Title
#general
Stefano Bonicatti

Stefano Bonicatti

08/15/2021, 8:37 AM
That seems an issue with the fact that osquery, to avoid doing network calls, only queries for local users. There’s a similar issue/consequence to that: https://github.com/osquery/osquery/issues/7194
Mystery Incorporated

Mystery Incorporated

08/15/2021, 8:55 AM
Interestingly if I do "net user" as the SYSTEM account, it says the command completed with one or more errors and doesn't list any AzureAD users is that expected?