Data collected by the device

Applies to client 2.0.x and later. For tenant admins, auditors and data protection officers.

The AdminExplorer client talks to the portal only when it was installed with a portal address (the bundle’s transform sets it). Without one it sends nothing and works from local settings. This page lists everything an enrolled device sends. Retention in the portal is on Security and privacy.

Connection

Direction	Outbound only, from the AdminExplorer service (LocalSystem) to your portal address. The portal never connects to the device.
Protocol	HTTPS, TLS 1.2 or 1.3, server certificate validated. Redirects are never followed; no cookies; no client certificate.
Proxy	The machine proxy configuration (WPAD or netsh winhttp), or a named proxy in HKLM\SOFTWARE\Circle Of Bytes\AdminExplorer\Portal\ProxyUrl (host:port).
Credentials	An enrollment key from the bundle, used once, then a device token (1 hour) and a rotating refresh token. Stored under a registry key only SYSTEM and Administrators can read, encrypted with machine-scope DPAPI. Tokens are never logged.
Schedule	Policy every 15 minutes, license every 6 hours, audit records every minute (or at 50 waiting), and at once with Sync now.

Enrollment

Sent once, when the device enrolls:

Field	Content
Machine id	A SHA-256 of the Windows MachineGuid and the install folder; not the raw MachineGuid
Hostname	The computer name
Operating system	The Windows version
Agent version	The AdminExplorer client version
Tenant id	From the bundle

When a machine that was enrolled before enrolls again, the portal keeps the address it enrolled from only while the re-enrollment waits for approval, at most 7 days, and shows it to tenant admins.

On every call

Each call carries the agent version, the id of the license the device holds and, once known, the device’s Windows Sandbox capability (edition supported, virtualization available, feature state). The portal uses these for the Devices page (last seen, version, policy current, sandbox).

Audit records

One record per elevation attempt, sandbox run and local administrator removal, in both flows:

Field	Content
Request id, start, end, duration	The attempt and how long the elevated program ran
Device	Hostname (the portal knows the device from its token)
User	Windows account name, SID and session number
What	Kind (exe, ps1, msi, lnk, sandbox), file path, arguments, shortcut path, SHA-256, publisher, process id, exit code
Decision	Decision, reason code, the reason the user typed, what matched (entry, rule, any, Entra group), approval mode, approver and time
Flags	Whether the folder is writable by the user; the confirmation answer for “any application”
Sandbox runs	The switches in force and the time limit
Local admin records	The member (SID, name, type), the group, the action and, when known, who added the member

Records are evidence: the portal accepts a record once, completes it once with its end and never changes who, what or why afterwards. Details: Audit and reports.

Manual approval requests

With Manual approval (Enterprise) the device sends the pending request (the same fields as the audit record) and polls for the decision. The approver’s comment comes back to the device and is shown to the user.

Installed software

When Installed software tracking is on (the default, both tiers):

Field	Content
Per entry	Name, version, publisher, install date, scope (machine or user), architecture, uninstall key name, MSI product code
Per-user entries	The user’s SID
Changes	Installed, updated (with the previous version) or removed, when, and the linked AdminExplorer elevation (request id, user, reason, file, link strength)

Only Add/Remove Programs entries are read: no file contents, no usage data. System components and updates are left out unless you turn them on. At most 500 per-user entries per user are tracked. A full inventory is sent at start, every 24 hours, after changes and with Sync now. Details: Installed software tracking.

Local groups

When Local administrator removal and protection is in Report or Enforce mode (both tiers), the device sends a snapshot of its protected local groups: for each member the SID, name, type, status (allowed, exception, violation), the action taken and, when known, who added it; plus the device’s join type (workgroup, domain, Entra, hybrid), its machine and domain SIDs and its findings. A snapshot is sent after a change and at least every 6 hours. In mode Off only the mode is sent. Details: Local administrator removal and protection.

Entra group membership lookups

With Entra group targeting (Enterprise) the device asks the portal which of the policy’s groups a user belongs to. It sends the user’s SID and, for Entra accounts, the user principal name. The answer contains only the user’s own groups among those the policy uses; the device never receives member lists.

What the device keeps locally

Data	Where	Bound
Audit records not sent yet	C:\Program Files\AdminExplorer\spool, readable by SYSTEM and Administrators only	50 MB or 10,000 records, oldest dropped first (event 2017)
Software changes not sent yet, and the last inventory	Same folder	5,000 machine changes or 10 MB; 2,000 per-user changes or 4 MB
Enrollment state and tokens	HKLM\SOFTWARE\Circle Of Bytes\AdminExplorer\Portal\State, SYSTEM and Administrators only, tokens DPAPI-encrypted
Events	Windows Application log, source AdminExplorer	As configured in Windows

Pending approval requests are kept in memory only. Uninstalling the client deletes the local queue (records not sent yet are lost); an upgrade keeps it.

What the device never sends

• Passwords, credentials or tokens of the user.
• File contents, documents, screenshots or keystrokes.
• Browsing or application usage data.
• The Windows MachineGuid itself (only a hash of it).