@thor Do you have information about that output? I0307 12:36:24.151345 3140 extensions.cpp:300] Could not autoload extensions: Failed reading: \ProgramData\osquery\extensions.load

Looks like path issue.

C:

is missing. Try to add complete path to your

extensions.load

in flags file.

--extensions_autoload=C:\programdata\osquery\extensions.load

if so, this is a bug. @thor

How is this a bug? The extensions autoload path needs the same permissions as the daemon, and this should be heavily documented in the readthedocs, if not thats an issue.

İf the osquery install to certain folder (programdata) and the extention file already exists in default folder, in this case why do i need to modify or add a thing to a thing. İ think it should work without adding or modifying a thing

Who is putting the extension file there? From what I know this isn't something that osquery is dropping for you, so this is a "bug" with whatever endpoint management you're using 😐 and/or however you're configuring your flags file.