Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I also note that my queries which used to contain TargetUsername for event log 4625 no longer contain any username, I suspect it is related to this?

hey! indeed sounds like it's related. Do you have teams?

<@U03CZEZMK4J> when I look at the documentation for agent options it sends me to the configuration for the fleet binary here <https://fleetdm.com/docs/deploying/configuration#agent-options>

<@U03CZEZMK4J> free user but teams or free the documentation says it is enabled by default and to be sure I set it in my config.yaml
```features:
  enable_host_users: true
  enable_software_inventory: true```
So given documentation says it defaults to true, and I have put this in my config.yaml, why would in not show to me?

I was asking because you can override the config at the team level too, so if you have teams that might have been the problem.

Are you able to share your full config.yaml? ideally the output of running `fleetctl get config`

In the meantime, I will try to reproduce on my end

To do that you gotta make a teams.yaml for the team yes?

to configure a team, yes you need to make a teams.yaml, but you still could have created a team from the UI. Either way, if you don't have teams then it's not relevant :+1: