ErrorActionPreference = 'Stop'
+$Root = Split-Path -Parent $PSScriptRoot
+Set-Location $Root
+
+git remote get-url $Remote 2>$null | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "remote not configured: $Remote"
+}
+
+if ((git status --porcelain)) {
+    throw 'working tree not clean; commit or stash first'
+}
+
+$before = (git rev-parse HEAD).Trim()
+Write-Output "local HEAD before GitHub push: $before"
+
+& "$PSScriptRoot\Sanitize-ForGitHub.ps1"
+& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target github
+& "$PSScriptRoot\Test-NoSecretsForGitHub.ps1"
+
+$status = git status --porcelain
+if (-not $status) {
+    Write-Output 'no changes after sanitize; pushing current HEAD to GitHub'
+    git push $Remote $Branch
+    exit 0
+}
+
+git add -A
+git commit -m "chore(github): sanitize secrets and sync public mirror URLs"
+git push --force-with-lease $Remote $Branch
+git reset --hard $before
+Write-Output "pushed $Remote/$Branch (force-with-lease mirror); local main restored to $before (production/kalinamall)"

scripts/Push-Mirror.ps1

@@ -1,4 +1,4 @@
-# Push main to a mirror remote with host-specific doc URLs, without leaving URL churn on main.
+# Push main to a mirror remote with host-specific doc URLs, without leaving URL churn on main.
 # Usage: .\scripts\Push-Mirror.ps1 github|kalinamall|papatramp
 param(
     [Parameter(Mandatory = $true)]
@@ -11,7 +11,7 @@ $Root = Split-Path -Parent $PSScriptRoot
 Set-Location $Root
 
 $remote = switch ($Target) {
-    'github' { 'origin' }
+    'github' { 'github' }
     'kalinamall' { 'kalinamall' }
     'papatramp' { 'papatramp' }
 }

scripts/Rewrite-GitHostUrls.ps1

@@ -1,4 +1,4 @@
-# Rewrite cross-repo URLs in tracked docs/config for the target Git host.
+# Rewrite cross-repo URLs in tracked docs/config for the target Git host.
 # Usage: .\scripts\Rewrite-GitHostUrls.ps1 github|kalinamall|papatramp
 param(
     [Parameter(Mandatory = $true)]
@@ -28,12 +28,12 @@ switch ($Target) {
 $BaseHost = $Base -replace '^https://', ''
 
 $patterns = @(
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`$1$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`$1$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`${1}$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`${1}$BlobSuffix/" }
+    @{ From = 'https://git\.kalinamall\.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
     @{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }
     @{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }
     @{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }

scripts/Sanitize-ForGitHub.ps1

@@ -0,0 +1,169 @@
+# Replace production-only values with public-safe placeholders (GitHub mirror).
+# Usage: .\scripts\Sanitize-ForGitHub.ps1
+# Reversible: production copies live on kalinamall/papatramp; restore via git reset --hard.
+param(
+    [switch]$WhatIf
+)
+
+$ErrorActionPreference = 'Stop'
+$Root = Split-Path -Parent $PSScriptRoot
+Set-Location $Root
+
+function Set-TrackedFileText {
+    param(
+        [Parameter(Mandatory = $true)][string]$RelativePath,
+        [Parameter(Mandatory = $true)][string]$Content
+    )
+    $path = Join-Path $Root $RelativePath
+    if ($WhatIf) {
+        Write-Output "WhatIf: would write $RelativePath"
+        return
+    }
+    $utf8Bom = New-Object System.Text.UTF8Encoding $true
+    [System.IO.File]::WriteAllText($path, $Content.TrimEnd() + "`r`n", $utf8Bom)
+    Write-Output "sanitized: $RelativePath"
+}
+
+$loginSettings = @'
+<#
+.SYNOPSIS
+    Локальные настройки Login_Monitor.ps1
+.DESCRIPTION
+    Скопируйте в C:\ProgramData\RDP-login-monitor\login_monitor.settings.ps1
+    и при необходимости отредактируйте. Deploy-LoginMonitor.ps1 не перезаписывает settings,
+    если SAC уже настроен (UseSAC не off и задан SacApiKey). При первой установке или апгрейде
+    с версии без SAC (нет Sac-Client.ps1 / пустой ключ) example копируется поверх с резервной .bak.
+#>
+
+# --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
+$TelegramBotToken = 'YOUR_BOT_TOKEN'
+$TelegramChatID = 'YOUR_CHAT_ID'
+# $TelegramBotTokenProtectedB64 = ''
+# $TelegramChatIDProtectedB64 = ''
+
+# --- Email (опционально) ---
+$NotifyOrder = 'tg'
+# $MailSmtpHost = 'smtp.example.com'
+# $MailSmtpPort = 587
+# $MailSmtpUser = ''
+# $MailSmtpPassword = ''
+# $MailFrom = 'monitor@example.com'
+# $MailTo = 'admin@example.com'
+# $MailSmtpStartTls = $true
+# $MailSmtpSsl = $false
+# $MailSmtpPasswordProtectedB64 = ''
+
+# --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
+# $ServerDisplayName = 'RDP-Server-01'
+# --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
+# $ServerIPv4 = '192.168.1.10'
+
+# --- Security Alert Center (SAC) ---
+# off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
+$UseSAC = 'fallback'
+$SacUrl = 'https://sac.example.com'
+$SacApiKey = 'sac_CHANGE_ME'
+$SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
+$SacTimeoutSec = 45
+$SacSpoolFlushMaxFiles = 50
+$SacSpoolMaxAgeHours = 72
+# $SacTlsSkipVerify = $false
+# $SacFallbackFailures = 5
+# $false = не слать report.daily.rdp с агента (суточный отчёт только из SAC)
+# В settings.ps1 используйте 1/0 или $true/$false — не пишите голое false без $
+$DailyReportEnabled = 1
+
+# --- Heartbeat SAC (agent.heartbeat): интервал в секундах; 14400 = 4 ч ---
+$HeartbeatInterval = 14400
+# Оповещение, если last_heartbeat.txt не обновлялся > множитель × интервал (2 × 4 ч = 8 ч)
+$HeartbeatStaleAlertMultiplier = 2
+# Poll SAC на команды qwinsta/logoff (сек); см. security-alert-center/docs/agent-control-plane.md
+# $SacCommandPollIntervalSec = 60
+
+# Окно (мин): LastBootUpTime + System 41/1074/6005/6008/6009 → «старт после перезагрузки ОС»
+$StartupRebootDetectMinutes = 5
+
+# --- Инвентаризация железа/ПО для SAC (agent.inventory, раз в 12 ч) ---
+$GetInventory = $true
+
+# --- RDS Shadow Control + WinRM inbound (Enter-PSSession), severity warning ---
+# $EnableRcm1149Monitoring = 1            # RCM Operational 1149 (RDP auth; workstation + RDS server)
+# $EnableRcmShadowControlMonitoring = 1   # RCM Operational 20506/20507/20510
+# $EnableWinRmInboundMonitoring = 1       # WinRM Operational 91 (+ correlate Security 4624)
+# $EnableAdminShareMonitoring = 1         # Security 5140 C$/ADMIN$ (audit File Share)
+# $WinRmIgnoreLocalSource = 1             # ::1, 127.0.0.1, fe80 (шум Exchange/локальный WinRM)
+# $WinRmIgnoreMachineAccounts = 1         # учётки, оканчивающиеся на $
+# $WinRmExchangeStrictMode = 1            # Exchange: user в Event 91 обязателен; 4624 только LogonProcess WinRM
+# HealthMailbox* уже в ExcludedUserPatterns скрипта
+# Проверка: powershell -File Login_Monitor.ps1 -CheckSac
+
+# --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
+$IgnoreAdvapiNetworkLogonSourceIps = @(
+    '192.168.1.10'
+)
+# --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
+# Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
+${Ignore4624-LT3-EmptyIP-Event} = $false
+
+# --- Ротация login_monitor.log и хранение бэкапов (Logs\Backup\LoginLog_*.bak) ---
+# $LogRotationHour = 0
+# $LogRotationMinute = 0
+$MaxBackupDays = 31
+
+# --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
+# Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
+$LockoutMonitorDomainController = 'dc01.contoso.local'
+$NetBiosDomainName = 'CONTOSO'
+$ExchangeIisLogPath = '\\mail.contoso.local\c$\inetpub\logs\LogFiles\W3SVC1'
+$ExchangeServerHostForIisExclude = ''
+$ExchangeIisLogTailLines = 5000
+$ExchangeIisLogMinutesBeforeLockout = 30
+'@
+
+Set-TrackedFileText -RelativePath 'login_monitor.settings.example.ps1' -Content $loginSettings
+
+$exchangeSettingsPath = Join-Path $Root 'exchange_monitor.settings.example.ps1'
+if (Test-Path -LiteralPath $exchangeSettingsPath) {
+    $ex = Get-Content -LiteralPath $exchangeSettingsPath -Raw
+    $ex = $ex -replace 'kalinamall\.ru', 'example.com'
+    $ex = $ex -replace 'fifth\.example\.com', 'mail.contoso.local'
+    $ex = $ex -replace 'k\.selezneva@example\.com', 'broken-mailbox@example.com'
+    Set-TrackedFileText -RelativePath 'exchange_monitor.settings.example.ps1' -Content $ex
+}
+
+$updatePath = Join-Path $Root 'update-rdp-monitor.ps1'
+if (Test-Path -LiteralPath $updatePath) {
+    $upd = Get-Content -LiteralPath $updatePath -Raw
+    $upd = $upd -replace "Posle fetch: vsegda reset --hard na kalinamall/main \(bez merge\), zatem clean -fd\.",
+        'Posle fetch: reset --hard na upstream/main (bez merge), zatem clean -fd.'
+    $upd = $upd -replace "\\\\b26\\NETLOGON\\RDP-login-monitor", '\\dc.contoso.local\NETLOGON\RDP-login-monitor'
+    $upd = $upd -replace "https://git\.kalinamall\.ru/PapaTramp/RDP-login-monitor\.git",
+        'https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git'
+    Set-TrackedFileText -RelativePath 'update-rdp-monitor.ps1' -Content $upd
+}
+
+$netlogonDoc = Join-Path $Root 'Docs/deploy-netlogon-publish.md'
+if (Test-Path -LiteralPath $netlogonDoc) {
+    $doc = Get-Content -LiteralPath $netlogonDoc -Raw
+    $doc = $doc -replace 'K6A-DC3', 'dc01.corp.example.com'
+    $doc = $doc -replace '\\\\b26\\', '\\dc.contoso.local\'
+    $doc = $doc -replace "https://git\.kalinamall\.ru/PapaTramp/RDP-login-monitor\.git",
+        'https://git.example.com/org/RDP-login-monitor.git'
+    Set-TrackedFileText -RelativePath 'Docs/deploy-netlogon-publish.md' -Content $doc
+}
+
+$mdFiles = @(git ls-files '*.md' 2>$null | Where-Object { $_ -and (Test-Path $_) })
+foreach ($rel in $mdFiles) {
+    $path = Join-Path $Root $rel
+    $md = Get-Content -LiteralPath $path -Raw
+    $orig = $md
+    $md = $md -replace 'https://git\.kalinamall\.ru/PapaTramp/([^)/\s]+)/src/branch/main/', 'https://git.papatramp.ru/PapaTramp/$1/src/branch/main/'
+    $md = $md -replace 'https://git\.papatramp\.ru/PapaTramp/([^)/\s]+)/src/branch/main/', 'https://git.papatramp.ru/PapaTramp/$1/src/branch/main/'
+    $md = $md -replace 'https://git\.kalinamall\.ru/PapaTramp/', 'https://git.papatramp.ru/PapaTramp/'
+    $md = $md -replace 'https://git\.papatramp\.ru/PapaTramp/', 'https://git.papatramp.ru/PapaTramp/'
+    if ($md -ne $orig) {
+        Set-TrackedFileText -RelativePath $rel -Content $md
+    }
+}
+
+Write-Output 'Sanitize-ForGitHub: done'

