I’m chatting with someone, who points out that on windows,

users

returns roaming users, but

user_groups

does not return their memberships in local groups. I remember we didn’t want to fetch all the remote groups and memberships, but I don’t remember if there’s a way to get roaming users in local groups. Does this this ring a bell for anyone?

Not really, but does osquery logs something in verbose mode when querying

user_groups

? There's logging if the

NetUserGetLocalGroups

API fails. But it could also be that that function won't return any groups for roaming users, not too sure.

I don’t have good access to a test device, I’m sorta assuming that from the

Local

in

NetUserGetLocalGroups

that it’s intentional

from the

Local

in

NetUserGetLocalGroups

that it’s intentional

Well but the local part is for the groups, so I would expect that it would return the local groups any user passed to it is member of.

It doesn’t. But I don’t understand yet. I wonder if it’s related to the way we create uids

NetUserGetLocalGroups

works with usernames. The table uses all the usernames that the

users

table has basically.