chore(private): fix PapaTramp URLs on papatramp mirror

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitignore

@@ -1,8 +1,3 @@
-.cursor/
+.cursor/
 tools/*.log
 *.log
-*.bak
-Logs/
-sac-spool/
-login_monitor.settings.ps1
-exchange_monitor.settings.ps1

Deploy-LoginMonitor.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Доставка Login_Monitor.ps1 с файловой шары по версии (домен: ПК и серверы).
 .DESCRIPTION

Diagnose-RdpLoginMonitor.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Диагностика RDP Login Monitor после входа по RDP (или при «тишине» в Telegram/SAC).
 .DESCRIPTION

Docs/exchange-mail-security.md

@@ -1,4 +1,4 @@
-# Exchange Mail Security — руководство
+# Exchange Mail Security — руководство
 
 Скрипт **`Exchange-MailSecurity.ps1`** предназначен **только для сервера Microsoft Exchange** с Exchange Management Shell (EMS). Не устанавливается на все компьютеры домена через GPO RDP-монитора.
 
@@ -68,16 +68,6 @@
 - Каналы: **Telegram** и/или **Email** (модуль **`Notify-Common.ps1`**).
 - Пересылка: **`$AlertOnlyOnNewForwardingFindings = $true`** — алерт при **новой** находке (`Logs\exchange_forwarding_baseline.json`).
 - **Первый скан:** **`$SuppressAlertsOnFirstBaselineRun = $true`** (по умолчанию) — существующие пересылки **только в baseline**, без всплеска алертов; одна **сводка** (`$SendInboxScanSummary`).
-
-### Dry-run перед первым Inbox-сканом
-
-```powershell
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\dc.contoso.local\NETLOGON\RDP-login-monitor\Exchange-MailSecurity.ps1" -Mode Inbox -WhatIf
-```
-
-`-WhatIf` подключает EMS, считает объём (`Get-Mailbox` / VIP-фильтр), **не вызывает** `Get-InboxRule`, не шлёт уведомления и не пишет baseline. Рекомендуется перед `-InstallTasks` и первым ночным `-Mode Inbox`.
-
-При полном скане без VIP скрипт пишет **WARN** в лог; проблемные ящики — в **`$SkipInboxScanMailboxes`**.
 - Далее — алерт только при **новых** или **изменённых** пересылках (в т.ч. включили ранее отключённое правило).
 - **`$NotifyWhenForwardingScanClean = $false`** — не слать «всё чисто» при нуле находок.
 

Encrypt-DpapiForRdpMonitor.ps1

@@ -1,4 +1,4 @@
-# Запуск: от администратора на ТОМ ЖЕ компьютере, где будет Login_Monitor.ps1.
+# Запуск: от администратора на ТОМ ЖЕ компьютере, где будет Login_Monitor.ps1.
 # Результат (Base64) вставьте в login_monitor.settings.ps1 или exchange_monitor.settings.ps1:
 # $TelegramBotTokenProtectedB64 / $TelegramChatIDProtectedB64 / $MailSmtpPasswordProtectedB64.
 param(

Exchange-MailSecurity.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Мониторинг Exchange: очереди транспорта, пересылка на внешние адреса (Inbox rules + mailbox forwarding + transport rules).
 .DESCRIPTION
@@ -10,13 +10,12 @@
     Опционально: exchange_monitor.settings.ps1 в том же каталоге (секреты, whitelist).
 #>
 
-[CmdletBinding(SupportsShouldProcess = $true)]
+[CmdletBinding()]
 param(
     [ValidateSet('Queues', 'Inbox', 'Watchdog')]
     [string]$Mode = 'Queues',
     [switch]$InstallTasks,
-    [switch]$Watchdog,
-    [switch]$WhatIf
+    [switch]$Watchdog
 )
 
 Set-StrictMode -Version Latest
@@ -26,7 +25,7 @@ $ErrorActionPreference = 'Stop'
 # КОНФИГУРАЦИЯ
 # ============================================
 
-$ScriptVersion = '1.6.8'
+$ScriptVersion = '1.6.7'
 $script:InstallRoot = [System.IO.Path]::GetFullPath("$env:ProgramData\RDP-login-monitor")
 $script:CanonicalScriptName = 'Exchange-MailSecurity.ps1'
 $LogFile = Join-Path $script:InstallRoot 'Logs\exchange_mail_security.log'
@@ -101,18 +100,6 @@ if (Test-Path -LiteralPath $SettingsFile) {
     . $SettingsFile
 }
 
-function Write-ExchangeScanSafetyWarnings {
-    if (-not $SuppressAlertsOnFirstBaselineRun) {
-        Write-ExchLog 'WARN: SuppressAlertsOnFirstBaselineRun=$false — первый Inbox-скан может разослать алерты по всем уже существующим пересылкам.'
-    }
-    if (-not $VipMailboxesOnly -and $MaxMailboxesPerRun -le 0 -and $ScanInboxRules) {
-        Write-ExchLog 'WARN: полный скан Inbox rules по всем ящикам (VipMailboxesOnly=$false). Рекомендуется пилот: VipMailboxesOnly=$true или -Mode Inbox -WhatIf.'
-    }
-    if (@($SkipInboxScanMailboxes | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }).Count -eq 0) {
-        Write-ExchLog 'TIP: добавьте проблемные ящики в $SkipInboxScanMailboxes, если Get-InboxRule падает (corrupt rule store).'
-    }
-}
-
 function Write-NotifyLog {
     param([string]$Message)
     Write-ExchLog $Message
@@ -248,7 +235,6 @@ if ($InstallTasks) {
         Send-ExchangeInstallNotification
         Write-ExchLog 'InstallTasks: install notification sent'
     }
-    Write-ExchLog 'InstallTasks: перед первым ночным Inbox-сканом выполните: Exchange-MailSecurity.ps1 -Mode Inbox -WhatIf'
     exit 0
 }
 
@@ -532,15 +518,6 @@ function Invoke-ExchangeQueueScan {
     Write-ExchLog "Queues: threshold MessageCount > $QueueMessageCountThreshold"
 
     $queues = @(Get-Queue -ErrorAction Stop)
-    if ($WhatIf) {
-        $hot = @($queues | Where-Object { $_.MessageCount -gt $QueueMessageCountThreshold })
-        Write-ExchLog "WhatIf: queues total=$($queues.Count), above threshold=$($hot.Count) — alerts skipped"
-        foreach ($q in $hot) {
-            Write-ExchLog "WhatIf: would alert queue=$($q.Identity) messages=$($q.MessageCount)"
-        }
-        return
-    }
-
     $hot = @($queues | Where-Object { $_.MessageCount -gt $QueueMessageCountThreshold })
     $state = Get-QueueAlertState
     $now = Get-Date
@@ -783,20 +760,6 @@ function Send-ExchangeInboxScanSummary {
 function Invoke-ExchangeInboxAndForwardingScan {
     $scopeLabel = Get-ExchangeInboxScanScopeLabel
     Write-ExchLog "Inbox/Forwarding scan v$ScriptVersion; scope: $scopeLabel; notify: $(Get-NotifyChainHuman)"
-    if ($WhatIf) {
-        $null = Import-ExchangeManagementShell
-        $internalDomains = Get-InternalAcceptedDomainNames
-        Write-ExchLog "WhatIf: accepted domains: $(@($internalDomains) -join ', ')"
-        $mailboxCount = 0
-        if ($ScanInboxRules) {
-            $mailboxes = @(Get-MailboxListForScan)
-            $mailboxCount = $mailboxes.Count
-            Write-ExchLog "WhatIf: would scan $mailboxCount mailboxes ($scopeLabel); Get-InboxRule not called"
-        }
-        Write-ExchLog "WhatIf: ScanMailboxForwarding=$ScanMailboxForwarding ScanTransportRules=$ScanTransportRules — no alerts, no baseline write"
-        return
-    }
-
     $null = Import-ExchangeManagementShell
     $internalDomains = Get-InternalAcceptedDomainNames
     Write-ExchLog "Accepted domains (internal): $(@($internalDomains) -join ', ')"
@@ -916,8 +879,7 @@ if (-not (Test-RunningElevated)) {
     Write-ExchLog 'WARNING: not running elevated - EMS/tasks may fail.'
 }
 
-Write-ExchLog "=== Exchange-MailSecurity v$ScriptVersion Mode=$Mode$(if ($WhatIf) { ' WhatIf' }) ==="
-Write-ExchangeScanSafetyWarnings
+Write-ExchLog "=== Exchange-MailSecurity v$ScriptVersion Mode=$Mode ==="
 
 try {
     switch ($Mode) {

Install-DeployScheduledTask.ps1

@@ -1,4 +1,4 @@
-#Requires -RunAsAdministrator
+#Requires -RunAsAdministrator
 [CmdletBinding()]
 param(
     [string]$TaskName = "RDP-Login-Monitor-Deploy",

