# Script Name: rdp-access-notification.ps1 # Beschreibung: Versendet Benachrichtigungen (E-Mail / Ntfy) bei RDP-Anmeldung # Autor: Patrick Asmus # Web: https://www.patrick-asmus.de # Git-Reposit.: https://git.techniverse.net/scriptos/rdp-access-mailbenachrichtigung.git # Version: 4.0 # Datum: 26.04.2026 # Modifikation: Zusammenfuehrung AD/Local, Config-Datei, Ntfy-Support ##################################################### $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path $configPath = Join-Path $scriptDir "config.conf" if (-not (Test-Path $configPath)) { Write-Error "Konfigurationsdatei nicht gefunden: $configPath" exit 1 } # --- Config parsen --- $conf = @{} foreach ($line in Get-Content -Path $configPath) { $line = $line.Trim() if ($line -eq "" -or $line.StartsWith("#")) { continue } $parts = $line -split "=", 2 if ($parts.Count -eq 2) { $conf[$parts[0].Trim()] = $parts[1].Trim() } } # --- Funktionen --- function Send-Email { param( [string]$To, [string]$RecipientName, [string]$Subject, [string]$ComputerName, [string]$EventDate, [string]$EventTime, [string]$Domain, [string]$User, [string]$ClientIP ) $htmlBody = @"
RDP-Zugriff erkannt

Hallo $RecipientName,

auf dem Device $ComputerName wurde eine RDP-Anmeldung registriert.

Datum$EventDate
Uhrzeit$EventTime
Domäne$Domain
Benutzer$User
IP-Adresse des Clients$ClientIP
Diese Nachricht wurde automatisch generiert.
"@ if (-not $To) { Write-Warning "Kein Empfaenger fuer E-Mail (Name: $RecipientName) - uebersprungen" return } try { Send-MailMessage ` -SmtpServer $conf["SMTP_SERVER"] ` -From "$($conf["SMTP_FROM_NAME"]) <$($conf["SMTP_FROM_EMAIL"])>" ` -To $To ` -Subject $Subject ` -Body $htmlBody ` -BodyAsHtml ` -Encoding ([System.Text.Encoding]::UTF8) ` -ErrorAction Stop } catch { Write-Error "E-Mail an $To fehlgeschlagen: $_" } } function Send-Ntfy { param( [string]$Title, [string]$Message ) $ntfyUrl = "$($conf["NTFY_SERVER"])/$($conf["NTFY_TOPIC"])" $headers = @{ "Title" = $Title "Priority" = $conf["NTFY_PRIORITY"] "Tags" = $conf["NTFY_TAGS"] } if ($conf["NTFY_AUTH_TOKEN"]) { $headers["Authorization"] = "Bearer $($conf["NTFY_AUTH_TOKEN"])" } try { Invoke-RestMethod ` -Uri $ntfyUrl ` -Method Post ` -Headers $headers ` -Body ([System.Text.Encoding]::UTF8.GetBytes($Message)) ` -ContentType "text/plain; charset=utf-8" } catch { Write-Error "Ntfy-Benachrichtigung fehlgeschlagen: $_" } } # --- RDP-Event auslesen --- $eventID = 1149 $eventLogName = "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" $latestEvent = Get-WinEvent -LogName $eventLogName -FilterXPath "" | Select-Object -First 1 if (-not $latestEvent) { exit 0 } $xml = [xml]$latestEvent.ToXml() if (-not $xml.Event.UserData) { exit 0 } $user = $xml.Event.UserData.EventXML.Param1 $domain = $xml.Event.UserData.EventXML.Param2 $clientIP = $xml.Event.UserData.EventXML.Param3 $eventTime = $latestEvent.TimeCreated $computerName = $latestEvent.MachineName $eventDate = $eventTime.ToString('dd.MM.yyyy') $eventTimeStr = $eventTime.ToString('HH:mm:ss') $subject = "RDP-Anmeldung registriert" # --- Empfaenger ermitteln --- $recipients = @() switch ($conf["MODE"]) { "ad" { $adMembers = Get-ADGroupMember -Identity $conf["AD_SECURITY_GROUP_DN"] | Where-Object { $_.objectClass -eq "user" } foreach ($member in $adMembers) { $adUser = Get-ADUser $member.DistinguishedName -Properties GivenName, Surname, EmailAddress $recipients += [PSCustomObject]@{ Name = "$($adUser.GivenName) $($adUser.Surname)" Email = $adUser.EmailAddress } } } "local" { foreach ($entry in $conf["LOCAL_RECIPIENTS"] -split ";") { $entry = $entry.Trim() if ($entry -eq "") { continue } $parts = $entry -split ",", 2 if ($parts.Count -eq 2) { $recipients += [PSCustomObject]@{ Name = $parts[0].Trim() Email = $parts[1].Trim() } } } } default { Write-Error "Unbekannter Modus: $($conf["MODE"]). Erlaubt: 'ad', 'local'" exit 1 } } # --- Benachrichtigungen versenden --- $methods = $conf["NOTIFICATION_METHODS"] -split "," if ($methods.Trim() -contains "email") { foreach ($recipient in $recipients) { Send-Email ` -To $recipient.Email ` -RecipientName $recipient.Name ` -Subject $subject ` -ComputerName $computerName ` -EventDate $eventDate ` -EventTime $eventTimeStr ` -Domain $domain ` -User $user ` -ClientIP $clientIP } } if ($methods.Trim() -contains "ntfy") { $ntfyMessage = @" Es wurde eine RDP Anmeldung auf $computerName registriert. Datum: $eventDate Uhrzeit: $eventTimeStr Domain: $domain Benutzer: $user IP-Adresse des Clients: $clientIP "@ Send-Ntfy -Title $subject -Message $ntfyMessage }