> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/configuring-collector-level-anonymization.md).

# Configuring Collector-level anonymization

{% hint style="info" %}
This page applies to devices running **Collector version 26.5 or later** that have migrated to [Device configuration profiles](/platform/user-guide/administration/system-configuration/data-management/device-configuration-profiles.md). Your tenant migrates when it saves a device configuration profile for the first time.

For devices running earlier Collector versions, and for 26.5 or later devices before migration, refer to the [Configuring Collector-level anonymization (classic)](/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/configuring-collector-level-anonymization/configuring-collector-level-anonymization-classic.md) page.
{% endhint %}

Nexthink offers various ways to anonymize data along with granular controls for user privacy. The approaches described in this documentation complement similar features offered by the data storage layer, ensuring that data leaving the Microsoft Windows or macOS devices is anonymized.

## Precedence by Collector version and migration state

The following table shows what governs the anonymization settings of a device in each case:

| Collector version                               | Migrated to device configuration profiles | What governs its configuration                                                                                                                        |
| ----------------------------------------------- | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| 26.4 or below                                   | Not applicable                            | Classic per-device configuration.                                                                                                                     |
| 26.5 or later, upgraded from an earlier version | No                                        | Classic per-device configuration.                                                                                                                     |
| 26.5 or later, new installation                 | No                                        | Classic per-device configuration defined during installation. If no configuration was defined during installation, Collector built-in defaults apply. |
| 26.5 or later                                   | Yes                                       | Device configuration profiles.                                                                                                                        |

{% hint style="warning" %}
After migrating to device configuration profiles, the UI settings in Nexthink govern what anonymization settings are reported. Settings you do not explicitly configure take the Nexthink-recommended default, which might differ from the device's current classic configuration. Review your settings before you save a profile for the first time.

Refer to the [Migrating to Device configuration profiles](https://edocs.nexthink.com/nexthink-infinity/infinity-specifications/migrating-to-device-configuration-profiles) documentation.
{% endhint %}

## Anonymization settings

You can manage anonymization settings for devices running Collector version 26.5 or later in [Device configuration profiles](/platform/user-guide/administration/system-configuration/data-management/device-configuration-profiles.md). Once a device is migrated, classic mechanisms can no longer change these settings. This includes remote actions, installer parameters, registry settings, and Collector configuration files.

Device configuration profiles rename some settings to match the user interface. The Collector built-in defaults and the values Collector reports do not change.

The following table lists each anonymization setting and its privacy options. **Collector built-in defaults** are the values Collector reports when no configuration was defined during installation and the device has not been migrated.