Install-ScheduledTasks.ps1

@@ -0,0 +1,87 @@
+#Requires -RunAsAdministrator
+<#
+.SYNOPSIS
+    Регистрирует в Планировщике заданий основной монитор и watchdog (как в README).
+.DESCRIPTION
+    Запускайте из повышенной PowerShell. Пути по умолчанию — D:\Soft\.
+    Watchdog использует Watchdog_RDP_Monitor.ps1 из репозитория (проверка процесса и heartbeat).
+#>
+[CmdletBinding()]
+param(
+    [string]$InstallRoot = "D:\Soft",
+    [string]$MainTaskName = "RDP Login Monitor",
+    [string]$WatchdogTaskName = "RDP Login Monitor Watchdog",
+    [int]$WatchdogRepeatMinutes = 5,
+    [int]$MainStartupRandomDelayMinutes = 1,
+    [int]$WatchdogStartupRandomDelayMinutes = 2
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$LoginScriptPath = Join-Path $InstallRoot "Login_Monitor.ps1"
+$WatchdogScriptPath = Join-Path $InstallRoot "Watchdog_RDP_Monitor.ps1"
+$LogsDir = Join-Path $InstallRoot "Logs"
+
+if (-not (Test-Path -LiteralPath $LoginScriptPath)) {
+    throw "Не найден основной скрипт: $LoginScriptPath"
+}
+if (-not (Test-Path -LiteralPath $WatchdogScriptPath)) {
+    throw "Не найден watchdog: $WatchdogScriptPath"
+}
+if (-not (Test-Path -LiteralPath $LogsDir)) {
+    New-Item -ItemType Directory -Path $LogsDir -Force | Out-Null
+}
+
+$principal = New-ScheduledTaskPrincipal `
+    -UserId "NT AUTHORITY\SYSTEM" `
+    -LogonType ServiceAccount `
+    -RunLevel Highest
+
+# --- Задание 1: основной монитор ---
+$mainArgs = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$LoginScriptPath`""
+$mainAction = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument $mainArgs
+$mainTrigger = New-ScheduledTaskTrigger -AtStartup -RandomDelay (New-TimeSpan -Minutes $MainStartupRandomDelayMinutes)
+$mainSettings = New-ScheduledTaskSettingsSet `
+    -AllowStartIfOnBatteries `
+    -DontStopIfGoingOnBatteries `
+    -StartWhenAvailable `
+    -MultipleInstances IgnoreNew `
+    -ExecutionTimeLimit ([TimeSpan]::Zero)
+
+Register-ScheduledTask `
+    -TaskName $MainTaskName `
+    -Action $mainAction `
+    -Trigger $mainTrigger `
+    -Principal $principal `
+    -Settings $mainSettings `
+    -Force | Out-Null
+
+Write-Host "Создано задание: $MainTaskName" -ForegroundColor Cyan
+
+# --- Задание 2: watchdog (старт + периодический запуск, как в README) ---
+$wdArgs = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$WatchdogScriptPath`""
+$wdAction = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument $wdArgs
+$wdTriggerStartup = New-ScheduledTaskTrigger -AtStartup -RandomDelay (New-TimeSpan -Minutes $WatchdogStartupRandomDelayMinutes)
+$repeatDuration = New-TimeSpan -Days 3650
+$anchor = (Get-Date).AddMinutes([Math]::Max(3, $WatchdogRepeatMinutes))
+$wdTriggerRepeat = New-ScheduledTaskTrigger -Once -At $anchor `
+    -RepetitionInterval (New-TimeSpan -Minutes $WatchdogRepeatMinutes) `
+    -RepetitionDuration $repeatDuration
+
+$wdSettings = New-ScheduledTaskSettingsSet `
+    -AllowStartIfOnBatteries `
+    -DontStopIfGoingOnBatteries `
+    -StartWhenAvailable `
+    -MultipleInstances IgnoreNew
+
+Register-ScheduledTask `
+    -TaskName $WatchdogTaskName `
+    -Action $wdAction `
+    -Trigger @($wdTriggerStartup, $wdTriggerRepeat) `
+    -Principal $principal `
+    -Settings $wdSettings `
+    -Force | Out-Null
+
+Write-Host "Создано задание: $WatchdogTaskName (триггеры: при старте ОС и каждые $WatchdogRepeatMinutes мин.)" -ForegroundColor Cyan
+Write-Host "Готово. При необходимости сразу запустите: Start-ScheduledTask -TaskName '$MainTaskName'" -ForegroundColor Green

Login_Monitor.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Мониторинг логинов/попыток входа с уведомлениями в Telegram
 .DESCRIPTION
@@ -90,7 +90,7 @@ $script:SkipLogDetailLimit = 15
 # строки ниже, если правки «мелкие» и вы не хотите менять отображаемую версию в логах).
 # Рекомендация: при значимых релизах меняйте и $ScriptVersion, и version.txt одинаково; при только
 # исправлениях на шаре — достаточно поднять patch в version.txt (например 1.3.0.1).
-$ScriptVersion = "2.1.15-SAC"
+$ScriptVersion = "2.1.9-SAC"
 
 # Логи (все под InstallRoot)
 $LogFile = Join-Path $script:InstallRoot "Logs\login_monitor.log"
@@ -1140,9 +1140,6 @@ if (-not (Test-Administrator)) {
 Write-Log "Скрипт запущен с правами администратора, версия $ScriptVersion"
 if ($script:LoginMonitorSettingsLoaded) {
     Write-Log "Настройки: login_monitor.settings.ps1 загружен."
-    if ($SacTlsSkipVerify) {
-        Write-Log 'CRITICAL: SacTlsSkipVerify=$true — проверка TLS для SAC отключена (риск MITM). Только для краткого отладочного окна в lab.'
-    }
 } else {
     Write-Log "Предупреждение: login_monitor.settings.ps1 не найден — Telegram/SMTP/4740 не настроены (скопируйте login_monitor.settings.example.ps1)."
 }
@@ -1539,122 +1536,6 @@ function Test-RcmLogAvailable {
     }
 }
 
