> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/configuring-collector-level-anonymization/configuring-collector-level-anonymization-classic.md). # Configuring Collector-level anonymization (classic) {% hint style="info" %} This page applies to devices running **Collector versions earlier than 26.5**, and to devices running Collector 26.5 or later that have not migrated to device configuration profiles. This includes a freshly installed 26.5 or later device. Once your tenant saves a device configuration profile for the first time, every eligible device switches to the mechanism described on the [Configuring Collector-level anonymization](/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/configuring-collector-level-anonymization.md) page. {% endhint %} Nexthink offers various ways to anonymize data along with granular controls for user privacy. The approaches described in this documentation complement similar features offered by the data storage layer, ensuring that data leaving the Microsoft Windows or macOS devices is anonymized. ## Anonymization options The following table lists each Collector-level anonymization option and the available settings for it.
DataDescriptionPrivacy optionsCollector built-in defaults
User nameUser logon name reported from the device.
  • cleartext: Collector reports the username in cleartext.
  • hashed: Collector hashes the username before sending it to the backend.
  • no_import: Collector does not collect the username at all.

Note: The integration with Microsoft Active Directory using the Data Enricher (classic) or Microsoft Entra ID using the Connector for Microsoft Entra ID are independent from this Collector configuration. Ensure that the list of AD fields retrieved by the Data Enricher (classic) and Connector for Microsoft Entra ID is properly configured.

cleartext
User Principal Name (UPN)Standardized user identifier that usually takes the form of an email address. The UPN allows the system to identify a user across systems uniquely. Nexthink also uses the UPN to enrich user objects with data from third-party services.
  • cleartext: Collector reports the UPN in cleartext.
  • hashed: Collector hashes the UPN before sending it to the backend.
  • no_import: Collector does not collect the UPN at all.

Note: Collector reports the UPN for Active Directory and Microsoft Entra ID user accounts on Windows. On macOS, Collector reports the UPN from Active Directory binding, from Microsoft Intune with Platform SSO (Collector 26.8 and later), or from Jamf Connect, in that order of priority. Collector does not report the UPN for system accounts, or for macOS local accounts that none of these sources covers. Refer to the Reporting the UPN on macOS documentation for more information.

no_import
Focus timeReports the application focus duration while the application’s windows were in focus.
  • enable: Execution events contain information about how long the application was in focus.
  • disable: Execution events do not contain information about how long the application was in focus.
disable
User activityControls the reporting of the time the user was interacting with the mouse, touchpad or keyboard.
  • enable: Collector reports time periods when the user is actively using a device.
  • disable: Collector does not report time periods when the user is actively using a device.
enable
Wi-Fi networkManages the reporting of the identification details for both the SSID and the BSSID with Wi-Fi performance metrics.
  • enable: Collector reports only performance metrics and connection attributes.
  • disable: Collector reports the SSID and BSSID of the connected hotspots in addition to the performance metrics and connection attributes.

    Note: On Windows 11 version 24H2 and later, enable the Location services setting to allow reporting Wi-Fi data.
enable
Network connectionsManages the reporting of network connection data.
  • enable: Collector reports network connections for all binaries including destination attributes and connection metrics.
  • disable: Collector reports no network connection data.
enable
Domain nameManages the reporting of the destination’s domain name for network connections.
  • enable: Collector reports the domain name of the destination.
  • disable: Collector reports no domain name for network connections.
disable
Data privacy filter for network connectionsReports network connections according to user-defined ALLOW / BLOCK rules.Refer to the #data-privacy-filter section for more information.Collector reports all network connections
## Changing the privacy options There are various configuration methods to change the default privacy setting for each data type. If your devices run Collector version 26.5 or later, consider migrating to device configuration profiles instead of using these methods. Refer to the [Configuring Collector-level anonymization](/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/configuring-collector-level-anonymization.md) page. The following table shows the different methods and their use cases:
Configuration methodUse case
#remote-actionsExisting installations
#windows-collector-installerNew installations
#windows-registryExisting installations
#macos-collector-installerNew installations
#macos-collector-configurationExisting installations
### Remote actions Change the Collector configuration parameter for the **User name, Wi-Fi network**, and **UPN** on Windows and macOS operating systems with the *Set anonymization features* remote action. Configure **Focus time** and **User activity** on Windows and macOS operating systems with the *Set Collector configuration* remote action. Configure **Network connections**, **Domain name** and **Data privacy filter** on Microsoft Windows and macOS operating systems with the *Set application connectivity configuration* remote action. The remote actions set the appropriate registry keys and configuration fields for you. ### Windows Collector installer Use the following optional parameters to change the default values for each data type:
User name

Parameter name: ANONYMIZE_USERNAME

Parameter values:

  • cleartext
  • hashed
  • no_import

Example: ANONYMIZE_USERNAME=no_import

User Principal Name (UPN)

Parameter name: UPN_PRIVACY

Parameter values:

