oceans2alaska
b4c0cf12ca
Add a `retain` block to privacy_policy.json (all on by default) so assessments show software, services, processes, tasks, shares/mounts and private peer IPs. Values pass an identifier-pattern filter (digit runs, SSN/phone, e-mail, charset, length, path depth). Accounts, command lines, child paths, filenames and public peer IPs stay omitted. Linux collector and Windows PowerShell collectors updated; tests cover retention, withholding and all-switches-off. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Local Windows Server collection
Read-only collection commands for supported Server release builds 2016/2019/2022/2025. The Python workflow launches fixed sections using system Windows PowerShell 5.1, NoProfile, fixed argument lists, bounded memory output and time/cancellation limits. No remoting/configuration, execution-policy bypass, elevation or credential storage. Actual Windows runtime/least-privilege acceptance is still pending.
The bundled samsara/assets/privacy_policy.json and privacy_catalogue.json are
required. Protect the deployment against unauthorized changes. Name/path projection
occurs before PowerShell JSON output and again at Python UI/report boundaries.
| Module | Default queries | Privacy/coverage limits |
|---|---|---|
| System | Local OS/build/boot, domain-joined boolean, adapter IPs | Fixed OS labels, opaque identities; no domain string/adapter description requested |
| Roles | Get-WindowsFeature installed identifiers | Canonical/opaque names; no active-use assertion |
| Services | Win32_Service Name, State, StartMode, ProcessId | No StartName, DisplayName, PathName; names canonical/opaque |
| Network | Get-Process names/PIDs, Get-NetTCPConnection | No command lines; names canonical/opaque; historical direction unverified |
| Tasks | MSFT_ScheduledTask TaskName, TaskPath, State only | Opaque identities/category; no Actions, Principals, Triggers, Settings, XML or arguments requested; partial |
| Software | Read-only HKLM uninstall registry views | DoNotExpandEnvironmentNames; canonical/opaque display name, numeric version; no installer query |
| Storage | Fixed Win32_LogicalDisk size/free/filesystem/drive metadata | No labels, mount-only volumes or child paths; partial |
| Shares | Get-SmbShare configured roots | Only exact reviewed local roots retained; no Get-SmbOpenFile or session enumeration; partial |
| Certificates | No provider call | not_collected pending a separately approved minimal design |
Provider-returned strings may enter process memory before projection; explicit properties do not prove that native provider internals process no other metadata. The application cannot promise PHI-free memory or zero incidental OS writes. Permission failures have categorical errors, timestamps and limitations; no raw exception messages are returned. Missing evidence must never imply inactivity.
Prefer the Python CLI and its configured private local report folder. Direct driver output is not supervised by Python's bounds or secure writer: do not use arbitrary shell redirects on production hosts. See privacy setup and native validation.
tests/powershell/Test-Collectors.ps1 parses ASTs and invokes synthetic mocked
providers only. It makes forbidden certificate, open-file, full-task and label
enumeration fail. Run on an authorized lab host with its existing script policy;
no real collector runs in that test. A passing mock test is not real-host acceptance.