-function Get-Rcm1149UserDataEventInfoMap {
-    param($Event)
-
-    $map = @{}
-    try {
-        $xml = [xml]$Event.ToXml()
-        $userData = $xml.Event.UserData
-        if ($null -eq $userData) { return $map }
-
-        $eventXml = $userData.EventXML
-        if ($null -eq $eventXml) {
-            foreach ($child in @($userData.ChildNodes)) {
-                if ($null -ne $child -and $child.LocalName -eq 'EventXML') {
-                    $eventXml = $child
-                    break
-                }
-            }
-        }
-        if ($null -eq $eventXml) { return $map }
-
-        foreach ($node in @($eventXml.ChildNodes)) {
-            if ($null -eq $node -or $node.NodeType -ne [System.Xml.XmlNodeType]::Element) { continue }
-            $map[$node.LocalName] = [string]$node.InnerText
-        }
-    } catch { }
-    return $map
-}
-
-function Resolve-Rcm1149UsernameFromParts {
-    param(
-        [string]$Param1,
-        [string]$Param2
-    )
-
-    $p1 = if ($null -ne $Param1) { $Param1.Trim() } else { '' }
-    $p2 = if ($null -ne $Param2) { $Param2.Trim() } else { '' }
-    if ([string]::IsNullOrWhiteSpace($p1)) { return $null }
-    if ($p1 -match '[\\@]') { return $p1 }
-    if (-not [string]::IsNullOrWhiteSpace($p2)) {
-        return "$p2\$p1"
-    }
-    return $p1
-}
-
-function Get-Rcm1149UsernameFromQwinsta {
-    <#
-      На части ПК (наблюдалось на Win10 Pro) RCM 1149 пишет пустые Param1/Param2,
-      хотя сеанс уже есть в qwinsta. Берём единственную RDP-сессию (rdp-tcp#N / Disc).
-      Состояния локализованы (Активно/Listen/…) — не завязываемся на английский STATE.
-    #>
-    $qwExe = Join-Path $env:SystemRoot 'System32\qwinsta.exe'
-    if (-not (Test-Path -LiteralPath $qwExe)) { return $null }
-
-    $prevEa = $ErrorActionPreference
-    $rawLines = @()
-    try {
-        $ErrorActionPreference = 'SilentlyContinue'
-        $rawLines = @(& $qwExe 2>&1 | ForEach-Object { [string]$_ })
-    } catch {
-        return $null
-    } finally {
-        $ErrorActionPreference = $prevEa
-    }
-
-    $candidates = [System.Collections.Generic.List[string]]::new()
-    foreach ($raw in $rawLines) {
-        $text = if ($null -ne $raw) { $raw.Trim() } else { '' }
-        if ([string]::IsNullOrWhiteSpace($text)) { continue }
-        if ($text -match '(?i)^SESSION') { continue }
-        if ($text -match '^-+$') { continue }
-
-        $parts = @($text -split '\s+' | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
-        if ($parts.Count -lt 2) { continue }
-
-        $idIdx = -1
-        $sid = -1
-        for ($i = 0; $i -lt $parts.Count; $i++) {
-            $token = $parts[$i].TrimStart('>')
-            if ($token -match '^\d+$') {
-                $idIdx = $i
-                $sid = [int]$token
-                break
-            }
-        }
-        if ($idIdx -lt 1) { continue }
-        # Listener «rdp-tcp» / ID 65536 — не пользовательская сессия.
-        if ($sid -eq 65536) { continue }
-
-        $before = @($parts[0..($idIdx - 1)])
-        if ($before.Count -eq 1) {
-            $sessionName = ''
-            $userName = $before[0].TrimStart('>')
-        } else {
-            $sessionName = $before[0].TrimStart('>')
-            $userName = $before[1]
-        }
-        if ([string]::IsNullOrWhiteSpace($userName)) { continue }
-        if ($userName -match '(?i)^(services|console|rdp-tcp)$') { continue }
-        if ($sessionName -match '(?i)^console$') { continue }
-        if ($sessionName -match '(?i)^rdp-tcp$' -and $sessionName -notmatch '#') { continue }
-
-        $isRdpNamed = $sessionName -match '(?i)^rdp-tcp#\d+'
-        $isDiscBare = [string]::IsNullOrWhiteSpace($sessionName)
-        if (-not ($isRdpNamed -or $isDiscBare)) { continue }
-
-        if (-not $candidates.Contains($userName)) {
-            [void]$candidates.Add($userName)
-        }
-    }
-
-    if ($candidates.Count -eq 1) {
-        return $candidates[0]
-    }
-    return $null
-}
-
 function Get-Rcm1149EventInfo {
     param($Event)
     $eventData = @{
@@ -1664,49 +1545,25 @@ function Get-Rcm1149EventInfo {
     }
     try {
         $map = Get-EventDataMap -Event $Event
-        $userDataMap = Get-Rcm1149UserDataEventInfoMap -Event $Event
         $user = Get-FirstNonEmptyMapValue -DataMap $map -Keys @(
             "TargetUser","User","Domain User","Param1","AccountName","ConnectionUser","SubjectUserName"
         )
         $ip = Get-FirstNonEmptyMapValue -DataMap $map -Keys @(
             "ClientIP","Client Address","IpAddress","Ip","Param3","Address","CallingStationId"
         )
-        if ([string]::IsNullOrWhiteSpace($user)) {
-            $user = Resolve-Rcm1149UsernameFromParts -Param1 $userDataMap['Param1'] -Param2 $userDataMap['Param2']
-        }
-        if ([string]::IsNullOrWhiteSpace($ip)) {
-            $ip = Get-FirstNonEmptyMapValue -DataMap $userDataMap -Keys @('Param3', 'Param2', 'Param1')
-        }
         if (-not [string]::IsNullOrWhiteSpace($user)) { $eventData.Username = [string]$user }
-        if (-not [string]::IsNullOrWhiteSpace($ip)) {
-            $eventData.ClientIP = Get-RdpMonitorNormalizedClientIp -Value ([string]$ip)
-        }
+        if (-not [string]::IsNullOrWhiteSpace($ip)) { $eventData.ClientIP = [string]$ip }
 
-        if (($eventData.Username -eq '-' -or [string]::IsNullOrWhiteSpace($eventData.Username)) -and $Event.Properties.Count -gt 0) {
-            $p0 = [string]$Event.Properties[0].Value
-            if (-not [string]::IsNullOrWhiteSpace($p0)) {
-                $eventData.Username = $p0
-            }
+        if ($eventData.Username -eq '-' -and $Event.Properties.Count -gt 0) {
+            $eventData.Username = [string]$Event.Properties[0].Value
         }
-        if ($eventData.ClientIP -eq '-' -or [string]::IsNullOrWhiteSpace($eventData.ClientIP)) {
+        if ($eventData.ClientIP -eq '-') {
             if ($Event.Properties.Count -gt 2) {
-                $p2 = [string]$Event.Properties[2].Value
-                if (-not [string]::IsNullOrWhiteSpace($p2)) {
-                    $eventData.ClientIP = Get-RdpMonitorNormalizedClientIp -Value $p2
-                }
+                $eventData.ClientIP = [string]$Event.Properties[2].Value
             } elseif ($Event.Properties.Count -gt 1) {
-                $p1 = [string]$Event.Properties[1].Value
-                if (-not [string]::IsNullOrWhiteSpace($p1)) {
-                    $eventData.ClientIP = Get-RdpMonitorNormalizedClientIp -Value $p1
-                }
+                $eventData.ClientIP = [string]$Event.Properties[1].Value
             }
         }
-        if ([string]::IsNullOrWhiteSpace($eventData.Username) -or $eventData.Username -eq '-') {
-            $eventData.Username = '-'
-        }
-        if ([string]::IsNullOrWhiteSpace($eventData.ClientIP) -or $eventData.ClientIP -eq '-') {
-            $eventData.ClientIP = '-'
-        }
     } catch {
         Write-Log "Ошибка разбора события RCM 1149: $($_.Exception.Message)"
     }
@@ -3179,13 +3036,10 @@ function Parse-RdpMonitorIgnoreListLine {
     if ($line[0] -eq '#' -or $line[0] -eq ';') { return $null }
     if ($line.StartsWith([char]0xFEFF)) { $line = $line.TrimStart([char]0xFEFF) }
 
-    $scopes = @('4624', '4625', '4634', '4647')
+    $scopes = @('4624', '4625')
     if ($line -match '^(?i)(4740|lockout|блокир)\s*:\s*(.+)$') {
         $scopes = @('4740')
         $line = $Matches[2].Trim()
-    } elseif ($line -match '^(?i)(logoff|logout|4634|4647)\s*:\s*(.+)$') {
-        $scopes = @('4634', '4647')
-        $line = $Matches[2].Trim()
     } elseif ($line -match '^(?i)(shadow|20506)\s*:\s*(.+)$') {
         $scopes = @('20506', '20507', '20510')
         $line = $Matches[2].Trim()
@@ -3196,7 +3050,7 @@ function Parse-RdpMonitorIgnoreListLine {
         $scopes = @('5140')
         $line = $Matches[2].Trim()
     } elseif ($line -match '^(?i)(all|\*)\s*:\s*(.+)$') {
-        $scopes = @('4624', '4625', '4634', '4647', '4740', '20506', '20507', '20510', 'winrm', '5140')
+        $scopes = @('4624', '4625', '4740', '20506', '20507', '20510', 'winrm', '5140')
         $line = $Matches[2].Trim()
     }
     if ([string]::IsNullOrWhiteSpace($line)) { return $null }
@@ -3381,7 +3235,7 @@ function Should-IgnoreEvent {
         if ($Username -like $p) { return $true }
     }
 
-    if ($EventID -ne 1149 -and $EventID -notin 4634, 4647) {
+    if ($EventID -ne 1149) {
         if ($ComputerName -eq "Authz" -or $ComputerName -like "Authz*") { return $true }
         if ($ComputerName -eq "NtLmSsp" -or $ComputerName -like "NtLmSsp*" -or $ComputerName -like "*NtLmSsp*") { return $true }
     }
@@ -3394,14 +3248,14 @@ function Should-IgnoreEvent {
     }
 
     if ($SourceIP -eq "127.0.0.1" -or $SourceIP -like "fe80:*") { return $true }
-    # RCM 1149 и logoff 4634/4647 часто без WorkstationName в EventData.
-    if ($EventID -notin 1149, 4634, 4647 -and ($ComputerName -eq "-" -or $ComputerName -eq "N/A")) { return $true }
+    # RCM 1149 не содержит WorkstationName; caller передаёт ComputerName='-'.
+    if ($EventID -ne 1149 -and ($ComputerName -eq "-" -or $ComputerName -eq "N/A")) { return $true }
 
     foreach ($pattern in $ExcludedComputerPatterns) {
         if ($ComputerName -like $pattern) { return $true }
     }
 
