1149 stores username in Param1/Param2 under UserData, not EventData — RDG sessions on
target PCs were skipped with empty User and never reached SAC as rdp.login.success.
Direct LAN RDP logout is reported to SAC with the same workstation filters as login (LogonType 10), dedup against paired 4647/4634, and ignore.lst logoff scope.
Real SAC/Telegram tokens and org paths back in example and NETLOGON publish script. Deploy now treats sac.example.com and sac_CHANGE_ME as unconfigured and overwrites from example.
Co-authored-by: Cursor <cursoragent@cursor.com>
Suppress duplicate SAC alerts when Windows logs two RD Gateway 302 events
within 90s for the same user, target host, and external client IP.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject null-padded spool payloads to rejected/, read UTF-16 spool, process recent events first, and raise flush batch to 20 so daily reports are not blocked by legacy junk.
Co-authored-by: Cursor <cursoragent@cursor.com>
Should-IgnoreEvent rejected every 1149 because ComputerName is always '-'; add persistent poll cursor, skip logging, and Diagnose on NETLOGON publish list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Enable Rcm1149 monitoring on servers when RCM journal is available; dedup 1149 notifications like 4624.
Co-authored-by: Cursor <cursoragent@cursor.com>
Production tokens and NETLOGON paths live on kalinamall/papatramp only. Use scripts/Push-PrivateMirror.ps1 after feature pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Real Telegram/SAC tokens, NETLOGON and org hostnames back on kalinamall. GitHub main keeps placeholders; use scripts/Push-PrivateMirror.ps1 after public pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace \\B26\\NETLOGON with \\dc.contoso.local\\NETLOGON.
Remove scripts/ mirror tools and tools/Push-KalinamallOnly.ps1.
Sanitize login_monitor.settings.example (placeholders, no secrets).
Simplify update-rdp-monitor.ps1 to use origin remote only.
Keep dev tooling under tools/ only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat Get-ScheduledTask limit strings as unlimited, prefer ProgramData for TaskQuery import, and copy UNC modules to temp before dot-source.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publish TaskQuery helpers to script scope after import so ExecutionTimeLimit checks work from nested deploy callers; add RDP_DEPLOY_FUNCTIONS_ONLY early exit for isolated function loading.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publish TaskQuery helpers to script scope after import so deploy checks work from nested callers; add kalinamall-only smoke tests and RDP_DEPLOY_FUNCTIONS_ONLY hook.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deploy uses Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved only; no call to Test-RdpMonitorScheduledTaskNeedsUnlimitedExecutionTimeLimit from external module.
Verify TaskQuery module by Get-RdpMonitorScheduledTaskExecutionTimeLimitResolved, prefer share path over stale InstallRoot, and guard verification when init fails.
Stop false redeploy loops when Get-ScheduledTask fails, push agent version to SAC immediately after deploy, and skip redundant schtasks /Run during task maintenance.
PTah