PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
195 Commits 1 Branch 1 Tag
ccbf3f9eb1f52a68bf1518e7dfe918fa2c60541b
Commit Graph

195 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
PTah fe2e6d624f fix: inventory JSON without JavaScriptSerializer WARN (2.0.22-SAC) 
Use ConvertTo-Json after CIM-safe Convert-AnyToJsonSerializable; pre-sanitize inventory details.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-05 10:00:11 +10:00
PTah 82c63fb9a8 feat: host inventory to SAC every 12h (GetInventory) 
Collect CPU/RAM/disks/GPU/OS via agent.inventory; setting $GetInventory (default true); deploy adds missing setting.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-05 09:53:03 +10:00
PTah bd83dc84dc fix: StrictMode-safe File Share audit init (UseGuid key) 
Enable-SecurityAudit crashed on init when checking RU/EN File Share attempts because accessing UseGuid on a hashtable without that key throws under Set-StrictMode -Version Latest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 10:20:17 +10:00
PTah afded8a495 docs: README highlights table and 2.0.19-SAC admin share 5140 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 10:17:11 +10:00
PTah 5fc5f2a9ad feat: monitor admin share access via Security 5140 C$/ADMIN$ (2.0.19-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 10:14:14 +10:00
PTah e3149785dc fix: daily report survives empty quser sessions (2.0.18-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 09:32:43 +10:00
PTah 6384a45395 fix: recognize auditpol RU Success+Failure as otказ not only sboy (2.0.17-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 15:08:20 +10:00
PTah 0acd591c83 fix: PS 5.1 empty SkipEntries breaks monitor loop (2.0.16-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 15:06:35 +10:00
PTah fa5248d501 fix: Sac-Client splat syntax for PS 5.1 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:45:49 +10:00
PTah f08a8a8561 fix: allow null SacOccurredAt on lifecycle notifications (2.0.15-SAC) 
PS 5.1 rejects binding null to [datetime]; use optional splatting for SAC occurred_at.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:45:35 +10:00
PTah 550cea9759 fix: RD Gateway startup replay, 1226 benign, SAC occurred_at (2.0.14-SAC) 
Persist RD Gateway poll cursor to avoid replaying 302/303 on monitor restart;
treat ErrorCode 1226 as normal disconnect; pass event TimeCreated to SAC ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:42:03 +10:00
PTah e00513f050 feat: deploy patch for MaxBackupDays default (2.0.13-SAC) 
Add deploy-time patch when login_monitor.settings.ps1 lacks MaxBackupDays,
enable the setting in example, and remove duplicate default in Login_Monitor.ps1.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:25:21 +10:00
PTah 22ac7a32c7 feat: shutdown diagnostics and log backup retention (2.0.12-SAC) 
- Log phase, uptime, batch sizes and shutdown path on unexpected stop

- PipelineStopped sends SAC alert with diagnostics; fix StopNotificationSent on settings reload

- Summarize large Skip 4624 batches; Remove-LogBackupsBeyondRetention uses MaxBackupDays from settings

- Purge LoginLog_*.bak on rotation, daily rotation check and startup

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 11:07:03 +10:00
PTah 92773948a7 fix: apply login_monitor.settings.ps1 to script scope (2.0.10-SAC) 
2.0.9 dot-sourced settings inside Import-LoginMonitorSettingsFile left UseSAC/Telegram in function scope; monitor ran with defaults off and no SAC ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:33:27 +10:00
PTah 7b83a19db0 fix: InstallTasks fails when settings WinRM lines lack dollar sign (2.0.9-SAC) 
Defer login_monitor.settings.ps1 dot-source until after -InstallTasks so broken WinRM assignments cannot abort task registration. Deploy repairs settings lines missing $ before variable names.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:14:17 +10:00
PTah 33367b05a8 fix: parse RD Gateway EventInfo XML and skip ephemeral 303 alerts 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:07:51 +10:00
PTah 94d12e0b5f chore: sync Cursor rules from CursorRules (version bump RDP/SSH split) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 09:31:56 +10:00
PTah 4b8ff95344 chore: add Cursor rule to bump ScriptVersion and version.txt on script changes 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 09:29:23 +10:00
PTah 47f95ba186 chore: bump release to 2.0.7-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 09:17:28 +10:00
PTah 335768915b feat: deploy UseSAC fallback by default and prevent duplicate daily reports 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 09:15:22 +10:00
PTah 5e5bc86e1b docs: add one-command quick start for first install 
Put NETLOGON deploy flow at the top of README so initial setup is straightforward: run one command and verify with log tail.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:28:28 +10:00
PTah 42d6af83f2 docs: add 5-minute WinRM stabilization checklist 
Document quick post-deploy validation for Enter-PSSession -> WinRM 91 -> SAC event flow and minimal noise-suppression guidance.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:26:32 +10:00
PTah 52e9e62ede docs: refresh README for WinRM and current SAC integration state 
Update current RDP monitor version and document recent WinRM parsing, deploy self-heal, and skip reason diagnostics behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:25:16 +10:00
PTah fae185421a fix: harden WinRM local IP detection and bump to 2.0.6-SAC 
Normalize WinRM source IP candidate before loopback/link-local checks and use explicit -Ip binding in WinRM ignore reason path to avoid false local-or-linklocal-ip skips.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:20:38 +10:00
PTah afc7bf9dca fix: log exact WinRM skip reason and bump to 2.0.5-SAC 
Add Get-WinRmIgnoreReason to expose precise built-in/ignore decision path (empty user, excluded pattern, machine account, local IP, ignore-list match) for WinRM 91 diagnostics.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:17:48 +10:00
PTah ac095fe1a0 fix: parse WinRM 91 user/ip correctly and bump to 2.0.4-SAC 
Improve WinRM Operational event parsing to extract username and clientIP from EventData/Message fallback, preventing false Skip for valid Enter-PSSession events.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:05:14 +10:00
PTah 81323e8596 chore: bump RDP monitor version to 2.0.3-SAC 
Increase ScriptVersion and version.txt after deploy-side reliability updates affecting WinRM monitoring behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 12:58:40 +10:00
PTah 1eedfc736f fix: enforce WinRM inbound block and enable Operational log in deploy 
Deploy now ensures required WinRM inbound settings exist in login_monitor.settings.ps1 and attempts to enable Microsoft-Windows-WinRM/Operational via wevtutil when disabled.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 12:55:05 +10:00
PTah d54d04623f fix: PS 5.1 Sac-Client JSON types without uint alias 2.0.2-SAC 
Replace [uint]/[ulong] -is checks with GetType().IsPrimitive for Windows PowerShell 5.1 on domain hosts.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:13:19 +10:00
PTah 084494cfa8 fix: SAC JSON serialize daily report without PSMethod cycle 2.0.1-SAC 
Convert-AnyToJsonSerializable returns plain arrays and skips PSMethod/ScriptBlock instead of Generic.List objects that broke JavaScriptSerializer.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:08:14 +10:00
PTah 1a1467f910 chore: bump release to 2.0.0-SAC 
Major version line so Deploy upgrades agents stuck on 1.6.x and older 1.2.x-SAC builds from NETLOGON.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:03:48 +10:00
PTah 543369832a fix: restore RD Gateway 302/303 polling and SAC ingest 1.2.35-SAC 
Fix poll cursor skipping events at time boundary, add 60min lookback on start, parse RU gateway messages, and map 303 disconnect to rdg.connection.disconnected.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 08:14:37 +10:00
PTah f970e284ac fix: stronger 4624 login dedup and logon type label 1.2.34-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 19:14:05 +10:00
PTah 6a9b2b70dc fix: use full path to schtasks.exe in deploy post-update start 1.2.33-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 19:03:28 +10:00
PTah 2118d4a4a0 fix: hide redundant workstation line in RDP login alerts 1.2.32-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:55:11 +10:00
PTah 78f241df32 feat: add Diagnose-RdpLoginMonitor.ps1 for post-login troubleshooting 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:40:10 +10:00
PTah e1ae9834a9 feat: single deploy startup, stop mode, notification_body 1.2.31-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:11:18 +10:00
PTah a74c8df877 feat: lifecycle notifications with telegram_via and settings reload 1.2.30-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 12:25:50 +10:00
PTah 2395f536cd feat: notification source line in agent alerts (1.2.29-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:51:55 +10:00
PTah b56ad9c7e4 feat: daily report agent version line and per-line active users (1.2.28-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:28:29 +10:00
PTah e738d97c9c chore: release 1.2.27-SAC (deploy version compare + docs) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:18:58 +10:00
PTah 1fe8bd9f7d fix(deploy): version compare for -SAC labels; refresh deploy docs 
Compare deployed_version.txt with full label (e.g. 1.2.26-SAC) so GPO deploy exits when up to date. Restructure deploy-rdp-login-monitor.md with mermaid flow, Exchange vs DomainMonitors split, and remove duplicated sections.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:13:33 +10:00
PTah bf04c8865c feat(deploy): auto-add Exchange WinRM/4624 noise settings on role detect (1.2.26-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:36:00 +10:00
PTah b010ad01eb fix: filter WinRM noise (HealthMailbox, machine accounts, loopback) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:31:30 +10:00
PTah 1ff8dd1a95 fix: init NotifyDedupCache under StrictMode (1.2.24-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:26:07 +10:00
PTah 724baa6c0a feat: monitor RDS Shadow Control and WinRM inbound (warning alerts, 1.2.23-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:20:57 +10:00
PTah 2bbf1face6 fix(deploy): patch DailyReportEnabled hint and invalid false assignment (1.2.22-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 17:50:17 +10:00
PTah d23e99a885 feat: unify Windows daily report with SAC layout; DailyReportEnabled toggle 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 17:18:02 +10:00
PTah 70f06790f6 docs: deploy adds commented ServerDisplayName hint in settings 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 15:57:35 +10:00
PTah c249451eba fix: deploy syncs Sac-Client bundle, SAC dual settings, and ServerDisplayName hint (1.2.20-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 15:55:16 +10:00