Skip to content

Modules

Jump to bottom
Rod Christiansen edited this page Oct 8, 2026 · 3 revisions

Modules

Ten collection modules. Each one has an osquery query pack, a processor and a model, and each contributes one object to the payload. Run one with --run-module <id>, several with --run-modules a,b,c, or all of them by running the agent with no module filter.

Id Collects Query pack
inventory Device identity — serial, UUID, name, asset metadata 2 queries
system OS version, activation, updates, services, scheduled tasks 22 queries
hardware CPU, memory, storage, graphics, displays, battery, radios 55 queries
network Interfaces, DNS, NetBIOS, routes, wireless, VPN, throughput 12 queries
security Defender, firewall, BitLocker, TPM, Secure Boot, certificates, detections 20 queries
identity Local and directory accounts, join state, sign-in history, Hello 15 queries
management MDM enrolment, policy, configuration profiles, managed apps, management tool logs 21 queries
applications Installed software, processes, startup items, usage 3 queries
installs Managed-software state from the Cimian install tool 17 queries
peripherals USB, Bluetooth, printers, displays, audio, input, storage 19 queries

Which modules run on which schedule is in Installation.

How to read the shapes

Every example below is hand-authored and trimmed. The device in them is WS-0001 at example.com.

Most property names are not declared by hand. Apart from the peripherals model, the Cimian session records in installs and two usage fields in applications, the models carry no [JsonPropertyName] attributes — the serializer's camelCase naming policy derives the JSON name from the C# property. That is why you see totalPhysical, scopeID (only the first character is lowered) and uuid (a leading acronym run lowercases wholesale).

Every module object also carries four fields from the common base:

{
  "moduleId": "system",
  "moduleVersion": "2026.02.11.1043",
  "collectedAt": "2026-03-04T09:14:22Z",
  "deviceId": "11111111-2222-4333-8444-555555555555"
}

They are omitted from the examples below for brevity.

A recurring pattern: osquery is used to find and stat things quickly, and where osquery cannot see something as SYSTEM, or does not model it at all, the processor falls back to WMI, a PowerShell cmdlet or a direct registry read. Several modules define queries that are collected but not currently consumed; those are noted where they matter.

inventory

The device's identity. Everything else in ReportMate is keyed off what this module produces, so it is also the module that can fail a run outright.

osquery — system_info (hostname, computer name, hardware serial, UUID) and a second projection of the same table for model and vendor.

Other sources — WMI Win32_BIOS.SerialNumber and Win32_SystemEnclosure.SerialNumber when osquery has no usable serial; HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid; Win32_Processor.ProcessorId and Win32_BaseBoard.SerialNumber via WMI; Environment.MachineName. If a site inventory file exists at C:\ProgramData\Management\Inventory.yaml, a small line-prefix parser reads allocation, catalog, area, location, usage, username, asset and fleet from it to fill the asset fields. That file is optional and is not produced by ReportMate.

{
  "deviceName": "WS-0001",
  "serialNumber": "EXAMPLE-SERIAL",
  "assetTag": "AST-4417",
  "uuid": "11111111-2222-4333-8444-555555555555",
  "location": "Building A",
  "owner": "jdoe",
  "department": "Design",
  "catalog": "standard",
  "usage": "shared",
  "fleet": "workstations",
  "purchaseDate": null,
  "warrantyExpiration": null
}

Behaviour worth knowing

  • The serial is mandatory. It is taken from osquery system_info, then chassis_info when present, then the WMI BIOS serial, then the WMI enclosure serial, so a device without a working osquery still reports. SMBIOS placeholders (0, System Serial Number, To be filled by O.E.M., Default string, None, Not Specified, anything starting 00000000) are rejected, and the module throws rather than substituting the hostname. Default Windows hostname prefixes such as WIN- and DESKTOP- are stripped when firmware puts one in front of the serial.
  • The UUID is resolved in order: osquery system_info.uuid (rejecting the all-zero GUID), then MachineGuid, then a SHA-256 fingerprint of the CPU id joined with the baseboard serial.
  • purchaseDate and warrantyExpiration exist in the model but are never populated by the Windows client.

system

Operating system identity, licensing, patch state and the things Windows schedules or runs.

osquery — os_version, uptime, system_info, services, default_environment, patches, scheduled_tasks, logged_in_users, windows_crashes, windows_events, time, plus a dozen registry queries covering Windows NT\CurrentVersion (EditionID, ProductName, UBR, CurrentBuild, DisplayVersion, ReleaseId, BuildLab), SYSTEM\Setup source-OS markers, NLS language and locale, the time zone key, the Feature Experience Pack, and per-user keyboard layouts joined against logged_in_users.

Other sources — the Windows Update Agent COM API (Microsoft.Update.Session → CreateUpdateSearcher → Search('IsInstalled=0')) for pending updates; Get-CimInstance SoftwareLicensingService plus slmgr.vbs /dli for activation; Microsoft.Win32.Registry.CurrentUser for a keyboard-layout fallback. Two small state files under cache\ (previous_os_version.json, previous_boot_time.json) let the module detect change between runs.

{
  "operatingSystem": {
    "name": "Windows 11",
    "architecture": "64-bit",
    "displayVersion": "24H2",
    "version": "10.0.26100",
    "build": "26100",
    "major": 10, "minor": 0, "patch": 26100,
    "installDate": "2025-11-02T18:44:00Z",
    "locale": "en-CA",
    "timeZone": "Pacific Standard Time",
    "edition": "Enterprise",
    "featureUpdate": "3775.0",
    "keyboardLayouts": ["English (Canada)"],
    "activeKeyboardLayout": "English (Canada)",
    "lastInPlaceUpgrade": null,
    "inPlaceUpgradeCount": 0,
    "activation": {
      "isActivated": true,
      "status": "Licensed",
      "statusCode": 1,
      "partialProductKey": "XXXXX",
      "licenseType": "Volume",
      "hasFirmwareLicense": true,
      "firmwareEdition": "Professional OEM",
      "licenseSource": "KMS"
    }
  },
  "updates": [
    { "id": "KB5000001", "title": "Cumulative Update", "category": "Windows Update",
      "installDate": "2026-02-18T00:00:00Z", "releaseDate": null,
      "status": "", "requiresRestart": false }
  ],
  "pendingWindowsUpdates": [
    { "title": "Cumulative Update Preview", "kbNumber": "KB5000002",
      "category": "Security Updates", "severity": "Important",
      "description": "Addresses security issues.", "cves": ["CVE-2026-0001"],
      "isMandatory": true, "isDownloaded": false, "rebootRequired": true,
      "releaseDate": "2026-03-01T00:00:00Z" }
  ],
  "pendingWindowsUpdatesCount": 1,
  "services": [
    { "name": "Spooler", "displayName": "Print Spooler", "status": "RUNNING",
      "startType": "AUTO_START", "path": "C:\\Windows\\System32\\spoolsv.exe",
      "description": "Loads files to memory for later printing." }
  ],
  "environment": [ { "name": "NUMBER_OF_PROCESSORS", "value": "16", "scope": "" } ],
  "scheduledTasks": [
    { "name": "ReportMate Hourly Collection", "path": "\\ReportMate Hourly Collection",
      "enabled": true, "hidden": true, "state": "Ready", "status": "Ready",
      "action": "C:\\Program Files\\ReportMate\\managedreportsrunner.exe",
      "lastRunTime": "2026-03-04T08:37:11Z", "nextRunTime": "2026-03-04T09:41:00Z",
      "lastRunCode": "0", "lastRunMessage": "" }
  ],
  "lastBootTime": "2026-03-02T04:31:07Z",
  "uptime": "1.04:43:15",
  "uptimeString": "1d, 4h"
}

