[WIP] Add dsregcmd /status analyzer to CMTrace Open by Copilot · Pull Request #4 · adamgell/cmtraceopen

Copilot · 2026-03-13T05:17:07Z

Thanks for assigning this issue to me. I'm starting to work on it and will keep this PR's description up to date as I form a plan and make progress.

Original prompt

This section details on the original issue you should resolve

<issue_title>Feature: dsregcmd /status Analyzer</issue_title>
<issue_description>

Summary

Add a dsregcmd /status analyzer to CMTrace Open — a diagnostic tool that parses dsregcmd output, surfaces join state, MDM enrollment, PRT health, certificate validity, and diagnostic issues with actionable remediation guidance. Three input modes: live capture (execute dsregcmd.exe /status as the current user), paste from clipboard, or file picker / drag-drop (.txt). Inspired by intunediag.com (Maksymilian Olowski, closed-source, client-side Next.js). All analysis logic below was reverse-engineered from the production JS bundles.

Motivation

dsregcmd /status is the single most important triage command for Entra ID join, Hybrid Join, PRT, and MDM enrollment issues. The raw output is verbose and requires memorizing which fields matter and what their values mean. CMTrace Open already captures dsregcmd output in its evidence collection pipeline (Invoke-CmtraceEvidenceCollection.ps1 → Get-DsRegStatusSummary), but that function only extracts 6 fields for the manifest summary. A full in-app analyzer would close the loop — admins can capture, parse, and diagnose without leaving the tool.

Existing Repo Touchpoints

These are the integration points already present in the codebase:

Area	File	What exists
Evidence collection	`scripts/collection/Invoke-CmtraceEvidenceCollection.ps1`	`Get-DsRegStatusSummary` parses 6 fields (`AzureAdJoined`, `DomainJoined`, `EnterpriseJoined`, `TenantId`, `TenantName`, `DeviceId`) via regex. Saves full output as `dsregcmd-status.txt` in `evidence/command-output/`.
Evidence profile	`scripts/collection/intune-evidence-profile.json`	`dsregcmd-status` command entry: `dsregcmd.exe /status` → `dsregcmd-status.txt`
Known sources	`src-tauri/src/commands/file_ops.rs`	`windows_known_log_sources()` registers sources under `windows-intune` and `windows-setup` families. dsregcmd is not yet registered as a known source.
Intune analysis	`src-tauri/src/commands/intune.rs`	`analyze_intune_logs` command with `IntuneAnalysisResult`, `IntuneDiagnosticInsight` (severity + evidence + fixes), `IntuneDiagnosticsConfidence`. This is the pattern to follow for the dsregcmd analyzer.
Frontend types	`src/types/intune.ts`	`IntuneDiagnosticSeverity`, `IntuneDiagnosticInsight`, `IntuneAnalysisResult` — reusable severity model.
Capabilities	`src-tauri/capabilities/default.json`	Has `clipboard-manager:allow-write-text` but not `clipboard-manager:allow-read-text`. No shell plugin.
Tauri plugins	`Cargo.toml`	`tauri-plugin-dialog`, `tauri-plugin-fs`, `tauri-plugin-clipboard-manager`. No `tauri-plugin-shell`.

Input Modes

Mode 1: Live Capture (Windows only)

Execute dsregcmd.exe /status as the launching user’s context via std::process::Command from a Tauri command. This avoids adding tauri-plugin-shell as a dependency — the Rust backend can spawn the process directly and return stdout as a String.

// Sketch — runs in a Tauri #[tauri::command]
use std::process::Command;

let output = Command::new("dsregcmd.exe")
    .arg("/status")
    .output()
    .map_err(|e| format!("Failed to execute dsregcmd: {}", e))?;

let stdout = String::from_utf8_lossy(&output.stdout).to_string();

User context note: dsregcmd /status returns different output depending on whether it runs as the logged-on user or as SYSTEM. The tool should display the execution context (user vs. SYSTEM, local vs. remote session) and surface the remote-session-system warning when `UserCo...

Custom agent used: Orchestrator
Architect agent that orchestrates work through subagents (Opus, Codex, Gemini)

Fixes Feature: dsregcmd /status Analyzer #2

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

Copilot

Pull request overview

Adds a new dsregcmd /status diagnostics workspace to CMTrace Open, including Rust-side parsing/rules + Tauri commands and a full frontend workflow (capture/paste/open file or evidence folder) to surface join/PRT/MDM/cert health and actionable insights.

