PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
121 Commits 1 Branch 1 Tag
afc7bf9dcaf3c991586d491b86e11c5b115bb092
Commit Graph

121 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
PTah afc7bf9dca fix: log exact WinRM skip reason and bump to 2.0.5-SAC 
Add Get-WinRmIgnoreReason to expose precise built-in/ignore decision path (empty user, excluded pattern, machine account, local IP, ignore-list match) for WinRM 91 diagnostics.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:17:48 +10:00
PTah ac095fe1a0 fix: parse WinRM 91 user/ip correctly and bump to 2.0.4-SAC 
Improve WinRM Operational event parsing to extract username and clientIP from EventData/Message fallback, preventing false Skip for valid Enter-PSSession events.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:05:14 +10:00
PTah 81323e8596 chore: bump RDP monitor version to 2.0.3-SAC 
Increase ScriptVersion and version.txt after deploy-side reliability updates affecting WinRM monitoring behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 12:58:40 +10:00
PTah 1eedfc736f fix: enforce WinRM inbound block and enable Operational log in deploy 
Deploy now ensures required WinRM inbound settings exist in login_monitor.settings.ps1 and attempts to enable Microsoft-Windows-WinRM/Operational via wevtutil when disabled.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 12:55:05 +10:00
PTah d54d04623f fix: PS 5.1 Sac-Client JSON types without uint alias 2.0.2-SAC 
Replace [uint]/[ulong] -is checks with GetType().IsPrimitive for Windows PowerShell 5.1 on domain hosts.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:13:19 +10:00
PTah 084494cfa8 fix: SAC JSON serialize daily report without PSMethod cycle 2.0.1-SAC 
Convert-AnyToJsonSerializable returns plain arrays and skips PSMethod/ScriptBlock instead of Generic.List objects that broke JavaScriptSerializer.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:08:14 +10:00
PTah 1a1467f910 chore: bump release to 2.0.0-SAC 
Major version line so Deploy upgrades agents stuck on 1.6.x and older 1.2.x-SAC builds from NETLOGON.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:03:48 +10:00
PTah 543369832a fix: restore RD Gateway 302/303 polling and SAC ingest 1.2.35-SAC 
Fix poll cursor skipping events at time boundary, add 60min lookback on start, parse RU gateway messages, and map 303 disconnect to rdg.connection.disconnected.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 08:14:37 +10:00
PTah f970e284ac fix: stronger 4624 login dedup and logon type label 1.2.34-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 19:14:05 +10:00
PTah 6a9b2b70dc fix: use full path to schtasks.exe in deploy post-update start 1.2.33-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 19:03:28 +10:00
PTah 2118d4a4a0 fix: hide redundant workstation line in RDP login alerts 1.2.32-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:55:11 +10:00
PTah 78f241df32 feat: add Diagnose-RdpLoginMonitor.ps1 for post-login troubleshooting 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:40:10 +10:00
PTah e1ae9834a9 feat: single deploy startup, stop mode, notification_body 1.2.31-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:11:18 +10:00
PTah a74c8df877 feat: lifecycle notifications with telegram_via and settings reload 1.2.30-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 12:25:50 +10:00
PTah 2395f536cd feat: notification source line in agent alerts (1.2.29-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:51:55 +10:00
PTah b56ad9c7e4 feat: daily report agent version line and per-line active users (1.2.28-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:28:29 +10:00
PTah e738d97c9c chore: release 1.2.27-SAC (deploy version compare + docs) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:18:58 +10:00
PTah 1fe8bd9f7d fix(deploy): version compare for -SAC labels; refresh deploy docs 
Compare deployed_version.txt with full label (e.g. 1.2.26-SAC) so GPO deploy exits when up to date. Restructure deploy-rdp-login-monitor.md with mermaid flow, Exchange vs DomainMonitors split, and remove duplicated sections.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:13:33 +10:00
PTah bf04c8865c feat(deploy): auto-add Exchange WinRM/4624 noise settings on role detect (1.2.26-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:36:00 +10:00
PTah b010ad01eb fix: filter WinRM noise (HealthMailbox, machine accounts, loopback) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:31:30 +10:00
PTah 1ff8dd1a95 fix: init NotifyDedupCache under StrictMode (1.2.24-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:26:07 +10:00
PTah 724baa6c0a feat: monitor RDS Shadow Control and WinRM inbound (warning alerts, 1.2.23-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:20:57 +10:00
PTah 2bbf1face6 fix(deploy): patch DailyReportEnabled hint and invalid false assignment (1.2.22-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 17:50:17 +10:00
PTah d23e99a885 feat: unify Windows daily report with SAC layout; DailyReportEnabled toggle 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 17:18:02 +10:00
PTah 70f06790f6 docs: deploy adds commented ServerDisplayName hint in settings 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 15:57:35 +10:00
PTah c249451eba fix: deploy syncs Sac-Client bundle, SAC dual settings, and ServerDisplayName hint (1.2.20-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 15:55:16 +10:00
PTah 1f27272883 fix: dedup 4624 login alerts and log Skip/dedup reasons (1.2.18-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 15:17:01 +10:00
PTah 49359c07a6 fix: tolerate missing ServerDisplayName and send host.ipv4 (1.2.17-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 13:33:26 +10:00
PTah 611d9c68ca chore: bump RDP monitor version to 1.2.16-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 13:01:20 +10:00
PTah 737da07d6a fix: add Exchange 4624 LT3 empty-IP filter switch 
Add configurable `${Ignore4624-LT3-EmptyIP-Event}` for RDP monitor to suppress noisy 4624 network logons with empty IP (-) on mail/Exchange hosts.
Update settings example and README with usage instructions.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 12:35:40 +10:00
PTah b9d385f51b feat: ServerDisplayName для Telegram и SAC host.display_name (1.2.15-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 11:49:13 +10:00
PTah e7f19e5c92 fix: SAC ingest POST через HttpWebRequest и проверка JSON bytes (1.2.14-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 11:13:43 +10:00
PTah e4f4d1bb1f fix: SAC POST не срезать '{' из-за StartsWith(BOM) в PowerShell (1.2.13-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:57:42 +10:00
PTah 74d1e4db75 fix: SAC POST body null prefix from Write-Log pipeline (1.2.12-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:44:22 +10:00
PTah 5284734092 fix: SAC JSON Cyrillic via JavaScriptSerializer, log 422 body (1.2.11-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:34:21 +10:00
PTah 1c210a40d8 fix: treat HTTP 201/409/202 as SAC success in WebException path (1.2.10-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:27:23 +10:00
PTah 83315cc3b8 fix: SAC 422 no spool loop, truncate title/summary, UTF-8 spool read (1.2.9-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:20:30 +10:00
PTah 04f69aac40 fix: update-rdp-monitor always reset --hard kalinamall/main on publish 
- Ignore stderr noise; parse HEAD; clean -fd; verify NETLOGON version.txt

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:10:51 +10:00
PTah 6c86e172b9 fix: SAC ingest UTF-8 JSON body for Cyrillic (1.2.8-SAC) 
Invoke-WebRequest now posts application/json; charset=utf-8 bytes

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 10:05:49 +10:00
PTah 71cb1fa9b6 fix: update-rdp-monitor fetch+reset for kalinamall force-push 
Prefer kalinamall remote; abort stale merge; ff-only or hard reset.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 09:35:55 +10:00
PTah ef237f345b chore: release 1.2.7-SAC — SAC ingest HTTP 201/409/202 
Bump version.txt and ScriptVersion for Deploy-LoginMonitor on NETLOGON.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 09:34:19 +10:00
PTah 1092f6340d fix: accept SAC ingest HTTP 201, 409, and legacy 202 
Remove .cursorignore (patterns covered by repo hygiene elsewhere)
 2026-05-28 09:13:14 +10:00
PTah 9030fb3c30 fix: heartbeat only to SAC, never Telegram/email 
agent.heartbeat in Send-NotifyOrSac skips local channels in dual/fallback/off.
Bump to 1.2.6-SAC.
 2026-05-28 07:56:18 +10:00
PTah 3ed20b130f chore: bump release to 1.2.5-SAC 
Raise ScriptVersion/version.txt for Sac-Client payload product_version and
update README release reference to keep docs aligned.
 2026-05-27 15:53:29 +10:00
PTah 1b4ca5fa01 feat: bootstrap SAC settings on deploy when upgrading from pre-SAC 
Deploy overwrites login_monitor.settings.ps1 from the trusted example when
Sac-Client.ps1 or SacApiKey/UseSAC are missing, with a .bak backup. Skips
overwrite when SAC is already configured; continues deploy on version match
if SAC bootstrap is still required.
 2026-05-27 15:23:32 +10:00
PTah a1a3bca0c3 fix: do not stop monitor when SAC /health is temporarily down 2026-05-27 15:02:07 +10:00
PTah 004a8c0026 fix: deploy graceful recycle writes restart.request directly (no 90s wait) 2026-05-27 14:53:54 +10:00
PTah 904ab13880 chore: bump version to 1.2.2-SAC 2026-05-27 14:44:02 +10:00
PTah 22a32bc1cb feat: graceful restart without Stop-Process; SAC key in settings example 2026-05-27 14:43:04 +10:00
PTah bd8076a1d0 docs: Windows/SAC update checklist; default Telegram in settings example 2026-05-27 14:27:27 +10:00