Join Slack
Powered by
Why would the `system_info.uuid` value change on b...
# general
s
Shawn Maddock
12/31/2024, 9:22 PM
Why would the
system_info.uuid
value change on bare-metal Windows devices?
Shawn Maddock
12/31/2024, 9:39 PM
Answer: because WMI is returning a placeholder (all zeros)
https://github.com/osquery/osquery/blob/6a8a7f7b2bba4c3de12731890ac538dee7e7228d/osquery/core/system.cpp#L166
Shawn Maddock
12/31/2024, 9:46 PM
I wish there was a way when querying the table to see that log message.
Shawn Maddock
12/31/2024, 9:49 PM
I suppose I can check if the UUID is a v4 and then exclude it if so
Shawn Maddock
12/31/2024, 10:12 PM
Hypervisors and cloud providers use v4, which makes sense, but so does Dell... so much for a hardware-based value.
15
Views
Open in Slack
Previous
Next