For windows, some of this stuff might be lurking in the registry around

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WinBio\AccountInfo\%\EnrolledFactors

,

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\NgcPin\Credentials\%\EncryptedPassword

, and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\FaceLogonEnrolledUsers\%

Removal of individual fingerprints:

log stream --predicate 'subsystem == "com.apple.preference.passwordpref" && eventMessage CONTAINS[c] "removeFingerprintWithUUID"'

@Brad Girardeau I saw you had some issues with the

unified_logs

table. Do you have or know of example code querying that I could use? re your comment

What we're doing is something like this instead:

with now_ts as (
  select unix_time as t from time
),
filtered_log as (
  select * from unified_log where
    timestamp > -1 and
    timestamp > (select t - 720 from now_ts) and
    max_rows = 10000 and
    predicate = concat(
      '([event predicate1]) || ',
      '([event predicate2])'
    )
),
event_type1 as (
  select 
    'event_type1' as event_type, timestamp, message from filtered_log where ...
),
event_type2 as (
  select
    'event_type2' as event_type, timestamp, message from filtered_log where ...
)
select * from event_type1 union
select * from event_type2

This does a single query to the unified log to get a copy of different event types that pass any of multiple initial filtering predicates, then further tables query each of the events of interest into a common set of columns (using

json_object

for comes in handy there). It only goes back in the log for at most 12 minutes to keep runtime and resource usage more under control, so just accepting some event loss here outside that lookback. I'd like to dig in more and get that 12 minutes up to a few hours at least. Already had to bump watchdog settings especially for memory (~3.5GB) to avoid this getting denylisted on most machines, and does get denylisted for ~5% of our fleet on any given day still. Some apps just seem to spew a huge amount of noise into this log. You could try being even more permissive in watchdog settings, at risk of more problems from a bad query elsewhere