-    if ($EventID -in 4624, 4625, 4634, 4647, 1149) {
+    if ($EventID -in 4624, 4625, 1149) {
         if (Test-RdpMonitorIgnoreListMatch -EventId ([string]$EventID) -Username $Username `
                 -ComputerName $ComputerName -SourceIP $SourceIP) {
             return $true
@@ -3421,7 +3275,6 @@ function Get-LoginEventInfo {
         SourceIP = "-"
         ProcessName = "-"
         LogonType = 0
-        SessionId = $null
     }
 
     try {
@@ -3439,17 +3292,6 @@ function Get-LoginEventInfo {
             $eventData.ProcessName = Get-FirstNonEmptyMapValue -DataMap $map -Keys @(
                 "SubStatus","Status","FailureReason","FailureReasonCode"
             )
-        } elseif ($Event.Id -in 4634, 4647) {
-            if ($Event.Id -eq 4647) {
-                $subjectUser = Get-FirstNonEmptyMapValue -DataMap $map -Keys @("SubjectUserName","AccountName")
-                if (-not [string]::IsNullOrWhiteSpace($subjectUser)) {
-                    $eventData.Username = $subjectUser
-                }
-            }
-            $sidRaw = Get-FirstNonEmptyMapValue -DataMap $map -Keys @("TargetLogonId","SubjectLogonId","LogonId")
-            if (-not [string]::IsNullOrWhiteSpace($sidRaw)) {
-                $eventData.SessionId = [string]$sidRaw.Trim()
-            }
         }
     } catch {
         Write-Log "Ошибка при извлечении данных события: $($_.Exception.Message)"
@@ -3522,8 +3364,6 @@ function Format-LoginEvent {
     $message = "<b>"
     if ($EventID -eq 4624) { $message += "✅ УСПЕШНЫЙ ВХОД" }
     elseif ($EventID -eq 4625) { $message += "❌ НЕУДАЧНАЯ ПОПЫТКА" }
-    elseif ($EventID -eq 4634) { $message += "🚪 ВЫХОД ИЗ СЕССИИ" }
-    elseif ($EventID -eq 4647) { $message += "🚪 ВЫХОД ПОЛЬЗОВАТЕЛЯ" }
     else { $message += "⚠️ СОБЫТИЕ" }
     $message += "</b>`r`n"
 
@@ -3544,7 +3384,6 @@ function Format-LoginEvent {
 
 $script:FailedLogonBuckets = @{}
 $script:LoginSuccessNotifyDedup = @{}
-$script:LogoffNotifyDedup = @{}
 
 function Get-RdpLoginNotifyDedupHostPart {
     param([string]$SecurityLogComputerName)
@@ -3603,33 +3442,6 @@ function Test-RdpLoginSuccessNotifyDedupAllow {
     return $true
 }
 
-function Get-RdpLogoffNotifyDedupKey {
-    param(
-        [string]$SecurityLogComputerName,
-        [string]$Username,
-        [int]$LogonType
-    )
-    $hostPart = Get-RdpLoginNotifyDedupHostPart -SecurityLogComputerName $SecurityLogComputerName
-    $userPart = Get-RdpLoginNotifyDedupUsernamePart -Username $Username
-    return "$hostPart|logoff|$userPart|$LogonType"
-}
-
-function Test-RdpLogoffNotifyDedupAllow {
-    param([string]$DedupKey)
-
-    if ($LoginSuccessNotifyDedupSeconds -le 0) { return $true }
-    $nowUtc = (Get-Date).ToUniversalTime()
-    if ($script:LogoffNotifyDedup.ContainsKey($DedupKey)) {
-        $lastUtc = $script:LogoffNotifyDedup[$DedupKey]
-        $delta = ($nowUtc - $lastUtc).TotalSeconds
-        if ($delta -ge 0 -and $delta -lt $LoginSuccessNotifyDedupSeconds) {
-            return $false
-        }
-    }
-    $script:LogoffNotifyDedup[$DedupKey] = $nowUtc
-    return $true
-}
-
 function Get-FailedLogonSourceKeyPart {
     param(
         [string]$SourceIP,
@@ -4688,7 +4500,7 @@ function Start-LoginMonitor {
         $lastWinRmCheckTime = (Get-Date).AddSeconds(-10)
         $lastAdminShare5140CheckTime = (Get-Date).AddSeconds(-10)
         $lastLockout4740CheckTime = (Get-Date).AddSeconds(-10)
-        $monitorEvents = @(4624, 4625, 4634, 4647, 4648)
+        $monitorEvents = @(4624, 4625, 4648)
 
         $script:MonitorInMainLoop = $true
         while ($true) {
@@ -4754,24 +4566,6 @@ function Start-LoginMonitor {
                         if ($event.Id -eq 4648) {
                             $shouldIgnore = $true
                             $ignoreReason = 'EventID 4648 excluded (MonitorInteractiveOnly)'
-                        } elseif ($event.Id -in 4634, 4647) {
-                            if (-not $osKind.IsWorkstation) {
-                                $shouldIgnore = $true
-                                $ignoreReason = 'logoff 4634/4647 only on workstations (server LT3 is Kerberos/LDAP noise)'
-                            } else {
-                                $interactiveTypes = @(10)
-                                $modeLabel = 'workstation logoff LT10'
-                                if ($interactiveTypes -notcontains $eventInfo.LogonType) {
-                                    $allow4647Workstation = (
-                                        $event.Id -eq 4647 -and
-                                        $eventInfo.LogonType -eq 0
-                                    )
-                                    if (-not $allow4647Workstation) {
-                                        $shouldIgnore = $true
-                                        $ignoreReason = "LogonType $($eventInfo.LogonType) not in $modeLabel"
-                                    }
-                                }
-                            }
                         } elseif ($event.Id -in 4624, 4625) {
                             if ($osKind.IsWorkstation) {
                                 $interactiveTypes = @(10)
@@ -4823,46 +4617,6 @@ function Start-LoginMonitor {
                         }
                     }
 
-                    if ($event.Id -in 4634, 4647) {
-                        $dedupKeyLogoff = Get-RdpLogoffNotifyDedupKey -SecurityLogComputerName $event.MachineName `
-                            -Username $eventInfo.Username -LogonType $eventInfo.LogonType
-                        if (-not (Test-RdpLogoffNotifyDedupAllow -DedupKey $dedupKeyLogoff)) {
-                            Write-Log "Notify dedup logoff $($event.Id): User=$($eventInfo.Username) LT=$($eventInfo.LogonType) (window ${LoginSuccessNotifyDedupSeconds}s)"
-                            continue
-                        }
-
-                        $formattedMessage = Format-LoginEvent -EventID $event.Id `
-                            -Username $eventInfo.Username `
-                            -ComputerName $eventInfo.ComputerName `
-                            -SourceIP $eventInfo.SourceIP `
-                            -ProcessName $eventInfo.ProcessName `
-                            -TimeCreated $eventInfo.TimeCreated `
-                            -LogonType $eventInfo.LogonType `
-                            -LogonTypeName $logonTypeName `
-                            -SecurityLogComputerName $event.MachineName
-
-                        $sacDetails = @{
-                            user = $eventInfo.Username
-                            ip_address = $eventInfo.SourceIP
-                            logon_type = $eventInfo.LogonType
-                            event_id_windows = [int]$event.Id
-                            workstation_name = $eventInfo.ComputerName
-                        }
-                        if ($null -ne $eventInfo.SessionId -and -not [string]::IsNullOrWhiteSpace([string]$eventInfo.SessionId)) {
-                            $sacDetails['session_id'] = [string]$eventInfo.SessionId
-                        }
-
-                        Write-Log "Notify logoff: ID=$($event.Id) User=$($eventInfo.Username) LT=$($eventInfo.LogonType) IP=$($eventInfo.SourceIP)"
-                        Send-MonitorNotification -Message $formattedMessage `
-                            -EmailSubject "RDP Login Monitor: выход (ID $($event.Id))" `
-                            -SacEventType 'rdp.session.logoff' -SacSeverity 'info' `
-                            -SacTitle "RDP session logoff $($event.Id)" `
-                            -SacSummary "Logoff $($event.Id) $($eventInfo.Username)" `
-                            -SacOccurredAt $eventInfo.TimeCreated `
-                            -SacDetails $sacDetails | Out-Null
-                        continue
-                    }
-
                     if ($event.Id -eq 4625 -and $FailedLogonRateLimitEnabled) {
                             $rl = Get-FailedLogonRateLimitDecision4625 -SourceIP $eventInfo.SourceIP `
                                 -ComputerName $eventInfo.ComputerName -Username $eventInfo.Username `
@@ -5025,13 +4779,6 @@ function Start-LoginMonitor {
                     foreach ($event in $rcmEvents) {
                         if ($event.TimeCreated -le $lastRcmCheckTime) { continue }
                         $rcmInfo = Get-Rcm1149EventInfo -Event $event
-                        if ($rcmInfo.Username -eq '-' -or [string]::IsNullOrWhiteSpace($rcmInfo.Username)) {
-                            $fromQw = Get-Rcm1149UsernameFromQwinsta
-                            if (-not [string]::IsNullOrWhiteSpace($fromQw)) {
-                                Write-Log "RCM 1149: EventLog user empty — qwinsta fallback User=$fromQw"
-                                $rcmInfo.Username = $fromQw
-                            }
-                        }
                         if ($rcmInfo.Username -like "*$") {
                             $rcmSkipped++
                             Write-Log "Skip 1149: User=$($rcmInfo.Username) IP=$($rcmInfo.ClientIP) — machine account"
@@ -5040,11 +4787,7 @@ function Start-LoginMonitor {
                         if (Should-IgnoreEvent -Username $rcmInfo.Username -ProcessName "-" `
                                 -ComputerName "-" -EventID 1149 -LogonType 10 -SourceIP $rcmInfo.ClientIP) {
                             $rcmSkipped++
-                            $ud = Get-Rcm1149UserDataEventInfoMap -Event $event
-                            $p1 = if ($ud.ContainsKey('Param1')) { $ud['Param1'] } else { '' }
-                            $p2 = if ($ud.ContainsKey('Param2')) { $ud['Param2'] } else { '' }
-                            $p3 = if ($ud.ContainsKey('Param3')) { $ud['Param3'] } else { '' }
-                            Write-Log "Skip 1149: User=$($rcmInfo.Username) IP=$($rcmInfo.ClientIP) — built-in exclusion or ignore.lst (EventXML Param1=$p1 Param2=$p2 Param3=$p3)"
+                            Write-Log "Skip 1149: User=$($rcmInfo.Username) IP=$($rcmInfo.ClientIP) — built-in exclusion or ignore.lst"
                             continue
                         }
 