Behaviour worth knowing

  • Activation deliberately uses slmgr.vbs rather than the SoftwareLicensingProduct CIM class, which measured roughly a hundred times slower. A firmware licence is only counted for Professional, Enterprise, Education or Pro editions.
  • activation.licenseSource is one of Firmware, GVLK, KMS, ADBA, MAK, Retail, Volume, Unavailable or Unknown. A volume client key is resolved further from the most recent activation block: ADBA for Active Directory-based activation, KMS for a KMS host. The difference matters when a device leaves the domain, because AD-based activation stops renewing at once.
  • When the licensing service is stopping (0xC004F075), slmgr is retried; if it still cannot answer, licenseSource is Unavailable rather than a guess.
  • In-place upgrades are counted from Source OS (Updated on …) subkeys under HKLM\SYSTEM\SETUP. Zero markers means the recorded install date is a real clean install.
  • The module emits change events: an os_update event when displayVersion moves, and a reboot event when boot time shifts by more than 60 seconds.
  • osquery duplicates the directory prefix in a scheduled task's action string; the processor works around it.

hardware

The physical machine. This is the largest module, and the only one with a per-run performance mode.

osquery — system_info, cpu_info, memory_devices, disk_info, logical_drives, video_info, battery, interface_details, drivers, physical_disk_performance, several file queries for the storage walk, and around thirty registry queries covering the CPU description keys, the display and network adapter class GUIDs, the Bluetooth radio class, and NPU device properties.

Other sources — WMI Win32_ComputerSystem, Win32_PhysicalMemory, Win32_VideoController. PowerShell Get-CimInstance Win32_VideoController, Get-Partition, Get-PhysicalDisk, Get-NetAdapter, Get-NetAdapterAdvancedProperty, Get-PnpDevice, Get-WmiObject Win32_PnPSignedDriver, and a directory-walk helper built on System.IO.Directory that skips reparse points. Displays come from the root\wmi classes WmiMonitorID, WmiMonitorConnectionParams, WmiMonitorListedSupportedSourceModes and WmiMonitorBasicDisplayParams.

{
  "manufacturer": "Acme",
  "model": "Workstation 5000",
  "processor": {
    "name": "Model 7 4400", "manufacturer": "GenuineIntel",
    "cores": 8, "logicalProcessors": 16, "architecture": "x64",
    "baseSpeed": 3.2, "maxSpeed": 4.8, "socket": "U3E1"
  },
  "memory": {
    "totalPhysical": 34359738368,
    "availablePhysical": 8589934592,
    "totalVirtual": 68719476736,
    "availableVirtual": 34359738368,
    "modules": [
      { "manufacturer": "Acme", "capacity": 17179869184, "type": "DDR5",
        "speed": 5600, "location": "DIMM 0" }
    ]
  },
  "storage": [
    {
      "name": "PHYSICALDRIVE0", "model": "Acme NVMe 1TB", "serialNumber": "SN0001",
      "type": "NVMe", "interface": "NVMe", "capacity": 1024209543168,
      "freeSpace": 402653184000, "health": "Good", "isInternal": true,
      "volumeLetters": ["C"],
      "storageAnalysisEnabled": true, "lastAnalyzed": "2026-03-04T04:12:00Z",
      "rootDirectories": [
        { "path": "C:\\Program Files", "name": "Program Files",
          "size": 64424509440, "formattedSize": "60 GB", "fileCount": 148221,
          "subdirectoryCount": 412, "depth": 1, "driveRoot": "C:",
          "percentageOfDrive": 6.3, "category": "ProgramFiles",
          "lastModified": "2026-03-01T22:10:00Z",
          "subdirectories": [], "largeFiles": [] }
      ]
    }
  ],
  "graphics": {
    "name": "GraphicsCard 900", "manufacturer": "Acme",
    "memorySize": 8, "driverVersion": "31.0.15.1234",
    "driverDate": "2026-01-14T00:00:00Z"
  },
  "displays": [
    { "name": "Acme U2724", "serialNumber": "EXAMPLE-MONITOR-SERIAL", "manufacturer": "Acme",
      "model": "Acme U2724", "type": "external", "vendorId": "10ac",
      "productId": "41ac", "manufactureYear": 2024, "manufactureWeek": 18,
      "resolution": "2560x1440", "connectionType": "DisplayPort External",
      "diagonalInches": 27.0, "isMainDisplay": false, "online": true }
  ],
  "usbDevices": [],
  "battery": { "chargePercent": 88, "isCharging": true,
               "estimatedRuntime": "05:16:00", "cycleCount": 143, "health": "Good" },
  "thermal": { "cpuTemperature": 44.0, "gpuTemperature": 39.0, "fans": [] },
  "npu": { "name": "Acme NPU", "manufacturer": "Acme", "architecture": "x64",
           "computeUnits": 40.0, "driverDate": "2026-01-09T00:00:00Z",
           "isAvailable": true },
  "wireless": { "name": "Wi-Fi 6E Adapter", "manufacturer": "Acme",
                "macAddress": "00:11:22:33:44:55", "driverVersion": "23.40.0.1",
                "driverDate": "2025-12-01T00:00:00Z", "status": "Enabled",
                "protocol": "802.11ax", "wifiGeneration": "Wi-Fi 6E",
                "wifiVersion": "6E", "isAvailable": true },
  "bluetooth": { "name": "Bluetooth Adapter", "manufacturer": "Acme",
                 "macAddress": "00:11:22:33:44:56", "driverVersion": "23.40.0.1",
                 "driverDate": "2025-12-01T00:00:00Z", "status": "Enabled",
                 "bluetoothVersion": "5.3", "isAvailable": true },
  "powerPlan": null
}

Behaviour worth knowing

  • Storage mode. --storage-mode quick reports drive totals only and takes about a second. deep walks Program Files, Program Files (x86), Users, Windows, ProgramData and any other top-level directories, producing the rootDirectories tree, and can take minutes. auto — the default — reuses cache\storage_analysis.json when it is less than 24 hours old and walks otherwise. The directory tree is attached only to the disk hosting the system volume, found through each disk's volumeLetters; when the partition map is unavailable, the sole (or largest) internal disk is used. The hourly task runs quick and only the daily hardware task runs deep.
  • volumeLetters lists the drive letters of the volumes on each physical disk, without the colon, so a consumer can label the disk that holds C.
  • Displays are read through WMI, not osquery. As SYSTEM, osquery gets zero rows from HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY, which is how the module ran across a whole fleet without ever reporting a monitor. vendorId is the three-letter EDID PNP code packed five bits per letter and rendered lowercase hex.
  • A display's serialNumber is the EDID text serial. The raw EDID is read from the monitor's Device Parameters registry node and the 0xFF descriptor is preferred, matching the macOS client. When a panel publishes no text serial, none is reported. WmiMonitorID.SerialNumberID is used only when the raw EDID cannot be read, and only when it is at least five characters, because some drivers surface a short numeric fragment shared by every panel of a model. isMainDisplay is only true when exactly one monitor is attached — a session-0 process cannot see which is primary.
  • usbDevices is always empty here. USB lives in the peripherals module. powerPlan is defined but never populated.
  • Some values are estimates. When the real figure is not available, availablePhysical defaults to a quarter of totalPhysical, totalVirtual to double it, and battery.estimatedRuntime is a synthetic six-hour baseline scaled by charge and health. On ARM systems without a reported graphics memory size, graphics.memorySize is estimated as an eighth of physical memory.
  • category on a directory is an enum name string: System, ProgramFiles, ProgramData, Users, Applications, Cache, Documents, Media or Other.
  • Physical disks are authoritative; logical volumes only attribute free space. Bus types USB, 1394, SD, MMC, Fibre Channel and iSCSI mark a disk external.

network

Interfaces and everything attached to them, plus an optional throughput test.

osquery — interface_addresses, interface_details, routes, services, system_info, default_environment, and registry queries for interface friendly names, the Tcpip DNS parameters (Domain, DhcpDomain, SearchList, DhcpDNS, NameServer) and the NetBT parameters (EnableLMHosts, NodeType, ScopeID).

