PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: rdp.session.logoff only on workstations, not DC/Exchange (2.1.12-SAC)

Browse Source 
4634/4647 on servers with LogonType 3 flooded SAC with Kerberos/LDAP session ends, not RDP logoffs.
This commit is contained in:
PTah
2026-07-13 17:36:31 +10:00
parent 23fa83ddd6
commit 6d5dfbbeed
3 changed files with 24 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Login_Monitor.ps1
+22 -11
View File
@@ -90,7 +90,7 @@ $script:SkipLogDetailLimit = 15
# строки ниже, если правки «мелкие» и вы не хотите менять отображаемую версию в логах).
# Рекомендация: при значимых релизах меняйте и $ScriptVersion, и version.txt одинаково; при только
# исправлениях на шаре — достаточно поднять patch в version.txt (например 1.3.0.1).
$ScriptVersion = "2.1.11-SAC"
$ScriptVersion = "2.1.12-SAC"
# Логи (все под InstallRoot)
$LogFile = Join-Path $script:InstallRoot "Logs\login_monitor.log"
@@ -4614,7 +4614,25 @@ function Start-LoginMonitor {
if ($event.Id -eq 4648) {
$shouldIgnore = $true
$ignoreReason = 'EventID 4648 excluded (MonitorInteractiveOnly)'
} elseif ($event.Id -in 4624, 4625, 4634, 4647) {
} elseif ($event.Id -in 4634, 4647) {
if (-not $osKind.IsWorkstation) {
$shouldIgnore = $true
$ignoreReason = 'logoff 4634/4647 only on workstations (server LT3 is Kerberos/LDAP noise)'
} else {
$interactiveTypes = @(10)
$modeLabel = 'workstation logoff LT10'
if ($interactiveTypes -notcontains $eventInfo.LogonType) {
$allow4647Workstation = (
$event.Id -eq 4647 -and
$eventInfo.LogonType -eq 0
)
if (-not $allow4647Workstation) {
$shouldIgnore = $true
$ignoreReason = "LogonType $($eventInfo.LogonType) not in $modeLabel"
}
}
}
} elseif ($event.Id -in 4624, 4625) {
if ($osKind.IsWorkstation) {
$interactiveTypes = @(10)
$modeLabel = 'workstation LT10'
@@ -4623,15 +4641,8 @@ function Start-LoginMonitor {
$modeLabel = 'server LT2/3/10'
}
if ($interactiveTypes -notcontains $eventInfo.LogonType) {
$allow4647Workstation = (
$osKind.IsWorkstation -and
$event.Id -eq 4647 -and
$eventInfo.LogonType -eq 0
)
if (-not $allow4647Workstation) {
$shouldIgnore = $true
$ignoreReason = "LogonType $($eventInfo.LogonType) not in $modeLabel"
}
$shouldIgnore = $true
$ignoreReason = "LogonType $($eventInfo.LogonType) not in $modeLabel"
}
} else {
$shouldIgnore = $true