README.md

@@ -1,6 +1,6 @@
 # RDP Login Monitor
 
-**Версия:** `2.1.14-SAC` (`$ScriptVersion` + `version.txt`)
+**Версия:** `2.1.5-SAC` (`$ScriptVersion` + `version.txt`)
 
 PowerShell-мониторинг Windows: RDP/RDS, RD Gateway, WinRM, admin share, блокировки УЗ, heartbeat, отчёты.
 
@@ -27,7 +27,6 @@ powershell -NoProfile -ExecutionPolicy Bypass -File "\\<DC>\NETLOGON\RDP-login-m
 | Источник | Тип SAC |
 |----------|---------|
 | Security 4624/4625 | `rdp.login.*` |
-| Security 4634/4647 (прямой RDP, **только рабочая станция**, LT10) | `rdp.session.logoff` → закрытие сессии в SAC |
 | Security 5140 | `smb.admin_share.access` |
 | WinRM Operational 91 | `winrm.session.started` |
 | RD Gateway 302/303 | `rdg.connection.*` → flap 302→303 в SAC |

README_eng.md

@@ -1,6 +1,6 @@
 # RDP Login Monitor
 
-**Version:** `2.1.14-SAC` (`$ScriptVersion` + `version.txt`)
+**Version:** `2.1.5-SAC` (`$ScriptVersion` + `version.txt`)
 
 PowerShell toolkit for monitoring Windows logons with Telegram and/or Email (SMTP) notifications.
 
@@ -92,7 +92,7 @@ For domain deployment from a share you do not configure the scheduler on clients
 
 - **`-SkipScheduledTaskMaintenance`**: during normal monitor startup, skip verification/recreation of scheduled tasks (if you manage tasks only via **`-InstallTasks`** or manually).
 - **`Install-DeployScheduledTask.ps1`** — helper to run **`Deploy-LoginMonitor.ps1`** from a share on a schedule (see **[DEPLOY.md](DEPLOY.md)**).
-- Watchdog is built into **`Login_Monitor.ps1`** (`-Watchdog`); scheduled tasks **`RDP-Login-Monitor`** / **`RDP-Login-Monitor-Watchdog`** are registered by **`-InstallTasks`**.
+- **`Watchdog_RDP_Monitor.ps1`** and **`Install-ScheduledTasks.ps1`** — **alternate** layout with a separate watchdog script and default paths under **`D:\Soft`**. For new installs, prefer the built-in **`-Watchdog`** in **`Login_Monitor.ps1`** and tasks **`RDP-Login-Monitor`** / **`RDP-Login-Monitor-Watchdog`**.
 - **`ignore.lst.example`** in the repo is a template for **`ignore.lst`** to suppress selected Security notifications (see section 7).
 - **`login_monitor.settings.example.ps1`** — template for **`login_monitor.settings.ps1`** (Telegram, SMTP, 4740, local IP exclusions). Deploy may create `login_monitor.settings.ps1` from the example on first install.
 

RdpMonitor-TaskQuery.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Запрос задач планировщика RDP-login-monitor через schtasks /Query /XML (fallback для Get-ScheduledTask).
 #>

Restart-RdpLoginMonitor.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Graceful restart RDP Login Monitor без Stop-Process.
 .DESCRIPTION

Sac-Client.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Клиент Security Alert Center для RDP-login-monitor.
 .DESCRIPTION
@@ -420,7 +420,6 @@ function Test-SacShouldAttemptSend {
 function Invoke-SacTlsPrep {
     if (-not $SacTlsSkipVerify) { return }
     if (-not $script:SacTlsCallbackRegistered) {
-        Write-SacLog 'CRITICAL: SacTlsSkipVerify=$true — TLS certificate validation disabled for SAC (MITM risk). Use only for short-lived lab debugging.'
         [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
         $script:SacTlsCallbackRegistered = $true
     }

Watchdog_RDP_Monitor.ps1

@@ -0,0 +1,117 @@
+<#
+.SYNOPSIS
+    Watchdog для Login_Monitor.ps1
+.DESCRIPTION
+    Проверяет, запущен ли основной скрипт Login_Monitor.ps1.
+    Если нет — запускает его и пишет лог.
+    Дополнительно проверяет heartbeat-файл и перезапускает скрипт, если heartbeat "протух".
+#>
+
+[CmdletBinding()]
+param(
+    [string]$MainScriptPath = "D:\Soft\Login_Monitor.ps1",
+    [string]$HeartbeatFile = "D:\Soft\Logs\last_heartbeat.txt",
+    [int]$HeartbeatStaleMinutes = 90,
+    [string]$WatchdogLog = "D:\Soft\Logs\watchdog.log"
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$script:Utf8BomEncoding = New-Object System.Text.UTF8Encoding $true
+$script:WatchdogLogBomChecked = $false
+
+function Ensure-FileStartsWithUtf8Bom {
+    param([Parameter(Mandatory = $true)][string]$Path)
+    if (-not (Test-Path -LiteralPath $Path)) { return }
+    $bytes = [System.IO.File]::ReadAllBytes($Path)
+    if ($bytes.Length -ge 3 -and $bytes[0] -eq 0xEF -and $bytes[1] -eq 0xBB -and $bytes[2] -eq 0xBF) { return }
+    $bom = [byte[]](0xEF, 0xBB, 0xBF)
+    $combined = New-Object byte[] ($bom.Length + $bytes.Length)
+    [Buffer]::BlockCopy($bom, 0, $combined, 0, $bom.Length)
+    if ($bytes.Length -gt 0) {
+        [Buffer]::BlockCopy($bytes, 0, $combined, $bom.Length, $bytes.Length)
+    }
+    [System.IO.File]::WriteAllBytes($Path, $combined)
+}
+
+function Write-WatchdogLog {
+    param([string]$Message)
+    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
+    $line = "$ts - $Message" + [Environment]::NewLine
+    $dir = Split-Path -Parent $WatchdogLog
+    if ($dir -and -not (Test-Path $dir)) {
+        New-Item -ItemType Directory -Path $dir -Force | Out-Null
+    }
+    if (-not $script:WatchdogLogBomChecked) {
+        Ensure-FileStartsWithUtf8Bom -Path $WatchdogLog
+        $script:WatchdogLogBomChecked = $true
+    }
+    [System.IO.File]::AppendAllText($WatchdogLog, $line, $script:Utf8BomEncoding)
+}
+
+function Get-MainScriptProcesses {
+    try {
+        $procs = Get-CimInstance Win32_Process -Filter "Name = 'powershell.exe' OR Name = 'pwsh.exe'" -ErrorAction Stop
+        return $procs | Where-Object { $_.CommandLine -and ($_.CommandLine -like "*$MainScriptPath*") }
+    } catch {
+        Write-WatchdogLog "Ошибка проверки процессов: $($_.Exception.Message)"
+        return @()
+    }
+}
+
+function Start-MainScript {
+    if (-not (Test-Path $MainScriptPath)) {
+        Write-WatchdogLog "Основной скрипт не найден: $MainScriptPath"
+        return
+    }
+    $args = "-NoProfile -ExecutionPolicy Bypass -File `"$MainScriptPath`""
+    Start-Process -FilePath "powershell.exe" -ArgumentList $args -WindowStyle Hidden | Out-Null
+    Write-WatchdogLog "Основной скрипт запущен: $MainScriptPath"
+}
+
+function Stop-MainScript {
+    $procs = Get-MainScriptProcesses
+    foreach ($p in $procs) {
+        try {
+            Stop-Process -Id $p.ProcessId -Force -ErrorAction Stop
+            Write-WatchdogLog "Остановлен зависший экземпляр PID=$($p.ProcessId)"
+        } catch {
+            Write-WatchdogLog "Ошибка остановки PID=$($p.ProcessId): $($_.Exception.Message)"
+        }
+    }
+}
+
+function Is-HeartbeatStale {
+    if (-not (Test-Path $HeartbeatFile)) {
+        Write-WatchdogLog "Heartbeat файл отсутствует: $HeartbeatFile"
+        return $true
+    }
+    try {
+        $raw = (Get-Content $HeartbeatFile -ErrorAction Stop | Select-Object -First 1).Trim()
+        if (-not $raw) { return $true }
+        $hb = [datetime]::ParseExact($raw, "dd.MM.yyyy HH:mm:ss", $null)
+        $age = (Get-Date) - $hb
+        return ($age.TotalMinutes -gt $HeartbeatStaleMinutes)
+    } catch {
+        Write-WatchdogLog "Ошибка чтения heartbeat: $($_.Exception.Message)"
+        return $true
+    }
+}
+
+$running = Get-MainScriptProcesses
+if (-not $running -or $running.Count -eq 0) {
+    Write-WatchdogLog "Основной скрипт не запущен, выполняю старт."
+    Start-MainScript
+    exit 0
+}
+
+if (Is-HeartbeatStale) {
+    Write-WatchdogLog "Heartbeat устарел, перезапускаю основной скрипт."
+    Stop-MainScript
+    Start-Sleep -Seconds 2
+    Start-MainScript
+} else {
+    Write-WatchdogLog "Проверка пройдена: процесс запущен, heartbeat свежий."
+}
+