Other sources — netsh wlan show interface / show profiles, netsh interface ip show dns, nbtstat -n and -c; PowerShell Get-NetAdapter, Get-NetAdapterAdvancedProperty, Get-NetAdapterStatistics, Get-NetIPAddress, Get-NetConnectionProfile, Get-DnsClientGlobalSetting, Get-DnsClientServerAddress, Get-VpnConnection, Get-VpnConnectionRoute; the root\wmi class MSNdis_80211_Configuration for the wireless channel; and the bundled speedtest.exe, run as --format=json --accept-license with a 60-second timeout.

{
  "hostname": "WS-0001",
  "domain": "example.com",
  "primaryInterface": "Ethernet",
  "activeConnection": {
    "connectionType": "Wired", "interfaceName": "Ethernet",
    "friendlyName": "Ethernet", "ipAddress": "192.0.2.24",
    "gateway": "192.0.2.1", "macAddress": "00:11:22:33:44:57",
    "activeWifiSsid": null, "wifiSignalStrength": null, "activeWifiChannel": null,
    "isVpnActive": false, "vpnName": ""
  },
  "localIpAddresses": ["192.0.2.24", "198.51.100.7"],
  "hostnameAddresses": ["198.51.100.7"],
  "managementAddress": "198.51.100.7",
  "interfaces": [
    { "name": "Ethernet", "friendlyName": "Ethernet", "type": "Ethernet",
      "macAddress": "00:11:22:33:44:57", "ipAddresses": ["192.0.2.24"],
      "status": "Up", "isActive": true, "bytesSent": 88213441,
      "bytesReceived": 1204118822, "mtu": 1500, "linkSpeed": "1 Gbps",
      "wirelessProtocol": "", "wirelessBand": "" }
  ],
  "wifiNetworks": [
    { "ssid": "example-wifi", "security": "Saved Profile",
      "signalStrength": 0, "isConnected": false, "channel": "6" }
  ],
  "vpnConnections": [],
  "dns": {
    "servers": ["192.0.2.10", "192.0.2.11"],
    "domain": "example.com",
    "searchDomains": ["example.com"],
    "dhcpDomain": "example.com",
    "dhcpDnsServers": ["192.0.2.10"],
    "nameServer": ""
  },
  "netbios": {
    "nodeType": "H-node (Hybrid)", "enableLMHosts": true, "scopeID": "",
    "localNames": [ { "name": "WS-0001", "type": "Workstation",
                      "status": "Registered", "ipAddress": "", "interface": "",
                      "ttl": null } ],
    "nameCache": []
  },
  "routes": [ { "destination": "0.0.0.0", "gateway": "192.0.2.1",
                "interface": "Ethernet", "metric": 25 } ],
  "networkQuality": {
    "dlThroughput": "742.19", "ulThroughput": "512.66",
    "dlRating": "High", "ulRating": "High", "rating": "High",
    "idleLatency": "8.4", "jitter": "1.2",
    "serverName": "Example ISP", "serverLocation": "Example City",
    "error": "", "source": "speedtest"
  }
}

Behaviour worth knowing

  • The active connection is chosen from the 0.0.0.0 default route, matching by IP, then by same-subnet gateway, then by a scoring fallback. connectionType is None when nothing qualifies.
  • VPN detection is a name-and-description match across a broad list of common clients and WAN Miniport protocols. A tunnel counts as connected only when the adapter is up and holds a non-APIPA IPv4 address. connectedAt is approximated as the collection time, not the real connect time.
  • netsh wlan is frequently refused when Windows location services are restricted. Channel detection falls through four methods and ends at a hard-coded "6" — treat a bare channel 6 with suspicion.
  • wifiNetworks[].security only ever says Active Connection or Saved Profile; it is not a cipher.
  • networkQuality is null when speedtest.exe is absent or times out. Its numeric fields are strings.
  • managementAddress is the address the device's own name resolves to, but only when that address is also assigned to a local interface. The module resolves the hostname, the system host name and the host name with its DNS suffix (three seconds per lookup), records the usable answers in hostnameAddresses and every locally assigned address, tunnels included, in localIpAddresses, and promotes a match, preferring IPv4. A stale DNS answer is not promoted, and the address on the default route in activeConnection is left as it is. This is what lets a remote tool reach a device over a VPN tunnel whose address DNS knows.

security

Defensive posture: what is protecting the machine, whether it is on, and what it has caught.

osquery — certificates, windows_security_products, bitlocker_info, tpm_info, patches, os_version, windows_events, plus registry queries for the Defender real-time protection and signature keys, the firewall profile keys, Secure Boot state and the Device Guard keys.

Other sources — WMI root\SecurityCenter2\AntiVirusProduct, root\Microsoft\Windows\DeviceGuard\Win32_DeviceGuard, Win32_ComputerSystem, and vendor BIOS classes (root\wmi\Lenovo_BiosPasswordSettings, root\HP\InstrumentedBIOS\HP_BIOSPassword, the Dell BIOS PowerShell provider). PowerShell Get-NetFirewallProfile, Get-SecureBootUEFI, Get-MpComputerStatus, Get-MpPreference, Get-BitLockerVolume, Get-AppLockerPolicy, Get-ProcessMitigation -System, Get-WinEvent. auditpol.exe /get /category:* /r for audit policy. The Windows Update COM searcher, filtered to the Security Updates category, for CVEs. And the OpenSSH files %ProgramData%\ssh\sshd_config and administrators_authorized_keys.

