PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(winrm): Exchange strict mode to suppress false 91/4624 alerts

Browse Source 
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
PTah
2026-06-05 11:07:21 +10:00
parent fe2e6d624f
commit 80b2337d61
6 changed files with 116 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Docs/deploy-rdp-login-monitor.md
+2 -1
View File
@@ -76,8 +76,9 @@ flowchart TD
- `${Ignore4624-LT3-EmptyIP-Event} = $true`
- `$WinRmIgnoreLocalSource = 1`
- `$WinRmIgnoreMachineAccounts = 1`
- `$WinRmExchangeStrictMode = 1`
Подавление шума WinRM (HealthMailbox, loopback) и лишних **4624 LT3**.
Подавление шума WinRM (HealthMailbox, loopback), ложных WinRM 91↔4624 (Outlook/LT3) и лишних **4624 LT3**.
**Мониторинг очередей транспорта и правил пересылки** — другой скрипт, **не** через GPO RDP-монитора: