From 6d5dfbbeed157b44bf526c3f2bf0adb80c7ac066 Mon Sep 17 00:00:00 2001
From: PTah <papatramp@gmail.com>
Date: Mon, 13 Jul 2026 17:36:31 +1000
Subject: [PATCH] fix: rdp.session.logoff only on workstations, not DC/Exchange
 (2.1.12-SAC)

4634/4647 on servers with LogonType 3 flooded SAC with Kerberos/LDAP session ends, not RDP logoffs.
---
 Login_Monitor.ps1 | 33 ++++++++++++++++++++++-----------
 README.md         |  2 +-
 version.txt       |  2 +-
 3 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/Login_Monitor.ps1 b/Login_Monitor.ps1
index 28e5965..c0a4c64 100644
--- a/Login_Monitor.ps1
+++ b/Login_Monitor.ps1
@@ -90,7 +90,7 @@ $script:SkipLogDetailLimit = 15
 # строки ниже, если правки «мелкие» и вы не хотите менять отображаемую версию в логах).
 # Рекомендация: при значимых релизах меняйте и $ScriptVersion, и version.txt одинаково; при только
 # исправлениях на шаре — достаточно поднять patch в version.txt (например 1.3.0.1).
-$ScriptVersion = "2.1.11-SAC"
+$ScriptVersion = "2.1.12-SAC"
 
 # Логи (все под InstallRoot)
 $LogFile = Join-Path $script:InstallRoot "Logs\login_monitor.log"
@@ -4614,7 +4614,25 @@ function Start-LoginMonitor {
                         if ($event.Id -eq 4648) {
                             $shouldIgnore = $true
                             $ignoreReason = 'EventID 4648 excluded (MonitorInteractiveOnly)'
-                        } elseif ($event.Id -in 4624, 4625, 4634, 4647) {
+                        } elseif ($event.Id -in 4634, 4647) {
+                            if (-not $osKind.IsWorkstation) {
+                                $shouldIgnore = $true
+                                $ignoreReason = 'logoff 4634/4647 only on workstations (server LT3 is Kerberos/LDAP noise)'
+                            } else {
+                                $interactiveTypes = @(10)
+                                $modeLabel = 'workstation logoff LT10'
+                                if ($interactiveTypes -notcontains $eventInfo.LogonType) {
+                                    $allow4647Workstation = (
+                                        $event.Id -eq 4647 -and
+                                        $eventInfo.LogonType -eq 0
+                                    )
+                                    if (-not $allow4647Workstation) {
+                                        $shouldIgnore = $true
+                                        $ignoreReason = "LogonType $($eventInfo.LogonType) not in $modeLabel"
+                                    }
+                                }
+                            }
+                        } elseif ($event.Id -in 4624, 4625) {
                             if ($osKind.IsWorkstation) {
                                 $interactiveTypes = @(10)
                                 $modeLabel = 'workstation LT10'
@@ -4623,15 +4641,8 @@ function Start-LoginMonitor {
                                 $modeLabel = 'server LT2/3/10'
                             }
                             if ($interactiveTypes -notcontains $eventInfo.LogonType) {
-                                $allow4647Workstation = (
-                                    $osKind.IsWorkstation -and
-                                    $event.Id -eq 4647 -and
-                                    $eventInfo.LogonType -eq 0
-                                )
-                                if (-not $allow4647Workstation) {
-                                    $shouldIgnore = $true
-                                    $ignoreReason = "LogonType $($eventInfo.LogonType) not in $modeLabel"
-                                }
+                                $shouldIgnore = $true
+                                $ignoreReason = "LogonType $($eventInfo.LogonType) not in $modeLabel"
                             }
                         } else {
                             $shouldIgnore = $true
diff --git a/README.md b/README.md
index ca630b9..ba5b3e8 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ powershell -NoProfile -ExecutionPolicy Bypass -File "\\<DC>\NETLOGON\RDP-login-m
 | Источник | Тип SAC |
 |----------|---------|
 | Security 4624/4625 | `rdp.login.*` |
-| Security 4634/4647 (прямой RDP) | `rdp.session.logoff` → закрытие сессии в SAC |
+| Security 4634/4647 (прямой RDP, **только рабочая станция**, LT10) | `rdp.session.logoff` → закрытие сессии в SAC |
 | Security 5140 | `smb.admin_share.access` |
 | WinRM Operational 91 | `winrm.session.started` |
 | RD Gateway 302/303 | `rdg.connection.*` → flap 302→303 в SAC |
diff --git a/version.txt b/version.txt
index ed356fa..3a74b42 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-2.1.11-SAC
+2.1.12-SAC