feat(deploy): sync ServerIPv4 hint and DailyReportEnabled on upgrade (2.1.3-SAC)

Co-authored-by: Cursor <cursoragent@cursor.com>

Deploy-LoginMonitor.ps1

@@ -285,12 +285,24 @@ function Test-RdpMonitorSettingsNeedsServerDisplayNameHint {
     return $true
 }
 
-function Test-RdpMonitorSettingsNeedsDailyReportHint {
+function Test-RdpMonitorSettingsDailyReportEnabledIsTrue {
     param([string]$SettingsPath)
     if (-not (Test-Path -LiteralPath $SettingsPath)) { return $false }
     $c = Get-RdpMonitorSettingsRaw -Path $SettingsPath
     if ([string]::IsNullOrWhiteSpace($c)) { return $false }
-    if ($c -match '(?m)^\s*(\#\s*)?\$DailyReportEnabled\s*=') { return $false }
+    if ($c -match '(?m)^\s*\$DailyReportEnabled\s*=\s*\$(?:true)\b') { return $true }
+    if ($c -match '(?m)^\s*\$DailyReportEnabled\s*=\s*1\s*(?:#.*)?$') { return $true }
+    return $false
+}
+
+function Test-RdpMonitorSettingsNeedsDailyReportHint {
+    param([string]$SettingsPath)
+    if (-not (Test-Path -LiteralPath $SettingsPath)) { return $true }
+    $c = Get-RdpMonitorSettingsRaw -Path $SettingsPath
+    if ([string]::IsNullOrWhiteSpace($c)) { return $true }
+    if (Test-RdpMonitorSettingsDailyReportEnabledIsTrue -SettingsPath $SettingsPath) { return $false }
+    if (Test-RdpMonitorSettingsHasInvalidDailyReportAssignment -SettingsPath $SettingsPath) { return $true }
+    if ($c -match '(?m)^\s*(\#\s*)?\$DailyReportEnabled\s*=') { return $true }
     return $true
 }
 
@@ -327,7 +339,7 @@ function Repair-RdpMonitorSettingsDailyReportAssignmentIfInvalid {
     return $true
 }
 
-function Update-RdpMonitorSettingsDailyReportHintIfMissing {
+function Sync-RdpMonitorSettingsDailyReportEnabledToTrue {
     param([string]$LocalSettings)
     if (-not (Test-Path -LiteralPath $LocalSettings)) { return $false }
     if (-not (Test-RdpMonitorSettingsNeedsDailyReportHint -SettingsPath $LocalSettings)) {
@@ -337,24 +349,35 @@ function Update-RdpMonitorSettingsDailyReportHintIfMissing {
     $c = Get-RdpMonitorSettingsRaw -Path $LocalSettings
     if ([string]::IsNullOrWhiteSpace($c)) { return $false }
 
+    $dailyLine = '$DailyReportEnabled = $true   # по умолчанию: только SAC; $true или 1 — отчёт с агента'
     $hintBlock = @(
         '# --- Суточный отчёт report.daily.rdp (агент или только SAC) ---'
-        '# $DailyReportEnabled = $false   # по умолчанию: только SAC; $true или 1 — отчёт с агента'
+        $dailyLine
         '# Не пишите "= false" без $ — PowerShell воспримет false как команду.'
     ) -join "`r`n"
 
     $bak = "$LocalSettings.bak.$(Get-Date -Format 'yyyyMMdd_HHmmss')"
     Copy-Item -LiteralPath $LocalSettings -Destination $bak -Force
-    Write-DeployLog "Добавление закомментированного `$DailyReportEnabled в login_monitor.settings.ps1; резервная копия: $bak"
 
+    if ($c -match '(?m)^\s*(\#\s*)?\$DailyReportEnabled\s*=') {
+        Write-DeployLog "login_monitor.settings.ps1: `$DailyReportEnabled → `$true (резервная копия: $bak)"
+        $newContent = [regex]::Replace(
+            $c,
+            '(?m)^\s*(\#\s*)?\$DailyReportEnabled\s*=.*$',
+            $dailyLine,
+            1
+        )
+    } else {
+        Write-DeployLog "login_monitor.settings.ps1: добавлен `$DailyReportEnabled = `$true (резервная копия: $bak)"
         $insertBefore = '(?m)^\s*#\s*---\s*Security Alert Center'
         if ($c -match $insertBefore) {
             $newContent = [regex]::Replace($c, $insertBefore, ($hintBlock + "`r`n`r`n" + '$0'), 1)
         } else {
             $newContent = ($c.TrimEnd() + "`r`n`r`n" + $hintBlock + "`r`n")
         }
+    }
+
     [System.IO.File]::WriteAllText($LocalSettings, $newContent.TrimEnd() + "`r`n", $Utf8Bom)
-    Write-DeployLog 'login_monitor.settings.ps1: добавлена подсказка # $DailyReportEnabled = $false'
     return $true
 }
 