Changes:

Introduces a Rust dsregcmd module (parser + derived signals + diagnostic rules) and exposes analyze_dsregcmd / capture_dsregcmd Tauri commands.
Adds a new frontend dsregcmd workspace UI (toolbar + sidebar + status bar integration) with source loading from file/folder/clipboard/live capture.
Updates shared UI routing (workspace switching + drag/drop behavior) to support the new workspace.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/types/dsregcmd.ts	Adds frontend TS types for dsregcmd facts/derived fields/diagnostics and analysis state.
src/stores/ui-store.ts	Extends workspace/view model to include `dsregcmd` and updates chrome labels.
src/stores/dsregcmd-store.ts	Adds Zustand store for dsregcmd analysis lifecycle, result, and source context.
src/lib/dsregcmd-source.ts	Implements dsregcmd source reading (file/folder/clipboard/capture) and refresh orchestration.
src/lib/commands.ts	Adds frontend invoke wrappers for `analyze_dsregcmd` and `capture_dsregcmd`.
src/hooks/use-drag-drop.ts	Routes drag/drop opens through the active workspace’s source-loading flow.
src/components/layout/Toolbar.tsx	Adds dsregcmd open/capture/paste actions, workspace switching buttons, and per-workspace open behavior.
src/components/layout/StatusBar.tsx	Displays dsregcmd analysis status and diagnostic counts when dsregcmd workspace is active.
src/components/layout/FileSidebar.tsx	Refactors sidebar into per-workspace variants and adds dsregcmd sidebar summary/actions.
src/components/layout/AppShell.tsx	Renders the new dsregcmd workspace alongside existing log/intune workspaces.
src/components/dsregcmd/DsregcmdWorkspace.tsx	New dsregcmd workspace UI: facts, diagnostics, timeline, export, and raw input view.
src-tauri/src/lib.rs	Exposes the dsregcmd module and registers new Tauri commands.
src-tauri/src/dsregcmd/rules.rs	Adds derived-signal computation + diagnostic rule engine + unit tests.
src-tauri/src/dsregcmd/parser.rs	Adds dsregcmd field parser + unit tests.
src-tauri/src/dsregcmd/models.rs	Adds serde models for facts/derived/diagnostic insight payloads.
src-tauri/src/dsregcmd/mod.rs	Wires parser + rules into a single `analyze_text` entry point.
src-tauri/src/commands/mod.rs	Registers new `commands::dsregcmd` module.
src-tauri/src/commands/file_ops.rs	Adjusts cfg-dependent known-sources builder to avoid non-Windows clippy warnings.
src-tauri/src/commands/dsregcmd.rs	Adds `analyze_dsregcmd` + `capture_dsregcmd` Tauri commands (Windows capture via `dsregcmd.exe /status`).
src-tauri/capabilities/default.json	Grants clipboard read permission required for dsregcmd “Paste Clipboard” flow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Adds a new dsregcmd /status diagnostics workflow to CMTrace Open, spanning a Rust-backed parser/analyzer plus a dedicated frontend workspace to load, capture, and review dsregcmd output alongside actionable insights.

Changes:

Introduces a Rust dsregcmd module (parser + derived signals + rule-based diagnostics) and Tauri commands to analyze text and capture live output on Windows.
Adds a new frontend dsregcmd workspace (store, source loaders for file/folder/clipboard/capture, UI panels, export).
Updates shared UI (toolbar, drag-drop routing, sidebar, status bar, app shell) and Tauri capabilities for clipboard read + text file export.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/types/dsregcmd.ts	New TS contract for dsregcmd facts/derived/diagnostics + source context/state.
src/stores/ui-store.ts	Adds `dsregcmd` as a workspace/view and updates chrome labels.
src/stores/dsregcmd-store.ts	New zustand store for dsregcmd analysis lifecycle + results.
src/lib/dsregcmd-source.ts	Loads dsregcmd input from file/folder/clipboard/capture and dispatches analysis into the store.
src/lib/commands.ts	Adds `analyze_dsregcmd` and `capture_dsregcmd` invoke wrappers.
src/hooks/use-drag-drop.ts	Routes drag/drop open behavior through the active workspace.
src/components/layout/Toolbar.tsx	Adds dsregcmd open actions (paste/capture), workspace switching UI, and workspace-aware open logic.
src/components/layout/StatusBar.tsx	Adds dsregcmd status reporting and refactors tone handling (but currently introduces a compile error).
src/components/layout/FileSidebar.tsx	Splits sidebar into Log/Intune/Dsregcmd modes with a dsregcmd-specific sidebar.
src/components/layout/AppShell.tsx	Adds `DsregcmdWorkspace` rendering in the main shell.
src/components/dsregcmd/DsregcmdWorkspace.tsx	New dsregcmd workspace UI: summary, diagnostics, grouped facts, timeline, exports, raw input view.
src-tauri/src/lib.rs	Registers new dsregcmd module and commands.
src-tauri/src/dsregcmd/*	New Rust dsregcmd models/parser/rules + unit tests.
src-tauri/src/commands/*	Adds dsregcmd Tauri commands; minor formatting change in file_ops.
src-tauri/capabilities/default.json	Enables clipboard read and fs text export permissions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                ? `Stale by ${result.derived.prtAgeHours?.toFixed(1) ?? "?"} hours.`
+                : "Primary Refresh Token presence derived from SSO state."
+            }
+            tone={result.derived.azureAdPrtPresent ? (result.derived.stalePrt ? "warn" : "good") : "bad"}


