fix: dedup 4624 login alerts and log Skip/dedup reasons (1.2.18-SAC)

Co-authored-by: Cursor <cursoragent@cursor.com>

tools/Show-Rdp4624Recent.ps1

@@ -0,0 +1,51 @@
+<#
+.SYNOPSIS
+    Просмотр недавних 4624 с полями для диагностики RDP-login-monitor.
+.EXAMPLE
+    .\Show-Rdp4624Recent.ps1
+    .\Show-Rdp4624Recent.ps1 -Minutes 30 -User papatramp
+#>
+[CmdletBinding()]
+param(
+    [int]$Minutes = 15,
+    [string]$User = '',
+    [int]$MaxEvents = 50
+)
+
+$start = (Get-Date).AddMinutes(-$Minutes)
+Write-Host "Security 4624 since $($start.ToString('yyyy-MM-dd HH:mm:ss')) (local time)" -ForegroundColor Cyan
+
+$events = @(Get-WinEvent -FilterHashtable @{
+    LogName   = 'Security'
+    Id        = 4624
+    StartTime = $start
+} -MaxEvents $MaxEvents -ErrorAction SilentlyContinue)
+
+if ($events.Count -eq 0) {
+    Write-Host 'No 4624 events in window.'
+    exit 0
+}
+
+function Get-EvProp($Event, [string]$Name) {
+    $xml = [xml]$Event.ToXml()
+    $n = $xml.Event.EventData.Data | Where-Object { $_.Name -eq $Name } | Select-Object -First 1
+    if ($null -eq $n) { return '-' }
+    return [string]$n.'#text'
+}
+
+$rows = foreach ($ev in $events) {
+    $u = Get-EvProp $ev 'TargetUserName'
+    if ($User -and $u -notlike "*$User*") { continue }
+  [pscustomobject]@{
+        TimeCreated = $ev.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
+        RecordId    = $ev.RecordId
+        User        = $u
+        LogonType   = Get-EvProp $ev 'LogonType'
+        IpAddress   = Get-EvProp $ev 'IpAddress'
+        Workstation = Get-EvProp $ev 'WorkstationName'
+        Process     = Get-EvProp $ev 'LogonProcessName'
+    }
+}
+
+$rows | Format-Table -AutoSize
+Write-Host "`nTip: monitor log — Select-String -Path 'C:\ProgramData\RDP-login-monitor\Logs\*.log' -Pattern 'Notify:|Skip 4624|Notify dedup'"

tools/Test-ScriptSyntax.ps1

@@ -0,0 +1,8 @@
+param([string]$Path = (Join-Path $PSScriptRoot '..\Login_Monitor.ps1'))
+$errs = $null
+[void][System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $Path), [ref]$null, [ref]$errs)
+if ($errs) {
+    $errs | ForEach-Object { $_.ToString() }
+    exit 1
+}
+Write-Output 'OK'