I also note that my queries which used to contain TargetUser

Question

I also note that my queries which used to contain TargetUsername for event log 4625 no longer contain any username I suspect it is related to this

roberto · Answer

hey indeed sounds like it s related Do you have teams

Mystery Incorporated · Answer

< roberto> when I look at the documentation for agent options it sends me to the configuration for the fleet binary here

Mystery Incorporated · Answer

< roberto> free user but teams or free the documentation says it is enabled by default and to be sure I set it in my config yaml ```features enable host users true enable software inventory true``` So given documentation says it defaults to true and I have put this in my config yaml why would in not show to me

roberto · Answer

I was asking because you can override the config at the team level too so if you have teams that might have been the problem Are you able to share your full config yaml ideally the output of running `fleetctl get config` In the meantime I will try to reproduce on my end

Mystery Incorporated · Answer

To do that you gotta make a teams yaml for the team yes

roberto · Answer

to configure a team yes you need to make a teams yaml but you still could have created a team from the UI Either way if you don t have teams then it s not relevant +1