@@ -365,7 +388,7 @@ function Sync-RdpMonitorSettingsDailyReportPatches {
     if (Repair-RdpMonitorSettingsDailyReportAssignmentIfInvalid -LocalSettings $LocalSettings) {
         $changed = $true
     }
-    if (Update-RdpMonitorSettingsDailyReportHintIfMissing -LocalSettings $LocalSettings) {
+    if (Sync-RdpMonitorSettingsDailyReportEnabledToTrue -LocalSettings $LocalSettings) {
         $changed = $true
     }
     return $changed
@@ -773,6 +796,7 @@ function Invoke-RdpMonitorSettingsPostPatches {
     if (-not (Test-Path -LiteralPath $LocalSettings)) { return $false }
     $changed = $false
     if (Update-RdpMonitorSettingsServerDisplayNameHintIfMissing -LocalSettings $LocalSettings) { $changed = $true }
+    if (Update-RdpMonitorSettingsServerIPv4HintIfMissing -LocalSettings $LocalSettings) { $changed = $true }
     if (Sync-RdpMonitorSettingsDailyReportPatches -LocalSettings $LocalSettings) { $changed = $true }
     if (Sync-RdpMonitorSettingsExchangeNoisePatches -LocalSettings $LocalSettings) { $changed = $true }
     if (Repair-RdpMonitorSettingsWinRmLinesIfInvalid -LocalSettings $LocalSettings) { $changed = $true }
@@ -886,8 +910,6 @@ function Update-RdpMonitorSettingsServerDisplayNameHintIfMissing {
     $hintBlock = @(
         '# --- Подпись сервера в Telegram и SAC (host.display_name); раскомментируйте при необходимости ---'
         "# `$ServerDisplayName = '$hostLabel'"
-        '# --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---'
-        '# $ServerIPv4 = '''
     ) -join "`r`n"
 
     $bak = "$LocalSettings.bak.$(Get-Date -Format 'yyyyMMdd_HHmmss')"
@@ -905,6 +927,51 @@ function Update-RdpMonitorSettingsServerDisplayNameHintIfMissing {
     return $true
 }
 
+function Test-RdpMonitorSettingsNeedsServerIPv4Hint {
+    param([string]$SettingsPath)
+    if (-not (Test-Path -LiteralPath $SettingsPath)) { return $false }
+    $c = Get-RdpMonitorSettingsRaw -Path $SettingsPath
+    if ([string]::IsNullOrWhiteSpace($c)) { return $false }
+    if ($c -match '(?m)^\s*(\#\s*)?\$ServerIPv4\s*=') { return $false }
+    return $true
+}
+
+function Update-RdpMonitorSettingsServerIPv4HintIfMissing {
+    param([string]$LocalSettings)
+    if (-not (Test-Path -LiteralPath $LocalSettings)) { return $false }
+    if (-not (Test-RdpMonitorSettingsNeedsServerIPv4Hint -SettingsPath $LocalSettings)) {
+        return $false
+    }
+
+    $c = Get-RdpMonitorSettingsRaw -Path $LocalSettings
+    if ([string]::IsNullOrWhiteSpace($c)) { return $false }
+
+    $hintBlock = @(
+        '# --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---'
+        "# `$ServerIPv4 = '10.0.0.10'"
+    ) -join "`r`n"
+
+    $bak = "$LocalSettings.bak.$(Get-Date -Format 'yyyyMMdd_HHmmss')"
+    Copy-Item -LiteralPath $LocalSettings -Destination $bak -Force
+    Write-DeployLog "Добавление закомментированного `$ServerIPv4 в login_monitor.settings.ps1; резервная копия: $bak"
+
+    $insertAfterDisplay = '(?m)^(\s*(\#\s*)?\$ServerDisplayName\s*=.*)$'
+    if ($c -match $insertAfterDisplay) {
+        $newContent = [regex]::Replace($c, $insertAfterDisplay, ('$1' + "`r`n" + $hintBlock), 1)
+    } else {
+        $insertBefore = '(?m)^\s*#\s*---\s*Security Alert Center'
+        if ($c -match $insertBefore) {
+            $newContent = [regex]::Replace($c, $insertBefore, ($hintBlock + "`r`n`r`n" + '$0'), 1)
+        } else {
+            $newContent = ($c.TrimEnd() + "`r`n`r`n" + $hintBlock + "`r`n")
+        }
+    }
+
+    [System.IO.File]::WriteAllText($LocalSettings, $newContent.TrimEnd() + "`r`n", $Utf8Bom)
+    Write-DeployLog "login_monitor.settings.ps1: добавлена подсказка # `$ServerIPv4 = '10.0.0.10'"
+    return $true
+}
+
 function Get-RdpMonitorSacBlockFromExample {
     param([string]$ExamplePath)
     if (-not (Test-Path -LiteralPath $ExamplePath)) { return $null }
@@ -1429,6 +1496,7 @@ try {
 