{
  "antivirus": { "name": "Microsoft Defender Antivirus", "version": "4.18.26010.5",
                 "isEnabled": true, "isUpToDate": true,
                 "lastUpdate": "2026-03-04T06:02:00Z",
                 "lastScan": "2026-03-03T21:00:00Z",
                 "scanType": "Quick", "statusDisplay": "Current" },
  "firewall": { "isEnabled": true, "profile": "", "statusDisplay": "Enabled",
                "profiles": [ { "name": "Domain", "enabled": true,
                                "defaultInboundAction": "Block",
                                "defaultOutboundAction": "Allow" } ],
                "rules": [] },
  "encryption": {
    "bitLocker": { "isEnabled": true, "status": "FullyEncrypted",
                   "recoveryKeyId": "aaaaaaaa-1111-4222-8333-bbbbbbbbbbbb",
                   "encryptedDrives": ["C:"], "recoveryKeysEscrowed": true,
                   "lastEscrowDate": "2025-11-02T19:10:00Z",
                   "escrowLocation": "Entra ID", "statusDisplay": "Enabled",
                   "recoveryKeys": [ { "driveLetter": "C:",
                       "recoveryKeyId": "aaaaaaaa-1111-4222-8333-bbbbbbbbbbbb",
                       "isEscrowed": true, "escrowDate": "2025-11-02T19:10:00Z",
                       "escrowLocation": "Entra ID",
                       "keyProtectors": ["Tpm", "RecoveryPassword"] } ] },
    "deviceEncryption": true, "statusDisplay": "Enabled",
    "encryptedVolumes": [ { "driveLetter": "C:", "encryptionMethod": "XtsAes256",
                            "encryptionPercentage": 100.0, "status": "FullyEncrypted" } ]
  },
  "tpm": { "isPresent": true, "isEnabled": true, "isActivated": true,
           "version": "2.0", "manufacturer": "Infineon", "statusDisplay": "Enabled" },
  "secureBoot": { "isEnabled": true, "isConfirmed": true, "statusDisplay": "Enabled",
                  "dbCertificates": [], "kekCertificates": [], "collectionErrors": [] },
  "deviceGuard": { "coreIsolationEnabled": true, "memoryIntegrityEnabled": true,
                   "coreIsolationStatus": "Running", "memoryIntegrityStatus": "Running",
                   "vbsEnabled": true, "vbsSupported": true, "vbsStatus": "Running",
                   "vbsServices": ["Credential Guard", "HVCI"],
                   "kernelDmaProtectionEnabled": true,
                   "smartAppControlAvailable": true, "smartAppControlState": "Off",
                   "statusDisplay": "Credential Guard, HVCI",
                   "exploitProtection": { "depEnabled": true, "aslrEnabled": true,
                     "cfgEnabled": true, "sehopEnabled": true,
                     "heapIntegrityEnabled": true, "systemStatus": "On" } },
  "rdp": { "isEnabled": false, "port": 3389, "nlaEnabled": true,
           "securityLayer": "Negotiate", "allowRemoteConnections": false,
           "statusDisplay": "Disabled" },
  "secureShell": { "isInstalled": false, "isServiceRunning": false,
                   "isFirewallRulePresent": false, "isConfigured": false,
                   "isKeyDeployed": false, "arePermissionsCorrect": false,
                   "serviceStatus": "Stopped", "configStatus": "Not configured",
                   "statusDisplay": "Not installed" },
  "firmwarePassword": { "manufacturer": "Acme", "source": "SMBIOS",
                        "adminPasswordSet": true, "powerOnPasswordSet": false,
                        "hddPasswordSet": null, "rawState": 3,
                        "adminPasswordStatus": 3, "statusDisplay": "Set",
                        "errorMessage": null },
  "lsaProtection": { "enabled": true, "runAsPpl": 1, "mode": "PPL" },
  "tamperProtection": { "isTamperProtected": true, "source": "Get-MpComputerStatus" },
  "pendingReboot": { "cbsServicing": false, "windowsUpdate": false,
                     "fileRename": false, "required": false },
  "asrRules": [ { "id": "d4f940ab-401b-4efc-aadc-ad5f3c50688a",
                  "name": "Block Office applications from creating child processes",
                  "action": 1, "state": "Block" } ],
  "defenderVersions": { "amEngineVersion": "1.1.26010.1",
                        "amProductVersion": "4.18.26010.5",
                        "amServiceVersion": "4.18.26010.5",
                        "nisEngineVersion": "1.1.26010.1",
                        "antivirusSignatureVersion": "1.435.221.0",
                        "antispywareSignatureVersion": "1.435.221.0" },
  "defenderExclusions": { "paths": [], "extensions": [], "processes": [],
                          "ipAddresses": [], "totalCount": 0 },
  "appLocker": { "serviceRunning": false, "serviceStartType": "Manual",
                 "policyConfigured": false, "effectivePolicySummary": "",
                 "wdacEnabled": false, "wdacAuditMode": false },
  "smartScreen": { "windowsState": "Warn", "edgeEnabled": true,
                   "edgePuaProtection": true },
  "auditPolicy": { "categories": [ { "category": "Detailed Tracking",
                     "subcategory": "Process Creation", "setting": "Success" } ],
                   "errorMessage": "" },
  "edrProducts": [ { "name": "Microsoft Defender Antivirus", "vendor": "Microsoft",
                     "source": "Service:WinDefend", "serviceRunning": true,
                     "version": "4.18.26010.5", "sid": "" } ],
  "detections": [], 
  "detectionSummary": { "totalDetections30d": 0, "totalBlocked30d": 0,
                        "totalCleaned30d": 0, "totalAllowed30d": 0,
                        "lastThreatDetectedAt": null, "hasActiveThreats": false },
  "certificates": [ { "commonName": "Example Issuing CA",
                      "subject": "CN=Example Issuing CA, DC=example, DC=com",
                      "issuer": "CN=Example Root CA", "serialNumber": "1a2b3c",
                      "thumbprint": "A1B2C3D4E5F60718293A4B5C6D7E8F9012345678",
                      "thumbprintSha256": "", "storeLocation": "LocalMachine",
                      "storeName": "CA", "notBefore": "2024-01-01T00:00:00Z",
                      "notAfter": "2029-01-01T00:00:00Z",
                      "keyAlgorithm": "RSA", "signingAlgorithm": "sha256RSA",
                      "keyLength": 2048, "isSelfSigned": false, "isExpired": false,
                      "isExpiringSoon": false, "daysUntilExpiry": 1034,
                      "status": "Valid", "isOsTrustedRoot": false } ],
  "certificateSummary": { "totalCount": 148, "validCount": 141, "expiredCount": 6,
                          "expiringSoonCount": 1, "osRootExpiredCount": 6,
                          "userExpiredCount": 0 },
  "securityUpdates": [], "securityCves": [], "securityEvents": [],
  "securityReleaseInfo": { "osVersion": "10.0.26100", "osBuild": "26100",
                           "productVersion": "Windows 11 Enterprise",
                           "releaseDate": null, "uniqueCvesCount": 0,
                           "daysSincePreviousRelease": 0,
                           "securityInfoUrl": "", "updateAvailable": false },
  "lastSecurityScan": "2026-03-03T21:00:00Z"
}

Behaviour worth knowing

  • BitLocker has a false-positive guard. On some Windows 11 builds osquery reports protection_status = 1 on a decrypted drive, so a volume only counts as encrypted when it has a real encryption method and a conversion status that means encrypted. Escrow location is derived from a BitLocker Management event 845 (Entra ID), then the ActiveDirectoryBackup policy value, then Not Backed Up.
  • UEFI certificates are parsed in C#. Get-SecureBootUEFI output is walked as EFI signature lists and each X.509 entry is loaded directly. Failures are reported per stage in secureBoot.collectionErrors rather than silently dropped, and the parsed certificates are also appended to certificates[] with storeLocation: "UEFI".
  • EDR detection is a service-name table, 26 entries covering the common endpoint products, plus whatever root\SecurityCenter2 reports. It says what is installed and running, not whether it is healthy.
  • Detections are deduplicated across the paired Defender events 1116 and 1117, so count, firstSeenAt and lastSeenAt describe one detection rather than two rows.
  • certificates[].isOsTrustedRoot separates the shipped root store — where expired certificates are normal noise — from certificates an administrator actually placed. firewall.rules is permanently empty by design; thumbprintSha256 is declared but never populated.
  • The module deliberately does not collect UAC, join state, local admins, LAPS, Hello, password policy or auto-logon. Those are in identity.

identity

Who can sign in, who has, and how the device is joined.

osquery — users, groups, user_groups, logged_in_users, logon_sessions, joins for administrators and Remote Desktop Users, registry queries for Winlogon, Netlogon, the local account policy and the domain-join Tcpip values, and four windows_events queries for account and logon events.

Other sources — PowerShell Get-LocalUser, Get-LocalGroup, Get-LocalGroupMember, Get-CimInstance Win32_UserProfile, Get-WmiObject Win32_ComputerSystem, Test-ComputerSecureChannel, Get-Tpm, Get-WinEvent; dsregcmd /status; net accounts; SecurityIdentifier.Translate for SID lookup; [System.DirectoryServices.ActiveDirectory.Domain] for the domain controller; and direct registry reads of the UAC policy values, both LAPS locations, Winlogon and the Entra identity cache.

