[management,client] Normalize anonymize_level and sanity-check the bundle upload URL

Two review follow-ups.

The API validated anonymize_level after trimming and lowercasing but
persisted the value verbatim, so " default " passed as default yet reached
the client — which only lowercases — as an unrecognized value it resolves
to strict. Persist the normalized form so what was validated is what the
client parses.

The remote debug bundle job forwarded the management-supplied upload URL
to the uploader unchecked and logged it at info level, where it can leak a
host, credentials, or query tokens. Reject a malformed or non-https URL
before generating the bundle, and keep the URL out of the info-level line
while leaving the full parameters at debug. The accepted host is left
unrestricted for now, pending a decision on management-directed uploads.

CONTRIBUTING.md

@@ -112,7 +112,6 @@ aligns with our security standards and design expectations.
         - [Test suite](#test-suite)
     - [Checklist before submitting a PR](#checklist-before-submitting-a-pr)
     - [When we close a PR](#when-we-close-a-pr)
-    - [Translations](#translations)
     - [Other project repositories](#other-project-repositories)
     - [Contributor License Agreement](#contributor-license-agreement)
 
@@ -613,17 +612,6 @@ A closed PR is not a rejected idea. Take it back to the
 [discussion](https://github.com/netbirdio/netbird/discussions), settle the
 approach, and reopen the work from there.
 
-## Translations
-
-Desktop UI translations are not contributed through pull requests. Translate on
-[Crowdin](https://crowdin.com/project/netbird) instead: no ticket needed, just
-join the project and pick your language. Crowdin syncs with this repository and
-opens the service PRs itself, so hand-edited locale files would conflict with
-the next sync. Style, terminology, and review guidance live in
-[client/ui/i18n/TRANSLATING.md](client/ui/i18n/TRANSLATING.md). To request a
-language the project does not offer yet, ask on the Crowdin project page or in
-a [discussion](https://github.com/netbirdio/netbird/discussions).
-
 ## Other project repositories
 
 NetBird project is composed of 3 main repositories:

client/internal/engine.go

@@ -1365,7 +1365,17 @@ func (e *Engine) receiveJobEvents() {
 }
 
 func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobResponse_Bundle, error) {
-	log.Infof("handle remote debug bundle request: %s", params.String())
+	// The upload URL can carry a host, credentials, or query tokens, so it is
+	// kept out of the info-level line; the full parameters stay available at
+	// debug level for troubleshooting.
+	log.Infof("handle remote debug bundle request: anonymize=%v anonymize_level=%q log_file_count=%d bundle_for=%v bundle_for_time=%d",
+		params.GetAnonymize(), params.GetAnonymizeLevel(), params.GetLogFileCount(), params.GetBundleFor(), params.GetBundleForTime())
+	log.Debugf("remote debug bundle request parameters: %s", params.String())
+
+	if err := validateBundleUploadURL(params.GetUploadUrl()); err != nil {
+		return nil, err
+	}
+
 	syncResponse, err := e.GetLatestSyncResponse()
 	if err != nil {
 		log.Warnf("get latest sync response: %v", err)
@@ -1393,7 +1403,7 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 
 	waitFor := time.Duration(params.BundleForTime) * time.Minute
 
-	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String())
+	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String(), params.GetUploadUrl())
 	if err != nil {
 		return nil, err
 	}
@@ -1406,6 +1416,26 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 	return response, nil
 }
 
+// validateBundleUploadURL sanity-checks a management-supplied upload URL for a
+// remote debug bundle job. An empty value is accepted — the executor falls back
+// to the default upload service. A non-empty value must be a well-formed https
+// URL with a host; a malformed value or a plaintext scheme is rejected. This
+// deliberately does not constrain which host may receive the bundle; that
+// policy is left open pending a decision on management-directed uploads.
+func validateBundleUploadURL(raw string) error {
+	if raw == "" {
+		return nil
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		return fmt.Errorf("parse upload URL: %w", err)
+	}
+	if parsed.Scheme != "https" || parsed.Host == "" {
+		return fmt.Errorf("upload URL must be an https URL with a host")
+	}
+	return nil
+}
+
 // receiveManagementEvents connects to the Management Service event stream to receive updates from the management service
 // E.g. when a new peer has been registered and we are allowed to connect to it.
 func (e *Engine) receiveManagementEvents() {

client/internal/engine_bundle_test.go

@@ -0,0 +1,35 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestValidateBundleUploadURL covers the sanity check applied to a
+// management-supplied upload URL before a remote debug bundle is generated.
+func TestValidateBundleUploadURL(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		raw     string
+		wantErr bool
+	}{
+		{name: "empty falls back to default", raw: ""},
+		{name: "https with host", raw: "https://upload.debug.netbird.io/upload"},
+		{name: "https self-hosted host", raw: "https://upload.example.com"},
+		{name: "plaintext rejected", raw: "http://upload.example.com", wantErr: true},
+		{name: "missing host rejected", raw: "https:///upload", wantErr: true},
+		{name: "non-url scheme rejected", raw: "ftp://upload.example.com", wantErr: true},
+		{name: "garbage rejected", raw: "://not a url", wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateBundleUploadURL(tc.raw)
+			if tc.wantErr {
+				require.Error(t, err, "an invalid upload URL must be rejected")
+				return
+			}
+			assert.NoError(t, err, "a valid or empty upload URL must be accepted")
+		})
+	}
+}

client/jobexec/executor.go

@@ -28,7 +28,11 @@ func NewExecutor() *Executor {
 	return &Executor{}
 }
 
-func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.GeneratorDependencies, params debug.BundleConfig, waitForDuration time.Duration, mgmURL string) (string, error) {
+func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.GeneratorDependencies, params debug.BundleConfig, waitForDuration time.Duration, mgmURL, uploadURL string) (string, error) {
+	if uploadURL == "" {
+		uploadURL = types.DefaultBundleURL
+	}
+
 	if waitForDuration > MaxBundleWaitTime {
 		log.Warnf("bundle wait time %v exceeds maximum %v, capping to maximum", waitForDuration, MaxBundleWaitTime)
 		waitForDuration = MaxBundleWaitTime
@@ -54,7 +58,7 @@ func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.
 		}
 	}()
 
-	key, err := debug.UploadDebugBundle(ctx, types.DefaultBundleURL, mgmURL, path, false)
+	key, err := debug.UploadDebugBundle(ctx, uploadURL, mgmURL, path, false)
 	if err != nil {
 		log.Errorf("failed to upload debug bundle: %v", err)
 		return "", fmt.Errorf("upload debug bundle: %w", err)

client/ssh/server/command_execution_windows.go

@@ -243,7 +243,7 @@ func (s *Server) setUserEnvironmentVariables(envMap map[string]string, userProfi
 
 // prepareCommandEnv prepares environment variables for command execution on Windows
 func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, session ssh.Session) []string {
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
@@ -383,7 +383,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 		return false
 	}
 
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 	shell := getUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{

client/ssh/server/port_forwarding.go

@@ -133,12 +133,7 @@ func (s *Server) checkPrivilegedPortAccess(forwardType string, port uint32, resu
 		return nil
 	}
 
-	// Only uid 0 may bind below the threshold, which is the kernel's own rule and
-	// is asked directly rather than through isPrivilegedOrUnknown: that helper
-	// reports an account it cannot evaluate as privileged, which is safe for a
-	// refusal and unsafe for a grant such as this one. Windows has returned
-	// above, so Uid here is a Unix uid and never a SID.
-	if result.User != nil && result.User.Uid == "0" {
+	if result.User != nil && isPrivilegedUsername(result.User.Username) {
 		return nil
 	}
 

client/ssh/server/privileges_other.go

@@ -1,16 +0,0 @@
-//go:build !windows
-
-package server
-
-// isProcessElevated is only meaningful on Windows; other platforms use the
-// effective UID check in isCurrentProcessPrivileged.
-func isProcessElevated() bool {
-	return false
-}
-
-// isWindowsAccountPrivilegedOrUnknown is only reachable on Windows. Report
-// privileged on other platforms so a caller refusing privileged accounts fails
-// closed.
-func isWindowsAccountPrivilegedOrUnknown(string) bool {
-	return true
-}