scripts/Test-NoSecretsForGitHub.ps1

@@ -0,0 +1,47 @@
+# Fail if tracked text still contains production-only markers (run before GitHub push).
+$ErrorActionPreference = 'Stop'
+$Root = Split-Path -Parent $PSScriptRoot
+Set-Location $Root
+
+$patterns = @(
+    '8239219522',
+    'sac_UkOsAT',
+    '2843230',
+    'sac\.kalinamall\.ru',
+    '\\\\b26\\',
+    'K6A-DC3',
+    'fifth\.kalinamall',
+    '192\.168\.160\.57',
+    'kalinamall\.ru',
+    'git\.kalinamall\.ru',
+    'git\.papatramp\.ru',
+    '\d{8,12}:[A-Za-z0-9_-]{20,}'
+)
+
+$extensions = @('*.md', '*.ps1', '*.example', '*.txt', '*.json', '*.yml', '*.yaml')
+$files = git ls-files $extensions 2>$null | Where-Object { $_ -and (Test-Path $_) }
+
+$hits = @()
+foreach ($file in $files) {
+    if ($file -like 'scripts/Rewrite-GitHostUrls.ps1') { continue }
+    if ($file -like 'scripts/Push-PrivateMirror.ps1') { continue }
+    if ($file -like 'scripts/Sanitize-ForGitHub.ps1') { continue }
+    if ($file -like 'scripts/Test-NoSecretsForGitHub.ps1') { continue }
+    if ($file -like 'scripts/Push-GitHubMirror.ps1') { continue }
+    if ($file -like 'scripts/Push-Mirror.ps1') { continue }
+
+    $text = Get-Content -LiteralPath $file -Raw -ErrorAction SilentlyContinue
+    if ([string]::IsNullOrEmpty($text)) { continue }
+
+    foreach ($pat in $patterns) {
+        if ($text -match $pat) {
+            $hits += "${file}: matches /$pat/"
+        }
+    }
+}
+
+if ($hits.Count -gt 0) {
+    Write-Error ("GitHub secret scan failed:`n" + ($hits -join "`n"))
+}
+
+Write-Output "GitHub secret scan: OK ($($files.Count) files)"

