9ab6cc64a1
docs: add Docs/ guides; Exchange Mail Security scripts (v1.6.0)
...
- Docs: RDP deploy, Exchange mail security, NETLOGON publish
- Exchange-MailSecurity.ps1, Notify-Common, Deploy/Install-DomainMonitors
- DEPLOY.md redirects to Docs/
2026-05-22 14:32:50 +10:00
40c557f041
feat: aggregated 4625 burst alerts (two-tier rate limit, v1.5.10)
...
- Tier 1: 5 failures per 60s per IP+user
- Tier 2: 12 failures per 60s per IP (spraying)
- Suppress per-event 4625 during burst; no auto-ban
2026-05-22 14:13:06 +10:00
ab98eab49c
fix: invoke auditpol by full path when System32 is missing from PATH (v1.5.6)
2026-05-22 10:41:59 +10:00
f4375c2349
readme and docs editing
2026-05-22 09:19:26 +10:00
52b1723137
feat: ignore.lst for 4740, IIS time window, stale heartbeat alert (v1.5.3)
...
- ignore.lst scopes: 4740:/all: prefixes; IP rules match IIS client IPs
- IIS ActiveSync IPs only within minutes before lockout event
- Alert when last_heartbeat.txt is older than 2x HeartbeatInterval
2026-05-19 20:46:35 +10:00
b7786e8690
feat: AD lockout 4740 with IIS IPs and SMTP notifications (v1.5.2)
...
Monitor Security 4740 on a configured domain controller and enrich alerts
with ActiveSync client IPs from IIS logs. Add unified Telegram and email
delivery with NotifyOrder. Update README and DPAPI helper for mail password.
2026-05-19 19:47:23 +10:00
bdcf2bdc5f
docs: expand ignore.lst section in README and README_eng
2026-05-04 09:02:14 +10:00
17befc867e
Document ignore.lst in README and DEPLOY
...
Describe optional Security 4624/4625 suppression, UTF-8, and that deploy does not ship ignore.lst.
2026-05-04 07:56:49 +10:00
e96131d722
docs: refresh README, add English README_eng.md
...
Document daily report, deploy marker, SkipScheduledTaskMaintenance, and legacy watchdog scripts. Add full English translation.
2026-05-03 18:52:18 +10:00
d26784fb7f
Refresh README for current ProgramData + Deploy workflow
2026-04-30 16:43:14 +10:00
02424875fb
Add repository search keywords to README
2026-04-30 16:34:26 +10:00
e0b0fa3d7e
Watchdog: schtasks /Run после установки; DEPLOY/README про задачи и UNC; версия 1.3.4
2026-04-29 16:07:35 +10:00
80f57c5351
Добавлен доменный деплой (Deploy-LoginMonitor.ps1, version.txt), DEPLOY.md, правки README и комментарий к версии в Login_Monitor.ps1
2026-04-29 15:14:41 +10:00
4f0b6e219c
Add Install-ScheduledTasks.ps1 for Task Scheduler registration; document in README
2026-04-13 11:29:21 +10:00
b164e51965
README: remove internal PMG/LDAP filter details from public docs
2026-04-13 11:23:44 +10:00
685ef5260a
Clarify startup Telegram: Gateway targets internal PCs; exclude Gateway-only from RDS host line
2026-04-13 10:53:10 +10:00
2826e3f9cd
Telegram startup: mention RDS and RD Gateway when applicable
2026-04-13 10:49:30 +10:00
848381e098
Use UTF-8 BOM for logs; document FAR encoding
2026-04-13 10:33:11 +10:00
99ab020347
Document recent monitoring and auditpol improvements
2026-04-11 22:16:13 +10:00
c5a4c26b1e
Add editor/gitattributes defaults for PowerShell encoding
2026-04-11 21:23:27 +10:00
89acb0a914
Update README.md
2026-04-09 16:42:00 +10:00
21ad87d08d
Add login monitor, watchdog and Task Scheduler docs
2026-04-09 16:36:27 +10:00
PTah