PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: rdp.session.logoff only on workstations, not DC/Exchange (2.1.12-SAC)

Browse Source 
4634/4647 on servers with LogonType 3 flooded SAC with Kerberos/LDAP session ends, not RDP logoffs.
This commit is contained in:
PTah
2026-07-13 17:36:31 +10:00
parent 23fa83ddd6
commit 6d5dfbbeed
3 changed files with 24 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -27,7 +27,7 @@ powershell -NoProfile -ExecutionPolicy Bypass -File "\\<DC>\NETLOGON\RDP-login-m
| Источник | Тип SAC |
|----------|---------|
| Security 4624/4625 | `rdp.login.*` |
| Security 4634/4647 (прямой RDP) | `rdp.session.logoff` → закрытие сессии в SAC |
| Security 4634/4647 (прямой RDP, **только рабочая станция**, LT10) | `rdp.session.logoff` → закрытие сессии в SAC |
| Security 5140 | `smb.admin_share.access` |
| WinRM Operational 91 | `winrm.session.started` |
| RD Gateway 302/303 | `rdg.connection.*` → flap 302→303 в SAC |