+  | "HybridEntraIdJoined"
+  | "EntraIdJoined"
+  | "NotJoined"
+  | "Unknown";


+    ? [
+        positionText ?? `${filteredCount} entries`,
+        `${totalLines} lines`,
+        severityText,
+        `${formatDetected ?? "Unknown"} format`,
+        parserDisplay?.provenanceLabel,
+        parserDisplay?.qualityLabel,
+      ]
+        .filter((part): part is string => Boolean(part))
+        .join(" | ")


adamgell · 2026-03-13T16:52:17Z

dsregcmd analysis failed.
Could not parse the digital signature check output for 'C:\Windows\System32\dsregcmd.exe': EOF while parsing a value at line 1 column 0

Build out the dsregcmd troubleshooting workflow across the Tauri backend, React UI, evidence collection profile, and supporting documentation. This commit adds bundle-aware dsregcmd analysis and live capture support that stages a temporary evidence bundle instead of returning command output alone. The backend now loads dsregcmd sources directly, keeps file and path inspection out of React, and exposes commands for source loading, path inspection, and output writing through Tauri. On the policy-analysis side, this introduces registry-backed Windows Hello for Business evidence loading with support for PolicyManager exports, generic Policies hives, and Microsoft Policies PassportForWork hives. The registry loader now understands UTF-16 registry exports, correlates current and provider policy state, falls back to machine or user policy hives when needed, and feeds richer phase, confidence, and diagnostic rule evaluation into the analyzer. The frontend workspace is updated to present the expanded dsregcmd model, improved health and issue summaries, richer Windows Hello and NGC interpretation, compact policy evidence presentation, and backend-driven source workflows for capture, paste, file, and folder inputs. Toolbar and sidebar copy are aligned with the new troubleshooting flow. The Intune evidence collection profile is updated to capture the additional registry artifacts required for policy correlation, repository configuration is adjusted for the new test target output, and Rust dependencies are updated to support the new registry tests. Finally, add a DSREGCMD troubleshooting guide and include the four reference screenshots used by the document so the new workflow is documented end-to-end.

Copilot

Pull request overview

Adds a new dsregcmd /status diagnostics workspace to CMTrace Open, including backend parsing/analysis + frontend capture/open/paste flows, and surfaces derived join/PRT/MDM/WHfB policy signals with actionable findings.

Changes:

Introduces Rust dsregcmd module (parser + derived/rules plumbing + registry policy evidence loading) and new Tauri commands for analyze/capture/source loading.
Adds a new dsregcmd workspace in the UI (toolbar integration, drag-drop routing, status bar + sidebar support, export/copy actions).
Extends evidence collection profile with additional registry exports used by the dsregcmd analyzer.