client/ssh/server/privileges_windows.go

@@ -1,228 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"fmt"
-	"strings"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-var (
-	netapi32                  = windows.NewLazySystemDLL("netapi32.dll")
-	procNetUserGetLocalGroups = netapi32.NewProc("NetUserGetLocalGroups")
-)
-
-const (
-	// lgIncludeIndirect makes NetUserGetLocalGroups also return local groups
-	// the user belongs to through a global group.
-	lgIncludeIndirect  = 0x1
-	maxPreferredLength = 0xFFFFFFFF
-)
-
-// localGroupUsersInfo0 mirrors LOCALGROUP_USERS_INFO_0.
-type localGroupUsersInfo0 struct {
-	name *uint16
-}
-
-// isProcessElevated reports whether the current process token is elevated
-// (TokenElevation): true for elevated administrators, the built-in
-// Administrator, administrators with UAC disabled, and SYSTEM; false for
-// standard users and administrators running with a UAC-filtered token.
-func isProcessElevated() bool {
-	return windows.GetCurrentProcessToken().IsElevated()
-}
-
-// isWindowsAccountPrivilegedOrUnknown reports whether the account is privileged
-// on this machine: a well-known service account, a built-in Administrator
-// (RID 500), or a member of the local Administrators group, directly or through
-// nested groups.
-//
-// An account whose privilege cannot be determined counts as privileged, which
-// is why the name says "or unknown". That is fail-closed for a caller that
-// refuses privileged accounts, and fail-open for a caller that grants something
-// to them, so only the former may use this.
-func isWindowsAccountPrivilegedOrUnknown(username string) bool {
-	sid, _, _, err := windows.LookupSID("", username)
-	if err != nil {
-		log.Warnf("privilege check: SID lookup for %q failed, treating as privileged: %v", username, err)
-		return true
-	}
-
-	if isPrivilegedUserSID(sid) {
-		return true
-	}
-
-	member, err := isLocalAdminsMember(username)
-	if err != nil {
-		log.Warnf("privilege check: cannot determine Administrators membership for %q, treating as privileged: %v", username, err)
-		return true
-	}
-	return member
-}
-
-// isPrivilegedUserSID reports whether the SID itself identifies a privileged
-// principal, without consulting group membership.
-func isPrivilegedUserSID(sid *windows.SID) bool {
-	wellKnown := []windows.WELL_KNOWN_SID_TYPE{
-		windows.WinLocalSystemSid,
-		windows.WinLocalServiceSid,
-		windows.WinNetworkServiceSid,
-		windows.WinBuiltinAdministratorsSid,
-	}
-	for _, sidType := range wellKnown {
-		if sid.IsWellKnown(sidType) {
-			return true
-		}
-	}
-	return isBuiltinAdministratorSID(sid)
-}
-
-// isBuiltinAdministratorSID reports whether the SID is a machine or domain
-// built-in Administrator account (S-1-5-21-...-500). RID 500 is reserved for
-// that account; it can be renamed but cannot be removed from the
-// Administrators group.
-func isBuiltinAdministratorSID(sid *windows.SID) bool {
-	if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
-		return false
-	}
-	count := sid.SubAuthorityCount()
-	if count < 2 || sid.SubAuthority(0) != 21 {
-		return false
-	}
-	return sid.SubAuthority(uint32(count-1)) == 500
-}
-
-// isLocalAdminsMember reports whether the account is a member of the local
-// Administrators group.
-//
-// Local accounts are checked against the local SAM, which is authoritative for
-// them and, unlike a token, cannot under-report: UAC filters the tokens of
-// local administrators, and a filtered token carries Administrators as
-// deny-only, which a membership check on the token would read as "not a
-// member". Domain accounts are exempt from that filtering, so for them an S4U
-// token is preferred because its group list is LSA's transitive expansion and
-// therefore covers nested and universal groups plus the machine's own local
-// groups. NetUserGetLocalGroups expands only one global-group hop but needs no
-// logon, so it serves as the fallback when no token can be obtained.
-func isLocalAdminsMember(username string) (bool, error) {
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	if err != nil {
-		return false, fmt.Errorf("create Administrators SID: %w", err)
-	}
-
-	account, domain := parseUsername(username)
-	if NewPrivilegeDropper().isLocalUser(domain) {
-		return localGroupsContainSID(account, adminSid)
-	}
-
-	member, s4uErr := s4uTokenIsMember(account, domain, adminSid)
-	if s4uErr == nil {
-		return member, nil
-	}
-	log.Debugf("privilege check: S4U membership check for %q failed, falling back to local group enumeration: %v", username, s4uErr)
-
-	member, err = localGroupsContainSID(buildUserCpn(account, domain), adminSid)
-	if err != nil {
-		return false, fmt.Errorf("S4U check: %w; local group enumeration: %w", s4uErr, err)
-	}
-	return member, nil
-}
-
-// s4uTokenIsMember obtains an S4U token for the account and checks whether the
-// given SID is enabled in it.
-func s4uTokenIsMember(account, domain string, sid *windows.SID) (bool, error) {
-	token, err := generateS4UUserToken(log.NewEntry(log.StandardLogger()), account, domain)
-	if err != nil {
-		return false, err
-	}
-	defer func() {
-		if err := windows.CloseHandle(token); err != nil {
-			log.Debugf("close S4U token: %v", err)
-		}
-	}()
-	return windows.Token(token).IsMember(sid)
-}
-
-// localGroupsContainSID reports whether the wanted group is among the local
-// groups the account belongs to, directly or through a global group.
-//
-// The wanted SID is resolved to its group name once and compared against the
-// enumerated names. Well-known SIDs resolve from a static table, so that lookup
-// needs no domain controller, and it keeps the comparison correct for a renamed
-// or localized group because both sides then carry the new name. Resolving each
-// enumerated name back to a SID instead would add a lookup per group that can
-// block until it times out while a domain controller is unreachable, and cannot
-// change the outcome: the names enumerated here are local groups of this
-// machine, whose names are unique, so a name match identifies the group.
-//
-// A failure to resolve the wanted SID is returned rather than reported as
-// "not a member", so a privilege check built on this fails closed.
-func localGroupsContainSID(username string, want *windows.SID) (bool, error) {
-	wantName, _, _, err := want.LookupAccount("")
-	if err != nil {
-		return false, fmt.Errorf("resolve group SID %s to a name: %w", want, err)
-	}
-
-	groups, err := netUserGetLocalGroups(username)
-	if err != nil {
-		return false, err
-	}
-
-	for _, group := range groups {
-		if strings.EqualFold(group, wantName) {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// netUserGetLocalGroups returns the names of the local groups the account is a
-// member of, including indirect membership through global groups.
-func netUserGetLocalGroups(username string) ([]string, error) {
-	name16, err := windows.UTF16PtrFromString(username)
-	if err != nil {
-		return nil, fmt.Errorf("convert username: %w", err)
-	}
-
-	var buf *byte
-	var entriesRead, totalEntries uint32
-	status, _, _ := procNetUserGetLocalGroups.Call(
-		0, // local server
-		uintptr(unsafe.Pointer(name16)),
-		0, // level 0: LOCALGROUP_USERS_INFO_0
-		lgIncludeIndirect,
-		uintptr(unsafe.Pointer(&buf)),
-		maxPreferredLength,
-		uintptr(unsafe.Pointer(&entriesRead)),
-		uintptr(unsafe.Pointer(&totalEntries)),
-	)
-	if status != 0 {
-		return nil, fmt.Errorf("NetUserGetLocalGroups for %q: status %d", username, status)
-	}
-	if buf == nil {
-		return nil, nil
-	}
-	defer func() {
-		if err := windows.NetApiBufferFree(buf); err != nil {
-			log.Debugf("free NetApi buffer: %v", err)
-		}
-	}()
-
-	// MAX_PREFERRED_LENGTH makes the API allocate as much as it needs, so a
-	// short read is not expected. Report it rather than silently returning a
-	// subset of the account's groups.
-	if entriesRead != totalEntries {
-		return nil, fmt.Errorf("NetUserGetLocalGroups for %q returned %d of %d groups", username, entriesRead, totalEntries)
-	}
-
-	entries := unsafe.Slice((*localGroupUsersInfo0)(unsafe.Pointer(buf)), entriesRead)
-	groups := make([]string, 0, entriesRead)
-	for _, entry := range entries {
-		groups = append(groups, windows.UTF16PtrToString(entry.name))
-	}
-	return groups, nil
-}

client/ssh/server/privileges_windows_test.go

@@ -1,293 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"os/user"
-	"testing"
-	"unsafe"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows"
-)
-
-// filterNormalAccount limits NetUserEnum to normal user accounts.
-const filterNormalAccount = 0x2
-
-// TOKEN_ELEVATION_TYPE values.
-const (
-	tokenElevationTypeDefault = 1
-	tokenElevationTypeFull    = 2
-	tokenElevationTypeLimited = 3
-)
-
-// tokenElevationType reads TokenElevationType from a token.
-func tokenElevationType(token windows.Token) (uint32, error) {
-	var elevationType, returnedLen uint32
-	err := windows.GetTokenInformation(token, windows.TokenElevationType,
-		(*byte)(unsafe.Pointer(&elevationType)), uint32(unsafe.Sizeof(elevationType)), &returnedLen)
-	if err != nil {
-		return 0, err
-	}
-	return elevationType, nil
-}
-
-// userInfo0 mirrors USER_INFO_0.
-type userInfo0 struct {
-	name *uint16
-}
-
-func mustParseSID(t *testing.T, s string) *windows.SID {
-	t.Helper()
-	sid, err := windows.StringToSid(s)
-	require.NoError(t, err, "parse SID %s", s)
-	return sid
-}
-
-// localAccountNames returns the names of the local user accounts.
-func localAccountNames(t *testing.T) []string {
-	t.Helper()
-
-	var buf *byte
-	var entriesRead, totalEntries, resume uint32
-	err := windows.NetUserEnum(nil, 0, filterNormalAccount, &buf, maxPreferredLength,
-		&entriesRead, &totalEntries, &resume)
-	require.NoError(t, err, "enumerate local users")
-	t.Cleanup(func() {
-		require.NoError(t, windows.NetApiBufferFree(buf), "free NetApi buffer")
-	})
-
-	entries := unsafe.Slice((*userInfo0)(unsafe.Pointer(buf)), entriesRead)
-	names := make([]string, 0, entriesRead)
-	for _, entry := range entries {
-		names = append(names, windows.UTF16PtrToString(entry.name))
-	}
-	return names
-}
-
-// localAccountNameByRID returns the name of the local account carrying the
-// given RID. Accounts such as Administrator and Guest can be renamed and are
-// localized, so tests must not name them literally.
-func localAccountNameByRID(t *testing.T, rid uint32) string {
-	t.Helper()
-
-	for _, name := range localAccountNames(t) {
-		sid, _, _, err := windows.LookupSID("", name)
-		if err != nil {
-			continue
-		}
-		if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
-			continue
-		}
-		count := sid.SubAuthorityCount()
-		if count < 2 || sid.SubAuthority(0) != 21 {
-			continue
-		}
-		if sid.SubAuthority(uint32(count-1)) == rid {
-			return name
-		}
-	}
-
-	t.Fatalf("no local account with RID %d", rid)
-	return ""
-}
-
-// wellKnownAccountName resolves a well-known SID to the qualified account name
-// the local system uses for it, which is localized.
-func wellKnownAccountName(t *testing.T, sidType windows.WELL_KNOWN_SID_TYPE) string {
-	t.Helper()
-
-	sid, err := windows.CreateWellKnownSid(sidType)
-	require.NoError(t, err, "create well-known SID")
-	name, domain, _, err := sid.LookupAccount("")
-	require.NoError(t, err, "resolve %s to an account name", sid)
-	if domain == "" {
-		return name
-	}
-	return domain + `\` + name
-}
-
-func TestIsBuiltinAdministratorSID(t *testing.T) {
-	tests := []struct {
-		name string
-		sid  string
-		want bool
-	}{
-		{"machine_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
-		{"domain_administrator", "S-1-5-21-3390233681-4087452608-412898826-500", true},
-		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
-		{"guest_account", "S-1-5-21-1111111111-2222222222-3333333333-501", false},
-		{"domain_admins_group", "S-1-5-21-1111111111-2222222222-3333333333-512", false},
-		{"system", "S-1-5-18", false},
-		{"administrators_group", "S-1-5-32-544", false},
-		{"non_nt_authority", "S-1-1-0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isBuiltinAdministratorSID(mustParseSID(t, tt.sid))
-			assert.Equal(t, tt.want, result, "RID 500 detection for %s", tt.sid)
-		})
-	}
-}
-
-func TestIsPrivilegedUserSID(t *testing.T) {
-	tests := []struct {
-		name string
-		sid  string
-		want bool
-	}{
-		{"local_system", "S-1-5-18", true},
-		{"local_service", "S-1-5-19", true},
-		{"network_service", "S-1-5-20", true},
-		{"administrators_group", "S-1-5-32-544", true},
-		{"builtin_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
-		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
-		{"users_group", "S-1-5-32-545", false},
-		{"everyone", "S-1-1-0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isPrivilegedUserSID(mustParseSID(t, tt.sid))
-			assert.Equal(t, tt.want, result, "SID privilege classification for %s", tt.sid)
-		})
-	}
-}
-
-func TestIsWindowsAccountPrivilegedOrUnknown(t *testing.T) {
-	tests := []struct {
-		name     string
-		username string
-		want     bool
-	}{
-		{"system", wellKnownAccountName(t, windows.WinLocalSystemSid), true},
-		{"local_service", wellKnownAccountName(t, windows.WinLocalServiceSid), true},
-		{"network_service", wellKnownAccountName(t, windows.WinNetworkServiceSid), true},
-		{"administrators_group", wellKnownAccountName(t, windows.WinBuiltinAdministratorsSid), true},
-		// The built-in Administrator (RID 500) and Guest (RID 501) accounts
-		// exist on every Windows installation, though they may be disabled.
-		{"builtin_administrator", localAccountNameByRID(t, 500), true},
-		{"guest", localAccountNameByRID(t, 501), false},
-		// Unresolvable accounts fail closed.
-		{"nonexistent_user", "netbird-no-such-user", true},
-		{"empty_username", "", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isWindowsAccountPrivilegedOrUnknown(tt.username)
-			assert.Equal(t, tt.want, result, "account privilege classification for %q", tt.username)
-		})
-	}
-}
-
-func TestIsProcessElevated(t *testing.T) {
-	elevated := isProcessElevated()
-
-	// TokenElevationType is a second, independent view of the same token:
-	// Full means elevated and Limited means a filtered administrator, while
-	// Default covers both a standard user and an administrator with no linked
-	// token (UAC off, the built-in Administrator, SYSTEM), so it implies nothing.
-	elevationType, err := tokenElevationType(windows.GetCurrentProcessToken())
-	require.NoError(t, err, "read token elevation type")
-
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	// Token(0) makes CheckTokenMembership evaluate the caller's own token. It
-	// counts only enabled SIDs, so a filtered administrator reports false here.
-	member, err := windows.Token(0).IsMember(adminSid)
-	require.NoError(t, err, "check own Administrators membership")
-
-	t.Logf("elevated=%v elevationType=%d memberOfAdministrators=%v", elevated, elevationType, member)
-
-	switch elevationType {
-	case tokenElevationTypeFull:
-		assert.True(t, elevated, "a token of elevation type Full must report elevated")
-	case tokenElevationTypeLimited:
-		assert.False(t, elevated, "a filtered administrator token must not report elevated")
-	}
-
-	// Administrators enabled in the token means the token wields administrative
-	// rights, which is what elevation reports.
-	if member {
-		assert.True(t, elevated, "token with enabled Administrators membership must report elevated")
-	}
-}
-
-// TestS4UMembershipAgreesWithLocalGroups exercises the S4U token path used
-// for domain accounts. S4U logons need the TCB privilege, so the test runs
-// only as SYSTEM (which is how CI executes the suite). For local accounts the
-// token's Administrators membership must agree with the SAM enumeration.
-func TestS4UMembershipAgreesWithLocalGroups(t *testing.T) {
-	system, err := windows.CreateWellKnownSid(windows.WinLocalSystemSid)
-	require.NoError(t, err, "create SYSTEM SID")
-	current, err := user.Current()
-	require.NoError(t, err, "get current user")
-	if current.Uid != system.String() {
-		t.Skipf("S4U logon requires SYSTEM (running as %s)", current.Username)
-	}
-
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	checked := 0
-	for _, name := range localAccountNames(t) {
-		viaToken, err := s4uTokenIsMember(name, ".", adminSid)
-		if err != nil {
-			// Disabled or logon-restricted accounts cannot get an S4U logon.
-			t.Logf("skipping %s: %v", name, err)
-			continue
-		}
-		viaSAM, err := localGroupsContainSID(name, adminSid)
-		require.NoError(t, err, "enumerate local groups for %s", name)
-
-		assert.Equal(t, viaSAM, viaToken, "S4U token and SAM enumeration must agree on Administrators membership for %s", name)
-		checked++
-	}
-	// Ineligible accounts are skipped, so without this the test could report
-	// success while comparing nothing at all.
-	require.Positive(t, checked, "no local account completed an S4U logon, so nothing was compared")
-	t.Logf("checked %d local accounts via S4U", checked)
-}
-
-// TestLocalGroupsContainSID_Administrator checks the positive case against the
-// built-in Administrator, a member of Administrators on every installation.
-func TestLocalGroupsContainSID_Administrator(t *testing.T) {
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	administrator := localAccountNameByRID(t, 500)
-	member, err := localGroupsContainSID(administrator, adminSid)
-	require.NoError(t, err, "enumerate local groups for %s", administrator)
-	assert.True(t, member, "%s is a member of the Administrators group", administrator)
-}
-
-// TestLocalGroupsContainSID_UnresolvableGroupFailsClosed covers a wanted SID
-// that resolves to no group: the error must surface rather than being reported
-// as "not a member", so the privilege check treats the account as privileged.
-func TestLocalGroupsContainSID_UnresolvableGroupFailsClosed(t *testing.T) {
-	unknown := mustParseSID(t, "S-1-5-21-1111111111-2222222222-3333333333-4444")
-
-	_, err := localGroupsContainSID(localAccountNameByRID(t, 500), unknown)
-	require.Error(t, err, "must report an error when the wanted group cannot be identified")
-}
-
-func TestLocalGroupsContainSID_Guest(t *testing.T) {
-	guestsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinGuestsSid)
-	require.NoError(t, err, "create Guests SID")
-	adminsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	guest := localAccountNameByRID(t, 501)
-
-	inGuests, err := localGroupsContainSID(guest, guestsSid)
-	require.NoError(t, err, "enumerate local groups for %s", guest)
-	assert.True(t, inGuests, "%s is a member of the Guests group", guest)
-
-	inAdmins, err := localGroupsContainSID(guest, adminsSid)
-	require.NoError(t, err, "enumerate local groups for %s", guest)
-	assert.False(t, inAdmins, "%s is not a member of the Administrators group", guest)
-}

client/ssh/server/server_config_test.go

@@ -239,7 +239,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 		forwardType   string
 		port          uint32
 		username      string
-		uid           string
 		expectError   bool
 		errorMsg      string
 		skipOnWindows bool
@@ -249,7 +248,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "remote",
 			port:          80,
 			username:      "testuser",
-			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -259,7 +257,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "tcpip-forward",
 			port:          443,
 			username:      "testuser",
-			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -269,7 +266,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        8080,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -277,7 +273,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        0,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -285,35 +280,13 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        22,
 			username:    "root",
-			uid:         "0",
 			expectError: false,
 		},
-		{
-			// Only uid 0 is privileged, whatever the account is called.
-			name:          "uid 0 under another name may bind a privileged port",
-			forwardType:   "remote",
-			port:          22,
-			username:      "toor",
-			uid:           "0",
-			expectError:   false,
-			skipOnWindows: true,
-		},
-		{
-			name:          "account named root without uid 0 may not",
-			forwardType:   "remote",
-			port:          22,
-			username:      "root",
-			uid:           "1000",
-			expectError:   true,
-			errorMsg:      "cannot bind to privileged port",
-			skipOnWindows: true,
-		},
 		{
 			name:        "local forward privileged port allowed for non-root",
 			forwardType: "local",
 			port:        80,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 	}
@@ -326,7 +299,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 
 			result := PrivilegeCheckResult{
 				Allowed: true,
-				User:    &user.User{Username: tt.username, Uid: tt.uid},
+				User:    &user.User{Username: tt.username},
 			}
 
 			err := server.checkPrivilegedPortAccess(tt.forwardType, tt.port, result)
@@ -447,13 +420,6 @@ func TestServer_PortConflictHandling(t *testing.T) {
 
 func TestServer_IsPrivilegedUser(t *testing.T) {
 
-	// Windows classification depends on account SIDs and group membership, and
-	// the accounts involved carry localized, renameable names. It is covered by
-	// TestIsWindowsAccountPrivileged, which resolves them from well-known SIDs.
-	if runtime.GOOS == "windows" {
-		t.Skip("covered by TestIsWindowsAccountPrivileged")
-	}
-
 	tests := []struct {
 		username    string
 		expected    bool
@@ -474,16 +440,44 @@ func TestServer_IsPrivilegedUser(t *testing.T) {
 			expected:    false,
 			description: "empty username should not be privileged",
 		},
-		{
-			username:    "Administrator",
-			expected:    false,
-			description: "Administrator should not be privileged on non-Windows systems",
-		},
+	}
+
+	// Add Windows-specific tests
+	if runtime.GOOS == "windows" {
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    true,
+				description: "Administrator should be considered privileged on Windows",
+			},
+			{
+				username:    "administrator",
+				expected:    true,
+				description: "administrator should be considered privileged on Windows (case insensitive)",
+			},
+		}...)
+	} else {
+		// On non-Windows systems, Administrator should not be privileged
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    false,
+				description: "Administrator should not be privileged on non-Windows systems",
+			},
+		}...)
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			result := isPrivilegedOrUnknown(tt.username)
+			result := isPrivilegedUsername(tt.username)
 			assert.Equal(t, tt.expected, result, tt.description)
 		})
 	}

client/ssh/server/sftp_windows.go

@@ -17,7 +17,7 @@ import (
 // createSftpCommand creates a Windows SFTP command with user switching.
 // The caller must close the returned token handle after starting the process.
 func (s *Server) createSftpCommand(targetUser *user.User, sess ssh.Session) (*exec.Cmd, windows.Token, error) {
-	username, domain := parseUsername(targetUser.Username)
+	username, domain := s.parseUsername(targetUser.Username)
 
 	netbirdPath, err := os.Executable()
 	if err != nil {

client/ssh/server/user_utils.go

@@ -16,6 +16,11 @@ var (
 	ErrPrivilegedUserSwitch = errors.New("cannot switch to privileged user - current user lacks required privileges")
 )
 
+// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
+func isPlatformUnix() bool {
+	return getCurrentOS() != "windows"
+}
+
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
 	getCurrentUser         = currentUserWithGetent
@@ -24,9 +29,6 @@ var (
 	getIsProcessPrivileged = isCurrentProcessPrivileged
 
 	getEuid = os.Geteuid
-
-	getProcessElevated                   = isProcessElevated
-	getWindowsAccountPrivilegedOrUnknown = isWindowsAccountPrivilegedOrUnknown
 )
 
 const (
@@ -63,13 +65,6 @@ type PrivilegeCheckResult struct {
 	RequiresUserSwitching bool
 }
 
-// privilegeCheckContext holds all context needed for privilege checking
-type privilegeCheckContext struct {
-	currentUser           *user.User
-	currentUserPrivileged bool
-	allowRoot             bool
-}
-
 // CheckPrivileges performs comprehensive privilege checking for all SSH features.
 // This is the single source of truth for privilege decisions across the SSH server.
 func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult {
@@ -80,7 +75,7 @@ func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult
 
 	// Handle empty username case - but still check root access controls
 	if req.RequestedUsername == "" {
-		if isPrivilegedOrUnknown(context.currentUser.Username) && !context.allowRoot {
+		if isPrivilegedUsername(context.currentUser.Username) && !context.allowRoot {
 			return PrivilegeCheckResult{
 				Allowed: false,
 				Error:   &PrivilegedUserError{Username: context.currentUser.Username},
@@ -140,7 +135,7 @@ func (s *Server) checkUserRequest(ctx *privilegeCheckContext, req PrivilegeCheck
 
 	needsUserSwitching := !isSameResolvedUser(resolvedUser, ctx.currentUser)
 
-	if isPrivilegedOrUnknown(resolvedUser.Username) && !ctx.allowRoot {
+	if isPrivilegedUsername(resolvedUser.Username) && !ctx.allowRoot {
 		return PrivilegeCheckResult{
 			Allowed:               false,
 			Error:                 &PrivilegedUserError{Username: resolvedUser.Username},
@@ -180,42 +175,6 @@ func (s *Server) resolveRequestedUser(requestedUsername string) (*user.User, err
 	return u, nil
 }
 
-// SetAllowRootLogin configures root login access
-func (s *Server) SetAllowRootLogin(allow bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.allowRootLogin = allow
-}
-
-// userNameLookup performs user lookup with root login permission check
-func (s *Server) userNameLookup(username string) (*user.User, error) {
-	result, err := s.userPrivilegeCheck(username)
-	if err != nil {
-		return nil, err
-	}
-	return result.User, nil
-}
-
-// userPrivilegeCheck performs user lookup with full privilege check result
-func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return result, result.Error
-	}
-
-	return result, nil
-}
-
-// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
-func isPlatformUnix() bool {
-	return getCurrentOS() != "windows"
-}
-
 // isSameResolvedUser compares two resolved user identities
 func isSameResolvedUser(user1, user2 *user.User) bool {
 	if user1 == nil || user2 == nil {
@@ -224,6 +183,13 @@ func isSameResolvedUser(user1, user2 *user.User) bool {
 	return user1.Uid == user2.Uid
 }
 
+// privilegeCheckContext holds all context needed for privilege checking
+type privilegeCheckContext struct {
+	currentUser           *user.User
+	currentUserPrivileged bool
+	allowRoot             bool
+}
+
 // isSameUser checks if two usernames refer to the same user
 // SECURITY: This function must be conservative - it should only return true
 // when we're certain both usernames refer to the exact same user identity
@@ -287,30 +253,159 @@ func isWindowsSameUser(requestedUsername, currentUsername string) bool {
 	return strings.EqualFold(reqDomain, curDomain)
 }
 
-// isPrivilegedOrUnknown reports whether the given username represents a
-// privileged user, or on Windows an account whose privilege could not be
-// determined.
-// On Unix: root.
-// On Windows: well-known service accounts, built-in Administrator accounts,
-// and members of the local Administrators group; handles domain-qualified
-// usernames like "DOMAIN\user" or "user@domain.com". An account that cannot be
-// resolved or evaluated is reported as privileged.
-//
-// Use this to refuse privileged accounts, never to grant them anything: the
-// undetermined case is safe for a refusal and unsafe for a grant.
-func isPrivilegedOrUnknown(username string) bool {
+// SetAllowRootLogin configures root login access
+func (s *Server) SetAllowRootLogin(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowRootLogin = allow
+}
+
+// userNameLookup performs user lookup with root login permission check
+func (s *Server) userNameLookup(username string) (*user.User, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return nil, result.Error
+	}
+
+	return result.User, nil
+}
+
+// userPrivilegeCheck performs user lookup with full privilege check result
+func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return result, result.Error
+	}
+
+	return result, nil
+}
+
+// isPrivilegedUsername checks if the given username represents a privileged user across platforms.
+// On Unix: root
+// On Windows: Administrator, SYSTEM (case-insensitive)
+// Handles domain-qualified usernames like "DOMAIN\Administrator" or "user@domain.com"
+func isPrivilegedUsername(username string) bool {
 	if getCurrentOS() != "windows" {
 		return username == "root"
 	}
-	return getWindowsAccountPrivilegedOrUnknown(username)
+
+	bareUsername := username
+	// Handle Windows domain format: DOMAIN\username
+	if idx := strings.LastIndex(username, `\`); idx != -1 {
+		bareUsername = username[idx+1:]
+	}
+	// Handle email-style format: username@domain.com
+	if idx := strings.Index(bareUsername, "@"); idx != -1 {
+		bareUsername = bareUsername[:idx]
+	}
+
+	return isWindowsPrivilegedUser(bareUsername)
+}
+
+// isWindowsPrivilegedUser checks if a bare username (domain already stripped) represents a Windows privileged account
+func isWindowsPrivilegedUser(bareUsername string) bool {
+	// common privileged usernames (case insensitive)
+	privilegedNames := []string{
+		"administrator",
+		"admin",
+		"root",
+		"system",
+		"localsystem",
+		"networkservice",
+		"localservice",
+	}
+
+	usernameLower := strings.ToLower(bareUsername)
+	for _, privilegedName := range privilegedNames {
+		if usernameLower == privilegedName {
+			return true
+		}
+	}
+
+	// computer accounts (ending with $) are not privileged by themselves
+	// They only gain privileges through group membership or specific SIDs
+
+	if targetUser, err := lookupUser(bareUsername); err == nil {
+		return isWindowsPrivilegedSID(targetUser.Uid)
+	}
+
+	return false
+}
+
+// isWindowsPrivilegedSID checks if a Windows SID represents a privileged account
+func isWindowsPrivilegedSID(sid string) bool {
+	privilegedSIDs := []string{
+		"S-1-5-18",     // Local System (SYSTEM)
+		"S-1-5-19",     // Local Service (NT AUTHORITY\LOCAL SERVICE)
+		"S-1-5-20",     // Network Service (NT AUTHORITY\NETWORK SERVICE)
+		"S-1-5-32-544", // Administrators group (BUILTIN\Administrators)
+		"S-1-5-500",    // Built-in Administrator account (local machine RID 500)
+	}
+
+	for _, privilegedSID := range privilegedSIDs {
+		if sid == privilegedSID {
+			return true
+		}
+	}
+
+	// Check for domain administrator accounts (RID 500 in any domain)
+	// Format: S-1-5-21-domain-domain-domain-500
+	// This is reliable as RID 500 is reserved for the domain Administrator account
+	if strings.HasPrefix(sid, "S-1-5-21-") && strings.HasSuffix(sid, "-500") {
+		return true
+	}
+
+	// Check for other well-known privileged RIDs in domain contexts
+	// RID 512 = Domain Admins group, RID 516 = Domain Controllers group
+	if strings.HasPrefix(sid, "S-1-5-21-") {
+		if strings.HasSuffix(sid, "-512") || // Domain Admins group
+			strings.HasSuffix(sid, "-516") || // Domain Controllers group
+			strings.HasSuffix(sid, "-519") { // Enterprise Admins group
+			return true
+		}
+	}
+
+	return false
 }
 
 // isCurrentProcessPrivileged checks if the current process is running with elevated privileges.
 // On Unix systems, this means running as root (UID 0).
-// On Windows, this means the process token is elevated (administrators, SYSTEM).
+// On Windows, this means running as Administrator or SYSTEM.
 func isCurrentProcessPrivileged() bool {
 	if getCurrentOS() == "windows" {
-		return getProcessElevated()
+		return isWindowsElevated()
 	}
 	return getEuid() == 0
 }
+
+// isWindowsElevated checks if the current process is running with elevated privileges on Windows
+func isWindowsElevated() bool {
+	currentUser, err := getCurrentUser()
+	if err != nil {
+		log.Errorf("failed to get current user for privilege check, assuming non-privileged: %v", err)
+		return false
+	}
+
+	if isWindowsPrivilegedSID(currentUser.Uid) {
+		log.Debugf("Windows user switching supported: running as privileged SID %s", currentUser.Uid)
+		return true
+	}
+
+	if isPrivilegedUsername(currentUser.Username) {
+		log.Debugf("Windows user switching supported: running as privileged username %s", currentUser.Username)
+		return true
+	}
+
+	log.Debugf("Windows user switching not supported: not running as privileged user (current: %s)", currentUser.Uid)
+	return false
+}

client/ssh/server/user_utils_test.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"os/user"
 	"runtime"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -28,8 +27,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 	originalLookupUser := lookupUser
 	originalGetCurrentOS := getCurrentOS
 	originalGetEuid := getEuid
-	originalGetProcessElevated := getProcessElevated
-	originalGetWindowsAccountPrivilegedOrUnknown := getWindowsAccountPrivilegedOrUnknown
+
+	// Reset caches to ensure clean test state
 
 	// Set test values - inject platform dependencies
 	getCurrentUser = func() (*user.User, error) {
@@ -54,31 +53,16 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		return euid
 	}
 
-	// Simulate the Windows token elevation check based on the fixture user:
-	// the built-in Administrator (RID 500) and SYSTEM run elevated.
-	getProcessElevated = func() bool {
+	// Mock privilege detection based on the test user
+	getIsProcessPrivileged = func() bool {
 		if currentUser == nil {
 			return false
 		}
-		return currentUser.Uid == "S-1-5-18" || strings.HasSuffix(currentUser.Uid, "-500")
-	}
-
-	// Simulate the Windows account classifier for the fixture accounts.
-	// "root" does not exist on Windows; the real classifier fails closed on
-	// unresolvable accounts, so it counts as privileged here too.
-	getWindowsAccountPrivilegedOrUnknown = func(username string) bool {
-		bare := username
-		if idx := strings.LastIndex(bare, `\`); idx != -1 {
-			bare = bare[idx+1:]
-		}
-		if idx := strings.Index(bare, "@"); idx != -1 {
-			bare = bare[:idx]
-		}
-		switch strings.ToLower(bare) {
-		case "administrator", "system", "root":
+		// Check both username and SID for Windows systems
+		if os == "windows" && isWindowsPrivilegedSID(currentUser.Uid) {
 			return true
 		}
-		return false
+		return isPrivilegedUsername(currentUser.Username)
 	}
 
 	// Return cleanup function
@@ -87,8 +71,10 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		lookupUser = originalLookupUser
 		getCurrentOS = originalGetCurrentOS
 		getEuid = originalGetEuid
-		getProcessElevated = originalGetProcessElevated
-		getWindowsAccountPrivilegedOrUnknown = originalGetWindowsAccountPrivilegedOrUnknown
+
+		getIsProcessPrivileged = isCurrentProcessPrivileged
+
+		// Reset caches after test
 	}
 }
 
@@ -435,9 +421,6 @@ func TestUsedFallback_MeansNoPrivilegeDropping(t *testing.T) {
 }
 
 func TestPrivilegedUsernameDetection(t *testing.T) {
-	// Windows classification is syscall-backed (SID resolution, group
-	// membership) and is covered by privileges_windows_test.go; here only the
-	// Unix logic and the platform dispatch are exercised.
 	tests := []struct {
 		name       string
 		username   string
@@ -449,9 +432,25 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 		{"unix_regular_user", "alice", "linux", false},
 		{"unix_root_capital", "Root", "linux", false}, // Case-sensitive
 
-		// Windows dispatch to the (mocked) account classifier
+		// Windows tests
 		{"windows_administrator", "Administrator", "windows", true},
+		{"windows_system", "SYSTEM", "windows", true},
+		{"windows_admin", "admin", "windows", true},
+		{"windows_admin_lowercase", "administrator", "windows", true}, // Case-insensitive
+		{"windows_domain_admin", "DOMAIN\\Administrator", "windows", true},
+		{"windows_email_admin", "admin@domain.com", "windows", true},
 		{"windows_regular_user", "alice", "windows", false},
+		{"windows_domain_user", "DOMAIN\\alice", "windows", false},
+		{"windows_localsystem", "localsystem", "windows", true},
+		{"windows_networkservice", "networkservice", "windows", true},
+		{"windows_localservice", "localservice", "windows", true},
+
+		// Computer accounts (these depend on current user context in real implementation)
+		{"windows_computer_account", "WIN2K19-C2$", "windows", false},      // Computer account by itself not privileged
+		{"windows_domain_computer", "DOMAIN\\COMPUTER$", "windows", false}, // Domain computer account
+
+		// Cross-platform
+		{"root_on_windows", "root", "windows", true}, // Root should be privileged everywhere
 	}
 
 	for _, tt := range tests {
@@ -460,8 +459,50 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 			cleanup := setupTestDependencies(nil, nil, tt.platform, 1000, nil, nil)
 			defer cleanup()
 
-			result := isPrivilegedOrUnknown(tt.username)
-			assert.Equal(t, tt.privileged, result, "privilege classification for %s on %s", tt.username, tt.platform)
+			result := isPrivilegedUsername(tt.username)
+			assert.Equal(t, tt.privileged, result)
+		})
+	}
+}
+
+func TestWindowsPrivilegedSIDDetection(t *testing.T) {
+	tests := []struct {
+		name        string
+		sid         string
+		privileged  bool
+		description string
+	}{
+		// Well-known system accounts
+		{"system_account", "S-1-5-18", true, "Local System (SYSTEM)"},
+		{"local_service", "S-1-5-19", true, "Local Service"},
+		{"network_service", "S-1-5-20", true, "Network Service"},
+		{"administrators_group", "S-1-5-32-544", true, "Administrators group"},
+		{"builtin_administrator", "S-1-5-500", true, "Built-in Administrator"},
+
+		// Domain accounts
+		{"domain_administrator", "S-1-5-21-1234567890-1234567890-1234567890-500", true, "Domain Administrator (RID 500)"},
+		{"domain_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-512", true, "Domain Admins group"},
+		{"domain_controllers_group", "S-1-5-21-1234567890-1234567890-1234567890-516", true, "Domain Controllers group"},
+		{"enterprise_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-519", true, "Enterprise Admins group"},
+
+		// Regular users
+		{"regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1001", false, "Regular domain user"},
+		{"another_regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1234", false, "Another regular user"},
+		{"local_user", "S-1-5-21-1234567890-1234567890-1234567890-1000", false, "Local regular user"},
+
+		// Groups that are not privileged
+		{"domain_users", "S-1-5-21-1234567890-1234567890-1234567890-513", false, "Domain Users group"},
+		{"power_users", "S-1-5-32-547", false, "Power Users group"},
+
+		// Invalid SIDs
+		{"malformed_sid", "S-1-5-invalid", false, "Malformed SID"},
+		{"empty_sid", "", false, "Empty SID"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isWindowsPrivilegedSID(tt.sid)
+			assert.Equal(t, tt.privileged, result, "Failed for %s: %s", tt.description, tt.sid)
 		})
 	}
 }

client/ssh/server/userswitching_windows.go

@@ -91,7 +91,7 @@ func validateUsernameFormat(username string) error {
 func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, func(), error) {
 	logger.Debugf("creating Windows executor command for user %s (Pty: %v)", localUser.Username, hasPty)
 
-	username, _ := parseUsername(localUser.Username)
+	username, _ := s.parseUsername(localUser.Username)
 	if err := validateUsername(username); err != nil {
 		return nil, nil, fmt.Errorf("invalid username %q: %w", username, err)
 	}
@@ -102,7 +102,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 // createUserSwitchCommand creates a command with Windows user switching.
 // Returns the command and a cleanup function that must be called after starting the process.
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 
 	shell := getUserShell(localUser.Uid)
 
@@ -138,7 +138,7 @@ func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session,
 }
 
 // parseUsername extracts username and domain from a Windows username
-func parseUsername(fullUsername string) (username, domain string) {
+func (s *Server) parseUsername(fullUsername string) (username, domain string) {
 	// Handle DOMAIN\username format
 	if idx := strings.LastIndex(fullUsername, `\`); idx != -1 {
 		domain = fullUsername[:idx]

client/ui/i18n/TRANSLATING.md

@@ -2,24 +2,9 @@
 
 A short brief for translating the desktop UI — for any translator, human or AI agent (*"you"* = whoever's translating).
 
-**Translations are managed on Crowdin: <https://crowdin.com/project/netbird>.** Join the project, pick your language, and translate in the editor. Each string carries a context note (the `description` from the source file) telling you what it is and where it shows up, and the project's glossary, style guide, and QA checks mirror this document.
+**Drive an agent with:** *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* — or *"…and review the existing German translation."*
 
-> 💡 **The one habit that matters most:** read each string's context before translating it. Labels are terse and ambiguous on their own; the context tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
-
----
-
-## How contributions flow
-
-```text
-i18n/locales/en/common.json ──sync──▶ Crowdin ──service PR──▶ i18n/locales/<code>/common.json
-```
-
-- `i18n/locales/en/common.json` is the source of truth. New and changed strings sync to Crowdin automatically (see `crowdin.yml` in the repository root).
-- Crowdin opens and updates a service pull request with the translated bundles, keeping the source's file shape and key order. Keys nobody has translated yet are left out of the export; the app falls back to English for them at runtime. Maintainers review and merge that PR.
-- Don't hand-edit `i18n/locales/<code>/common.json` in your own PRs: the next sync would conflict with or overwrite your changes. Translate on Crowdin instead.
-- Missing your language? Request it on the Crowdin project page or in a [GitHub discussion](https://github.com/netbirdio/netbird/discussions). When a language first ships, a maintainer adds its row to `i18n/locales/_index.json` with `code`, `displayName` (the native name), and `englishName`, which puts it in the app's language picker.
-
-**Prefer translating with an AI agent?** That still works: drive it with *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* as before, but deliver the result to Crowdin instead of a pull request. Download your language's file from the Crowdin editor, let the agent translate it, and upload it back (the editor's offline translation flow). Crowdin runs its QA checks on upload, and the next service PR carries the strings into the repo.
+> 💡 **The one habit that matters most:** read each key's `description` before translating it. Labels are terse and ambiguous on their own; the `description` tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
 
 ---
 
@@ -45,6 +30,25 @@ A **business zero-trust VPN** — an encrypted **overlay mesh** between a compan
 
 ---
 
+## The files
+
+```
+i18n/locales/_index.json         shipped-language list
+i18n/locales/en/common.json      source of truth — message + description
+i18n/locales/<code>/common.json  a target — message only
+```
+
+Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
+
+| ✅ Do | ❌ Don't |
+|---|---|
+| Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |
+| Put **only `message`** in target bundles | Copy `description` into a target bundle |
+| Give every key a non-empty `message` | Leave keys missing or empty |
+| Save valid UTF-8 JSON, no BOM | Add trailing commas or break the JSON |
+
+---
+
 ## Hard rules — get these exactly right
 
 These are the usual ways a translation *breaks the app*, not just reads oddly.
@@ -54,7 +58,7 @@ These are the usual ways a translation *breaks the app*, not just reads oddly.
 | Copy `{placeholders}` verbatim — `{version}`, `{count}`, `{name}`… | Translate the word inside the braces (`{verbleibend}` breaks it) |
 | Reposition a placeholder so the sentence flows | Drop or duplicate a placeholder |
 | Preserve every `\n`, leading/trailing space, and trailing `...` | Trim "invisible" spaces or the `...` (they're load-bearing) |
-| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the context flags |
+| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the description flags |
 
 **Plurals:** the app has only a *one / other* split — the singular key fires only when `count == 1`; the `{count}` key covers everything else (0, 2, 5, 100…). Languages with more than two forms (ru, pl, uk) can't be fully correct here — use the form that fits the widest range (Russian genitive plural: `минут` / `часов` / `дней`). Don't invent extra keys or cram multiple forms into one string. When no single form fits every value — a unit label after a number field, say — reach for a number-agnostic form (an abbreviation, or wording that reads the same for 1 and 100) instead of forcing a plural the *one / other* split can't supply.
 
@@ -74,15 +78,13 @@ When a brand sits beside a common noun, keep its exact spelling but join them th
 
 > **Use the word that language's IT users actually say.** Translate when a natural, common term exists; keep the English term *only* when the literal translation would be awkward or no one in that field really uses it.
 
-Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing translation:** match how a term was already rendered for your language rather than re-deciding it.
+Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing bundles:** match how a term was already rendered for your language rather than re-deciding it.
 
 Two checks before you commit a term:
 
 - **Prefer established localized wording.** If a widely used tool in this space (for example WireGuard) ships your language, its wording for a shared term such as *handshake* is what users already expect — look at the translated app, not just English docs. For generic UI verbs and formal address, follow your OS vendor's style guide (Microsoft / Apple / Google).
 - **Watch for false friends.** A literal translation can collide with a *different* established term in your field — confirm your word doesn't already mean something else in this domain before using it.
 
-These tiers are mirrored in the Crowdin project glossary, so the editor highlights them inline. When you settle a new Tier C term for your language, add its translation to the glossary entry so it sticks for everyone who comes after you.
-
 ---
 
 ## Style
@@ -96,7 +98,7 @@ These tiers are mirrored in the Crowdin project glossary, so the editor highligh
 
 Where it reads naturally, aim to keep each string **roughly the same length** as the English — the UI is tight and over-long strings can wrap or truncate. It's a soft preference, not a rule: if your language simply needs more words, use them.
 
-A few habits that keep a translation reading like one product rather than a word-for-word port:
+A few habits that keep a bundle reading like one product rather than a word-for-word port:
 
 - **Translate meaning, not words.** Render what a string *does*. An idiom or an awkward source phrase should become natural in your language, not a literal calque.
 - **Keep one voice within a family.** Sibling strings — the connection states, every settings *help* caption, every "… Failed" title — should share a grammatical form. If one member sounds wrong in that form, re-voice the whole family rather than leave one odd sibling.
@@ -105,26 +107,27 @@ A few habits that keep a translation reading like one product rather than a word
 
 ---
 
-## Reviewing a language
+## Procedure
 
-**On Crowdin:** proofread in the editor — context, glossary highlights, and QA flags sit inline next to each string.
+**New language** — read `en/common.json` *with* descriptions → settle your Tier C terms → write `i18n/locales/<code>/common.json` (same keys and order as `en`, `message` only, placeholders & brands preserved) → add a row to `_index.json` (`{"code","displayName"` = native name`,"englishName"}`) → run the QA list. Use the locale-code style the existing entries use (e.g. `fr`, `pt`, `zh-CN`).
 
-**In the repo** — e.g. driving an AI agent with *"Read `i18n/TRANSLATING.md` and review the existing German translation"* — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Report what you found, and apply the fixes **on Crowdin** — direct edits to the locale files are overwritten by the next sync.
+**Review (de / hu / …)** — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Fix in place, then report what you changed (especially term standardizations) so a native speaker can sanity-check.
 
 ---
 
 ## QA before you finish
 
+- [ ] Valid JSON · **every `en` key** present, same order · **no `description`** fields
 - [ ] Every `{placeholder}`, `\n`, and intentional space preserved · `...` / `… Failed` / `{name}` quotes kept
-- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing translation for your language)
+- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing bundle for your language)
 - [ ] Buttons & tray short · locale punctuation and capitalization applied
-- [ ] Crowdin QA flags resolved (variables, glossary terms, punctuation)
+- [ ] New language added to `_index.json`
 - [ ] **Tested in the running app** ↓
 
 ---
 
 ## Test it in the app
 
-A translation can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
+A bundle can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
 
 How to run the app and switch language: see the project README. Can't run it (e.g. a headless agent)? Say so in your summary — don't silently skip this step.

crowdin.yml

@@ -1,11 +0,0 @@
-skip_untranslated_strings: true
-skip_untranslated_files: true
-import_eq_suggestions: true
-
-files:
-  - source: /client/ui/i18n/locales/en/common.json
-    translation: /client/ui/i18n/locales/%two_letters_code%/common.json
-    type: chrome
-    languages_mapping:
-      two_letters_code:
-        zh-CN: zh-CN

management/internals/modules/reverseproxy/activity/interface.go

@@ -1,25 +0,0 @@
-// Package activity records that a principal used a reverse proxy service, so
-// that activity accounting counts people and devices which reach services
-// through the proxy but never touch the dashboard or the management API.
-package activity
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// Manager records reverse proxy usage against the timestamps activity
-// accounting reads. Both methods are best effort from the caller's point of
-// view: a lost record is corrected by the next request, and no authorization
-// decision reads them back.
-type Manager interface {
-	// RecordUserLogin records a completed SSO sign-in to a proxied service.
-	// Service users have no interactive login and are ignored.
-	RecordUserLogin(ctx context.Context, accountID string, user *types.User) error
-	// RecordPeerSeen records that a peer reached a private service over the
-	// mesh, which is what lets its owner count as active. Peers activity
-	// accounting excludes, and peers already seen recently, are ignored.
-	RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error
-}

management/internals/modules/reverseproxy/activity/manager/manager.go

@@ -1,66 +0,0 @@
-package manager
-
-import (
-	"context"
-	"time"
-
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
-	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// peerSeenInterval is how stale a peer's LastSeen must be before reaching a
-// private service refreshes it. Positive tunnel validations are cached on the
-// proxy for five minutes, so without a floor a busy peer would rewrite its row
-// behind every request; an hour still sits well inside the window activity
-// accounting asks about.
-const peerSeenInterval = time.Hour
-
-type managerImpl struct {
-	store store.Store
-}
-
-// NewManager returns the activity manager backed by the management store.
-func NewManager(store store.Store) activity.Manager {
-	return &managerImpl{store: store}
-}
-
-// RecordUserLogin stamps the login the same way the dashboard and device login
-// paths do, so a person who only ever reaches proxied services still has a
-// login on record.
-func (m *managerImpl) RecordUserLogin(ctx context.Context, accountID string, user *types.User) error {
-	if user == nil || user.IsServiceUser {
-		return nil
-	}
-
-	return m.store.SaveUserLastLogin(ctx, accountID, user.Id, time.Now().UTC())
-}
-
-// RecordPeerSeen stamps LastSeen, the column a peer activates its owner
-// through. The peer the caller already holds answers the throttle without a
-// query, so a peer seen inside the interval costs nothing to skip; the same
-// cutoff goes to the store, which enforces it inside the UPDATE so concurrent
-// requests for one peer cannot each write off their own stale read.
-func (m *managerImpl) RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error {
-	if peer == nil || !countsTowardActivity(peer) {
-		return nil
-	}
-
-	staleBefore := time.Now().UTC().Add(-peerSeenInterval)
-	if peer.Status != nil && peer.Status.LastSeen.After(staleBefore) {
-		return nil
-	}
-
-	_, err := m.store.RefreshPeerLastSeen(ctx, accountID, peer.ID, staleBefore)
-
-	return err
-}
-
-// countsTowardActivity reports whether the peer represents a device a person
-// actually runs. Embedded proxy peers are infrastructure and browser (WASM)
-// clients are ephemeral sessions, so activity accounting ignores both and a
-// write for them could never count.
-func countsTowardActivity(peer *peer.Peer) bool {
-	return !peer.ProxyMeta.Embedded && peer.Meta.KernelVersion != "wasm"
-}

