https://github.com/osquery/osquery logo
Title
l

Luke Walker

01/30/2022, 9:33 PM
any documentation on what permissions osquery needs to run? working a strange case where osqueryi.exe on Windows 10 dies with exit code -1073741511 (0xC0000139), and no other message. Execution is being handled by an RMM, but it is running under LocalSystem/SYSTEM.
s

Stefano Bonicatti

01/30/2022, 11:16 PM
What version of osquery?
That message might be relative to the fact that’s not finding a dll it needs to run. That been said, osquery can also run as a normal user, you won’t have access to everything in the tables, but it shouldn’t be unable to run, especially not throw an exception
l

Luke Walker

01/31/2022, 1:26 AM
wish I knew which DLL it was talking about then
version is 5.2.1
if I move osqueryi.exe directly into
%windir%\System32
, it works. Might be something quirky with environment & .NET, I'll have to go digging there later. At least it works now.
s

Stefano Bonicatti

01/31/2022, 8:48 AM
That’s strange/unexpected, but anyway osquery doesn’t use .NET it’s a “classic” C/C++ application.