Do I have to do anything in particular to get the program list updated? "SELECT * FROM programs" It seems like it's not updating very often

Just noticed , 5.2.2 is not available on Choco. I know this is semi-supported but curious what is needed to update this ?

when osquery 5.2.2 (installed using the fleet/orbit msi) runs on domain controllers, the LSASS process takes up 100% cpu and remains, until the osqueryd service is stopped couldn't find any known issues on this, has anyone else seen such behaviour?

hello all, happy St. Patty's day. Running into an issue performing an uninstall of osquery. Osquery was installed using the 4.8.0 .msi installer, so we're trying to perform an uninstall and then update to 5.2.2. When running

"MsiExec.exe /X{0C3DA4C7-F7B7-4C82-9BAC-91BF848A2CF8}"

or

"msiexec.exe /x osquery-4.8.0.msi"

the following error is returned: - Error: "This action is only valid for products that are currently installed"

Prior to the uninstall, osquery is definitely installed - all the directories and registry keys are there.

Hi @Ted Dorosheff -- so, it is behavior that is repeatable if one were to install 4.8.0 using the msi installer and then try to uninstall using the above command? If so we could open an issue to investigate the issue, although it's not a problem that has been reported before to my knowledge

Hey I want to delete the older agent from my hosts but in windows i dont see it in add or remove programs. And new install is not upgrading the older one but doing a fresh new one as separate application. How do i remove old one now?

Hi @Ojas, maybe the old agent was installed through Chocolatey? In that case you can

choco uninstall osquery

from an Administrator powershell.

nope wasnt install through chocolatey

Do you know how it was deployed then? Maybe an administrative install was used? What is the version of the old agent? Do you still have the osquery service?

Has osquery been tried on any Windows IoT editions? I can see that a basic query runs but since there are driver and API differences it makes me wonder if there's a likelihood of any unexpected query behaviour

I'd generally expect the APIs to fail and not return bad data. But I don't know that anyone had much tested it

Hi, I am using the

hash

table in windows and trying to fetch the

sha1

of a few files. However, for some files, I do receive the correct data, while for others I don’t. Can someone please help me understand if there is any reason that I don’t receive the data for some files? I don’t receive the sha1 of

windowsdesktop-runtime-5.0.15-win-x86.exe

while I do get the sha1 of

svchost.exe

Team, Anyone knows how to check for open ports using OS-Query in Windows ??

I figured this out for myself, but for a while I was lazily trying to write a registry query with path LIKE and getting no results. I take it that's intended behavior, that it's a bit dynamic and can't enumerate all possible 'trees' unless I specify the full path?

Total noob to Windows everything, so pardon if this is obvious/has been mentioned in scrollback, but it also struck me as odd that I'm enforcing a key with puppet at path

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs

but auditing it at

HKEY_LOCAL_MACHINE

as the first part of the path ¯\_(ツ)_/¯

@allister don’t know if my long explanation here helps https://github.com/osquery/osquery/issues/7389, but I delved into the code some time ago to describe the current nuanced behavior.

I tried a couple of iterations on the query before sticking to the more obvious working one for now but I'm in agreement that docs or the behavior could be improved to help with this. My amateur way of not knowing the registry may have used that HKLM in the past and it's still there respected as an alias or something just goes to show how not-savvy I am about the platform 😅

Hi! I have a client with the "ALL_APPLICATION_PACKAGES" issue on Windows Server 2019. @Stefano Bonicatti fixed it in 5.0.1 https://github.com/osquery/osquery/issues/7165. My client is using 4.9.0, so the fix is not present. However, before telling them to upgrade, I want to test it in a VM, but I can't reproduce it.

On a Windows Server 2019 everything seems to work, but on another instance the install succeeds but the upgrade fails to set the ACLs.
I'm not sure what is the specific difference between the instances of the same Windows Server version that seem to not have any problem, versus the one that do, but all the issues are around ACLs.

I think I'm facing the same thing with windows instances. Any tips on that?

Hi, Whats the clean way to uninstall and reinstall fleet agent on windows? step 1. Go to programs and uninstall 'fleet osquery' . step 2. Install by double clicking on the msi installer -- is this correct way? the problem I am facing is in step 2, somehow it hangs for a minute and then gives "Fatal error" in installation without any further detail. For now I am shooting in the dark due to lack of descriptive error message. Any idea?

Does anyone have setups to enable windows event logging for osquery in Windows? I keep running into access denied errors , not sure which access is misconfigured

@KM are you running osquery as Administrator? Can you post the errors as they are shown?

is there some magic incantation to do a "more full" build version than the one currently in the os_version table for windows?

supposedly there's some set of more numbers that denote a more specific build after a period-delimited value, like 19044.1767 or something?

(trying to track the follina patch)

@allister That’s a limit of the API used in that table (WMI), but

kernel_info

version

column should have the full one

@allister the segment of the OS version (

1767

) you are referring to is the Update Build Revision (UBR) As @Jason mentioned, you can use the registry to get that info:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR

gotit, thank you all kindly!

Should that

patch

value be

19044.1767

?

Opened https://github.com/osquery/osquery/issues/7657 about this field and maybe getting something more sensible in there