{
  "users": [
    { "username": "jdoe", "fullName": "J Doe", "description": "",
      "sid": "S-1-12-1-1111111111-2222222222-3333333333-4444444444",
      "homeDirectory": "C:\\Users\\jdoe", "uid": 0, "gid": 0, "shell": "",
      "uuid": "", "accountType": "EntraID", "isAdmin": false, "isDisabled": false,
      "isLocal": false, "passwordNeverExpires": false,
      "userCannotChangePassword": false, "passwordRequired": true,
      "isLockout": false, "lastLogon": "2026-03-04T08:02:11Z",
      "createdAt": "2025-11-04T15:00:00Z", "passwordLastSet": null,
      "accountExpires": null, "lastFailedLogin": null, "failedLoginCount": 0,
      "groupMemberships": ["Users"], "userPrincipalName": "jdoe@example.com" }
  ],
  "groups": [ { "name": "Administrators", "description": "Full control",
                "sid": "S-1-5-32-544", "gid": 0, "comment": "",
                "groupType": "Builtin", "isBuiltIn": true,
                "members": ["EXAMPLE\\Domain Admins"] } ],
  "loggedInUsers": [ { "username": "jdoe", "domain": "EXAMPLE",
                       "sessionType": "console", "logonType": "Interactive",
                       "sessionState": "Active", "loginTime": "2026-03-04T08:02:11Z",
                       "sessionId": 1, "pid": null, "host": "", "tty": "",
                       "isActive": true } ],
  "loginHistory": [ { "username": "jdoe", "timestamp": "2026-03-04T08:02:11Z",
                      "logoutTime": null, "duration": "1h 12m",
                      "eventType": "Logon", "eventId": 4624,
                      "logonType": "Interactive", "source": "", "sourceIp": "",
                      "success": true } ],
  "sessionHistory": [ { "username": "jdoe", "timestamp": "2026-03-03T09:01:00Z",
                        "endTime": "2026-03-03T17:22:00Z", "duration": "8h 21m",
                        "durationMinutes": 501.0, "eventId": 23,
                        "eventType": "Logoff", "sessionId": 1,
                        "sourceAddress": "" } ],
  "sessionSummary": { "totalSessions": 42, "uniqueUsers": 3,
                      "avgSessionMinutes": 264.5, "medianSessionMinutes": 218.0,
                      "oldestSession": "2026-02-04T08:11:00Z",
                      "newestSession": "2026-03-04T08:02:11Z",
                      "sessionsByHour": { "08": 12, "09": 7 },
                      "sessionsByDayOfWeek": { "Monday": 9, "Tuesday": 8 } },
  "directoryServices": {
    "activeDirectory": { "isDomainJoined": true, "domainName": "EXAMPLE",
                         "domainController": "dc01.example.com",
                         "organizationalUnit": "", "lastPasswordSet": null,
                         "dnsDomainName": "example.com",
                         "forestName": "example.com" },
    "entraId": { "isEntraJoined": true, "isEntraRegistered": false,
                 "tenantId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
                 "tenantName": "Example", "deviceId": "11111111-2222-3333-4444-555555555555",
                 "thumbprint": "A1B2C3D4E5F6", "deviceCertificateValidity": "Valid",
                 "deviceAuthStatus": "SUCCESS", "joinDate": null },
    "workgroup": ""
  },
  "ssoState": { "entraPrt": true, "entraPrtUpdateTime": "2026-03-04T07:55:00Z",
                "entraPrtExpiryTime": "2026-03-18T07:55:00Z",
                "entraPrtAuthority": "https://login.microsoftonline.com/…",
                "enterprisePrt": false, "enterprisePrtAuthority": "",
                "onPremTgt": true, "cloudTgt": true, "kerbTopLevelNames": "" },
  "domainTrust": { "secureChannelValid": true, "domainName": "example.com",
                   "domainController": "dc01.example.com", "trustStatus": "Healthy",
                   "lastChecked": "2026-03-04T09:14:20Z", "errorMessage": "",
                   "computerAccountExists": true, "machinePasswordAgeDays": null },
  "windowsHello": { "statusDisplay": "Enabled (PIN) [Business] - Configured",
                    "credentialProviders": { "pinEnabled": true,
                      "faceRecognitionEnabled": false, "fingerprintEnabled": false,
                      "smartCardEnabled": false, "providers": [] },
                    "biometricService": { "isServiceRunning": false,
                      "serviceStatus": "Stopped", "devices": [] },
                    "helloEvents": [] },
  "uac": { "enableLua": true, "consentPromptBehaviorAdmin": 5,
           "promptOnSecureDesktop": 1, "level": "NotifyChangesSecure" },
  "laps": { "windowsLapsConfigured": true, "legacyLapsInstalled": false,
            "backupDirectory": "Azure AD", "adminAccountName": "" },
  "passwordPolicy": { "minPasswordLength": 14, "maxPasswordAgeDays": 0,
                      "minPasswordAgeDays": 1, "passwordHistoryLength": 24,
                      "lockoutThreshold": 10, "lockoutDurationMinutes": 15,
                      "complexityRequired": null, "errorMessage": "" },
  "tpmOwnership": { "isOwned": true, "isReady": true, "autoProvisioning": true,
                    "manufacturerIdTxt": "IFX", "managedAuthLevel": "Full" },
  "autoLogin": { "autoAdminLogon": false, "hasDefaultUserName": false,
                 "hasDefaultPassword": false, "hasDefaultDomainName": false,
                 "defaultUserName": "" },
  "summary": { "totalUsers": 3, "adminUsers": 1, "disabledUsers": 0,
               "localUsers": 1, "domainUsers": 2, "currentlyLoggedIn": 1,
               "failedLoginsLast7Days": 0, "domainStatus": "Hybrid" }
}

Behaviour worth knowing

  • Built-in accounts are filtered by SID RID, not by name — RIDs 500, 501, 503 and 504 — so the filter works on non-English Windows.
  • The PowerShell pass rebuilds users and groups from scratch, discarding the osquery rows whenever it succeeds. Groups are limited to Administrators, Remote Desktop Users, Users, Power Users and Backup Operators.
  • Admin detection has two paths. Local accounts are matched by name against the Administrators group; profile-derived accounts are matched by SID, which is the accurate path and the one that covers Entra (S-1-12-1-…) and domain members.
  • Join state comes from dsregcmd /status. Its AzureAd* field names are renamed to entra* in the payload. summary.domainStatus is Hybrid when both AD and Entra report joined.
  • The auto-logon password is never read — only the presence of the DefaultPassword value is reported, and its presence logs a warning.
  • passwordPolicy parses English net accounts labels and will produce nulls on a non-English Windows. failedLoginsLast7Days is never computed.
  • Several Windows Hello sub-objects — policies, NGC key storage, Credential Guard, WebAuthN — depend on osquery results that no shipped query pack produces, so they stay empty. Hello data comes from the event-log fallback.

management

Enrolment, policy and configuration. The design point is that policy is collected generically from registry roots rather than per product.

osquery — enrolment and identity from HKLM\SOFTWARE\Microsoft\Enrollments, …\Provisioning\OMADM\Accounts, …\CurrentVersion\MDM and …\CurrentVersion\AAD\Storage; management certificates from the certificates table; and seven broad policy sweeps:

Query Root Source label
policy_registry_machine HKLM\SOFTWARE\Policies\** Group Policy, device
policy_registry_machine_wow6432 HKLM\SOFTWARE\WOW6432Node\Policies\** Group Policy, device
policy_registry_mdm_current HKLM\SOFTWARE\Microsoft\PolicyManager\current\** MDM, device
policy_registry_user HKEY_USERS\%\SOFTWARE\Policies\** Group Policy, user
policy_registry_system HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\** System policy, device
policy_registry_system_control HKLM\SYSTEM\CurrentControlSet\Policies\** System policy, device
policy_registry_user_system HKEY_USERS\%\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\** System policy, user

Two deliberate scoping decisions are worth repeating: MDM policy is limited to the current subtree because the whole PolicyManager tree is roughly 23,000 values and 6 MB per device and is not device state; and user policy must be read through HKEY_USERS, because the agent runs as SYSTEM and HKCU would resolve to SYSTEM's own hive.

Other sources — dsregcmd /status is the primary source for join, tenant and device details. MdmDiagnosticsTool.exe; the WMI namespace root\cimv2\mdm\dmmap (health attestation and Device Guard status) and root\ccm (SMS_Client, SMS_Authority) for co-management; Get-BitLockerVolume; the Autopilot policy cache in the registry; the Intune Management Extension Win32Apps registry tree for managed apps and its log file. A log survey walks %ProgramData% for the Intune extension log directory and for any Managed*\logs directory following the same convention.

{
  "deviceState": { "entraJoined": true, "enterpriseJoined": false,
                   "domainJoined": true, "virtualDesktop": false,
                   "deviceName": "WS-0001", "status": "Entra Joined" },
  "deviceDetails": { "deviceId": "11111111-2222-3333-4444-555555555555",
                     "thumbprint": "A1B2C3D4E5F6", "deviceCertificateValidity": "Valid",
                     "keyContainerId": "", "keyProvider": "Microsoft Platform Crypto Provider",
                     "tmpProtected": true, "deviceAuthStatus": "SUCCESS",
                     "intuneDeviceId": "66666666-7777-8888-9999-000000000000",
                     "entraObjectId": "11111111-2222-3333-4444-555555555555",
                     "primaryUser": "jdoe@example.com", "managementName": "WS-0001" },
  "tenantDetails": { "tenantName": "Example",
                     "tenantId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
                     "mdmUrl": "https://example.manage.microsoft.com/",
                     "mdmComplianceUrl": "", "settingsUrl": "" },
  "userState": { "ngcSet": true, "ngcKeyId": "", "canReset": true,
                 "workplaceJoined": false, "wamDefaultSet": true,
                 "wamDefaultAuthority": "organizations", "wamDefaultId": "",
                 "wamDefaultGUID": "" },
  "mdmEnrollment": { "isEnrolled": true, "provider": "Microsoft Intune",
                     "enrollmentId": "77777777-8888-9999-aaaa-bbbbbbbbbbbb",
                     "userPrincipalName": "jdoe@example.com",
                     "managementUrl": "https://example.manage.microsoft.com/",
                     "serverUrl": "https://example.manage.microsoft.com/",
                     "enrollmentMethod": "Auto-Enrolled" },
  "ownershipType": "Corporate",
  "lastSync": "2026-03-04T06:41:00Z",
  "autopilotConfig": { "activated": true, "registered": true, "status": "Complete",
                       "statusDetail": "", "tenantId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
                       "tenantDomain": "example.com", "profileName": "Standard Workstation",
                       "cloudAssigned": true, "deploymentMode": "SelfDeploying",
                       "policyDate": "2025-11-02", "forcedEnrollment": true,
                       "correlationId": "" },
  "configurationProfiles": [
    { "name": "Example Browser Policy", "profileName": "Example Browser Policy",
      "uuid": "HKLM\\SOFTWARE\\Policies\\Example\\Browser",
      "identifier": "Example/Browser", "source": "Group Policy",
      "category": "Applications", "organization": "", "type": "Device",
      "status": "Applied", "description": "", "payloadCount": 1,
      "installDate": null, "lastModified": "2026-01-22T04:00:00Z",
      "settings": {}, "appliedSettings": [],
      "payloads": [ { "type": "Registry", "identifier": "Example/Browser",
                      "displayName": "Browser", "version": 1,
                      "settings": { "HomepageLocation": "https://intranet.example.com" } } ] }
  ],
  "registryPolicies": [ { "keyPath": "HKLM\\SOFTWARE\\Policies\\Example\\Browser",
                          "valueName": "HomepageLocation",
                          "value": "https://intranet.example.com", "type": "REG_SZ",
                          "source": "Group Policy", "category": "Applications",
                          "description": "", "lastModified": null } ],
  "intunePolicies": [], "mdmConfigurations": [], "omaURISettings": [],
  "securityPolicies": [], "compliancePolicies": [],
  "managedApps": [ { "name": "Example Editor", "appId": "abcd1234", "version": "3.1.0",
                     "installState": "Installed", "complianceState": "Compliant",
                     "enforcementState": "Success", "appType": "Win32",
                     "errorCode": "0", "lastInstallAttempt": "2026-02-28T03:12:00Z",
                     "targetType": "Device" } ],
  "profiles": [],
  "lastPolicyUpdate": "2026-03-04T06:41:00Z",
  "totalPoliciesApplied": 412,
  "policyCountsBySource": { "Group Policy": 188, "MDM": 190, "System Policy": 34 },
  "mdmDiagnostics": { "collectedAt": "2026-03-04T09:14:10Z",
    "healthAttestation": { "secureBootEnabled": true, "bitLockerStatus": "On",
      "codeIntegrityEnabled": true, "bootDebuggingEnabled": false,
      "lastUpdateTime": "2026-03-04T06:00:00Z", "errorMessage": "" },
    "coManagementStatus": { "configMgrInstalled": false, "isCoManaged": false,
      "configMgrVersion": "", "errorMessage": "" },
    "recentIntuneLogs": [] },
  "logs": { "platform": "Windows", "roots": [
    { "tool": "mdm", "name": "Intune",
      "path": "C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
      "layout": "flat", "fileCount": 12, "totalBytes": 48211440,
      "newestModified": "2026-03-04T06:41:00Z", "inventoryTruncated": false,
      "primaryLog": "IntuneManagementExtension.log",
      "errorCount": 0, "warningCount": 3, "version": "1.90.0.0",
      "files": [], "tails": [] } ] },
  "metadata": {}
}

Behaviour worth knowing — what "profiles" means here

There is no separate profiles module. Two things carry the name:

  • management.profiles[] is the legacy MDM profile list. It is marked obsolete in the code and is still emitted for compatibility.
  • management.configurationProfiles[] is the current concept. The flat registry sweep is grouped into one profile per policy branch, each carrying every value beneath it as payload settings, deliberately shaped so the dashboard renders Windows registry policy and macOS configuration-profile payloads through the same reader. uuid is the policy key path. The native and WOW6432Node views of the same branch collapse into one profile. There is no per-product logic — extending coverage means adding a registry root, never a per-application query.

The logs section surveys management tool log roots, mirroring the macOS client field for field so one reader serves both. Every C:\ProgramData\Managed<Tool>\logs directory is a root (ManagedInstalls becomes tool installs, ManagedBootstrap becomes bootstrap, and so on), plus the Intune Management Extension log directory as tool mdm, read with CMTrace severities. For each root it reports the file inventory, the latest session summary when the tool writes YYYY-MM-DD\HHMM or HHMMSS session directories, error and warning counts from the primary log's tail, and capped tails of the most relevant logs. version is read from the owning tool's installed binary and omitted when the tool has no known binary or is not installed; nothing is executed to ask a tool its version. Limits: 20 roots, 50 files and 6 tails per root, 150 lines or 32 KB per tail, and a 5,000-entry walk per root, after which inventoryTruncated is true and the counts are a floor.

provider is inferred as Microsoft Intune when the device is enrolled with no provider recorded and either Intune policies exist or the MDM URL points at the Intune service. tenantName deliberately is not used for that inference, because dsregcmd fills it for any Entra-joined device.

applications

Installed software, what is running, what starts automatically, and how much each application is actually used.

osquery — programs, startup_items, processes (excluding zombies).

Other sources — the Windows Security log, events 4688 and 4689 (process creation and termination), falling back to Microsoft-Windows-Kernel-Process/Operational events 1 and 2, and using System log events 1074 and 6008 to close sessions left open by a shutdown. SID to username resolution goes through SecurityIdentifier.Translate. FileVersionInfo fills in versions the registry records incompletely. Idle split comes from the per-user JSON files that usagetracker.exe writes under C:\ProgramData\ManagedReports\usagetracker\.