     $needsSettingsBootstrap = Test-RdpMonitorSettingsNeedsSacBootstrap -SettingsPath $settingsLocal
     $needsDisplayNameHint = Test-RdpMonitorSettingsNeedsServerDisplayNameHint -SettingsPath $settingsLocal
+    $needsServerIPv4Hint = Test-RdpMonitorSettingsNeedsServerIPv4Hint -SettingsPath $settingsLocal
     $needsDailyReportHint = Test-RdpMonitorSettingsNeedsDailyReportHint -SettingsPath $settingsLocal
     $needsDailyReportRepair = Test-RdpMonitorSettingsHasInvalidDailyReportAssignment -SettingsPath $settingsLocal
     $needsExchangeNoisePatch = Test-RdpMonitorSettingsNeedsExchangeNoisePatch -SettingsPath $settingsLocal
@@ -1437,7 +1505,7 @@ try {
     $needsStartupRebootDetectMinutes = Test-RdpMonitorSettingsNeedsStartupRebootDetectMinutes -SettingsPath $settingsLocal
     $needsBundleSync = Test-RdpMonitorDeployBundleNeedsSync -ShareRoot $shareRoot
     $needsTaskExecutionLimitFix = Test-RdpMonitorDeployMainTaskNeedsUnlimitedExecutionTime -ShareRoot $shareRoot
-    $needsSacBootstrap = $needsSettingsBootstrap -or $needsBundleSync -or $needsDisplayNameHint -or $needsDailyReportHint -or $needsDailyReportRepair -or $needsExchangeNoisePatch -or $needsWinRmInboundBlock -or $needsHeartbeatInterval -or $needsStartupRebootDetectMinutes -or $needsTaskExecutionLimitFix
+    $needsSacBootstrap = $needsSettingsBootstrap -or $needsBundleSync -or $needsDisplayNameHint -or $needsServerIPv4Hint -or $needsDailyReportHint -or $needsDailyReportRepair -or $needsExchangeNoisePatch -or $needsWinRmInboundBlock -or $needsHeartbeatInterval -or $needsStartupRebootDetectMinutes -or $needsTaskExecutionLimitFix
 
     if (Test-RdpMonitorExchangeServerRole) {
         Write-DeployLog "Обнаружена роль Exchange — при необходимости допишем WinRM/4624 noise settings в login_monitor.settings.ps1."
@@ -1466,8 +1534,10 @@ try {
                 Write-DeployLog "Версия совпадает ($shareVerRaw), но нужна донастройка SAC в settings — продолжаем деплой."
             } elseif ($needsDisplayNameHint) {
                 Write-DeployLog "Версия совпадает ($shareVerRaw), но нет подсказки `$ServerDisplayName в settings — продолжаем деплой."
+            } elseif ($needsServerIPv4Hint) {
+                Write-DeployLog "Версия совпадает ($shareVerRaw), но нет подсказки `$ServerIPv4 в settings — продолжаем деплой."
             } elseif ($needsDailyReportHint) {
-                Write-DeployLog "Версия совпадает ($shareVerRaw), но нет `$DailyReportEnabled в settings — продолжаем деплой."
+                Write-DeployLog "Версия совпадает ($shareVerRaw), но `$DailyReportEnabled не `$true — допишем/исправим и продолжим деплой."
             } elseif ($needsDailyReportRepair) {
                 Write-DeployLog "Версия совпадает ($shareVerRaw), но в settings некорректно задан `$DailyReportEnabled (= true/false без `$) — продолжаем деплой."
             } elseif ($needsExchangeNoisePatch) {

Login_Monitor.ps1

@@ -90,7 +90,7 @@ $script:SkipLogDetailLimit = 15
 # строки ниже, если правки «мелкие» и вы не хотите менять отображаемую версию в логах).
 # Рекомендация: при значимых релизах меняйте и $ScriptVersion, и version.txt одинаково; при только
 # исправлениях на шаре — достаточно поднять patch в version.txt (например 1.3.0.1).
-$ScriptVersion = "2.1.2-SAC"
+$ScriptVersion = "2.1.3-SAC"
 
 # Логи (все под InstallRoot)
 $LogFile = Join-Path $script:InstallRoot "Logs\login_monitor.log"

exchange_monitor.settings.example.ps1

@@ -29,11 +29,11 @@ $QueueMessageCountThreshold = 150
 # --- Пилот VIP (рекомендуется для первого запуска) ---
 # $VipMailboxesOnly = $true
 # $VipMailboxes = @(
-#     'director@kalinamall.ru',
+#     'director@example.com',
-#     'cfo@kalinamall.ru'
+#     'cfo@example.com'
 # )
 # $VipMailboxPatterns = @(
-#     '*@kalinamall.ru'   # опционально: все ящики домена из Get-Mailbox
+#     '*@example.com'   # опционально: все ящики домена из Get-Mailbox
 # )
 
 # Первый ночной скан: не слать сотни алертов по уже существующим пересылкам
@@ -46,9 +46,9 @@ $QueueMessageCountThreshold = 150
 # $SendInboxScanSummary = $true
 
 # Удалённый EMS (если скрипт не на Exchange)
-# $ExchangeServerFqdn = 'fifth.kalinamall.ru'
+# $ExchangeServerFqdn = 'mail.example.com'
 
 # Не сканировать Inbox rules (битое хранилище правил / Watson на Get-InboxRule)
 # $SkipInboxScanMailboxes = @(
-#     'k.selezneva@kalinamall.ru'
+#     'k.selezneva@example.com'
 # )

login_monitor.settings.example.ps1

@@ -9,9 +9,8 @@
 #>
 
 # --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
-# Закрытое зеркало Gitea — доверенный инстанс; в публичном GitHub используйте example без секретов.
+$TelegramBotToken = 'YOUR_BOT_TOKEN'
-$TelegramBotToken = '8239219522:AAEyOZX3cwNfgGOMDkf-mgjTIuoaOh5gF7I'
+$TelegramChatID = 'YOUR_CHAT_ID'
-$TelegramChatID = '2843230'
 # $TelegramBotTokenProtectedB64 = ''
 # $TelegramChatIDProtectedB64 = ''
 
@@ -30,20 +29,20 @@ $NotifyOrder = 'tg'
 # --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
 # $ServerDisplayName = 'UNMS Kalina'
 # --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
-# $ServerIPv4 = '192.168.160.57'
+# $ServerIPv4 = '10.0.0.10'
 
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
 $UseSAC = 'fallback'
-$SacUrl = 'https://sac.kalinamall.ru'
+$SacUrl = 'https://sac.example.com'
-$SacApiKey = 'sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8'
+$SacApiKey = 'sac_CHANGE_ME'
 # $SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
 # $SacTimeoutSec = 12
 # $SacTlsSkipVerify = $false
 # $SacFallbackFailures = 5
 # $false = не слать report.daily.rdp с агента (суточный отчёт только из SAC)
 # В settings.ps1 используйте 1/0 или $true/$false — не пишите голое false без $
-$DailyReportEnabled = 1
+$DailyReportEnabled = $true   # по умолчанию: только SAC; $true или 1 — отчёт с агента
 
 # --- Heartbeat SAC (agent.heartbeat): интервал в секундах; 14400 = 4 ч ---
 $HeartbeatInterval = 14400
@@ -70,7 +69,7 @@ $GetInventory = $true
 
 # --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
 $IgnoreAdvapiNetworkLogonSourceIps = @(
-    '192.168.160.57'
+    '10.0.0.1'
 )
 # --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
 # Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
@@ -83,9 +82,9 @@ $MaxBackupDays = 31
 
 # --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
 # Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
-$LockoutMonitorDomainController = 'K6A-DC3'
+$LockoutMonitorDomainController = 'DC01'
-$NetBiosDomainName = 'B26'
+$NetBiosDomainName = 'CONTOSO'
-$ExchangeIisLogPath = '\\fifth.kalinamall.ru\c$\inetpub\logs\LogFiles\W3SVC1'
+$ExchangeIisLogPath = '\\mail.example.com\c$\inetpub\logs\LogFiles\W3SVC1'
 $ExchangeServerHostForIisExclude = ''
 $ExchangeIisLogTailLines = 5000
 $ExchangeIisLogMinutesBeforeLockout = 30

update-rdp-monitor.ps1

@@ -4,7 +4,7 @@
 .DESCRIPTION
     Dlya servera publikatsii (napr. DC3). Po umolchaniyu GitHub (github.com/PTah).
     Na zakrytom zerkale ukazhite -GitUrl URL vashego Gitea.
-    Posle fetch: vsegda reset --hard na kalinamall/main (bez merge), zatem clean -fd.
+    Posle fetch: vsegda reset --hard na vetku upstream (bez merge), zatem clean -fd.
     Kopiruyutsya: polnyj spisok v Docs/deploy-netlogon-publish.md.
 .EXAMPLE
     powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\soft\update-rdp-monitor.ps1
@@ -14,8 +14,8 @@
 [CmdletBinding(SupportsShouldProcess = $true)]
 param(
     [string]$RepoPath = 'C:\Soft\Git\RDP-login-monitor',
-    [string]$NetlogonDest = '\\b26\NETLOGON\RDP-login-monitor',
+    [string]$NetlogonDest = '\\dc.contoso.local\NETLOGON\RDP-login-monitor',
-    [string]$GitUrl = 'https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git',
+    [string]$GitUrl = 'https://github.com/PTah/RDP-login-monitor.git',
     [string]$GitBranch = 'main',
     [string]$LogFile = 'C:\soft\Logs\update-rdp-monitor.log',
     [switch]$SkipGitClean
@@ -112,38 +112,25 @@ function Ensure-GitRepository {
 function Get-ConfiguredGitRemoteName {
     $names = @(Invoke-GitCommand -Arguments @('remote') | ForEach-Object { "$_".Trim() } | Where-Object { $_ })
     if ($names.Count -eq 0) { return $null }
-    if ('kalinamall' -in $names) { return 'kalinamall' }
-    foreach ($n in $names) {
-        $url = (& git -C $RepoPath remote get-url $n 2>$null)
-        if ($url -match 'git\.kalinamall\.ru') { return $n }
-    }
     if ('origin' -in $names) { return 'origin' }
     return $names[0]
 }
 
-function Ensure-GitKalinamallRemote {
+function Ensure-GitUpstreamRemote {
     $name = Get-ConfiguredGitRemoteName
     if ($null -ne $name) {
         $url = (& git -C $RepoPath remote get-url $name 2>$null)
-        if ($url -match 'git\.kalinamall\.ru') {
         Write-UpdateLog "Using remote: $name ($url)"
         return $name
     }
-        Write-UpdateLog "Remote $name is not kalinamall ($url); adding kalinamall -> $GitUrl"
+    Write-UpdateLog "No remotes; adding origin -> $GitUrl"
-    } else {
+    Invoke-GitCommand -Arguments @('remote', 'add', 'origin', $GitUrl)
-        Write-UpdateLog "No remotes; adding kalinamall -> $GitUrl"
+    return 'origin'
-    }
-    if ('kalinamall' -in @(& git -C $RepoPath remote 2>$null)) {
-        Invoke-GitCommand -Arguments @('remote', 'set-url', 'kalinamall', $GitUrl)
-        return 'kalinamall'
-    }
-    Invoke-GitCommand -Arguments @('remote', 'add', 'kalinamall', $GitUrl)
-    return 'kalinamall'
 }
 
 function Update-Repository {
     Ensure-GitRepository
-    $remote = Ensure-GitKalinamallRemote
+    $remote = Ensure-GitUpstreamRemote
     Invoke-GitCommand -Arguments @('fetch', '--prune', $remote, $GitBranch)
     $upstream = "${remote}/${GitBranch}"
 

version.txt

@@ -1 +1 @@
-2.1.2-SAC
+2.1.3-SAC