Reviewed changes

Copilot reviewed 24 out of 30 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/types/dsregcmd.ts	Adds TypeScript types for dsregcmd facts/derived results, diagnostics, and source context/state.
src/stores/ui-store.ts	Adds `dsregcmd` as a workspace/view and updates chrome status labels.
src/stores/dsregcmd-store.ts	New Zustand store for dsregcmd analysis lifecycle, results, and source context.
src/lib/dsregcmd-source.ts	Implements source loading (file/folder/clipboard/capture) and connects to dsregcmd store.
src/lib/commands.ts	Adds frontend invoke wrappers for dsregcmd commands plus path inspection and text export write.
src/hooks/use-drag-drop.ts	Routes drag/drop open behavior through active workspace actions.
src/components/layout/Toolbar.tsx	Adds dsregcmd open/paste/capture actions, workspace switch buttons, and refresh integration.
src/components/layout/StatusBar.tsx	Extends status bar to show dsregcmd analysis status and quick diagnostics counters.
src/components/layout/FileSidebar.tsx	Refactors sidebar into per-workspace panels; adds dsregcmd sidebar summary/actions.
src/components/layout/AppShell.tsx	Adds dsregcmd workspace rendering and refactors workspace selection rendering.
src/components/dsregcmd/DsregcmdWorkspace.tsx	New dsregcmd workspace UI (cards, issues, grouped facts, timeline, exports, raw input).
src-tauri/src/lib.rs	Exposes `dsregcmd` module and registers new dsregcmd + file ops commands.
src-tauri/src/dsregcmd/registry.rs	Loads WHfB-related policy evidence from exported registry artifacts (with tests).
src-tauri/src/dsregcmd/parser.rs	Parses dsregcmd `/status` text into structured facts (with tests).
src-tauri/src/dsregcmd/models.rs	Defines dsregcmd facts/derived/result models serialized to the frontend (with tests).
src-tauri/src/dsregcmd/mod.rs	Wires parser + rule analysis entrypoint and re-exports dsregcmd model types.
src-tauri/src/commands/mod.rs	Registers new `dsregcmd` command module.
src-tauri/src/commands/file_ops.rs	Adds `inspect_path_kind` + `write_text_output_file` Tauri commands.
src-tauri/src/commands/dsregcmd.rs	New Tauri commands for dsregcmd analyze/capture/load source, including Windows signature verification and bundle staging.
src-tauri/capabilities/default.json	Expands app capabilities (notably fs + clipboard read).
src-tauri/Cargo.toml	Adds `tempfile` dev-dependency for new dsregcmd registry tests.
src-tauri/Cargo.lock	Locks `tempfile` dependency.
scripts/collection/intune-evidence-profile.json	Adds additional registry export definitions used for policy evidence correlation.
DSREGCMD_TROUBLESHOOTING.md	Adds user-facing documentation for the dsregcmd workspace and workflows.
.gitignore	Ignores `src-tauri/target-test` artifacts.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Initial plan

d9b6cba

Copilot AI assigned Copilot and adamgell Mar 13, 2026

Copilot started work on behalf of adamgell March 13, 2026 05:17 View session

Copilot AI requested a review from adamgell March 13, 2026 05:17

Add dsregcmd analyzer workspace

3f8db52

adamgell requested a review from Copilot March 13, 2026 14:54

Copilot started reviewing on behalf of adamgell March 13, 2026 14:55 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

Address dsregcmd review feedback

ee86556

adamgell approved these changes Mar 13, 2026

View reviewed changes

Merge branch 'main' into copilot/add-dsregcmd-status-analyzer

6608dca

adamgell requested a review from Copilot March 13, 2026 16:09

Copilot started reviewing on behalf of adamgell March 13, 2026 16:10 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

adamgell added 3 commits March 13, 2026 12:37

Fix PR branch CI blockers

b63711e

Handle unknown dsregcmd PRT state

ea8ff42

Preserve PascalCase dsregcmd join types

2bdf371

adamgell marked this pull request as ready for review March 13, 2026 16:49

adamgell added 3 commits March 13, 2026 12:55

Harden dsregcmd signature parsing

97fb4b4

Use native Authenticode for dsregcmd

db99fba

adamgell requested a review from Copilot March 14, 2026 00:11

Copilot started reviewing on behalf of adamgell March 14, 2026 00:12 View session

Copilot AI reviewed Mar 14, 2026

View reviewed changes

Comment thread src-tauri/src/commands/dsregcmd.rs

Comment thread src-tauri/src/commands/dsregcmd.rs

Comment thread src-tauri/capabilities/default.json

Refactor imports in dsregcmd.rs for clarity and consistency

36b99d3

adamgell merged commit 0ba93b1 into main Mar 14, 2026
5 checks passed

adamgell deleted the copilot/add-dsregcmd-status-analyzer branch July 13, 2026 16:40

This was referenced Jul 31, 2026

feat(intune): parse Company Portal macOS app logs #387

Merged

feat(sccm): analyze client policy transactions #391

Closed

Navigation Menu

Uh oh!

[WIP] Add dsregcmd /status analyzer to CMTrace Open - #4

[WIP] Add dsregcmd /status analyzer to CMTrace Open#4
adamgell merged 11 commits into
mainfrom
copilot/add-dsregcmd-status-analyzer

Copilot AI commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

adamgell commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Mar 13, 2026

Summary

Motivation

Existing Repo Touchpoints

Input Modes

Mode 1: Live Capture (Windows only)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

adamgell commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants