4.0 KiB
Local Windows Server inventory
Targets: Windows Server 2016/2019/2022/2025, Windows PowerShell 5.1, 64-bit execution. Real Windows host validation is still pending in this Linux development workspace. No remoting or credentials are used.
Get-ServerInventory.ps1 is the fixed JSON driver. With no arguments it emits a full v1 inventory envelope. -Section system|roles|services|network|tasks|software|storage|shares|certificates emits an internal per-section JSON result. The Python collector invokes these independently to enforce time/output limits while preserving other sections after failures.
| Module | Local read-only source |
|---|---|
| Get-ServerSystem.ps1 | CIM OS/product type/build, boot, domain membership, adapter configuration |
| Get-ServerRoles.ps1 | Installed Get-WindowsFeature entries |
| Get-ServerServices.ps1 | Win32_Service metadata and service identities; no PathName/arguments |
| Get-ServerNetwork.ps1 | Get-NetTCPConnection and Get-Process names/IDs |
| Get-ServerTasks.ps1 | Get-ScheduledTask visible definitions, accounts, safe executable basenames, selected triggers |
| Get-ServerSoftware.ps1 | HKLM uninstall registrations using explicit Registry32/Registry64 read-only handles |
| Get-ServerStorage.ps1 | Get-Volume, Get-SmbShare and aggregate Get-SmbOpenFile share-root correlation; volumes/shares share the existing storage inventory category |
| Get-ServerCertificates.ps1 | Public metadata in accessible LocalMachine certificate stores |
| Inventory.Common.ps1 | Section timing, safe errors and permission limitations |
No Win32_Product, installer operations, private-key export, task execution, service changes, registry writes or remoting setup. No execution-policy bypass; use approved script signing/distribution if enterprise policy blocks scripts. Non-elevated sensitive checks are conservatively partial even if their visible query succeeds. Elevation is never attempted automatically. Domain Administrator privileges are not required; assess with the least-privileged authorized account and treat omitted evidence explicitly.
The Windows Server gate uses CIM ProductType 2/3 plus the release build map; Windows 10/11 are not Server targets even where their kernel builds overlap. The gate is enforced by Python and by full-envelope PowerShell use. -Section system can return failed/partial identity details for diagnostics, but Python will not accept an unverified identity as an assessment.
Direct full-script use has no Python timeout/cancellation supervisor; use the Python CLI or GUI for bounded execution. Both paths honor local script execution policy. Every script emits only selected public/administrative metadata, never raw CIM objects, exception text, task XML, task arguments or service command lines.
See README.md for exact GUI, headless and real-host validation instructions. tests/powershell/Test-Collectors.ps1 parses scripts and mocks their data sources; this is synthetic testing, not real host validation.
Implementation references: Get-WindowsFeature, Win32_Service, Get-NetTCPConnection, Get-ScheduledTask, registry software inventory, certificate provider.
Scoring v2 excludes default administrative shares, but keeps them in inventory. Business-share client confirmation requires share-root-correlated open-file counts, not just TCP 445 activity. The read-only activity query exports no file names, session users or client names; same-root administrative aliases remain ambiguous. See docs/SCORING.md. This new query still requires native Windows validation.