This website requires JavaScript.
2bbf1face6
fix(deploy): patch DailyReportEnabled hint and invalid false assignment (1.2.22-SAC)
2026-05-29 17:50:17 +10:00
d23e99a885
feat: unify Windows daily report with SAC layout; DailyReportEnabled toggle
2026-05-29 17:18:02 +10:00
70f06790f6
docs: deploy adds commented ServerDisplayName hint in settings
2026-05-29 15:57:35 +10:00
c249451eba
fix: deploy syncs Sac-Client bundle, SAC dual settings, and ServerDisplayName hint (1.2.20-SAC)
2026-05-29 15:55:16 +10:00
1f27272883
fix: dedup 4624 login alerts and log Skip/dedup reasons (1.2.18-SAC)
2026-05-28 15:17:01 +10:00
49359c07a6
fix: tolerate missing ServerDisplayName and send host.ipv4 (1.2.17-SAC)
2026-05-28 13:33:26 +10:00
611d9c68ca
chore: bump RDP monitor version to 1.2.16-SAC
2026-05-28 13:01:20 +10:00
737da07d6a
fix: add Exchange 4624 LT3 empty-IP filter switch
2026-05-28 12:35:40 +10:00
b9d385f51b
feat: ServerDisplayName для Telegram и SAC host.display_name (1.2.15-SAC)
2026-05-28 11:49:13 +10:00
e7f19e5c92
fix: SAC ingest POST через HttpWebRequest и проверка JSON bytes (1.2.14-SAC)
2026-05-28 11:13:43 +10:00
e4f4d1bb1f
fix: SAC POST не срезать '{' из-за StartsWith(BOM) в PowerShell (1.2.13-SAC)
2026-05-28 10:57:42 +10:00
74d1e4db75
fix: SAC POST body null prefix from Write-Log pipeline (1.2.12-SAC)
2026-05-28 10:44:22 +10:00
5284734092
fix: SAC JSON Cyrillic via JavaScriptSerializer, log 422 body (1.2.11-SAC)
2026-05-28 10:34:21 +10:00
1c210a40d8
fix: treat HTTP 201/409/202 as SAC success in WebException path (1.2.10-SAC)
2026-05-28 10:27:23 +10:00
83315cc3b8
fix: SAC 422 no spool loop, truncate title/summary, UTF-8 spool read (1.2.9-SAC)
2026-05-28 10:20:30 +10:00
04f69aac40
fix: update-rdp-monitor always reset --hard kalinamall/main on publish
2026-05-28 10:10:51 +10:00
6c86e172b9
fix: SAC ingest UTF-8 JSON body for Cyrillic (1.2.8-SAC)
2026-05-28 10:05:49 +10:00
71cb1fa9b6
fix: update-rdp-monitor fetch+reset for kalinamall force-push
2026-05-28 09:35:55 +10:00
ef237f345b
chore: release 1.2.7-SAC — SAC ingest HTTP 201/409/202
2026-05-28 09:34:19 +10:00
1092f6340d
fix: accept SAC ingest HTTP 201, 409, and legacy 202
2026-05-28 09:13:14 +10:00
9030fb3c30
fix: heartbeat only to SAC, never Telegram/email
2026-05-28 07:56:18 +10:00
3ed20b130f
chore: bump release to 1.2.5-SAC
2026-05-27 15:53:29 +10:00
1b4ca5fa01
feat: bootstrap SAC settings on deploy when upgrading from pre-SAC
2026-05-27 15:23:32 +10:00
a1a3bca0c3
fix: do not stop monitor when SAC /health is temporarily down
2026-05-27 15:02:07 +10:00
004a8c0026
fix: deploy graceful recycle writes restart.request directly (no 90s wait)
2026-05-27 14:53:54 +10:00
904ab13880
chore: bump version to 1.2.2-SAC
2026-05-27 14:44:02 +10:00
22a32bc1cb
feat: graceful restart without Stop-Process; SAC key in settings example
2026-05-27 14:43:04 +10:00
bd8076a1d0
docs: Windows/SAC update checklist; default Telegram in settings example
2026-05-27 14:27:27 +10:00
edbe00ffb3
feat: SAC client 1.2.0-SAC and daily report details for ingest
2026-05-27 14:15:16 +10:00
577b8bc220
feat(Login): вынести локальные настройки в login_monitor.settings.ps1 Секреты, SMTP, 4740 и IP-исключения больше не в Login_Monitor.ps1 — не слетают при автообновлении с NETLOGON. Deploy создаёт settings из example при первой установке.
