From be0c394ac496c73e004c68ab6784027af69fe040 Mon Sep 17 00:00:00 2001 From: PTah Date: Mon, 27 Apr 2026 10:29:10 +1000 Subject: [PATCH] Fix Uc RU category string: add missing 0x0445 in vyhod (auditpol 0x57); v1.1.2 --- Login_Monitor.ps1 | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Login_Monitor.ps1 b/Login_Monitor.ps1 index ee9ea60..acd5b45 100644 --- a/Login_Monitor.ps1 +++ b/Login_Monitor.ps1 @@ -30,7 +30,7 @@ function Uc { param([int[]]$C) -join ($C | ForEach-Object { [char]$_ }) } # ============================================ # Версия (обновляйте при значимых изменениях; пишется в лог и в консоль при интерактивном запуске) -$ScriptVersion = "1.1.1" +$ScriptVersion = "1.1.2" # Логи $LogFile = "D:\Soft\Logs\login_monitor.log" @@ -240,7 +240,8 @@ function Enable-SecurityAudit { $r = Invoke-AuditPol -Arguments '/list /subcategory:*' if ($r.ExitCode -ne 0) { return $false } - $ax = Uc @(0x0412,0x0445,0x043E,0x0434,0x002F,0x0432,0x044B,0x043E,0x0434) + # RU category Logon/Logoff (Uc): must include 0x0445 before second 043E (was 0x57 from auditpol) + $ax = Uc @(0x0412,0x0445,0x043E,0x0434,0x002F,0x0432,0x044B,0x0445,0x043E,0x0434) return ($r.Text -like ('*{0}*' -f $ax)) } @@ -281,7 +282,7 @@ function Enable-SecurityAudit { } function Ensure-RuLogonLogoffSubcategories { - $category = Uc @(0x0412,0x0445,0x043E,0x0434,0x002F,0x0432,0x044B,0x043E,0x0434) + $category = Uc @(0x0412,0x0445,0x043E,0x0434,0x002F,0x0432,0x044B,0x0445,0x043E,0x0434) $targets = @( (Uc @(0x0412,0x0445,0x043E,0x0434,0x0020,0x0432,0x0020,0x0441,0x0438,0x0441,0x0442,0x0435,0x043C,0x0443)), (Uc @(0x0412,0x044B,0x0445,0x043E,0x0434,0x0020,0x0438,0x0437,0x0020,0x0441,0x0438,0x0441,0x0442,0x0435,0x043C,0x044B))