exchange_monitor.settings.example.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Пример локальных настроек Exchange-MailSecurity.ps1
 .DESCRIPTION
@@ -29,11 +29,11 @@ $QueueMessageCountThreshold = 150
 # --- Пилот VIP (рекомендуется для первого запуска) ---
 # $VipMailboxesOnly = $true
 # $VipMailboxes = @(
-#     'director@kalinamall.ru',
-#     'cfo@kalinamall.ru'
+#     'director@example.com',
+#     'cfo@example.com'
 # )
 # $VipMailboxPatterns = @(
-#     '*@kalinamall.ru'   # опционально: все ящики домена из Get-Mailbox
+#     '*@example.com'   # опционально: все ящики домена из Get-Mailbox
 # )
 
 # Первый ночной скан: не слать сотни алертов по уже существующим пересылкам
@@ -46,9 +46,9 @@ $QueueMessageCountThreshold = 150
 # $SendInboxScanSummary = $true
 
 # Удалённый EMS (если скрипт не на Exchange)
-# $ExchangeServerFqdn = 'fifth.kalinamall.ru'
+# $ExchangeServerFqdn = 'mail.example.com'
 
 # Не сканировать Inbox rules (битое хранилище правил / Watson на Get-InboxRule)
 # $SkipInboxScanMailboxes = @(
-#     'k.selezneva@kalinamall.ru'
+#     'k.selezneva@example.com'
 # )

login_monitor.settings.example.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Локальные настройки Login_Monitor.ps1
 .DESCRIPTION
@@ -9,8 +9,8 @@
 #>
 
 # --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
-$TelegramBotToken = '8239219522:AAEyOZX3cwNfgGOMDkf-mgjTIuoaOh5gF7I'
-$TelegramChatID = '2843230'
+$TelegramBotToken = 'YOUR_BOT_TOKEN'
+$TelegramChatID = 'YOUR_CHAT_ID'
 # $TelegramBotTokenProtectedB64 = ''
 # $TelegramChatIDProtectedB64 = ''
 
@@ -29,17 +29,15 @@ $NotifyOrder = 'tg'
 # --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
 # $ServerDisplayName = 'UNMS Kalina'
 # --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
-# $ServerIPv4 = '192.168.160.57'
+# $ServerIPv4 = '10.0.0.10'
 
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
 $UseSAC = 'fallback'
-$SacUrl = 'https://sac.kalinamall.ru'
-$SacApiKey = 'sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8'
-$SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
-$SacTimeoutSec = 45
-$SacSpoolFlushMaxFiles = 50
-$SacSpoolMaxAgeHours = 72
+$SacUrl = 'https://sac.example.com'
+$SacApiKey = 'sac_CHANGE_ME'
+# $SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
+# $SacTimeoutSec = 12
 # $SacTlsSkipVerify = $false
 # $SacFallbackFailures = 5
 # $false = не слать report.daily.rdp с агента (суточный отчёт только из SAC)
@@ -60,7 +58,6 @@ $StartupRebootDetectMinutes = 5
 $GetInventory = $true
 
 # --- RDS Shadow Control + WinRM inbound (Enter-PSSession), severity warning ---
-# $EnableRcm1149Monitoring = 1            # RCM Operational 1149 (RDP auth; workstation + RDS server)
 # $EnableRcmShadowControlMonitoring = 1   # RCM Operational 20506/20507/20510
 # $EnableWinRmInboundMonitoring = 1       # WinRM Operational 91 (+ correlate Security 4624)
 # $EnableAdminShareMonitoring = 1         # Security 5140 C$/ADMIN$ (audit File Share)
@@ -72,7 +69,7 @@ $GetInventory = $true
 
 # --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
 $IgnoreAdvapiNetworkLogonSourceIps = @(
-    '192.168.160.57'
+    '10.0.0.1'
 )
 # --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
 # Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
@@ -85,9 +82,9 @@ $MaxBackupDays = 31
 
 # --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
 # Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
-$LockoutMonitorDomainController = 'K6A-DC3'
-$NetBiosDomainName = 'B26'
-$ExchangeIisLogPath = '\\fifth.kalinamall.ru\c$\inetpub\logs\LogFiles\W3SVC1'
+$LockoutMonitorDomainController = 'DC01'
+$NetBiosDomainName = 'CONTOSO'
+$ExchangeIisLogPath = '\\mail.example.com\c$\inetpub\logs\LogFiles\W3SVC1'
 $ExchangeServerHostForIisExclude = ''
 $ExchangeIisLogTailLines = 5000
 $ExchangeIisLogMinutesBeforeLockout = 30

scripts/Push-GitHubMirror.ps1

@@ -1,39 +0,0 @@
-# Push sanitized main to GitHub without leaving secrets on local main (kalinamall workflow).
-# Usage: .\scripts\Push-GitHubMirror.ps1
-param(
-    [string]$Remote = 'github',
-    [string]$Branch = 'main'
-)
-
-$ErrorActionPreference = 'Stop'
-$Root = Split-Path -Parent $PSScriptRoot
-Set-Location $Root
-
-git remote get-url $Remote 2>$null | Out-Null
-if ($LASTEXITCODE -ne 0) {
-    throw "remote not configured: $Remote"
-}
-
-if ((git status --porcelain)) {
-    throw 'working tree not clean; commit or stash first'
-}
-
-$before = (git rev-parse HEAD).Trim()
-Write-Output "local HEAD before GitHub push: $before"
-
-& "$PSScriptRoot\Sanitize-ForGitHub.ps1"
-& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target github
-& "$PSScriptRoot\Test-NoSecretsForGitHub.ps1"
-
-$status = git status --porcelain
-if (-not $status) {
-    Write-Output 'no changes after sanitize; pushing current HEAD to GitHub'
-    git push $Remote $Branch
-    exit 0
-}
-
-git add -A
-git commit -m "chore(github): sanitize secrets and sync public mirror URLs"
-git push --force-with-lease $Remote $Branch
-git reset --hard $before
-Write-Output "pushed $Remote/$Branch (force-with-lease mirror); local main restored to $before (production/kalinamall)"

scripts/Push-Mirror.ps1

@@ -1,4 +1,4 @@
-# Push main to a mirror remote with host-specific doc URLs, without leaving URL churn on main.
+# Push main to a mirror remote with host-specific doc URLs, without leaving URL churn on main.
 # Usage: .\scripts\Push-Mirror.ps1 github|kalinamall|papatramp
 param(
     [Parameter(Mandatory = $true)]
@@ -11,7 +11,7 @@ $Root = Split-Path -Parent $PSScriptRoot
 Set-Location $Root
 
 $remote = switch ($Target) {
-    'github' { 'github' }
+    'github' { 'origin' }
     'kalinamall' { 'kalinamall' }
     'papatramp' { 'papatramp' }
 }

scripts/Rewrite-GitHostUrls.ps1

@@ -1,4 +1,4 @@
-# Rewrite cross-repo URLs in tracked docs/config for the target Git host.
+# Rewrite cross-repo URLs in tracked docs/config for the target Git host.
 # Usage: .\scripts\Rewrite-GitHostUrls.ps1 github|kalinamall|papatramp
 param(
     [Parameter(Mandatory = $true)]
@@ -28,12 +28,12 @@ switch ($Target) {
 $BaseHost = $Base -replace '^https://', ''
 
 $patterns = @(
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`${1}$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`${1}$BlobSuffix/" }
-    @{ From = 'https://git\.kalinamall\.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
-    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`$1$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`$1$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
+    @{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`$1$BlobSuffix/" }
     @{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }
     @{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }
     @{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }

scripts/Sanitize-ForGitHub.ps1

@@ -1,169 +0,0 @@
-# Replace production-only values with public-safe placeholders (GitHub mirror).
-# Usage: .\scripts\Sanitize-ForGitHub.ps1
-# Reversible: production copies live on kalinamall/papatramp; restore via git reset --hard.
-param(
-    [switch]$WhatIf
-)
-
-$ErrorActionPreference = 'Stop'
-$Root = Split-Path -Parent $PSScriptRoot
-Set-Location $Root
-
-function Set-TrackedFileText {
-    param(
-        [Parameter(Mandatory = $true)][string]$RelativePath,
-        [Parameter(Mandatory = $true)][string]$Content
-    )
-    $path = Join-Path $Root $RelativePath
-    if ($WhatIf) {
-        Write-Output "WhatIf: would write $RelativePath"
-        return
-    }
-    $utf8Bom = New-Object System.Text.UTF8Encoding $true
-    [System.IO.File]::WriteAllText($path, $Content.TrimEnd() + "`r`n", $utf8Bom)
-    Write-Output "sanitized: $RelativePath"
-}
-
-$loginSettings = @'
-<#
-.SYNOPSIS
-    Локальные настройки Login_Monitor.ps1
-.DESCRIPTION
-    Скопируйте в C:\ProgramData\RDP-login-monitor\login_monitor.settings.ps1
-    и при необходимости отредактируйте. Deploy-LoginMonitor.ps1 не перезаписывает settings,
-    если SAC уже настроен (UseSAC не off и задан SacApiKey). При первой установке или апгрейде
-    с версии без SAC (нет Sac-Client.ps1 / пустой ключ) example копируется поверх с резервной .bak.
-#>
-
-# --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
-$TelegramBotToken = 'YOUR_BOT_TOKEN'
-$TelegramChatID = 'YOUR_CHAT_ID'
-# $TelegramBotTokenProtectedB64 = ''
-# $TelegramChatIDProtectedB64 = ''
-
-# --- Email (опционально) ---
-$NotifyOrder = 'tg'
-# $MailSmtpHost = 'smtp.example.com'
-# $MailSmtpPort = 587
-# $MailSmtpUser = ''
-# $MailSmtpPassword = ''
-# $MailFrom = 'monitor@example.com'
-# $MailTo = 'admin@example.com'
-# $MailSmtpStartTls = $true
-# $MailSmtpSsl = $false
-# $MailSmtpPasswordProtectedB64 = ''
-
-# --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
-# $ServerDisplayName = 'RDP-Server-01'
-# --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
-# $ServerIPv4 = '192.168.1.10'
-
-# --- Security Alert Center (SAC) ---
-# off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
-$UseSAC = 'fallback'
-$SacUrl = 'https://sac.example.com'
-$SacApiKey = 'sac_CHANGE_ME'
-$SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
-$SacTimeoutSec = 45
-$SacSpoolFlushMaxFiles = 50
-$SacSpoolMaxAgeHours = 72
-# $SacTlsSkipVerify = $false
-# $SacFallbackFailures = 5
-# $false = не слать report.daily.rdp с агента (суточный отчёт только из SAC)
-# В settings.ps1 используйте 1/0 или $true/$false — не пишите голое false без $
-$DailyReportEnabled = 1
-
-# --- Heartbeat SAC (agent.heartbeat): интервал в секундах; 14400 = 4 ч ---
-$HeartbeatInterval = 14400
-# Оповещение, если last_heartbeat.txt не обновлялся > множитель × интервал (2 × 4 ч = 8 ч)
-$HeartbeatStaleAlertMultiplier = 2
-# Poll SAC на команды qwinsta/logoff (сек); см. security-alert-center/docs/agent-control-plane.md
-# $SacCommandPollIntervalSec = 60
-
-# Окно (мин): LastBootUpTime + System 41/1074/6005/6008/6009 → «старт после перезагрузки ОС»
-$StartupRebootDetectMinutes = 5
-
-# --- Инвентаризация железа/ПО для SAC (agent.inventory, раз в 12 ч) ---
-$GetInventory = $true
-
-# --- RDS Shadow Control + WinRM inbound (Enter-PSSession), severity warning ---
-# $EnableRcm1149Monitoring = 1            # RCM Operational 1149 (RDP auth; workstation + RDS server)
-# $EnableRcmShadowControlMonitoring = 1   # RCM Operational 20506/20507/20510
-# $EnableWinRmInboundMonitoring = 1       # WinRM Operational 91 (+ correlate Security 4624)
-# $EnableAdminShareMonitoring = 1         # Security 5140 C$/ADMIN$ (audit File Share)
-# $WinRmIgnoreLocalSource = 1             # ::1, 127.0.0.1, fe80 (шум Exchange/локальный WinRM)
-# $WinRmIgnoreMachineAccounts = 1         # учётки, оканчивающиеся на $
-# $WinRmExchangeStrictMode = 1            # Exchange: user в Event 91 обязателен; 4624 только LogonProcess WinRM
-# HealthMailbox* уже в ExcludedUserPatterns скрипта
-# Проверка: powershell -File Login_Monitor.ps1 -CheckSac
-
-# --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
-$IgnoreAdvapiNetworkLogonSourceIps = @(
-    '192.168.1.10'
-)
-# --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
-# Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
-${Ignore4624-LT3-EmptyIP-Event} = $false
-
-# --- Ротация login_monitor.log и хранение бэкапов (Logs\Backup\LoginLog_*.bak) ---
-# $LogRotationHour = 0
-# $LogRotationMinute = 0
-$MaxBackupDays = 31
-
-# --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
-# Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
-$LockoutMonitorDomainController = 'dc01.contoso.local'
-$NetBiosDomainName = 'CONTOSO'
-$ExchangeIisLogPath = '\\mail.contoso.local\c$\inetpub\logs\LogFiles\W3SVC1'
-$ExchangeServerHostForIisExclude = ''
-$ExchangeIisLogTailLines = 5000
-$ExchangeIisLogMinutesBeforeLockout = 30
-'@
-
-Set-TrackedFileText -RelativePath 'login_monitor.settings.example.ps1' -Content $loginSettings
-
-$exchangeSettingsPath = Join-Path $Root 'exchange_monitor.settings.example.ps1'
-if (Test-Path -LiteralPath $exchangeSettingsPath) {
-    $ex = Get-Content -LiteralPath $exchangeSettingsPath -Raw
-    $ex = $ex -replace 'kalinamall\.ru', 'example.com'
-    $ex = $ex -replace 'fifth\.example\.com', 'mail.contoso.local'
-    $ex = $ex -replace 'k\.selezneva@example\.com', 'broken-mailbox@example.com'
-    Set-TrackedFileText -RelativePath 'exchange_monitor.settings.example.ps1' -Content $ex
-}
-
-$updatePath = Join-Path $Root 'update-rdp-monitor.ps1'
-if (Test-Path -LiteralPath $updatePath) {
-    $upd = Get-Content -LiteralPath $updatePath -Raw
-    $upd = $upd -replace "Posle fetch: vsegda reset --hard na kalinamall/main \(bez merge\), zatem clean -fd\.",
-        'Posle fetch: reset --hard na upstream/main (bez merge), zatem clean -fd.'
-    $upd = $upd -replace "\\\\b26\\NETLOGON\\RDP-login-monitor", '\\dc.contoso.local\NETLOGON\RDP-login-monitor'
-    $upd = $upd -replace "https://git\.kalinamall\.ru/PapaTramp/RDP-login-monitor\.git",
-        'https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git'
-    Set-TrackedFileText -RelativePath 'update-rdp-monitor.ps1' -Content $upd
-}
-
-$netlogonDoc = Join-Path $Root 'Docs/deploy-netlogon-publish.md'
-if (Test-Path -LiteralPath $netlogonDoc) {
-    $doc = Get-Content -LiteralPath $netlogonDoc -Raw
-    $doc = $doc -replace 'K6A-DC3', 'dc01.corp.example.com'
-    $doc = $doc -replace '\\\\b26\\', '\\dc.contoso.local\'
-    $doc = $doc -replace "https://git\.kalinamall\.ru/PapaTramp/RDP-login-monitor\.git",
-        'https://git.example.com/org/RDP-login-monitor.git'
-    Set-TrackedFileText -RelativePath 'Docs/deploy-netlogon-publish.md' -Content $doc
-}
-
-$mdFiles = @(git ls-files '*.md' 2>$null | Where-Object { $_ -and (Test-Path $_) })
-foreach ($rel in $mdFiles) {
-    $path = Join-Path $Root $rel
-    $md = Get-Content -LiteralPath $path -Raw
-    $orig = $md
-    $md = $md -replace 'https://git\.kalinamall\.ru/PapaTramp/([^)/\s]+)/src/branch/main/', 'https://git.papatramp.ru/PapaTramp/$1/src/branch/main/'
-    $md = $md -replace 'https://git\.papatramp\.ru/PapaTramp/([^)/\s]+)/src/branch/main/', 'https://git.papatramp.ru/PapaTramp/$1/src/branch/main/'
-    $md = $md -replace 'https://git\.kalinamall\.ru/PapaTramp/', 'https://git.papatramp.ru/PapaTramp/'
-    $md = $md -replace 'https://git\.papatramp\.ru/PapaTramp/', 'https://git.papatramp.ru/PapaTramp/'
-    if ($md -ne $orig) {
-        Set-TrackedFileText -RelativePath $rel -Content $md
-    }
-}
-
-Write-Output 'Sanitize-ForGitHub: done'

scripts/Test-NoSecretsForGitHub.ps1

@@ -1,47 +0,0 @@
-# Fail if tracked text still contains production-only markers (run before GitHub push).
-$ErrorActionPreference = 'Stop'
-$Root = Split-Path -Parent $PSScriptRoot
-Set-Location $Root
-
-$patterns = @(
-    '8239219522',
-    'sac_UkOsAT',
-    '2843230',
-    'sac\.kalinamall\.ru',
-    '\\\\b26\\',
-    'K6A-DC3',
-    'fifth\.kalinamall',
-    '192\.168\.160\.57',
-    'kalinamall\.ru',
-    'git\.kalinamall\.ru',
-    'git\.papatramp\.ru',
-    '\d{8,12}:[A-Za-z0-9_-]{20,}'
-)
-
-$extensions = @('*.md', '*.ps1', '*.example', '*.txt', '*.json', '*.yml', '*.yaml')
-$files = git ls-files $extensions 2>$null | Where-Object { $_ -and (Test-Path $_) }
-
-$hits = @()
-foreach ($file in $files) {
-    if ($file -like 'scripts/Rewrite-GitHostUrls.ps1') { continue }
-    if ($file -like 'scripts/Push-PrivateMirror.ps1') { continue }
-    if ($file -like 'scripts/Sanitize-ForGitHub.ps1') { continue }
-    if ($file -like 'scripts/Test-NoSecretsForGitHub.ps1') { continue }
-    if ($file -like 'scripts/Push-GitHubMirror.ps1') { continue }
-    if ($file -like 'scripts/Push-Mirror.ps1') { continue }
-
-    $text = Get-Content -LiteralPath $file -Raw -ErrorAction SilentlyContinue
-    if ([string]::IsNullOrEmpty($text)) { continue }
-
-    foreach ($pat in $patterns) {
-        if ($text -match $pat) {
-            $hits += "${file}: matches /$pat/"
-        }
-    }
-}
-
-if ($hits.Count -gt 0) {
-    Write-Error ("GitHub secret scan failed:`n" + ($hits -join "`n"))
-}
-
-Write-Output "GitHub secret scan: OK ($($files.Count) files)"

update-rdp-monitor.ps1

@@ -1,10 +1,10 @@
-<#
+<#
 .SYNOPSIS
     Obnovlyaet klon RDP-login-monitor s upstream git i kopiruet dist na NETLOGON.
 .DESCRIPTION
     Dlya servera publikatsii (napr. DC3). Po umolchaniyu GitHub (github.com/PTah).
     Na zakrytom zerkale ukazhite -GitUrl URL vashego Gitea.
-    Posle fetch: vsegda reset --hard na kalinamall/main (bez merge), zatem clean -fd.
+    Posle fetch: vsegda reset --hard na vetku upstream (bez merge), zatem clean -fd.
     Kopiruyutsya: polnyj spisok v Docs/deploy-netlogon-publish.md.
 .EXAMPLE
     powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\soft\update-rdp-monitor.ps1
@@ -14,7 +14,7 @@
 [CmdletBinding(SupportsShouldProcess = $true)]
 param(
     [string]$RepoPath = 'C:\Soft\Git\RDP-login-monitor',
-    [string]$NetlogonDest = '\\b26\NETLOGON\RDP-login-monitor',
+    [string]$NetlogonDest = '\\dc.contoso.local\NETLOGON\RDP-login-monitor',
     [string]$GitUrl = 'https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git',
     [string]$GitBranch = 'main',
     [string]$LogFile = 'C:\soft\Logs\update-rdp-monitor.log',
@@ -34,7 +34,6 @@ $DistFiles = @(
     'Install-DomainMonitors.ps1',
     'Deploy-DomainMonitors.ps1',
     'exchange_monitor.settings.example.ps1',
-    'Diagnose-RdpLoginMonitor.ps1',
     'login_monitor.settings.example.ps1'
 )
 
@@ -113,38 +112,25 @@ function Ensure-GitRepository {
 function Get-ConfiguredGitRemoteName {
     $names = @(Invoke-GitCommand -Arguments @('remote') | ForEach-Object { "$_".Trim() } | Where-Object { $_ })
     if ($names.Count -eq 0) { return $null }
-    if ('kalinamall' -in $names) { return 'kalinamall' }
-    foreach ($n in $names) {
-        $url = (& git -C $RepoPath remote get-url $n 2>$null)
-        if ($url -match 'git\.kalinamall\.ru') { return $n }
-    }
     if ('origin' -in $names) { return 'origin' }
     return $names[0]
 }
 
-function Ensure-GitKalinamallRemote {
+function Ensure-GitUpstreamRemote {
     $name = Get-ConfiguredGitRemoteName
     if ($null -ne $name) {
         $url = (& git -C $RepoPath remote get-url $name 2>$null)
-        if ($url -match 'git\.kalinamall\.ru') {
-            Write-UpdateLog "Using remote: $name ($url)"
-            return $name
-        }
-        Write-UpdateLog "Remote $name is not kalinamall ($url); adding kalinamall -> $GitUrl"
-    } else {
-        Write-UpdateLog "No remotes; adding kalinamall -> $GitUrl"
+        Write-UpdateLog "Using remote: $name ($url)"
+        return $name
     }
-    if ('kalinamall' -in @(& git -C $RepoPath remote 2>$null)) {
-        Invoke-GitCommand -Arguments @('remote', 'set-url', 'kalinamall', $GitUrl)
-        return 'kalinamall'
-    }
-    Invoke-GitCommand -Arguments @('remote', 'add', 'kalinamall', $GitUrl)
-    return 'kalinamall'
+    Write-UpdateLog "No remotes; adding origin -> $GitUrl"
+    Invoke-GitCommand -Arguments @('remote', 'add', 'origin', $GitUrl)
+    return 'origin'
 }
 
 function Update-Repository {
     Ensure-GitRepository
-    $remote = Ensure-GitKalinamallRemote
+    $remote = Ensure-GitUpstreamRemote
     Invoke-GitCommand -Arguments @('fetch', '--prune', $remote, $GitBranch)
     $upstream = "${remote}/${GitBranch}"
 

version.txt

@@ -1 +1 @@
-2.1.15-SAC
+2.1.9-SAC