Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Does anyone have a bash script (macOS/Linux) and/or powershell/batch script that updates osquery endpoints with a flagfile

I ran the "newer" exe and it still didn't update.

&gt; I ran the “newer” exe and it still didn’t update.
What does this mean?

Ooops. I meant the .msi

```powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest <https://pkg.osquery.io/windows/osquery-4.7.0.msi> -OutFile C:\windows\temp\osquery.msi"
C:\windows\temp\osquery.msi /quiet```

The current installation is 4.5.0

Trying to manually update one agent for 4.7.0

I'd like to do this via group policy scripts on some endpoints.

<@U7QP20JQH>

I’m not an expert window admin — so that’s running the msi in quiet mode, right? Did it actually install?

I doubt there’s any restart there, so there may well be a new osquery on disk, but you need to restart it. (maybe?)

I don’t know if the MSI overwrites the config or flags file. So that’s something to check

From a powershell, you can invoke `osqueryd.exe --version` to see what the version on disk is

Oh, wait… Windows doesn’t let you replace an open file. And the service manager has osqueryd.exe open. So there’s some chance an MSI install will fail. Also worth trying without `/quiet` and seeing what it does.

Thanks for the response!

No worries. I actually had similar thoughts. I have to do the same on a few linux boxes too. Similar concept except bash. <@U7QP20JQH>

linux and macos are different, in that you _can_ replace a binary that’s open. Windows won’t let you

But I don’t know if the osquery MSI stops  the service first, or is generally flagged as upgradable