<table data-search="false"><thead><tr><th width="128">Setting</th><th width="265.666748046875">Description</th><th width="334.666748046875">Privacy options</th><th width="228">Collector built-in defaults</th></tr></thead><tbody><tr><td><strong>User name</strong></td><td>User logon name reported from the device.</td><td><ul><li><strong>Enabled</strong>: The system reports the user account name. The <code>user.name</code> is populated and available in Nexthink Query Language (NQL), dashboards, and Remote actions.</li><li><strong>Disabled</strong>: The system does not report the user account name. The <code>user.name</code> is empty. The system tracks users anonymously by security identifier (SID). Directory enrichment by name and name-based targeting are unavailable.</li></ul><p><strong>Note</strong>: The integration with Microsoft Active Directory using the <a href="/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/api-and-integrations-classic/data-enricher-classic.md">Data Enricher (classic)</a> or Microsoft Entra ID using the <a href="/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/inbound-connectors/connector-for-microsoft-entra-id-azure-ad.md">Connector for Microsoft Entra ID</a> are independent from this Collector configuration. Ensure that the list of AD fields retrieved by the Data Enricher (classic) and Connector for Microsoft Entra ID is properly configured.<br><br><strong>Note</strong>: The <code>hashed</code> option is not available in device configuration profiles. A device configured with <code>hashed</code> through classic configuration keeps reporting <code>hashed</code> until it is migrated.</p></td><td><code>cleartext</code></td></tr><tr><td><strong>User Principal Name (UPN)</strong></td><td><p>Standardized user identifier that usually takes the form of an email address.</p><p>The UPN allows the system to identify a user across systems uniquely. Nexthink also uses the UPN to enrich user objects with data from third-party services.</p></td><td><ul><li><strong>Enabled</strong>: The system reports the UPN. <code>user.upn</code> is populated and available in NQL. The system uses it for cross-system user identification and connector-based enrichment.</li><li><strong>Disabled</strong>: The system does not collect the UPN. <code>user.upn</code> is empty. Cross-system user identification, connector-based enrichment, Spark, AI Tools, and other UPN-dependent features are unavailable.</li></ul><p><strong>Note</strong>: The <code>hashed</code> option is not available in device configuration profiles. A device configured with <code>hashed</code> through classic configuration keeps reporting <code>hashed</code> until it is migrated.<br><br><strong>Note</strong>: Collector reports the UPN for Active Directory and Microsoft Entra ID user accounts on Windows. On macOS, Collector reports the UPN from Active Directory binding, from Microsoft Intune with Platform SSO (Collector 26.8 and later), or from Jamf Connect, in that order of priority. Collector does not report the UPN for system accounts, or for macOS local accounts that none of these sources covers. Refer to the <a href="/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/macos-collector-references/reporting-the-upn-on-macos.md">Reporting the UPN on macOS</a> documentation for more information.</p></td><td><code>no_import</code></td></tr><tr><td><strong>Application focus time</strong></td><td>Reports the application focus duration while the application’s windows were in focus.</td><td><ul><li><strong>Enabled</strong>: The system populates <code>focus_time</code> on execution events and makes it available in NQL, dashboards, and software metering.</li><li><strong>Disabled</strong>: The <code>focus_time</code> is empty. Software metering and AI tool usage tracking are unavailable.</li></ul></td><td><code>disable</code></td></tr><tr><td><strong>User interaction time</strong></td><td>Controls the reporting of the time the user was interacting with the mouse, touchpad or keyboard.</td><td><ul><li><strong>Enabled</strong>: The system reports active usage intervals. <code>user_interaction_time</code> is populated on session events and available in NQL and dashboards.</li><li><strong>Disabled</strong>: The system does not report active usage intervals. <code>user_interaction_time</code> is empty. User availability metrics and features that depend on engagement signals are unavailable.</li></ul></td><td><code>enable</code></td></tr><tr><td><strong>Wi-Fi network names</strong></td><td>Manages the reporting of the identification details for both the SSID and the BSSID with Wi-Fi performance metrics.</td><td><ul><li><strong>Enabled</strong>: The system reports SSID and BSSID alongside Wi-Fi performance data.</li><li><strong>Disabled</strong>: The system does not collect SSID and BSSID. The system still reports Wi-Fi performance metrics, but network-specific identification and troubleshooting are unavailable.<br><br><strong>Note:</strong> Only supported on Windows. On Windows 11 version 24H2 and later, enable the <strong>Location services</strong> setting to allow reporting Wi-Fi data.</li></ul></td><td><p><code>enable</code></p><p>Anonymization is on: Collector does not report SSID and BSSID. This classic value is the opposite of the <strong>Enabled</strong> privacy option.</p></td></tr><tr><td><strong>Network connections</strong></td><td>Manages the reporting of network connection data and destination domain names.</td><td><ul><li><strong>Enabled with domain names</strong>: The system reports connection events, including the DNS domain name of each destination (<code>destination.domain</code>). This enables destination-level identification and filtering in NQL and Device View.</li><li><strong>Enabled</strong>: The system reports connection events without destination domain names. <code>destination.domain</code> is empty.</li><li><strong>Disabled</strong>: The system generates no connection events. Network analytics, application network visibility, and execution-level traffic metrics are unavailable.</li></ul></td><td><p><code>enable</code></p><p>Classic configuration sets this through two separate settings: network connections, enabled by default, and domain name, disabled by default. Together they match the <strong>Enabled</strong> privacy option.</p></td></tr><tr><td><strong>Network connections (advanced filtering)</strong></td><td>Reports network connections according to user-defined <code>ALLOW</code> / <code>BLOCK</code> rules.</td><td>Refer to the <a data-mention href="#network-connections-advanced-filtering">#network-connections-advanced-filtering</a> section for more information.</td><td>Collector reports all network connections</td></tr></tbody></table>

## Network connections (advanced filtering)

This setting allows you to configure a filter for Collector, forcing it to report connections only to specific destinations.

