Do you still get results, in addition to the error? (May depend on what your queries are) Because the osquery source code describes this problem. https://github.com/osquery/osquery/blob/master/osquery/events/windows/ntfs_event_publisher.cpp#L535-L559