  • cleartext
  • hashed
  • no_import

Example: UPN_PRIVACY=hashed

Focus time

Parameter name: WINDOW_FOCUS_TIME_MONITORING

Parameter values:

  • enable
  • disable

Example: WINDOW_FOCUS_TIME_MONITORING=enable

User activity

Parameter name: USER_INTERACTION_TIME_MONITORING

Parameter values:

  • enable
  • disable

Example: USER_INTERACTION_TIME_MONITORING=disable

Wi-Fi network

Parameter name: ANONYMIZE_WIFI_NETWORK

Parameter values:

  • enable
  • disable

Example: ANONYMIZE_WIFI_NETWORK=disable

Network connections

Parameter name: CONNECTIONS_REPORTING

Parameter values:

  • enable
  • disable

Example: CONNECTIONS_REPORTING=disable

Data privacy filter

Parameter name: DATA_PRIVACY_FILTER

Parameter values: [a comma separated list of ALLOW / BLOCK rules]

Example:

DATA_PRIVACY_FILTER="ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080"

Refer to the #data-privacy-filter section for more information.

Domain name

Parameter name: DOMAIN_NAME_REPORTING

Parameter values:

  • enable
  • disable

Example: DOMAIN_NAME_REPORTING=enable

### Windows registry To configure the anonymization, perform the following steps: 1. Stop Collector. 2. Modify the registry. 3. Start Collector. Use the Windows registry to adjust the default value of the relevant key:
User name

Adjust the UserName value of AnonymizedData key.

Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData

Data type: DWORD (32-bit)

Value name: UserName

Value data:

  • 0: cleartext
  • 1: hashed
  • 2: no_import
User Principal Name (UPN)

Adjust the UpnPrivacy value of the AnonymizedData key.

Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData

Data type: DWORD (32-bit)

Value name: UpnPrivacy

Value data:

  • 0: no_import
  • 1: hashed
  • 2: cleartext
Focus time

Adjust the Enabled value of the WindowFocusTimeMonitoring key.

Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\WindowFocusTimeMonitoring

Data type: DWORD (32-bit)

Value name: Enabled

Value data:

  • 0: disable
  • 1: enable
User activity

Adjust the Disabled value of the UserInteractionTimeMonitoring key.

Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\UserInteractionTimeMonitoring

Data type: DWORD (32-bit)

Value name: Disabled

Value data:

  • 0: disable
  • 1: enable
Wi-Fi network

Adjust the WifiNetwork value of the AnonymizedData key.

Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData

Data type: DWORD (32-bit)

Value name: WifiNetwork

Value data:

  • 0: disable
  • 1: enable
Network connections

Adjust the ConnectionsReporting value of the AppConnectivity key.

Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AppConnectivity

Data type: DWORD (32-bit)

Value name: ConnectionsReporting

Value data:

  • 0: disable
  • 1: enable
Data privacy filter

Adjust the DataPrivacyFilter value of the AppConnectivity key.

Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AppConnectivity

Data type: String (REG_SZ)

Value name: DataPrivacyFilter

Value data example:

"ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080"



Refer to the #data-privacy-filter section for more information.

Domain name

Adjust the DomainNameReporting value of the AnonymizedData key.

Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData

Data type: DWORD (32-bit)

Value name: DomainNameReporting

Value data:

  • 0: disable
  • 1: enable
### macOS Collector installer Use the following optional parameters to change the default values for each data type:
User name

Parameter name: anonymize_username

Parameter values:

  • cleartext
  • hashed
  • no_import

Example: anonymize_username=hashed

User Principal Name (UPN)

Parameter name: upn_privacy

Parameter values:

  • cleartext
  • hashed
  • no_import

Example: upn_privacy=hashed

Focus time

Parameter name: windows_focus_time_monitoring

Parameter values:

  • enable
  • disable

Example: windows_focus_time_monitoring=enable

User activity

Parameter name: user_interaction_time_monitoring

Parameter values:

  • enable
  • disable

Example: user_interaction_time_monitoring=disable

Wi-Fi network

Parameter name: anonymize_wifi_network

Parameter values:

  • enable
  • disable

Example: anonymize_wifi_network=disable

Network connections

Parameter name: connections_reporting

Parameter values:

  • false
  • true

Example: connections_reporting=false

Data privacy filter

Parameter name: data_privacy_filter

Parameter values: [a comma separated list of ALLOW / BLOCK rules]

Example:

data_privacy_filter="ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080"

Refer to the #data-privacy-filter section for more information.

Domain name

Parameter name: domain_name_reporting

Parameter values:

  • false
  • true

Example: domain_name_reporting=true

### macOS Collector configuration To configure the anonymization, perform the following steps: 1. Stop Collector. 2. Modify the configuration file. 3. Start Collector. Use the macOS Collector configuration file `config.json` located in the folder `/Library/Application Support/Nexthink` to add the following parameters on a new line at the end of the file before the closing curly bracket:
User name

Parameter name: AnonymizeUserName

Parameter values:

  • cleartext
  • hashed
  • no_import

Example of the end of a configuration file:

...
"AnonymizeUserName": "no_import"
}
User Principal Name (UPN)

Parameter name: UpnPrivacy

Parameter values:

  • cleartext
  • hashed
  • no_import

Example of the end of a configuration file:

...
"UpnPrivacy": "cleartext"
}
Focus time

Parameter name: EnableWindowFocusTimeMonitoring

Parameter values:

  • false
  • true

Example of the end of a configuration file:

...
"EnableWindowFocusTimeMonitoring": "true"
}
User activity

Parameter name: DisableUserInteractionTimeMonitoring

Parameter values:

  • false
  • true

Example of the end of a configuration file:

...
"DisableUserInteractionTimeMonitoring": "true"
}
Wi-Fi network

Parameter name: AnonymizeWifiNetwork

Parameter values:

  • false
  • true

Example of the end of a configuration file:

...
"AnonymizeWifiNetwork": "false"
}
Network connections

Parameter name: ConnectionsReporting

Parameter values:

  • false
  • true

Example of the end of a configuration file:

...
"ConnectionsReporting": "false"
}
Data privacy filter

Parameter name: DataPrivacyFilter

Parameter values:[a comma separated list of ALLOW / BLOCK rules]

Example of the end of a configuration file:

...
"DataPrivacyFilter": "ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080"
}

Refer to the #data-privacy-filter section for more information.

Domain name

Parameter name:DomainNameReporting

Parameter values:

  • false
  • true

Example of the end of a configuration file:

...
"DomainNameReporting": "true"
}
## Data privacy filter This option allows you to configure Collector to report connections only to specific destinations. Use the [#windows-registry](#windows-registry "mention") or [#macos-collector-configuration](#macos-collector-configuration "mention") method to configure the default privacy options. The `DataPrivacyFilter` configuration parameter takes a comma-separated list of `ALLOW` and `BLOCK` filter rules. Each filter rule takes the following form: `ALLOW | BLOCK [PATTERN]` There are four options for the `[PATTERN]`: * A domain name with an optional port number, for example: `abc.intra.nexthink.com:443` * A domain name with a leading `*` wildcard and an optional port number, for example: `*.nexthink.com:443` * An IP address (IPv4 or IPv6) with optional port number, for example: `192.0.2.123:443` * A subnet mask, for example: `192.0.2.0/24` {% hint style="info" %} Enclose IPv6 addresses in brackets when you combine them with a port number, for example: `ALLOW [fe80::1ff:fe23:4567:890a]:8080`. Brackets are optional for IPv6-based rules without a port number. {% endhint %} ### Domain name with wildcard In domain name based patterns, use a `*` wildcard to match zero, one, or multiple sub-domains. For example, `ALLOW *.nexthink.com` matches all these domain names: * `nexthink.com` * `intra.nexthink.com` * `abc.intra.nexthink.com` The domain name based patterns with a `*` wildcard must start with the `*` wildcard instead of a sub-domain. Correct example: * `ALLOW *.nexthink.com` Incorrect examples: * `ALLOW intra.*.nexthink.com` * `ALLOW nexthink.*` * `ALLOW *nexthink.com` ### Default rules There are two default rules: * System default rule: `BLOCK *` ("block everything else"). The system automatically adds this rule, if there is at least one user-defined rule. * User-defined default rule: `ALLOW *` ("allow everything else"). The user-defined default rule overwrites the system default rule. These defaults apply to the following cases: | Case | Default | | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | The filter is not configured or parameter value is empty. | The Collector reports all connections. | | The filter is configured and there is at least one user-defined rule. | The Collector reports connections according to the user-defined `ALLOW` / `BLOCK` rules and blocks everything else. | {% hint style="info" %} If you define only `BLOCK` rules, the Collector reports no connections. {% endhint %} ### Filter rule evaluation Collector evaluates rules in the order from more specific to less specific: 1. IP address with port number. 2. IP address without port number. 3. Domain name with many sub-domains before domain names with fewer sub-domains. 4. Domain name with port before domain name without port. 5. Domain name without wildcard (`*`) before domain name with a wildcard. 6. Subnet mask. 7. User-defined default rule (`ALLOW *`) before system default rule (`BLOCK *`). ### Considerations * You can configure up to 1,000 filter rules. The system only evaluates the first 1,000 if there are more filter rules. * Rule-based evaluation on domain names does not apply to connections without a domain name. * In case of a connection with multiple domain names and conflicting matching rules (`ALLOW` / `BLOCK`), the `ALLOW` rule overrules the `BLOCK` pattern. * Collector does not support IPv4 addresses in IPv6 format. An IPv4 filter rule in IPv6 format does not match connections with the corresponding IPv4 address. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.nexthink.com/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/configuring-collector-level-anonymization/configuring-collector-level-anonymization-classic.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.