Hello, I looked up /etc/shadow on the Fleet UI and got a different result than if I went to cat /etc/shadow directly on the target server I'm not sure why querying the Shadow table would query test1111111 but looking at /etc/shadow on the local machine without Test1111111

If you open

osqueryi

in that shell do you get that test result?

Yes, open the qsqueryi query and the results will be the same as on the Fleet UI