{
  "totalApplications": 214,
  "applicationsWithUsage": 37,
  "lastInventoryUpdate": "2026-03-04T09:14:19Z",
  "installedApplications": [
    { "name": "Example Editor", "version": "3.1.0", "publisher": "Example Inc.",
      "installLocation": "C:\\Program Files\\Example Editor",
      "installDate": "2026-02-28T00:00:00Z", "size": null,
      "architecture": "x64", "source": "MSI",
      "usage": { "name": "Example Editor", "executable": "editor.exe",
                 "path": "C:\\Program Files\\Example Editor\\editor.exe",
                 "publisher": "Example Inc.",
                 "firstSeen": "2026-03-04T05:11:02Z",
                 "lastUsed": "2026-03-04T08:58:40Z",
                 "lastExitTime": "2026-03-04T08:58:40Z",
                 "launchCount": 3, "totalSeconds": 7412.0,
                 "activeUsageSeconds": 3980.0, "averageSessionSeconds": 2470.7,
                 "activeSessionCount": 3, "uniqueUserCount": 1,
                 "users": ["EXAMPLE\\jdoe"], "recentSessions": [] } }
  ],
  "runningProcesses": [
    { "name": "editor.exe", "processId": 8124,
      "path": "C:\\Program Files\\Example Editor\\editor.exe",
      "memoryUsage": 412372992, "cpuPercent": 1.8,
      "startTime": "2026-03-04T08:02:44Z" }
  ],
  "startupPrograms": [
    { "name": "ExampleSync", "path": "C:\\Program Files\\Example Sync\\sync.exe",
      "location": "Registry", "enabled": true }
  ],
  "usage": {
    "isCaptureEnabled": true, "status": "complete",
    "generatedAt": "2026-03-04T09:14:19Z",
    "windowStart": "2026-03-04T05:14:19Z", "windowEnd": "2026-03-04T09:14:19Z",
    "totalLaunches": 11, "totalUsageSeconds": 21344.0,
    "warnings": [],
    "activeSessions": [
      { "sessionId": "8124-638400000000000000", "name": "Example Editor",
        "publisher": "Example Inc.",
        "path": "C:\\Program Files\\Example Editor\\editor.exe",
        "processId": 8124, "user": "EXAMPLE\\jdoe",
        "userSid": "S-1-12-1-1111111111-2222222222-3333333333-4444444444",
        "startTime": "2026-03-04T08:02:44Z", "endTime": null,
        "durationSeconds": 4055.0, "foregroundSeconds": 2210.0,
        "activeSeconds": 1980.0, "isActive": true }
    ]
  },
  "dailyUsageHistory": [
    { "date": "2026-03-04", "appName": "Example Editor", "publisher": "Example Inc.",
      "launches": 3, "totalSeconds": 7412.0, "foregroundSeconds": 3120.0,
      "activeSeconds": 2740.0, "users": ["EXAMPLE\\jdoe"] }
  ]
}

Behaviour worth knowing

  • Usage is a window delta, not a cumulative. The API accumulates on conflict, so the client sends only what happened since the last window. The window runs from a watermark file to now, capped at four hours. The watermark is written at collection time, so a failed transmission loses a window rather than replaying it — the idempotency key handles the retry case.
  • Three different numbers. durationSeconds is process lifetime. foregroundSeconds is time the application held OS focus. activeSeconds is foreground and user input within the previous 300 seconds. Only the last is a defensible "someone was using this" figure. Both idle figures stay zero where usagetracker.exe is not running — the collector runs as SYSTEM in session 0 and cannot call the foreground or last-input APIs for a user.
  • Daily history is keyed on the local day, matching usagetracker.exe. A session that spans midnight has its seconds apportioned across the local days it covers, and when tracker figures are merged in, totalSeconds is kept at or above foregroundSeconds.
  • Launches are activations, not process starts. A new launch is only counted when a session begins more than 60 seconds after everything else for that application exited. Counting raw sessions produced millions of "launches" across a fleet in two days.
  • Service and OS binaries are filtered out by path and by an explicit denylist, with a small allowlist for the System32 tools people genuinely use.
  • Attribution matches an executable to an installed application by longest install-location prefix, then by a fuzzy name match that ignores vendor words. The event-log path drops what it cannot resolve; the tracker path falls back to the executable name.
  • Despite the name, usage.activeSessions contains every session in the window, not only the still-running ones. The snapshot's own applications list is not serialized — per-application figures ride on installedApplications[].usage.

installs

Managed-software state, read from Cimian, the Windows managed-install tool. This module is the analogue of Munki reporting on the macOS client. If Cimian is not installed, it reports that and little else.

osquery — seventeen queries, almost all against the file table. They locate and stat the report files, the session log directories, the configuration file, the manifests, the catalogs and the package cache, plus services, processes, programs and a registry lookup for the package key. osquery finds the files; the processor then reads them directly, so an osquery miss does not lose the data.

Other sources — direct reads of the JSON, JSONL, YAML and log files under C:\ProgramData\ManagedInstalls\; FileVersionInfo on the Cimian executable; Process.GetProcesses(); schtasks for the scheduled-task state; and the uninstall registry key for the installed version.

{
  "lastCheckIn": "2026-03-04T04:12:33Z",
  "bootstrapModeActive": false,
  "runLog": "…",
  "cacheStatus": {
    "cache_size_mb": 2841.7, "file_count": 63,
    "cimian_last_run": "2026-03-04T04:12:33Z",
    "cimian_total_packages": 48,
    "cimian_packages_with_updates": 2,
    "cimian_packages_with_warnings": 1,
    "cimian_packages_with_errors": 0
  },
  "cimian": {
    "isInstalled": true, "version": "0.1.21", "status": "Active",
    "lastRun": "2026-03-04T04:12:33Z",
    "lastSessionTime": "2026-03-04T04:12:33Z", "totalSessions": 214,
    "bootstrapFlagPresent": false,
    "pendingPackages": ["Example Editor"],
    "services": ["Cimian Managed Software Update Hourly: REGISTERED"],
    "activeProcesses": [],
    "registryConfig": {}, "config": {},
    "catalogs": ["standard"],
    "reports": { "items.json": { "size": "184320", "mtime": "1772596353" } },
    "items": [
      { "id": "example-editor", "itemName": "Example Editor",
        "displayName": "Example Editor", "itemType": "managed_install",
        "currentStatus": "Update Available", "mappedStatus": "Pending",
        "latestVersion": "3.2.0", "installedVersion": "3.1.0",
        "lastSeenInSession": "20260304-041233",
        "lastSuccessfulTime": "2026-02-28T03:12:00Z",
        "lastAttemptTime": "2026-03-04T04:12:33Z",
        "lastAttemptStatus": "Pending", "lastUpdate": null,
        "installCount": 1, "updateCount": 0, "failureCount": 0, "warningCount": 0,
        "totalSessions": 12, "installLoopDetected": false, "hasInstallLoop": false,
        "lastError": "", "lastWarning": "",
        "pendingReason": "Update available", "installMethod": "msi",
        "type": "msi", "category": "Applications", "developer": "Example Inc.",
        "recentAttempts": [] }
    ],
    "sessions": [
      { "session_id": "20260304-041233", "start_time": "2026-03-04T04:12:33Z",
        "end_time": "2026-03-04T04:19:02Z", "run_type": "auto",
        "status": "completed", "total_actions": 4, "total_packages_managed": 48,
        "packages_installed": 1, "packages_pending": 1, "packages_failed": 0,
        "installs": 1, "updates": 0, "removals": 0, "successes": 1, "failures": 0,
        "duration_seconds": 389, "cache_size_mb": 2841.7,
        "hostname": "WS-0001", "user": "SYSTEM", "process_id": 4188,
        "log_version": "2", "packages_handled": ["Example Editor"],
        "environment": {}, "config": {}, "summary": {}, "system_info": {},
        "flags": {}, "batch_operations": [], "performance_metrics": {},
        "failed_items": [], "blocking_applications": {} }
    ],
    "events": [
      { "eventId": "e-0001", "sessionId": "20260304-041233",
        "timestamp": "2026-03-04T04:14:10Z", "level": "INFO",
        "eventType": "install", "package": "Example Editor", "version": "3.1.0",
        "action": "install", "status": "Success",
        "message": "Installed Example Editor 3.1.0", "duration": "00:02:11",
        "progress": 100, "error": "", "installerType": "MSI",
        "installerPath": "", "installerOutput": "", "context": {},
        "sourceFile": "", "sourceFunction": "", "sourceLine": 0,
        "logFile": "", "batchId": "", "systemContext": {},
        "relatedPackages": [], "performanceCounters": {}, "checkOnlyMode": false }
    ]
  },
  "cimianSessionStats": null,
  "cimianSnapshot": null
}

