| name | windows-system-inventory |
| description | Use when collecting a read-only Windows host fingerprint, role, runtime, volume, software, service, certificate, or drift baseline; use windows-health-assessment for health findings. |
| metadata | {"portable":true,"compatible_with":["claude-code","codex"]} |
Windows System Inventory
Use when
- Establish target identity and platform before another operation.
- Capture a workstation, server, or Server Core baseline.
- Compare allow-listed configuration snapshots for drift.
Do not use when
- A symptom needs diagnosis; use
windows-health-assessment or windows-troubleshooting.
- The request asks to install, remove, or update software.
Inputs
Explicit hostname or local target, environment, collection scope, data
minimisation rules, freshness limit, and evidence destination.
Platform and privilege boundary
R0. Standard-user collection is preferred. Missing privileged fields are
NOT_ASSESSED. The 0.1 executable collector is local-only.
Workflow
- Resolve the target and record machine fingerprint and time.
- Run
Get-WseSystemInventory; add narrow collectors only when needed.
- Collect object properties, not formatted or localised command text.
- Exclude secrets, raw user data, recovery material, and unrestricted exports.
- Compare snapshots only when schema and target fingerprint match.
Mutation, verification, and recovery
No host mutation is allowed. Evidence-file creation is the only write. Verify
collector availability, target identity, timestamp, schema, and redaction.
Stop conditions
Stop on ambiguous target, stale inventory, unexpected remote target, sensitive
field request, schema mismatch, or a collector that would change state.
Capability contract and degraded mode
Read/execute local collectors; write only to an approved evidence path. Without
execution, return the field plan and mark all values unobserved.
Outputs
Versioned operation envelope, platform fingerprint, scoped inventory, warnings,
collector limitations, and evidence pack hash.
Decision rules
| Condition | Action |
|---|
| Role/module absent | Mark not applicable or unavailable; do not fail host health |
| Field may contain a secret | Omit or redact; never hash as a substitute for approval |
| Fleet request | Hand off manifest to windows-fleet-management |
Quality standards
Second collection with no change produces an equivalent normalised snapshot.
Every value has target, source, and timestamp context.
Anti-patterns
- Exporting all registry keys. Fix: use allow-lists.
- Parsing table output. Fix: retain objects.
- Counting missing roles as failures. Fix: report applicability.
- Collecting usernames without purpose. Fix: minimise identity data.
- Calling a central job live proof. Fix: correlate a local snapshot.
References