management/internals/modules/reverseproxy/activity/manager/manager_test.go

@@ -1,149 +0,0 @@
-package manager
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// recordingStore captures the two writes the activity manager makes. The
-// embedded interface satisfies the rest and panics if anything else is called,
-// which keeps the manager honest about its surface.
-type recordingStore struct {
-	store.Store
-	logins []loginWrite
-	seen   []seenWrite
-}
-
-type loginWrite struct {
-	accountID string
-	userID    string
-	at        time.Time
-}
-
-type seenWrite struct {
-	accountID   string
-	peerID      string
-	staleBefore time.Time
-}
-
-func (s *recordingStore) SaveUserLastLogin(_ context.Context, accountID, userID string, lastLogin time.Time) error {
-	s.logins = append(s.logins, loginWrite{accountID: accountID, userID: userID, at: lastLogin})
-	return nil
-}
-
-func (s *recordingStore) RefreshPeerLastSeen(_ context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
-	s.seen = append(s.seen, seenWrite{accountID: accountID, peerID: peerID, staleBefore: staleBefore})
-	return true, nil
-}
-
-func TestRecordUserLogin(t *testing.T) {
-	tests := []struct {
-		name        string
-		user        *types.User
-		expectWrite bool
-	}{
-		{
-			name:        "regular user is recorded",
-			user:        &types.User{Id: "user1", AccountID: "account1"},
-			expectWrite: true,
-		},
-		{
-			// Activity accounting never counts service users, so a row for one
-			// would be noise.
-			name:        "service user is ignored",
-			user:        &types.User{Id: "svc1", AccountID: "account1", IsServiceUser: true},
-			expectWrite: false,
-		},
-		{
-			name:        "missing user is ignored",
-			user:        nil,
-			expectWrite: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			st := &recordingStore{}
-			require.NoError(t, NewManager(st).RecordUserLogin(context.Background(), "account1", tt.user))
-
-			if !tt.expectWrite {
-				assert.Empty(t, st.logins, "no login should have been recorded")
-				return
-			}
-
-			require.Len(t, st.logins, 1, "exactly one login should have been recorded")
-			assert.Equal(t, "account1", st.logins[0].accountID, "login must be recorded against the service account")
-			assert.Equal(t, tt.user.Id, st.logins[0].userID, "login must be recorded against the signing-in user")
-			assert.Equal(t, time.UTC, st.logins[0].at.Location(), "timestamps are written in UTC")
-			assert.WithinDuration(t, time.Now().UTC(), st.logins[0].at, time.Minute, "login should be stamped now")
-		})
-	}
-}
-
-func TestRecordPeerSeen(t *testing.T) {
-	tests := []struct {
-		name        string
-		peer        *peer.Peer
-		expectWrite bool
-	}{
-		{
-			name:        "peer seen long ago is recorded",
-			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-			expectWrite: true,
-		},
-		{
-			name:        "peer never seen is recorded",
-			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{}},
-			expectWrite: true,
-		},
-		{
-			// The throttle. The caller already holds the peer, so skipping a
-			// recently seen one costs nothing.
-			name:        "peer seen inside the interval is skipped",
-			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-10 * time.Minute)}},
-			expectWrite: false,
-		},
-		{
-			name:        "embedded proxy peer is skipped",
-			peer:        &peer.Peer{ID: "peer1", ProxyMeta: peer.ProxyMeta{Embedded: true}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-			expectWrite: false,
-		},
-		{
-			name:        "browser client is skipped",
-			peer:        &peer.Peer{ID: "peer1", Meta: peer.PeerSystemMeta{KernelVersion: "wasm"}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-			expectWrite: false,
-		},
-		{
-			name:        "missing peer is ignored",
-			peer:        nil,
-			expectWrite: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			st := &recordingStore{}
-			require.NoError(t, NewManager(st).RecordPeerSeen(context.Background(), "account1", tt.peer))
-
-			if !tt.expectWrite {
-				assert.Empty(t, st.seen, "no activity should have been recorded")
-				return
-			}
-
-			require.Len(t, st.seen, 1, "exactly one activity write should have been recorded")
-			assert.Equal(t, "account1", st.seen[0].accountID, "activity must be recorded against the service account")
-			assert.Equal(t, tt.peer.ID, st.seen[0].peerID, "activity must be recorded against the calling peer")
-			assert.Equal(t, time.UTC, st.seen[0].staleBefore.Location(), "cutoffs are passed in UTC")
-			assert.WithinDuration(t, time.Now().UTC().Add(-peerSeenInterval), st.seen[0].staleBefore, time.Minute,
-				"the store must enforce the same interval the local check applies")
-		})
-	}
-}

management/internals/server/boot.go

@@ -27,8 +27,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
-	proxyactivity "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
-	proxyactivitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
@@ -233,7 +231,6 @@ func (s *BaseServer) ReverseProxyGRPCServer() *nbgrpc.ProxyServiceServer {
 		proxyService := nbgrpc.NewProxyServiceServer(s.AccessLogsManager(), s.ProxyTokenStore(), s.PKCEVerifierStore(), s.proxyOIDCConfig(), s.PeersManager(), s.UsersManager(), s.IdpManager(), s.ProxyManager(), s.Store())
 		s.AfterInit(func(s *BaseServer) {
 			proxyService.SetServiceManager(s.ServiceManager())
-			proxyService.SetActivityManager(s.ProxyActivityManager())
 			proxyService.SetProxyController(s.ServiceProxyController())
 			proxyService.SetAgentNetworkSynthesizer(newAgentNetworkSynthesizer(s.Store()))
 			proxyService.SetAgentNetworkLimitsService(s.AgentNetworkManager())
@@ -293,13 +290,6 @@ func (s *BaseServer) PKCEVerifierStore() *nbgrpc.PKCEVerifierStore {
 	})
 }
 
-// ProxyActivityManager records reverse proxy usage for activity accounting.
-func (s *BaseServer) ProxyActivityManager() proxyactivity.Manager {
-	return Create(s, func() proxyactivity.Manager {
-		return proxyactivitymanager.NewManager(s.Store())
-	})
-}
-
 func (s *BaseServer) AccessLogsManager() accesslogs.Manager {
 	return Create(s, func() accesslogs.Manager {
 		accessLogManager := accesslogsmanager.NewManager(s.Store(), s.PermissionsManager(), s.GeoLocationManager())

management/internals/shared/grpc/proxy.go

@@ -32,7 +32,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
@@ -129,9 +128,6 @@ type ProxyServiceServer struct {
 	// Manager for IdP-enriched user data (may be nil when no IdP is configured)
 	idpManager idp.Manager
 
-	// Manager that records reverse proxy usage for activity accounting
-	activityManager activity.Manager
-
 	// Store for one-time authentication tokens
 	tokenStore *OneTimeTokenStore
 
@@ -254,13 +250,6 @@ func (s *ProxyServiceServer) SetServiceManager(manager rpservice.Manager) {
 	s.serviceManager = manager
 }
 
-// SetActivityManager wires the manager that records reverse proxy usage.
-func (s *ProxyServiceServer) SetActivityManager(manager activity.Manager) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.activityManager = manager
-}
-
 // SetAgentNetworkSynthesizer wires the agent-network service synthesiser.
 // Optional — when nil the snapshot path skips agent-network synthesis. The
 // modules layer injects this after both the proxy server and the agent-network
@@ -1728,7 +1717,7 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 
 	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
 
-	token, err := sessionkey.SignToken(
+	return sessionkey.SignToken(
 		service.SessionPrivateKey,
 		userID,
 		user.Email,
@@ -1738,25 +1727,6 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 		groupNames,
 		proxyauth.DefaultSessionExpiry,
 	)
-	if err != nil {
-		return "", err
-	}
-
-	s.recordUserLogin(ctx, service.AccountID, user)
-
-	return token, nil
-}
-
-// recordUserLogin hands the sign-in to the activity manager. The RPC must not
-// fail on it, so the error is logged and dropped here rather than returned.
-func (s *ProxyServiceServer) recordUserLogin(ctx context.Context, accountID string, user *types.User) {
-	if s.activityManager == nil {
-		return
-	}
-
-	if err := s.activityManager.RecordUserLogin(ctx, accountID, user); err != nil {
-		log.WithContext(ctx).Debugf("record proxy login for user %s: %v", user.Id, err)
-	}
 }
 
 // ValidateUserGroupAccess checks if a user has access to a service.
@@ -2106,8 +2076,6 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 		return nil, err
 	}
 
-	s.recordPeerSeen(ctx, service.AccountID, peer)
-
 	log.WithFields(log.Fields{
 		"domain":       domain,
 		"tunnel_ip":    tunnelIPStr,
@@ -2125,18 +2093,6 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 	}, nil
 }
 
-// recordPeerSeen hands the mesh request to the activity manager. The RPC must
-// not fail on it, so the error is logged and dropped here rather than returned.
-func (s *ProxyServiceServer) recordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) {
-	if s.activityManager == nil {
-		return
-	}
-
-	if err := s.activityManager.RecordPeerSeen(ctx, accountID, peer); err != nil {
-		log.WithContext(ctx).Debugf("record proxy activity for peer %s: %v", peer.ID, err)
-	}
-}
-
 // resolvePeerOwner returns the user a peer is linked to, once per request so
 // the status gate and the identity resolution below share a single lookup.
 // Unlinked peers (machine agents) have no owner. A lookup that fails returns

management/internals/shared/grpc/proxy_group_access_test.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"net"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -156,27 +155,6 @@ type mockTunnelPeersManager struct {
 	groupsErr error
 }
 
-// mockActivityManager records what the RPC handed to the activity manager. The
-// policy (throttling, exclusions) is the manager's and is tested there; these
-// tests only pin which requests reach it.
-type mockActivityManager struct {
-	seenMarks []seenMark
-}
-
-type seenMark struct {
-	accountID string
-	peerID    string
-}
-
-func (m *mockActivityManager) RecordUserLogin(_ context.Context, _ string, _ *types.User) error {
-	return nil
-}
-
-func (m *mockActivityManager) RecordPeerSeen(_ context.Context, accountID string, peer *peer.Peer) error {
-	m.seenMarks = append(m.seenMarks, seenMark{accountID: accountID, peerID: peer.ID})
-	return nil
-}
-
 func (m *mockTunnelPeersManager) GetPeerByTunnelIP(_ context.Context, _ string, _ net.IP) (*peer.Peer, error) {
 	return m.peer, m.peerErr
 }
@@ -767,78 +745,6 @@ func TestValidateTunnelPeerOwnerStatus(t *testing.T) {
 	}
 }
 
-// TestValidateTunnelPeerRecordsActivity pins that a granted mesh request is
-// handed to the activity manager. Which of those the manager then writes is its
-// own decision, covered by its tests.
-func TestValidateTunnelPeerRecordsActivity(t *testing.T) {
-	const (
-		domain    = "app.example.com"
-		accountID = "account1"
-		peerID    = "peer1"
-	)
-
-	activityManager := &mockActivityManager{}
-	server := &ProxyServiceServer{
-		activityManager: activityManager,
-		serviceManager: &mockReverseProxyManager{
-			proxiesByAccount: map[string][]*service.Service{
-				accountID: {{Domain: domain, AccountID: accountID}},
-			},
-		},
-		peersManager: &mockTunnelPeersManager{
-			peer: &peer.Peer{ID: peerID, Name: "agent", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-		},
-		usersManager: &mockUsersManager{users: map[string]*types.User{}},
-	}
-
-	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
-		Domain:   domain,
-		TunnelIp: "100.64.0.1",
-	})
-
-	require.NoError(t, err)
-	require.True(t, resp.GetValid(), "peer should be granted access")
-
-	require.Len(t, activityManager.seenMarks, 1, "a granted peer should reach the activity manager once")
-	assert.Equal(t, accountID, activityManager.seenMarks[0].accountID, "activity must be attributed to the service account")
-	assert.Equal(t, peerID, activityManager.seenMarks[0].peerID, "activity must be attributed to the calling peer")
-}
-
-// TestValidateTunnelPeerDeniedRecordsNoActivity keeps the write on the granted
-// path only: a refused peer is not evidence its owner was active.
-func TestValidateTunnelPeerDeniedRecordsNoActivity(t *testing.T) {
-	const (
-		domain    = "app.example.com"
-		accountID = "account1"
-	)
-
-	activityManager := &mockActivityManager{}
-	server := &ProxyServiceServer{
-		activityManager: activityManager,
-		serviceManager: &mockReverseProxyManager{
-			proxiesByAccount: map[string][]*service.Service{
-				accountID: {{Domain: domain, AccountID: accountID}},
-			},
-		},
-		peersManager: &mockTunnelPeersManager{
-			peer: &peer.Peer{ID: "peer1", Name: "agent", UserID: "user1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-		},
-		// The owner is blocked, so the tunnel gate denies before the mint.
-		usersManager: &mockUsersManager{users: map[string]*types.User{
-			"user1": {Id: "user1", AccountID: accountID, Blocked: true},
-		}},
-	}
-
-	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
-		Domain:   domain,
-		TunnelIp: "100.64.0.1",
-	})
-
-	require.NoError(t, err)
-	require.False(t, resp.GetValid(), "blocked owner should be denied")
-	assert.Empty(t, activityManager.seenMarks, "a denied peer must not be marked seen")
-}
-
 func TestGetAccountProxyByDomain(t *testing.T) {
 	tests := []struct {
 		name             string

management/server/http/handlers/proxy/auth_callback_integration_test.go

@@ -19,7 +19,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
-	activitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
@@ -222,7 +221,6 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	)
 
 	proxyService.SetServiceManager(&testServiceManager{store: testStore})
-	proxyService.SetActivityManager(activitymanager.NewManager(testStore))
 
 	handler := NewAuthCallbackHandler(proxyService, nil)
 
@@ -540,55 +538,6 @@ func TestAuthCallback_UserAllowedToLogin(t *testing.T) {
 // TestAuthCallback_UserDeniedByAccountStatus asserts that a user whose account
 // is pending approval or blocked never receives a session token from the OIDC
 // callback, and that the redirect carries a description the proxy can render.
-// TestAuthCallback_RecordsUserLogin drives the real OIDC callback and asserts
-// the login lands on the user row. That timestamp is what activity accounting
-// reads, and it is the only signal that can ever count someone who reaches
-// proxy-protected services from a browser and never opens the dashboard.
-func TestAuthCallback_RecordsUserLogin(t *testing.T) {
-	setup := setupAuthCallbackTest(t)
-	defer setup.cleanup()
-
-	ctx := context.Background()
-
-	before, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
-	require.NoError(t, err)
-	require.Nil(t, before.LastLogin, "fixture user starts with no login on record")
-
-	setup.oidcServer.tokenSubject = "allowedUserId"
-	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
-
-	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
-	rec := httptest.NewRecorder()
-	setup.router.ServeHTTP(rec, req)
-	require.Equal(t, http.StatusFound, rec.Code)
-
-	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
-	require.NoError(t, err)
-	require.NotNil(t, after.LastLogin, "a completed proxy SSO login must be recorded on the user")
-	require.WithinDuration(t, time.Now().UTC(), after.LastLogin.UTC(), time.Minute, "login should be stamped at sign-in time")
-}
-
-// TestAuthCallback_DeniedUserLoginNotRecorded keeps the write on the granted
-// path: a refused sign-in is not a login.
-func TestAuthCallback_DeniedUserLoginNotRecorded(t *testing.T) {
-	setup := setupAuthCallbackTest(t)
-	defer setup.cleanup()
-
-	ctx := context.Background()
-
-	setup.oidcServer.tokenSubject = "blockedUserId"
-	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
-
-	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
-	rec := httptest.NewRecorder()
-	setup.router.ServeHTTP(rec, req)
-	require.Equal(t, http.StatusFound, rec.Code)
-
-	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "blockedUserId")
-	require.NoError(t, err)
-	require.Nil(t, after.LastLogin, "a denied user must not be recorded as having logged in")
-}
-
 func TestAuthCallback_UserDeniedByAccountStatus(t *testing.T) {
 	tests := []struct {
 		name            string

management/server/store/sql_store.go

@@ -599,34 +599,6 @@ func (s *SqlStore) ApproveAccountPeers(ctx context.Context, accountID string) (i
 	return int(result.RowsAffected), nil
 }
 
-// RefreshPeerLastSeen updates only peer_status_last_seen. Every other status
-// column is left untouched: peer_status_connected and
-// peer_status_session_started_at belong to the sync stream that owns the
-// session, and a blind write here would corrupt the fencing
-// MarkPeerConnectedIfNewerSession relies on.
-//
-// LastSeen comes from the database clock for the same reason it does there: a
-// Go-side timestamp is taken before the write and can land after a connect that
-// used CURRENT_TIMESTAMP, dragging the column backwards.
-//
-// staleBefore carries the caller's throttle into the same statement, so
-// concurrent requests for one peer collapse into a single write instead of
-// each racing on its own stale read. The column is nullable — Status is an
-// embedded pointer, so a peer stored without one leaves it NULL — and NULL
-// loses every comparison, hence the explicit branch for a peer never seen.
-func (s *SqlStore) RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
-	result := s.db.WithContext(ctx).
-		Model(&nbpeer.Peer{}).
-		Where(accountAndIDQueryCondition, accountID, peerID).
-		Where("(peer_status_last_seen IS NULL OR peer_status_last_seen < ?)", staleBefore).
-		Update("peer_status_last_seen", gorm.Expr("CURRENT_TIMESTAMP"))
-	if result.Error != nil {
-		return false, status.Errorf(status.Internal, "refresh peer last seen: %v", result.Error)
-	}
-
-	return result.RowsAffected > 0, nil
-}
-
 // SaveUsers saves the given list of users to the database.
 func (s *SqlStore) SaveUsers(ctx context.Context, users []*types.User) error {
 	if len(users) == 0 {

management/server/store/sql_store_activity_test.go

@@ -1,122 +0,0 @@
-package store
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-const activityAccountID = "activityAccountId"
-
-func newActivityTestStore(t *testing.T) Store {
-	t.Helper()
-
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	require.NoError(t, err)
-	t.Cleanup(cleanUp)
-
-	require.NoError(t, store.SaveAccount(context.Background(), &types.Account{
-		Id:        activityAccountID,
-		Domain:    "activity.example.com",
-		CreatedAt: time.Now().UTC(),
-	}))
-
-	return store
-}
-
-func TestRefreshPeerLastSeen(t *testing.T) {
-	ctx := context.Background()
-	store := newActivityTestStore(t)
-	stored := time.Now().UTC().Add(-3 * time.Hour)
-	require.NoError(t, store.AddPeerToAccount(ctx, activityPeer(stored)))
-
-	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
-	require.NoError(t, err)
-	assert.True(t, refreshed, "a peer seen three hours ago is stale enough to refresh")
-
-	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
-	require.NoError(t, err)
-	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should be stamped at write time")
-	assert.True(t, peer.Status.LastSeen.After(stored), "last seen must move forward")
-}
-
-// TestRefreshPeerLastSeenHonoursCutoff covers the throttle the caller relies on:
-// two concurrent requests both read the same stale peer, but only the statement
-// that still finds LastSeen behind the cutoff writes.
-func TestRefreshPeerLastSeenHonoursCutoff(t *testing.T) {
-	ctx := context.Background()
-	store := newActivityTestStore(t)
-	stored := time.Now().UTC().Add(-10 * time.Minute)
-	require.NoError(t, store.AddPeerToAccount(ctx, activityPeer(stored)))
-
-	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
-	require.NoError(t, err)
-	assert.False(t, refreshed, "a peer seen inside the interval must not be written")
-
-	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
-	require.NoError(t, err)
-	assert.WithinDuration(t, stored, peer.Status.LastSeen.UTC(), time.Second, "last seen must be left where it was")
-}
-
-// TestRefreshPeerLastSeenRecordsNeverSeenPeer covers the nullable column. Status
-// is an embedded pointer, so a peer stored without one leaves last seen NULL,
-// and NULL loses the cutoff comparison — such a peer would never record its
-// first activity.
-func TestRefreshPeerLastSeenRecordsNeverSeenPeer(t *testing.T) {
-	ctx := context.Background()
-	store := newActivityTestStore(t)
-	stored := activityPeer(time.Time{})
-	stored.Status = nil
-	require.NoError(t, store.AddPeerToAccount(ctx, stored))
-
-	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
-	require.NoError(t, err)
-	assert.True(t, refreshed, "a peer that was never seen must record its first activity")
-
-	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
-	require.NoError(t, err)
-	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should be stamped at write time")
-}
-
-// TestRefreshPeerLastSeenLeavesSessionStateAlone pins the column boundary: the
-// connected flag and the session token belong to the sync stream that owns the
-// peer's session, and a blind write here would corrupt its fencing. This is why
-// SavePeerStatus is not reused for an activity bump.
-func TestRefreshPeerLastSeenLeavesSessionStateAlone(t *testing.T) {
-	ctx := context.Background()
-	store := newActivityTestStore(t)
-
-	stored := activityPeer(time.Date(2026, 3, 1, 9, 0, 0, 0, time.UTC))
-	stored.Status.Connected = true
-	stored.Status.SessionStartedAt = 1234567890
-	require.NoError(t, store.AddPeerToAccount(ctx, stored))
-
-	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
-	require.NoError(t, err)
-	require.True(t, refreshed, "the peer is stale enough to refresh")
-
-	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
-	require.NoError(t, err)
-	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should move forward")
-	assert.True(t, peer.Status.Connected, "connected flag must survive an activity write")
-	assert.Equal(t, int64(1234567890), peer.Status.SessionStartedAt, "session token must survive an activity write")
-}
-
-func activityPeer(lastSeen time.Time) *nbpeer.Peer {
-	return &nbpeer.Peer{
-		ID:        "activityPeer",
-		AccountID: activityAccountID,
-		Key:       "activityPeerKey",
-		IP:        netip.MustParseAddr("100.64.0.9"),
-		Name:      "activity-peer",
-		DNSLabel:  "activity-peer",
-		Status:    &nbpeer.PeerStatus{LastSeen: lastSeen},
-	}
-}

management/server/store/store.go

@@ -180,14 +180,6 @@ type Store interface {
 	// Returns true when the update happened, false when this stream lost
 	// the race against a newer session.
 	MarkPeerConnectedIfNewerSession(ctx context.Context, accountID, peerID string, newSessionStartedAt int64) (bool, error)
-	// RefreshPeerLastSeen records that a peer was just seen, stamping the
-	// database clock like the other status writers. Connected and
-	// SessionStartedAt are left alone, so this never interferes with the
-	// session-ownership protocol MarkPeerConnectedIfNewerSession implements.
-	// The write only lands when the stored LastSeen is older than
-	// staleBefore, which keeps a caller's throttle atomic under concurrent
-	// requests for the same peer. Returns true when the update happened.
-	RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error)
 	// MarkPeerDisconnectedIfSameSession sets the peer to disconnected and
 	// resets SessionStartedAt to zero, but only when the stored
 	// SessionStartedAt equals the given sessionStartedAt. LastSeen is

management/server/store/store_mock.go

@@ -3261,21 +3261,6 @@ func (mr *MockStoreMockRecorder) MarkProxyAccessTokenUsed(ctx, tokenID interface
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkProxyAccessTokenUsed", reflect.TypeOf((*MockStore)(nil).MarkProxyAccessTokenUsed), ctx, tokenID)
 }
 
