v1.9.0

v1.9.0

Prototype new dashboard

The dashboard has been rebuilt from scratch. Same data, same API, same database —
a different way of presenting it. Nothing about collection or storage changed.

The page now opens with a statement, not a grid of tiles

The old dashboard began with six metric cards of equal weight. The new one begins
with the one sentence that describes the project: "Still 21 % of all logons go
through NTLM." Below it, a handover bar shows the split between NTLMv1, NTLMv2
and Kerberos as shares rather than absolute counts, so it does not swing just
because one day was busier than another. Next to it, a live countdown to the
October 2026 deadline.

Underneath, four focus cards name what to look at first — largest item, quickest
win, what breaks at the deadline, and anything happening outside office hours —
each one a link into the section it came from.

Full screen width, self-packing layout

The layout has no fixed column count and no maximum width. Panels declare a
minimum width and the grid packs as many per row as the window allows: four on a
27-inch monitor, two on a laptop, one on a phone. Wide panels (programs,
machines, domain view) span two columns where there is room.

Everything is clickable

Clicking a program, an account, a machine or a Kerberos service filters the event
list and jumps to it. Active filters appear as chips you can remove one at a time.
Clicking an event opens a detail drawer showing every field grouped by meaning —
identity, target, process, protocol, diagnostics — with an explanation of what
that event ID means and what a failure code implies. From the drawer you can
pivot to all events of the same program, account, machine or kind.

Kept from the old dashboard

All eleven sections are still there, plus two new ones: most-used targets and
a separate Kerberos accounts panel. Also unchanged: per-program sparklines,
the exception-list generator for Group Policy, the status dropdowns with "hide
done", the timing heatmap, CSV export, the machine readiness table with its
auditing and October 2026 columns, and the German/English toggle — the full
translation set carried over and grew to 365 keys per language.

Fixed: no way to log out

The rebuilt page had a logout button in the markup but nothing ever showed it or
handled the click - anyone running with a dashboard password could log in and
never end the session from the UI. The server now reveals the button exactly
when a password is configured, and clicking it invalidates the session
server-side (the endpoint always did).

Fixed: the share of NTLM was not computable

stats.total counts every stored event including Kerberos, and stats.krb
counts Kerberos services, not tickets. Neither could answer "what share of
authentication still uses NTLM". The API now also returns krb_ev, the Kerberos
ticket count, which is what the new headline is built on.

Upgrade notes

• Collector only. Replace the file and restart the service, then hard-refresh
  the browser (Ctrl+F5) so the new page is loaded instead of the cached one.
• Agents are unchanged; the version bump only keeps the numbers in step.
• No database migration, wire protocol unchanged. Item statuses set in the old
  dashboard carry over.