Configuring Collector-level anonymization (classic)

This page applies to Collector versions earlier than 26.5. To understand how anonymization works for Collector version 26.5 and later, refer to the Configuring Collector-level anonymization page.

Nexthink offers various ways to anonymize data along with granular controls for user privacy. The approaches described in this documentation complement similar features offered by the data storage layer, ensuring that data leaving the Microsoft Windows or macOS devices is anonymized.

Anonymization options

The following table lists each Collector-level anonymization option and the available settings for them.

If you disable User name and User interaction time reporting in device configuration profiles, you don't need to enable the server-side equivalents.

Data	Description	Privacy options	Default privacy option
User name	User logon name reported from the device.	cleartext: Collector reports the username in cleartext. hashed: Collector hashes the username before sending it to the backend. no_import: Collector does not collect the username at all. Note: The integration with Microsoft Active Directory using the Data Enricher (classic) or Microsoft Entra ID using the Connector for Microsoft Entra ID are independent from this Collector configuration. Ensure that the list of AD fields retrieved by the Data Enricher (classic) and Connector for Microsoft Entra ID is properly configured.	cleartext
User Principal Name (UPN)	Standardized user identifier that usually takes the form of an email address. The UPN allows the system to identify a user across systems uniquely. Nexthink also uses the UPN to enrich user objects with data from third-party services.	cleartext: Collector reports the UPN in cleartext. hashed: Collector hashes the UPN before sending it to the backend. no_import: Collector does not collect the UPN at all.	no_import
Focus time	Reports the application focus duration while the application’s windows were in focus.	enable: Execution events contain information about how long the application was in focus. disable: Execution events do not contain information about how long the application was in focus.	disable
User activity	Controls the reporting of the time the user was interacting with the mouse, touchpad or keyboard.	enable: Collector reports time periods when the user is actively using a device. disable: Collector does not report time periods when the user is actively using a device.	enable
Wi-Fi network	Manages the reporting of the identification details for both the SSID and the BSSID with Wi-Fi performance metrics.	enable: Collector reports only performance metrics and connection attributes. disable: Collector reports the SSID and BSSID of the connected hotspots in addition to the performance metrics and connection attributes. Note: On Windows 11 version 24H2 and later, enable the Location services setting to allow reporting Wi-Fi data.	enable
Network connections	Manages the reporting of network connection data.	enable: Collector reports network connections for all binaries including destination attributes and connection metrics. disable: Collector reports no network connection data.	enable
Data privacy filter for network connections	Reports network connections according to user-defined ALLOW / BLOCK rules.	Refer to the Data privacy filter section for more information.	Collector reports all network connections
Domain name	Manages the reporting of the destination’s domain name for network connections.	enable: Collector reports the domain name of the destination. disable: Collector reports no domain name for network connections.	disable

Anonymization option names

Based on the deployed Collector version, the system offers the same anonymization options under slightly different names. Your organization might have multiple Collector versions deployed at the same time: some earlier and others later than version 26.5.

Use the following table to map anonymization option names for Collector versions earlier and later than 26.5.

Setting name for Collector version 26.5 and later	Setting name for Collector version earlier than 26.5
User name	User name
User Principal Name (UPN)	User Principal Name (UPN)
Application focus time	Focus time
User interaction time	User activity
Wi-Fi network names	Wi-Fi network
Network connections	Network connections
Network connections (advanced filtering)	Data privacy filter *
Network connections (advanced filtering)	Domain name *

* The Data privacy filter and Domain name settings have been merged into Network connections (advanced filtering) from Collector version 26.5 onwards.

Changing the default privacy options

There are various configuration methods to change the default privacy setting for each data type.

The following table shows the different methods and their use cases:

Configuration method	Use case
Remote actions	Existing installations
Windows Collector installer	New installations
Windows registry	Existing installations
macOS Collector installer	New installations
macOS Collector configuration	Existing installations

Remote actions

Change the Collector configuration parameter for the User name, Wi-Fi network, and UPN on Windows and macOS operating systems with the Set anonymization features remote action.

Configure Focus time and User activity on Windows and macOS operating systems with the Set Collector configuration remote action.

Configure Network connections, Domain name and Data privacy filter on Microsoft Windows and macOS operating systems with the Set application connectivity configuration remote action.

The remote actions set the appropriate registry keys and configuration fields for you.