update-rdp-monitor.ps1

@@ -1,10 +1,10 @@
-<#
+<#
 .SYNOPSIS
     Obnovlyaet klon RDP-login-monitor s upstream git i kopiruet dist na NETLOGON.
 .DESCRIPTION
     Dlya servera publikatsii (napr. DC3). Po umolchaniyu GitHub (github.com/PTah).
     Na zakrytom zerkale ukazhite -GitUrl URL vashego Gitea.
-    Posle fetch: vsegda reset --hard na vetku upstream (bez merge), zatem clean -fd.
+    Posle fetch: vsegda reset --hard na kalinamall/main (bez merge), zatem clean -fd.
     Kopiruyutsya: polnyj spisok v Docs/deploy-netlogon-publish.md.
 .EXAMPLE
     powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\soft\update-rdp-monitor.ps1
@@ -14,7 +14,7 @@
 [CmdletBinding(SupportsShouldProcess = $true)]
 param(
     [string]$RepoPath = 'C:\Soft\Git\RDP-login-monitor',
-    [string]$NetlogonDest = '\\dc.contoso.local\NETLOGON\RDP-login-monitor',
+    [string]$NetlogonDest = '\\b26\NETLOGON\RDP-login-monitor',
     [string]$GitUrl = 'https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git',
     [string]$GitBranch = 'main',
     [string]$LogFile = 'C:\soft\Logs\update-rdp-monitor.log',
@@ -34,6 +34,7 @@ $DistFiles = @(
     'Install-DomainMonitors.ps1',
     'Deploy-DomainMonitors.ps1',
     'exchange_monitor.settings.example.ps1',
+    'Diagnose-RdpLoginMonitor.ps1',
     'login_monitor.settings.example.ps1'
 )
 
@@ -112,25 +113,38 @@ function Ensure-GitRepository {
 function Get-ConfiguredGitRemoteName {
     $names = @(Invoke-GitCommand -Arguments @('remote') | ForEach-Object { "$_".Trim() } | Where-Object { $_ })
     if ($names.Count -eq 0) { return $null }
+    if ('kalinamall' -in $names) { return 'kalinamall' }
+    foreach ($n in $names) {
+        $url = (& git -C $RepoPath remote get-url $n 2>$null)
+        if ($url -match 'git\.kalinamall\.ru') { return $n }
+    }
     if ('origin' -in $names) { return 'origin' }
     return $names[0]
 }
 
-function Ensure-GitUpstreamRemote {
+function Ensure-GitKalinamallRemote {
     $name = Get-ConfiguredGitRemoteName
     if ($null -ne $name) {
         $url = (& git -C $RepoPath remote get-url $name 2>$null)
-        Write-UpdateLog "Using remote: $name ($url)"
-        return $name
+        if ($url -match 'git\.kalinamall\.ru') {
+            Write-UpdateLog "Using remote: $name ($url)"
+            return $name
+        }
+        Write-UpdateLog "Remote $name is not kalinamall ($url); adding kalinamall -> $GitUrl"
+    } else {
+        Write-UpdateLog "No remotes; adding kalinamall -> $GitUrl"
     }
-    Write-UpdateLog "No remotes; adding origin -> $GitUrl"
-    Invoke-GitCommand -Arguments @('remote', 'add', 'origin', $GitUrl)
-    return 'origin'
+    if ('kalinamall' -in @(& git -C $RepoPath remote 2>$null)) {
+        Invoke-GitCommand -Arguments @('remote', 'set-url', 'kalinamall', $GitUrl)
+        return 'kalinamall'
+    }
+    Invoke-GitCommand -Arguments @('remote', 'add', 'kalinamall', $GitUrl)
+    return 'kalinamall'
 }
 
 function Update-Repository {
     Ensure-GitRepository
-    $remote = Ensure-GitUpstreamRemote
+    $remote = Ensure-GitKalinamallRemote
     Invoke-GitCommand -Arguments @('fetch', '--prune', $remote, $GitBranch)
     $upstream = "${remote}/${GitBranch}"
 

version.txt

@@ -1 +1 @@
-2.1.9-SAC
+2.1.15-SAC