The reason I ask is that we are hosting an inciden...
# fleett
Tor
11/07/2023, 3:25 PMThe reason I ask is that we are hosting an incident response exercise where osquery and fleetdm is one of the tools provided. The Linux hosts are perfectly fine, but queries against the windows domain-joined machines fail. There is a message in the logs that says “Requires Fleet Premium Licence” against the AP endpoint /api/latest/fleet/device (this was 4.33.1; updating to 4.40.0 now).
g
Grant Bilstad
11/07/2023, 3:41 PMHey @Tor,
Windows hosts shouldn't need licensing. The Windows endpoints are not responding to live queries? Believe the log message is a "red herring" as some features are enabled out of the box for Windows on fleet free to make certain things work.
t
Tor
11/07/2023, 4:14 PMHm. No, they do not :-) and “Last fetched” says “14 days ago”, while they all tell me they are on line :-)
Tor
11/07/2023, 4:15 PMRefetch does not work, and the orbit (in this set I am not using standard osquery) binary is running on all hosts.
Tor
11/07/2023, 4:24 PM(14 days ago was when we installed the environment.)
Tor
11/07/2023, 6:18 PMFound the issue! Appears that we didn’t use —insecure for the Windows hosts.
Tor
11/07/2023, 6:22 PM(Rather, we did to begin with, but reinstalled the clients a few hours later without.)
g
Grant Bilstad
11/07/2023, 11:34 PMGlad to hear, thanks @Tor Please reach out for any further support fleet
t
Tor
11/08/2023, 8:25 PMThere also (or perhaps this was the root cause) was an issue with the windows log directory definition being /var/log.
4 Views