-// RefreshPeerLastSeen mocks base method.
-func (m *MockStore) RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RefreshPeerLastSeen", ctx, accountID, peerID, staleBefore)
-	ret0, _ := ret[0].(bool)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// RefreshPeerLastSeen indicates an expected call of RefreshPeerLastSeen.
-func (mr *MockStoreMockRecorder) RefreshPeerLastSeen(ctx, accountID, peerID, staleBefore interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RefreshPeerLastSeen", reflect.TypeOf((*MockStore)(nil).RefreshPeerLastSeen), ctx, accountID, peerID, staleBefore)
-}
-
 // RemovePeerFromAllGroups mocks base method.
 func (m *MockStore) RemovePeerFromAllGroups(ctx context.Context, peerID string) error {
 	m.ctrl.T.Helper()

management/server/types/job.go

@@ -3,10 +3,12 @@ package types
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
 
+	"github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
@@ -150,6 +152,21 @@ func validateAndBuildBundleParams(req api.WorkloadRequest, workload *Workload) e
 	if bundle.Parameters.LogFileCount < 1 || bundle.Parameters.LogFileCount > 1000 {
 		return fmt.Errorf("log-file-count must be between 1 and 1000, got %d", bundle.Parameters.LogFileCount)
 	}
+	// validate anonymize_level: omitted or empty defaults on the client;
+	// otherwise it must name a known level. An unknown value is rejected here
+	// rather than silently escalated, so a typo surfaces at job creation. The
+	// normalized (trimmed, lowercased) value is persisted so it matches what
+	// the client parses — the client only lowercases, so a stored " default "
+	// would otherwise resolve to strict.
+	if lvl := bundle.Parameters.AnonymizeLevel; lvl != nil {
+		normalized := strings.ToLower(strings.TrimSpace(*lvl))
+		switch normalized {
+		case "", anonymize.LevelDefaultString, anonymize.LevelStrictString:
+		default:
+			return fmt.Errorf("anonymize_level must be %q or %q, got %q", anonymize.LevelDefaultString, anonymize.LevelStrictString, *lvl)
+		}
+		bundle.Parameters.AnonymizeLevel = &normalized
+	}
 
 	workload.Parameters, err = json.Marshal(bundle.Parameters)
 	if err != nil {
@@ -209,6 +226,17 @@ func (j *Job) ToStreamJobRequest() (*proto.JobRequest, error) {
 	}
 }
 
+// derefString returns the pointed-to string, or "" when the pointer is nil.
+// The bundle parameters carry anonymize_level and upload_url as optional
+// fields; an absent value maps to the empty proto string, which the client
+// resolves to its default.
+func derefString(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
 func (j *Job) buildStreamBundleResponse() (*proto.JobRequest, error) {
 	var p api.BundleParameters
 	if err := json.Unmarshal(j.Workload.Parameters, &p); err != nil {
@@ -218,10 +246,12 @@ func (j *Job) buildStreamBundleResponse() (*proto.JobRequest, error) {
 		ID: []byte(j.ID),
 		WorkloadParameters: &proto.JobRequest_Bundle{
 			Bundle: &proto.BundleParameters{
-				BundleFor:     p.BundleFor,
-				BundleForTime: int64(p.BundleForTime),
-				LogFileCount:  int32(p.LogFileCount),
-				Anonymize:     p.Anonymize,
+				BundleFor:      p.BundleFor,
+				BundleForTime:  int64(p.BundleForTime),
+				LogFileCount:   int32(p.LogFileCount),
+				Anonymize:      p.Anonymize,
+				AnonymizeLevel: derefString(p.AnonymizeLevel),
+				UploadUrl:      derefString(p.UploadUrl),
 			},
 		},
 	}, nil

management/server/types/job_test.go

@@ -0,0 +1,137 @@
+package types
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+func strPtr(s string) *string { return &s }
+
+// bundleJobFromParams builds a bundle Job whose stored workload parameters are
+// the marshalled REST BundleParameters, mirroring what NewJob persists.
+func bundleJobFromParams(t *testing.T, p api.BundleParameters) *Job {
+	t.Helper()
+	raw, err := json.Marshal(p)
+	require.NoError(t, err, "marshal bundle parameters")
+	return &Job{
+		ID: "job-1",
+		Workload: Workload{
+			Type:       JobTypeBundle,
+			Parameters: raw,
+			Result:     []byte("{}"),
+		},
+	}
+}
+
+// TestBuildStreamBundleResponse_CarriesIdentityAndUploadFields verifies the
+// anonymize_level and upload_url REST fields are mapped onto the proto request
+// the client receives.
+func TestBuildStreamBundleResponse_CarriesIdentityAndUploadFields(t *testing.T) {
+	job := bundleJobFromParams(t, api.BundleParameters{
+		BundleFor:      true,
+		BundleForTime:  2,
+		LogFileCount:   100,
+		Anonymize:      true,
+		AnonymizeLevel: strPtr("strict"),
+		UploadUrl:      strPtr("https://upload.example.com"),
+	})
+
+	req, err := job.ToStreamJobRequest()
+	require.NoError(t, err, "ToStreamJobRequest must succeed")
+
+	bundle := req.GetBundle()
+	require.NotNil(t, bundle, "the request must carry bundle parameters")
+	assert.Equal(t, "strict", bundle.GetAnonymizeLevel(), "anonymize_level must reach the client")
+	assert.Equal(t, "https://upload.example.com", bundle.GetUploadUrl(), "upload_url must reach the client")
+	assert.True(t, bundle.GetAnonymize(), "existing fields must still map")
+	assert.Equal(t, int32(100), bundle.GetLogFileCount(), "existing fields must still map")
+}
+
+// newBundleJobRequest builds an api.JobRequest carrying a bundle workload with
+// the given parameters, mirroring what the REST handler decodes.
+func newBundleJobRequest(t *testing.T, p api.BundleParameters) *api.JobRequest {
+	t.Helper()
+	var wr api.WorkloadRequest
+	require.NoError(t, wr.FromBundleWorkloadRequest(api.BundleWorkloadRequest{
+		Type:       api.WorkloadTypeBundle,
+		Parameters: p,
+	}), "build bundle workload request")
+	return &api.JobRequest{Workload: wr}
+}
+
+// TestNewJob_AnonymizeLevelValidation verifies the management API accepts only
+// known anonymization levels (empty defaults on the client) and rejects an
+// unknown value instead of silently escalating it.
+func TestNewJob_AnonymizeLevelValidation(t *testing.T) {
+	base := api.BundleParameters{BundleFor: false, LogFileCount: 100, Anonymize: true}
+
+	for _, tc := range []struct {
+		name    string
+		level   *string
+		wantErr bool
+	}{
+		{name: "omitted", level: nil},
+		{name: "empty", level: strPtr("")},
+		{name: "default", level: strPtr("default")},
+		{name: "strict", level: strPtr("strict")},
+		{name: "mixed case", level: strPtr("Strict")},
+		{name: "padded", level: strPtr(" default ")},
+		{name: "unknown", level: strPtr("verbose"), wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			p := base
+			p.AnonymizeLevel = tc.level
+			_, err := NewJob("user-1", "acc-1", "peer-1", newBundleJobRequest(t, p))
+			if tc.wantErr {
+				require.Error(t, err, "an unknown anonymize_level must be rejected")
+				assert.Contains(t, err.Error(), "anonymize_level", "the error must name the offending field")
+				return
+			}
+			require.NoError(t, err, "a known anonymize_level must be accepted")
+		})
+	}
+}
+
+// TestNewJob_AnonymizeLevelNormalized verifies an accepted level is persisted
+// trimmed and lowercased, so it reaches the client as a value the client's
+// lowercase-only parser resolves correctly rather than escalating to strict.
+func TestNewJob_AnonymizeLevelNormalized(t *testing.T) {
+	job, err := NewJob("user-1", "acc-1", "peer-1", newBundleJobRequest(t, api.BundleParameters{
+		BundleFor:      false,
+		LogFileCount:   100,
+		Anonymize:      true,
+		AnonymizeLevel: strPtr("  Default  "),
+	}))
+	require.NoError(t, err, "a padded known level must be accepted")
+
+	req, err := job.ToStreamJobRequest()
+	require.NoError(t, err, "ToStreamJobRequest must succeed")
+	assert.Equal(t, "default", req.GetBundle().GetAnonymizeLevel(),
+		"the persisted level must be normalized so the client does not resolve it to strict")
+}
+
+// TestBuildStreamBundleResponse_OmittedFieldsMapToEmpty verifies that omitted
+// optional fields map to the empty proto string, which the client resolves to
+// its defaults (default anonymization level, default upload server).
+func TestBuildStreamBundleResponse_OmittedFieldsMapToEmpty(t *testing.T) {
+	job := bundleJobFromParams(t, api.BundleParameters{
+		BundleFor:     false,
+		BundleForTime: 1,
+		LogFileCount:  50,
+		Anonymize:     false,
+		// AnonymizeLevel and UploadUrl intentionally nil.
+	})
+
+	req, err := job.ToStreamJobRequest()
+	require.NoError(t, err, "ToStreamJobRequest must succeed")
+
+	bundle := req.GetBundle()
+	require.NotNil(t, bundle, "the request must carry bundle parameters")
+	assert.Empty(t, bundle.GetAnonymizeLevel(), "an omitted anonymize_level must map to empty so the client defaults it")
+	assert.Empty(t, bundle.GetUploadUrl(), "an omitted upload_url must map to empty so the client defaults it")
+}

shared/management/http/api/openapi.yml

@@ -154,6 +154,14 @@ components:
           type: boolean
           description: Whether sensitive data should be anonymized in the bundle.
           example: false
+        anonymize_level:
+          type: string
+          description: How much the anonymizer redacts. "default" (or empty) keeps internal IP ranges, "strict" also anonymizes them.
+          example: strict
+        upload_url:
+          type: string
+          description: Service URL the client requests an upload URL from before uploading the bundle. Empty selects the default upload server.
+          example: https://upload.debug.netbird.io
       required:
         - bundle_for
         - bundle_for_time

shared/management/http/api/types.gen.go

@@ -2527,6 +2527,9 @@ type BundleParameters struct {
 	// Anonymize Whether sensitive data should be anonymized in the bundle.
 	Anonymize bool `json:"anonymize"`
 
+	// AnonymizeLevel How much the anonymizer redacts. "default" (or empty) keeps internal IP ranges, "strict" also anonymizes them.
+	AnonymizeLevel *string `json:"anonymize_level,omitempty"`
+
 	// BundleFor Whether to generate a bundle for the given timeframe.
 	BundleFor bool `json:"bundle_for"`
 
@@ -2535,6 +2538,9 @@ type BundleParameters struct {
 
 	// LogFileCount Maximum number of log files to include in the bundle.
 	LogFileCount int `json:"log_file_count"`
+
+	// UploadUrl Service URL the client requests an upload URL from before uploading the bundle. Empty selects the default upload server.
+	UploadUrl *string `json:"upload_url,omitempty"`
 }
 
 // BundleResult defines model for BundleResult.

shared/management/proto/management.proto

@@ -114,6 +114,9 @@ message BundleParameters {
   // (or empty) keeps internal IP ranges, "strict" also anonymizes them.
   // Unknown values are treated as "strict".
   string anonymize_level  = 5;
+  // upload_url is the service URL the client requests an upload URL from
+  // before uploading the bundle. Empty selects the default upload server.
+  string upload_url       = 6;
 }
 
 message BundleResult {