Behaviour worth knowing

  • cimian.sessions[] emits snake_case. Those fields carry explicit [JsonPropertyName] attributes. The cacheStatus dictionary keys are snake_case too. Everything else in the module is camelCase.
  • A full run skips the module while managedsoftwareupdate is running, to avoid reading half-written reports. Runs that name modules with --run-module or --run-modules bypass the check, which is how the Cimian postflight (--run-modules inventory,installs) reports straight after a Cimian run.
  • currentStatus is Cimian's own vocabulary; mappedStatus normalises it to Installed, Pending, Warning, Error or Removed for filtering. An install loop and a not-installed item both map to Warning, whatever status Cimian reports for a looping item.
  • A Cimian warning verdict survives the run that produced it: an item Cimian marked Warning (a postinstall warning, or a LoopGuard suppression) keeps mappedStatus Warning and its lastWarning text even when its install event completed. Only a clean success clears it. Install events carry each warning or failed item with a message: lastWarning for warnings, the last error or the failing event's error text for failures.
  • Cimian counts as installed when its items, sessions or version prove it ran, even if the service and scheduled-task probes miss. A session summary with no errors field is read for its failure count instead.
  • runLog ships the entire run log as one string, opened with a shared read handle so a running Cimian does not block it.
  • installs is not on any of the interval tasks, because it depends on a tool that is itself running on a schedule; it is reported by the Cimian postflight, by the MSI's all-modules task (a full run) and by the first check-in after install. The NUPKG's all-modules task leaves it out.

peripherals

Everything attached to the machine. This is the one module whose payload names are all explicit, because the shape has to match the macOS client and the dashboard reader exactly.

osquery — nineteen queries, every one of them against the registry table, covering the DISPLAY, USB, USBSTOR, HID and PCI enumeration keys, the printer control keys, the MMDevices audio render and capture keys, the Bluetooth device parameters, and HARDWARE\DEVICEMAP\SERIALCOMM.

Other sources — a WMI or PowerShell CIM fallback for every category: Win32_PnPEntity (USB, keyboards and mice, cameras, Thunderbolt, scanners), Win32_SoundDevice, Win32_Printer, Win32_LogicalDisk filtered to removable drives, Win32_SerialPort, and a PowerShell read of the Bluetooth device keys that UTF-8 decodes the binary name value. Displays come from the same root\wmi monitor classes the hardware module uses.

{
  "usbDevices": [
    { "name": "Example Pen Tablet", "vendor": "Example", "vendorId": "056a",
      "model": "Pen Tablet", "modelId": "0391",
      "deviceInstanceId": "USB\\VID_056A&PID_0391\\0AA00A0000001",
      "serialNumber": "0AA00A0000001", "isCompositeChild": false,
      "class": "HID", "subclass": "", "protocol": "", "removable": true }
  ],
  "bluetoothDevices": [
    { "name": "Example Headset", "address": "001122334455",
      "deviceType": "Audio", "deviceCategory": "Audio/Video",
      "isConnected": false, "isPaired": true, "manufacturer": "Example",
      "lastSeen": "" }
  ],
  "printers": [
    { "name": "Print-Queue-01", "displayName": "Print-Queue-01",
      "manufacturer": "Example", "model": "LaserJet 500",
      "driver": "Example Universal Print Driver", "driverVersion": "6.9.0",
      "portName": "IP_192.0.2.60", "location": "Building A",
      "status": "Idle", "shareName": "", "connectionType": "Network",
      "isDefault": true, "isShared": false, "isNetwork": true,
      "serverName": "", "comment": "", "deviceType": "Printer" }
  ],
  "displayDevices": [
    { "serialNumber": "EXAMPLE-MONITOR-SERIAL", "manufacturer": "Acme",
      "model": "Acme U2724", "friendlyName": "Acme U2724",
      "hardwareId": "MONITOR\\EXAMPLE_MONITOR_ID", "connectionType": "DisplayPort External",
      "deviceDescription": "Generic PnP Monitor",
      "pnpDeviceId": "DISPLAY\\EXAMPLE_MONITOR_ID\\5&1a2b3c&0&UID_EXAMPLE", "isExternal": true }
  ],
  "inputDevices": [
    { "name": "Example Pen Tablet", "description": "Example Pen Tablet",
      "vendor": "Example", "vendorId": "056a", "productId": "0391",
      "serialNumber": "0AA00A0000001", "tabletType": "Pen Display",
      "registryPath": "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\HID\\…",
      "deviceType": "Graphics Tablet", "hidDeviceId": "HID\\VID_056A&PID_0391",
      "isBuiltIn": false, "connectionType": "USB" }
  ],
  "audioDevices": [
    { "name": "Speakers", "manufacturer": "Example", "type": "Render",
      "isDefault": true, "isInput": false, "isOutput": true, "isBuiltIn": true,
      "connectionType": "Internal", "deviceType": "Audio Device",
      "status": "Active", "registryPath": "HKLM\\SOFTWARE\\Microsoft\\…" }
  ],
  "cameras": [
    { "name": "Example Webcam", "manufacturer": "Example", "modelId": "0826",
      "isBuiltIn": false, "connectionType": "USB", "deviceType": "Camera",
      "status": "OK", "registryPath": "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USB\\…" }
  ],
  "storageDevices": [
    { "name": "Example Portable SSD", "devicePath": "E:", "volumeName": "SCRATCH",
      "fileSystem": "NTFS", "totalSize": "1000204886016",
      "freeSpace": "742938214400", "serialNumber": "SN0002",
      "driveType": "Removable", "storageType": "SSD", "connectionType": "USB",
      "deviceType": "External Storage" }
  ],
  "thunderboltDevices": [],
  "scanners": [],
  "serialPorts": [
    { "name": "COM3", "device": "\\Device\\Serial0", "portType": "Serial",
      "connectionType": "Internal", "deviceType": "Serial Port" }
  ]
}

Behaviour worth knowing

  • Eleven flat arrays, no wrappers. The model has nested category objects internally, but they are all [JsonIgnore]d. Only the flat arrays serialize, chosen to match the macOS client and the dashboard reader. Graphics tablets are folded into inputDevices with deviceType set to Graphics Tablet and tabletType carried across.
  • serialNumber is only set when the device exposes a USB serial descriptor. Where Windows derives the instance id from bus topology, it is null. deviceInstanceId is a bus address, not an identity, and should not be used as a key.
  • isCompositeChild matters. A composite device's children carry &MI_nn in their instance path and no serial — the serial lives on the parent, so consumers must collapse children onto it.
  • Displays are reported by both this module and hardware, on purpose. The EDID serial is an identity key and must be the same string in both payloads, so both read it from the same reader. Win32_DesktopMonitor is deliberately not used — it names everything "Generic PnP Monitor" and carries no serial. Pen displays are why display and tablet collection are coupled: some generations publish no USB serial at all, leaving the EDID serial as the only stable identity.
  • A PrinterData model and a printers processor exist in the tree but are not registered and not shipped — there is no printers module id and no printers.json query pack. Printers reach the payload only through this module.
  • The tablet vendor filter is a generic list of graphics-tablet vendors, not a site-specific list.

MIT licensed. reportmate.app

reportmate-client-win

Other ReportMate wikis

Clone this wiki locally