Windows Collector installer

Use the following optional parameters to change the default values for each data type:

User name	Parameter name: ANONYMIZE_USERNAME Parameter values: cleartext hashed no_import Example: ANONYMIZE_USERNAME=no_import
User Principal Name (UPN)	Parameter name: UPN_PRIVACY Parameter values: cleartext hashed no_import Example: UPN_PRIVACY=hashed
Focus time	Parameter name: WINDOW_FOCUS_TIME_MONITORING Parameter values: enable disable Example: WINDOW_FOCUS_TIME_MONITORING=enable
User activity	Parameter name: USER_INTERACTION_TIME_MONITORING Parameter values: enable disable Example: USER_INTERACTION_TIME_MONITORING=disable
Wi-Fi network	Parameter name: ANONYMIZE_WIFI_NETWORK Parameter values: enable disable Example: ANONYMIZE_WIFI_NETWORK=disable
Network connections	Parameter name: CONNECTIONS_REPORTING Parameter values: enable disable Example: CONNECTIONS_REPORTING=disable
Data privacy filter	Parameter name: DATA_PRIVACY_FILTER Parameter values: [a comma separated list of ALLOW / BLOCK rules] Example: DATA_PRIVACY_FILTER="ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080" Refer to the Data privacy filter section for more information.
Domain name	Parameter name: DOMAIN_NAME_REPORTING Parameter values: enable disable Example: DOMAIN_NAME_REPORTING=enable

Windows registry

To configure the anonymization, perform the following steps:

1. Stop Collector.
2. Modify the registry.
3. Start Collector.

Use the Windows registry to adjust the default value of the relevant key:

User name	Adjust the UserName value of AnonymizedData key. Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData Data type: DWORD (32-bit) Value name: UserName Value data: 0: cleartext 1: hashed 2: no_import
User Principal Name (UPN)	Adjust the UpnPrivacy value of the AnonymizedData key. Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData Data type: DWORD (32-bit) Value name: UpnPrivacy Value data: 0: no_import 1: hashed 2: cleartext
Focus time	Adjust the Enabled value of the WindowFocusTimeMonitoring key. Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\WindowFocusTimeMonitoring Data type: DWORD (32-bit) Value name: Enabled Value data: 0: disable 1: enable
User activity	Adjust the Disabled value of the UserInteractionTimeMonitoring key. Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\UserInteractionTimeMonitoring Data type: DWORD (32-bit) Value name: Disabled Value data: 0: disable 1: enable
Wi-Fi network	Adjust the WifiNetwork value of the AnonymizedData key. Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData Data type: DWORD (32-bit) Value name: WifiNetwork Value data: 0: disable 1: enable
Network connections	Adjust the ConnectionsReporting value of the AppConnectivity key. Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AppConnectivity Data type: DWORD (32-bit) Value name: ConnectionsReporting Value data: 0: disable 1: enable
Data privacy filter	Adjust the DataPrivacyFilter value of the AppConnectivity key. Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AppConnectivity Data type: String (REG_SZ) Value name: DataPrivacyFilter Value data example: "ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080" Refer to the Data privacy filter section for more information.
Domain name	Adjust the DomainNameReporting value of the AnonymizedData key. Key name: HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData Data type: DWORD (32-bit) Value name: DomainNameReporting Value data: 0: disable 1: enable

macOS Collector installer

Use the following optional parameters to change the default values for each data type:

User name	Parameter name: anonymize_username Parameter values: cleartext hashed no_import Example: anonymize_username=hashed
User Principal Name (UPN)	Parameter name: upn_privacy Parameter values: cleartext hashed no_import Example: upn_privacy=hashed
Focus time	Parameter name: windows_focus_time_monitoring Parameter values: enable disable Example: windows_focus_time_monitoring=enable
User activity	Parameter name: user_interaction_time_monitoring Parameter values: enable disable Example: user_interaction_time_monitoring=disable
Wi-Fi network	Parameter name: anonymize_wifi_network Parameter values: enable disable Example: anonymize_wifi_network=disable
Network connections	Parameter name: connections_reporting Parameter values: false true Example: connections_reporting=false
Data privacy filter	Parameter name: data_privacy_filter Parameter values: [a comma separated list of ALLOW / BLOCK rules] Example: data_privacy_filter="ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080" Refer to the Data privacy filter section for more information.
Domain name	Parameter name: domain_name_reporting Parameter values: false true Example: domain_name_reporting=true

macOS Collector configuration

To configure the anonymization, perform the following steps:

1. Stop Collector.
2. Modify the configuration file.
3. Start Collector.

Use the macOS Collector configuration file config.json located in the folder /Library/Application Support/Nexthink to add the following parameters on a new line at the end of the file before the closing curly bracket:

User name	Parameter name: AnonymizeUserName Parameter values: cleartext hashed no_import Example of the end of a configuration file: ... "AnonymizeUserName": "no_import" }
User Principal Name (UPN)	Parameter name: UpnPrivacy Parameter values: cleartext hashed no_import Example of the end of a configuration file: ... "UpnPrivacy": "cleartext" }
Focus time	Parameter name: EnableWindowFocusTimeMonitoring Parameter values: false true Example of the end of a configuration file: ... "EnableWindowFocusTimeMonitoring": "true" }
User activity	Parameter name: DisableUserInteractionTimeMonitoring Parameter values: false true Example of the end of a configuration file: ... "DisableUserInteractionTimeMonitoring": "true" }
Wi-Fi network	Parameter name: AnonymizeWifiNetwork Parameter values: false true Example of the end of a configuration file: ... "AnonymizeWifiNetwork": "false" }
Network connections	Parameter name: ConnectionsReporting Parameter values: false true Example of the end of a configuration file: ... "ConnectionsReporting": "false" }
Data privacy filter	Parameter name: DataPrivacyFilter Parameter values:[a comma separated list of ALLOW / BLOCK rules] Example of the end of a configuration file: ... "DataPrivacyFilter": "ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080" } Refer to the Data privacy filter section for more information.
Domain name	Parameter name:DomainNameReporting Parameter values: false true Example of the end of a configuration file: ... "DomainNameReporting": "true" }

Data privacy filter

This option allows you to configure Collector to report connections only to specific destinations.

Use the Windows registry or macOS Collector configuration method to configure the default privacy options.

The DataPrivacyFilter configuration parameter takes a comma-separated list of ALLOW and BLOCK filter rules. Each filter rule takes the following form: ALLOW | BLOCK [PATTERN]

There are four options for the [PATTERN]:

• A domain name with an optional port number, for example: abc.intra.nexthink.com:443
• A domain name with a leading * wildcard and an optional port number, for example: *.nexthink.com:443
• An IP address (IPv4 or IPv6) with optional port number, for example: 192.0.2.123:443
• A subnet mask, for example: 192.0.2.0/24

Enclose IPv6 addresses in brackets when you combine them with a port number, for example: ALLOW [fe80::1ff:fe23:4567:890a]:8080. Brackets are optional for IPv6-based rules without a port number.

Domain name with wildcard

In domain name based patterns, use a * wildcard to match zero, one, or multiple sub-domains.

For example, ALLOW *.nexthink.com matches all these domain names:

• nexthink.com
• intra.nexthink.com
• abc.intra.nexthink.com

The domain name based patterns with a * wildcard must start with the * wildcard instead of a sub-domain.

Correct example:

• ALLOW *.nexthink.com

Incorrect examples:

• ALLOW intra.*.nexthink.com
• ALLOW nexthink.*
• ALLOW *nexthink.com

Default rules

There are two default rules:

• System default rule: BLOCK * ("block everything else"). The system automatically adds this rule, if there is at least one user-defined rule.
• User-defined default rule: ALLOW * ("allow everything else").

The user-defined default rule overwrites the system default rule.

These defaults apply to the following cases:

Case	Default
The filter is not configured or parameter value is empty.	The Collector reports all connections.
The filter is configured and there is at least one user-defined rule.	The Collector reports connections according to the user-defined ALLOW / BLOCK rules and blocks everything else.

If you define only BLOCK rules, the Collector reports no connections.

Filter rule evaluation

Collector evaluates rules in the order from more specific to less specific:

1. IP address with port number.
2. IP address without port number.
3. Domain name with many sub-domains before domain names with fewer sub-domains.
4. Domain name with port before domain name without port.
5. Domain name without wildcard (*) before domain name with a wildcard.
6. Subnet mask.
7. User-defined default rule (ALLOW *) before system default rule (BLOCK *).

Considerations

• You can configure up to 1,000 filter rules. The system only evaluates the first 1,000 if there are more filter rules.
• Rules based evaluation on domain names do not apply to connections without a domain name.
• In case of a connection with multiple domain names and conflicting matching rules (ALLOW / BLOCK), the ALLOW rule overrules the BLOCK pattern.
• Collector does not support IPv4 addresses in IPv6 format. An IPv4 filter rule in IPv6 format does not match connections with the corresponding IPv4 address.