Real SAC/Telegram tokens and org paths back in example and NETLOGON publish script. Deploy now treats sac.example.com and sac_CHANGE_ME as unconfigured and overwrites from example.
Co-authored-by: Cursor <cursoragent@cursor.com>
Suppress duplicate SAC alerts when Windows logs two RD Gateway 302 events
within 90s for the same user, target host, and external client IP.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject null-padded spool payloads to rejected/, read UTF-16 spool, process recent events first, and raise flush batch to 20 so daily reports are not blocked by legacy junk.
Co-authored-by: Cursor <cursoragent@cursor.com>
Should-IgnoreEvent rejected every 1149 because ComputerName is always '-'; add persistent poll cursor, skip logging, and Diagnose on NETLOGON publish list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Enable Rcm1149 monitoring on servers when RCM journal is available; dedup 1149 notifications like 4624.
Co-authored-by: Cursor <cursoragent@cursor.com>
Production tokens and NETLOGON paths live on kalinamall/papatramp only. Use scripts/Push-PrivateMirror.ps1 after feature pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Real Telegram/SAC tokens, NETLOGON and org hostnames back on kalinamall. GitHub main keeps placeholders; use scripts/Push-PrivateMirror.ps1 after public pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace \\B26\\NETLOGON with \\dc.contoso.local\\NETLOGON.
Remove scripts/ mirror tools and tools/Push-KalinamallOnly.ps1.
Sanitize login_monitor.settings.example (placeholders, no secrets).
Simplify update-rdp-monitor.ps1 to use origin remote only.
Keep dev tooling under tools/ only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publish TaskQuery helpers to script scope after import so ExecutionTimeLimit checks work from nested deploy callers; add RDP_DEPLOY_FUNCTIONS_ONLY early exit for isolated function loading.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publish TaskQuery helpers to script scope after import so deploy checks work from nested callers; add kalinamall-only smoke tests and RDP_DEPLOY_FUNCTIONS_ONLY hook.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deploy uses Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved only; no call to Test-RdpMonitorScheduledTaskNeedsUnlimitedExecutionTimeLimit from external module.
Verify TaskQuery module by Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved, prefer share path over stale InstallRoot, and guard verification when init fails.
Stop false redeploy loops when Get-ScheduledTask fails, push agent version to SAC immediately after deploy, and skip redundant schtasks /Run during task maintenance.
Default PT72H caused Task Scheduler to stop the monitor after 72 hours.
Register main task with PT0S, re-register on deploy and Ensure when limit is set.
Co-authored-by: Cursor <cursoragent@cursor.com>
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.
Co-authored-by: Cursor <cursoragent@cursor.com>
PTah