2026-05-25 09:44:43 +10:00
971461accf
fix(Exchange): stop Import-ExchangeManagementShell leaking True (v1.6.7)
2026-05-22 16:10:36 +10:00
744f254c09
fix(Exchange): define Get-ExchangeInboxScanScopeLabel before InstallTasks (v1.6.6)
2026-05-22 16:02:05 +10:00
1584be89e2
feat(Exchange): skip corrupt inbox rule stores (v1.6.5)
2026-05-22 16:00:09 +10:00
cdf563cbe9
fix(deploy): copy exchange_monitor.settings.example to ProgramData (v1.6.4)
2026-05-22 15:00:30 +10:00
872df98a2c
fix: Exchange monitor encoding for PS 5.1 (v1.6.3)
2026-05-22 14:57:35 +10:00
7c13c96622
fix: Deploy-DomainMonitors encoding for PS 5.1 / NETLOGON (v1.6.2) - ASCII runtime strings in domain deploy/install scripts - Publish *.ps1 to NETLOGON with UTF-8 BOM
2026-05-22 14:53:28 +10:00
0c916b50c6
feat(Exchange): VIP scan, disabled rules, first-baseline suppress (v1.6.1) - VipMailboxes + VipMailboxPatterns; unified VIP scope - Scan disabled inbox rules with external forward (lower severity) - Suppress per-finding alerts on first baseline run - Post-scan summary and install notification
2026-05-22 14:44:57 +10:00
9ab6cc64a1
docs: add Docs/ guides; Exchange Mail Security scripts (v1.6.0) - Docs: RDP deploy, Exchange mail security, NETLOGON publish - Exchange-MailSecurity.ps1, Notify-Common, Deploy/Install-DomainMonitors - DEPLOY.md redirects to Docs/
2026-05-22 14:32:50 +10:00
40c557f041
feat: aggregated 4625 burst alerts (two-tier rate limit, v1.5.10) - Tier 1: 5 failures per 60s per IP+user - Tier 2: 12 failures per 60s per IP (spraying) - Suppress per-event 4625 during burst; no auto-ban
2026-05-22 14:13:06 +10:00
a324841b7d
chore: clarify IIS log line wording for 4740 (v1.5.9)
2026-05-22 11:06:19 +10:00
a29ef8e0f7
config: LockoutMonitorDomainController K6A-DC3 (v1.5.8)
2026-05-22 11:01:38 +10:00
16d555037f
fix: daily report uses full path to quser.exe when System32 missing from PATH (v1.5.7)
2026-05-22 10:54:57 +10:00
ab98eab49c
fix: invoke auditpol by full path when System32 is missing from PATH (v1.5.6)
2026-05-22 10:41:59 +10:00
eccffe927a
Fixed BOM
2026-05-22 10:28:40 +10:00
83f5c7de63
config: fifth IIS UNC, NETLOGON publish script (v1.5.5)
2026-05-22 10:13:54 +10:00
67c33fd4ff
config: IIS logs on fifth UNC path (v1.5.5)
2026-05-22 10:05:18 +10:00
6d7b4874ce
config: Kalina Telegram, DC3/B26 lockout, IIS path (v1.5.4)
2026-05-22 09:58:09 +10:00
f4375c2349
readme and docs editing
2026-05-22 09:19:26 +10:00
52b1723137
feat: ignore.lst for 4740, IIS time window, stale heartbeat alert (v1.5.3)
2026-05-19 20:46:35 +10:00
b7786e8690
feat: AD lockout 4740 with IIS IPs and SMTP notifications (v1.5.2)
2026-05-19 19:47:23 +10:00
938df9bfe0
fix: refresh ignore.lst each monitor loop for log/mtime (v1.4.4)
2026-05-04 10:22:03 +10:00
a3a5b45cf8
fix: ignore list startup line use -f format (avoid $kindLabel: parse), bump 1.4.3
2026-05-04 09:42:32 +10:00
362318707e
fix: PowerShell parse error for ignore list line (), bump 1.4.2
2026-05-04 09:40:34 +10:00
98031a20a1
fix: InstallTasks before DPAPI, deploy elevation and installtasks logs (1.4.1)
2026-05-04 09:38:02 +10:00
b3da911d51
chore: bump version to 1.4.0
2026-05-04 09:33:54 +10:00
967e470e39
feat: list ignore.lst rules in startup Telegram notice
2026-05-04 09:30:24 +10:00
ace7220752
feat: log ignore.lst reload with rule counts
2026-05-04 09:11:03 +10:00
bdcf2bdc5f
docs: expand ignore.lst section in README and README_eng
2026-05-04 09:02:14 +10:00
57bc617d26
Sanitize ignore.lst.example placeholders
2026-05-04 08:25:21 +10:00
17befc867e
Document ignore.lst in README and DEPLOY
2026-05-04 07:56:49 +10:00
d3154ceb1b
Add ignore.lst filtering for Security logon alerts
2026-05-04 07:55:04 +10:00
fe600790e8
docs(license): update copyright holder name
2026-05-03 18:55:00 +10:00
11736501ec
chore: add MIT LICENSE
2026-05-03 18:54:16 +10:00
e96131d722
docs: refresh README, add English README_eng.md
2026-05-03 18:52:18 +10:00
99be51467e
Refine RD Gateway 303 semantics and show deploy update timestamp
2026-04-30 16:55:30 +10:00
d26784fb7f
Refresh README for current ProgramData + Deploy workflow
2026-04-30 16:43:14 +10:00
02424875fb
Add repository search keywords to README
2026-04-30 16:34:26 +10:00
0e2b3f2534
Clarify manual deploy option for small server fleets
2026-04-30 16:31:33 +10:00
b6ac34a52d
Add periodic deploy task installer and docs for rarely rebooted servers
2026-04-30 16:21:42 +10:00
a37a639be1
Fix RD Gateway 302/303 field mapping (XML + updated Properties layout).
