fritz
12/01/2021, 4:18 PMusers
and user_groups
tables.
For example if you wanted to find users who belonged to the administrator group on macOS you would run something like:
SELECT
u.uid,
u.username,
ug.gid,
g.groupname
FROM users u
JOIN user_groups ug USING(uid)
JOIN groups g ON ug.gid = g.gid
WHERE g.groupname = 'admin';
+-----+-----------------+-----+-----------+
| uid | username | gid | groupname |
+-----+-----------------+-----+-----------+
| 502 | fritz | 80 | admin |
| 501 | kolide-imac-pro | 80 | admin |
| 0 | root | 80 | admin |
+-----+-----------------+-----+-----------+
Mayan
12/01/2021, 4:21 PM