Production tokens and NETLOGON paths live on kalinamall/papatramp only. Use scripts/Push-PrivateMirror.ps1 after feature pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Real Telegram/SAC tokens, NETLOGON and org hostnames back on kalinamall. GitHub main keeps placeholders; use scripts/Push-PrivateMirror.ps1 after public pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace \\B26\\NETLOGON with \\dc.contoso.local\\NETLOGON.
Remove scripts/ mirror tools and tools/Push-KalinamallOnly.ps1.
Sanitize login_monitor.settings.example (placeholders, no secrets).
Simplify update-rdp-monitor.ps1 to use origin remote only.
Keep dev tooling under tools/ only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publish TaskQuery helpers to script scope after import so ExecutionTimeLimit checks work from nested deploy callers; add RDP_DEPLOY_FUNCTIONS_ONLY early exit for isolated function loading.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publish TaskQuery helpers to script scope after import so deploy checks work from nested callers; add kalinamall-only smoke tests and RDP_DEPLOY_FUNCTIONS_ONLY hook.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deploy uses Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved only; no call to Test-RdpMonitorScheduledTaskNeedsUnlimitedExecutionTimeLimit from external module.
Verify TaskQuery module by Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved, prefer share path over stale InstallRoot, and guard verification when init fails.
Stop false redeploy loops when Get-ScheduledTask fails, push agent version to SAC immediately after deploy, and skip redundant schtasks /Run during task maintenance.
Default PT72H caused Task Scheduler to stop the monitor after 72 hours.
Register main task with PT0S, re-register on deploy and Ensure when limit is set.
Co-authored-by: Cursor <cursoragent@cursor.com>
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Enable-SecurityAudit crashed on init when checking RU/EN File Share attempts because accessing UseGuid on a hashtable without that key throws under Set-StrictMode -Version Latest.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add deploy-time patch when login_monitor.settings.ps1 lacks MaxBackupDays,
enable the setting in example, and remove duplicate default in Login_Monitor.ps1.
Co-authored-by: Cursor <cursoragent@cursor.com>
2.0.9 dot-sourced settings inside Import-LoginMonitorSettingsFile left UseSAC/Telegram in function scope; monitor ran with defaults off and no SAC ingest.
Co-authored-by: Cursor <cursoragent@cursor.com>
PTah