f7b3597206
fix: qwinsta username fallback when RCM 1149 user empty (2.1.14-SAC)
...
On some Win10 Pro hosts EventLog 1149 has blank Param1/Param2; resolve the sole RDP session user from qwinsta before emitting Sac/notify events.
2026-07-14 10:47:30 +10:00
23fa83ddd6
feat: send rdp.session.logoff on Security 4634/4647 (2.1.11-SAC)
...
Direct LAN RDP logout is reported to SAC with the same workstation filters as login (LogonType 10), dedup against paired 4647/4634, and ignore.lst logoff scope.
2026-07-13 17:10:24 +10:00
e21fae2ae5
fix: audit hardening 2.1.10-SAC — gitignore, SAC TLS warn, Exchange safety
...
- Extend .gitignore for local settings, logs, spool, backups
- Log CRITICAL when SacTlsSkipVerify is enabled (Login_Monitor + Sac-Client)
- Exchange-MailSecurity: -WhatIf dry-run, scan safety warnings, v1.6.8
- Remove legacy Watchdog_RDP_Monitor.ps1 and Install-ScheduledTasks.ps1
- Add scripts for GitHub sanitize mirror push workflow
2026-07-07 20:20:00 +10:00
ccd50a085d
fix: RCM 1149 silent drop on RDS servers (2.1.5-SAC)
...
Should-IgnoreEvent rejected every 1149 because ComputerName is always '-'; add persistent poll cursor, skip logging, and Diagnose on NETLOGON publish list.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-24 14:29:02 +10:00
55d58b25a3
docs: sync README version lines with 2.1.4-SAC
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-24 14:14:43 +10:00
6384a45395
fix: recognize auditpol RU Success+Failure as otказ not only sboy (2.0.17-SAC)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-03 15:08:20 +10:00
577b8bc220
feat(Login): вынести локальные настройки в login_monitor.settings.ps1
...
Секреты, SMTP, 4740 и IP-исключения больше не в Login_Monitor.ps1 —
не слетают при автообновлении с NETLOGON. Deploy создаёт settings из example при первой установке.
2026-05-25 09:44:43 +10:00
9ab6cc64a1
docs: add Docs/ guides; Exchange Mail Security scripts (v1.6.0)
...
- Docs: RDP deploy, Exchange mail security, NETLOGON publish
- Exchange-MailSecurity.ps1, Notify-Common, Deploy/Install-DomainMonitors
- DEPLOY.md redirects to Docs/
2026-05-22 14:32:50 +10:00
40c557f041
feat: aggregated 4625 burst alerts (two-tier rate limit, v1.5.10)
...
- Tier 1: 5 failures per 60s per IP+user
- Tier 2: 12 failures per 60s per IP (spraying)
- Suppress per-event 4625 during burst; no auto-ban
2026-05-22 14:13:06 +10:00
ab98eab49c
fix: invoke auditpol by full path when System32 is missing from PATH (v1.5.6)
2026-05-22 10:41:59 +10:00
f4375c2349
readme and docs editing
2026-05-22 09:19:26 +10:00
bdcf2bdc5f
docs: expand ignore.lst section in README and README_eng
2026-05-04 09:02:14 +10:00
e96131d722
docs: refresh README, add English README_eng.md
...
Document daily report, deploy marker, SkipScheduledTaskMaintenance, and legacy watchdog scripts. Add full English translation.
2026-05-03 18:52:18 +10:00
PTah