Hi guys, In my organization there is Windows DC׳s servers with a lot of login users (around 50 users). When I tried to ask query from users or logged_in_users table the process was hang until I kill the process. Anyone meet this? An idea for a solution? osquery 4.3.0

I did put in some speedups to the

users

table since 4.3 on Windows, if that might help

Hi @Mike Myers, When I ask Users from my DC Server I got all of the users under this domain. Is this the desired behavior?

I don't know enough about the desired behavior on domain controllers, but, which table is it that your'e using?

ah, ok.

users

picks up users from the registry and the filesystem, and differentiates between local and 'roaming' I think. Maybe there's a way to filter the ouptut.

So I tell you the problem

maybe the

type

column is relevant for this

When I run this query I have like 32K users on DC - this is include the all org users.

yea, that's how it was before. I believe if you try the 4.6 release you won't have that problem anymore