To configure this setting in the user interface, refer to [Device configuration profiles](/platform/user-guide/administration/system-configuration/data-management/device-configuration-profiles.md).

The filter is a comma-separated list of `ALLOW` and `BLOCK` rules. Each filter rule takes the following form: `ALLOW | BLOCK [PATTERN]`

There are four options for the `[PATTERN]`:

* A domain name with an optional port number, for example: `abc.intra.nexthink.com:443`
* A domain name with a leading `*` wildcard and an optional port number, for example: `*.nexthink.com:443`
* An IP address (IPv4 or IPv6) with optional port number, for example: `192.0.2.123:443`
* A subnet mask, for example: `192.0.2.0/24`

{% hint style="info" %}
Enclose IPv6 addresses in brackets when you combine them with a port number, for example: `ALLOW [fe80::1ff:fe23:4567:890a]:8080`. Brackets are optional for IPv6-based rules without a port number.
{% endhint %}

### Domain name with wildcard <a href="#configuringcollectorlevelanonymization-domainnamewithwildcard" id="configuringcollectorlevelanonymization-domainnamewithwildcard"></a>

In domain name based patterns, use a `*` wildcard to match zero, one, or multiple sub-domains.

For example, `ALLOW *.nexthink.com` matches all these domain names:

* `nexthink.com`
* `intra.nexthink.com`
* `abc.intra.nexthink.com`

The domain name based patterns with a `*` wildcard must start with the `*` wildcard instead of a sub-domain.

Correct example:

* `ALLOW *.nexthink.com`

Incorrect examples:

* `ALLOW intra.*.nexthink.com`
* `ALLOW nexthink.*`
* `ALLOW *nexthink.com`

### Default rules <a href="#configuringcollectorlevelanonymization-defaultrules" id="configuringcollectorlevelanonymization-defaultrules"></a>

There are two default rules:

* System default rule: `BLOCK *` ("block everything else"). The system automatically adds this rule, if there is at least one user-defined rule.
* User-defined default rule: `ALLOW *` ("allow everything else").

The user-defined default rule overwrites the system default rule.

These defaults apply to the following cases:

| Case                                                                  | Default                                                                                                             |
| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| The filter is not configured or parameter value is empty.             | The Collector reports all connections.                                                                              |
| The filter is configured and there is at least one user-defined rule. | The Collector reports connections according to the user-defined `ALLOW` / `BLOCK` rules and blocks everything else. |

{% hint style="info" %}
If you define only `BLOCK` rules, the Collector reports no connections.
{% endhint %}

### Filter rule evaluation <a href="#configuringcollectorlevelanonymization-filterruleevaluation" id="configuringcollectorlevelanonymization-filterruleevaluation"></a>

Collector evaluates rules in the order from more specific to less specific:

1. IP address with port number.
2. IP address without port number.
3. Domain name with many sub-domains before domain names with fewer sub-domains.
4. Domain name with port before domain name without port.
5. Domain name without wildcard (`*`) before domain name with a wildcard.
6. Subnet mask.
7. User-defined default rule (`ALLOW *`) before system default rule (`BLOCK *`).

### Considerations <a href="#configuringcollectorlevelanonymization-considerations" id="configuringcollectorlevelanonymization-considerations"></a>

* You can configure up to 1,000 filter rules. The system only evaluates the first 1,000 if there are more filter rules.
* Rule-based evaluation on domain names does not apply to connections without a domain name.
* In case of a connection with multiple domain names and conflicting matching rules (`ALLOW` / `BLOCK`), the `ALLOW` rule overrules the `BLOCK` pattern.
* Collector does not support IPv4 addresses in IPv6 format. An IPv4 filter rule in IPv6 format does not match connections with the corresponding IPv4 address.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/configuring-collector-level-anonymization.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.