Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

It is possible that this data could be retrieved via a workaround (like the `kolide_wmi` table) but I have not investigated it much and couldn't say for certain.

<@U018CU81VC1> I just checked and I cannot retrieve this data using WMI either.

I have problem here, I can get this data from powershell script but if there are GPO I don't see this rules.

Yeah, I am unfortunately out of my depth when it comes to GPO/Windows Server

<@U018CU81VC1> I am just offering an idea here. I _think_ most GPO settings are actually just registry keys.

I would use the `registry` table to look up those Registry keys.

You can use the link below to search for GPO options and it will return the Registry path for that setting.

<https://gpsearch.azurewebsites.net/>

For example, the Windows Domain Firewall status is at the following path: `HKEY_LOCAL_MACHINE:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall`

Sounds good, let me check :slightly_smiling_face:

I’m curious to know if this works so let us know :slightly_smiling_face: