# Local Windows Server collection

Read-only collection commands for supported Server release builds 2016/2019/2022/2025.
The Python workflow launches fixed sections using system Windows PowerShell 5.1,
NoProfile, fixed argument lists, bounded memory output and time/cancellation limits.
No remoting/configuration, execution-policy bypass, elevation or credential storage.
Actual Windows runtime/least-privilege acceptance is still pending.

The bundled `samsara/assets/privacy_policy.json` and `privacy_catalogue.json` are
required. Protect the deployment against unauthorized changes. Name/path projection
occurs before PowerShell JSON output and again at Python UI/report boundaries.

| Module | Default queries | Privacy/coverage limits |
| --- | --- | --- |
| System | Local OS/build/boot, domain-joined boolean, adapter IPs | Fixed OS labels, opaque identities; no domain string/adapter description requested |
| Roles | Get-WindowsFeature installed identifiers | Canonical/opaque names; no active-use assertion |
| Services | Win32_Service Name, State, StartMode, ProcessId | No StartName, DisplayName, PathName; names canonical/opaque |
| Network | Get-Process names/PIDs, Get-NetTCPConnection | No command lines; names canonical/opaque; historical direction unverified |
| Tasks | MSFT_ScheduledTask TaskName, TaskPath, State only | Opaque identities/category; no Actions, Principals, Triggers, Settings, XML or arguments requested; partial |
| Software | Read-only HKLM uninstall registry views | DoNotExpandEnvironmentNames; canonical/opaque display name, numeric version; no installer query |
| Storage | Fixed Win32_LogicalDisk size/free/filesystem/drive metadata | No labels, mount-only volumes or child paths; partial |
| Shares | Get-SmbShare configured roots | Only exact reviewed local roots retained; no Get-SmbOpenFile or session enumeration; partial |
| Certificates | No provider call | not_collected pending a separately approved minimal design |

Provider-returned strings may enter process memory before projection; explicit
properties do not prove that native provider internals process no other metadata.
The application cannot promise PHI-free memory or zero incidental OS writes.
Permission failures have categorical errors, timestamps and limitations; no raw
exception messages are returned. Missing evidence must never imply inactivity.

Prefer the Python CLI and its configured private local report folder. Direct driver
output is not supervised by Python's bounds or secure writer: do not use arbitrary
shell redirects on production hosts. See [privacy setup and native validation](../docs/PRIVACY_HARDENING.md).

`tests/powershell/Test-Collectors.ps1` parses ASTs and invokes synthetic mocked
providers only. It makes forbidden certificate, open-file, full-task and label
enumeration fail. Run on an authorized lab host with its existing script policy;
no real collector runs in that test. A passing mock test is not real-host acceptance.