gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 04:32:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(agent/v1/sw-inventory): mirror V2 fix — accept AAD/MSA SIDs and emit real registry path

Browse Source 
V1 carried the same two bugs as V2: the per-user profile enumeration filter
only matched S-1-5-21-* SIDs, silently skipping the AAD/MSA cloud SIDs
(S-1-12-1-*) that Win10 1903+ uses for AAD-joined users — so on Win11 AAD
boxes the per-user Uninstall hive of the actually-logged-in user was never
read. Additionally, CollectFromKey logged "{source}\{subKeyPath}" which
mashed the telemetry tag (HKU_<RID>) with the relative path, producing a
non-path string like "HKU_1000\S-1-5-21-...\SOFTWARE\..." in debug logs.

Same patch as V2 commit 6c4f7250: extend SID filter to include S-1-12-1-*,
log rootKey.Name (HKEY_USERS / HKEY_LOCAL_MACHINE / ...) as the path prefix
and report the telemetry tag separately as "(source=...)".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Oliver Kieselbach
2026-05-07 22:53:33 +02:00
parent 6c4f7250b9
commit c0a8f2ed27
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Telemetry/Analyzers/SoftwareInventoryAnalyzer.cs
+11 -4
View File
@@ -441,13 +441,16 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers
private void CollectFromKey(RegistryKey rootKey, string subKeyPath, string source, List<SoftwareEntry> results)
{
// rootKey.Name yields the canonical hive name (HKEY_LOCAL_MACHINE / HKEY_USERS / …),
// so the log line is a real registry path. `source` is a separate telemetry tag
// (e.g. HKLM_64, HKU_<RID>) used as RegistrySource on the SoftwareEntry.
try
{
using (var key = rootKey.OpenSubKey(subKeyPath, writable: false))
{
if (key == null)
{
_logger.Debug($"{Name}: Registry key not found: {source}\\{subKeyPath}");
_logger.Debug($"{Name}: Registry key not found: {rootKey.Name}\\{subKeyPath} (source={source})");
return;
}
@@ -490,7 +493,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers
}
catch (Exception ex)
{
_logger.Warning($"{Name}: Failed to read {source}\\{subKeyPath}: {ex.Message}");
_logger.Warning($"{Name}: Failed to read {rootKey.Name}\\{subKeyPath} (source={source}): {ex.Message}");
}
}
@@ -515,8 +518,12 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers
foreach (var sid in profileList.GetSubKeyNames())
{
// Only real user profiles (S-1-5-21-*), skip well-known SIDs
if (!sid.StartsWith("S-1-5-21-", StringComparison.OrdinalIgnoreCase))
// Real user profiles only:
// S-1-5-21-* classic local/AD user accounts
// S-1-12-1-* Microsoft Account / Azure AD cloud SIDs (Win10 1903+ AAD-joined devices)
// Skip well-known service SIDs (S-1-5-18/19/20) and everything else.
if (!sid.StartsWith("S-1-5-21-", StringComparison.OrdinalIgnoreCase) &&
!sid.StartsWith("S-1-12-1-", StringComparison.OrdinalIgnoreCase))
continue;
// Skip current user SID — already covered by HKCU read above