Multi-user machines and running elevated
By default the collector runs as the signed-in user and reports for that one person. On shared workstations, lab machines and anything deployed by an MDM, you usually want one install that covers everyone. Run as root (macOS and Linux) or SYSTEM (Windows), the collector works out who to collect for and reads each person’s files from their own home directory.
Who it collects for
Section titled “Who it collects for”| Running as | People collected for |
|---|---|
| A normal user | That user only |
| root / SYSTEM | Every person with an account on the machine |
The collector finds people with dscacheutil on macOS, /etc/passwd on Linux, and profile folders on Windows. Each record carries the name of the person it came from, so a machine used by three people reports three people, never one machine labelled root.
The user and host are read per record, not frozen at enrolment. A workstation changes hands and gets renamed over its life, and the reports follow.
How each signal is attributed
Section titled “How each signal is attributed”| Signal | Attributed to |
|---|---|
| AI usage, plans and lines written (Claude Code, Codex, Cursor) | The person whose home directory the files are in |
| Browsing | The person whose browser profile it is. Each person has their own read point. |
| Network observations | The owner of the process holding the connection |
| Application time and machine state | The person at the console (/dev/console owner on macOS, the logind seat on Linux) |
Enrolment also names the console user rather than root, and shield360 collector status lists the last report for each person.
Things to know
Section titled “Things to know”- Coding-agent hooks aren’t installed from an elevated collector. They would land in root’s home. Run
shield360 coding installas each user, or let the per-user install script do it. - Upgrading is safe. Each person has their own usage watermark. The single watermark from a per-user install is read once for the account that wrote it, so an upgrade doesn’t re-send old usage.
- Git remotes resolve across accounts. The collector reads repository remotes with
safe.directory=*, so an elevated collector can name projects in repositories owned by other accounts. - Key fingerprints reach further. Unprivileged, the collector can read only its own user’s process environments. Elevated, it can fingerprint keys in any process (when policy allows). Some hardened-runtime binaries on macOS still refuse, and those processes simply aren’t fingerprinted.