2026-04-30 16:04:31 +10:00
1c14eec3cd
Update DEPLOY.md with a tested GPO startup setup and troubleshooting notes.
2026-04-29 17:47:21 +10:00
cc8925f88a
Start main task immediately after InstallTasks and include script version in startup notification.
2026-04-29 16:45:13 +10:00
a20055f9d3
Singleton lock: DeleteOnClose, Ctrl+C propagates, release in finally (v1.3.9)
2026-04-29 16:23:16 +10:00
313cc189e9
v1.3.5: путь скрипта при Start-Process, диагностика watchdog, DEPLOY.md
2026-04-29 16:13:14 +10:00
e0b0fa3d7e
Watchdog: schtasks /Run после установки; DEPLOY/README про задачи и UNC; версия 1.3.4
2026-04-29 16:07:35 +10:00
80f57c5351
Добавлен доменный деплой (Deploy-LoginMonitor.ps1, version.txt), DEPLOY.md, правки README и комментарий к версии в Login_Monitor.ps1
2026-04-29 15:14:41 +10:00
306b0762a1
Workstation vs server: ProductType; WKS uses LT10 + RCM 1149; server keeps 2/3/10 (v1.2.0)
2026-04-29 14:30:28 +10:00
6bc5173236
auditpol: detect RU only from /list, not culture; fall back to EN (Hyper-V); v1.1.3
2026-04-27 10:47:16 +10:00
be0c394ac4
Fix Uc RU category string: add missing 0x0445 in vyhod (auditpol 0x57); v1.1.2
2026-04-27 10:29:10 +10:00
850781a38d
Revert "Use ASCII-only source for Telegram and logs; remove emoji (v1.2.0)"
2026-04-27 10:25:55 +10:00
b032de9d1c
Use ASCII-only source for Telegram and logs; remove emoji (v1.2.0)
2026-04-27 10:24:09 +10:00
4a4a736eb9
Harden auditpol block: build RU category strings via Uc, English log lines, bump to 1.1.1
2026-04-27 10:19:09 +10:00
383ffb0bf8
Add script version to startup log and admin error
2026-04-27 10:07:23 +10:00
3d03d905a1
Fix scheduling checks and harden Telegram message formatting.
2026-04-27 10:01:42 +10:00
4f0b6e219c
Add Install-ScheduledTasks.ps1 for Task Scheduler registration; document in README
2026-04-13 11:29:21 +10:00
b164e51965
README: remove internal PMG/LDAP filter details from public docs
2026-04-13 11:23:44 +10:00
0dce7e7017
Fix daily report: force array for unique users (PS 5.1 Count on scalar)
2026-04-13 11:12:44 +10:00
9f680dfd89
Telegram Security events: show log server vs workstation (4624/4625)
2026-04-13 10:59:02 +10:00
685ef5260a
Clarify startup Telegram: Gateway targets internal PCs; exclude Gateway-only from RDS host line
2026-04-13 10:53:10 +10:00
2826e3f9cd
Telegram startup: mention RDS and RD Gateway when applicable
2026-04-13 10:49:30 +10:00
848381e098
Use UTF-8 BOM for logs; document FAR encoding
2026-04-13 10:33:11 +10:00
99ab020347
Document recent monitoring and auditpol improvements
2026-04-11 22:16:13 +10:00
65469cf1d2
Improve auditpol parsing for RU logon/logoff category output
2026-04-11 22:14:31 +10:00
0c9faece92
Fix auditpol localization (RU logon subcategory) and reduce noise
2026-04-11 21:57:16 +10:00
d0171daf8e
Fix auditpol for RU subcategory and safer stderr handling
2026-04-11 21:48:49 +10:00
16baf12094
Update scripts
2026-04-11 21:16:37 +10:00
c5a4c26b1e
Add editor/gitattributes defaults for PowerShell encoding
2026-04-09 17:01:17 +10:00
89acb0a914
Update README.md
2026-04-09 16:42:00 +10:00
21ad87d08d
Add login monitor, watchdog and Task Scheduler docs
2026-04-09 16:36:27 +10:00
PTah