Title
#general
d

demonbhao

12/02/2020, 7:11 AM
Hello, I would like to ask why the osquery query table Users can query the domain account information, I would like to know how to query the users table
Mike Myers

Mike Myers

12/02/2020, 3:59 PM
Tables are documented on the schema webpage at osquery.io/schema and for each, there's a link to the "table spec" file which sometimes has query examples at the bottom. The
users
table on Windows doesn't really query domain account information. It lists the domain user accounts that have logged into the local endpoint and left a record in the registry.
4:00 PM
There's currently no domain-user-enumerating table
sundsta

sundsta

12/02/2020, 4:23 PM
Unless osquery is running on a domain controller. Then you will be enumerating domain users.
d

demonbhao

12/04/2020, 9:27 AM
Hello, yes, my domain controller has osquery deployed, but when I query the users table of other machines, all domain accounts will also appear, why?Here are the results I got after querying the two machines, both containing the native account and the domain account but both machines are my domain management controller
Mike Myers

Mike Myers

12/04/2020, 5:06 PM
This may not answer your question but, the
users
table reads both the local machine users and the Roaming Profiles registry key which should (?) only have the domain users that have signed in locally.