Replace \\B26\\NETLOGON with \\dc.contoso.local\\NETLOGON.
Remove scripts/ mirror tools and tools/Push-KalinamallOnly.ps1.
Sanitize login_monitor.settings.example (placeholders, no secrets).
Simplify update-rdp-monitor.ps1 to use origin remote only.
Keep dev tooling under tools/ only.
Co-authored-by: Cursor <cursoragent@cursor.com>
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add deploy-time patch when login_monitor.settings.ps1 lacks MaxBackupDays,
enable the setting in example, and remove duplicate default in Login_Monitor.ps1.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add configurable `${Ignore4624-LT3-EmptyIP-Event}` for RDP monitor to suppress noisy 4624 network logons with empty IP (-) on mail/Exchange hosts.
Update settings example and README with usage instructions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deploy overwrites login_monitor.settings.ps1 from the trusted example when
Sac-Client.ps1 or SacApiKey/UseSAC are missing, with a .bak backup. Skips
overwrite when SAC is already configured; continues deploy on version match
if SAC bootstrap is still required.
Секреты, SMTP, 4740 и IP-исключения больше не в Login_Monitor.ps1 —
не слетают при автообновлении с NETLOGON. Deploy создаёт settings из example при первой установке.
PTah