Title
#fleet
Mystery Incorporated

Mystery Incorporated

06/22/2021, 5:23 PM
Yea so now wierdly it works from the cmd prompt but not when ran as a windows service
Chris

Chris

06/22/2021, 5:26 PM
I recall having issues with the Windows service at one point. Mine was related to the exec path. In services.msc, what does your path to executable have? mine reads:
C:\Program Files\osquery\osqueryd\osqueryd.exe --flagfile "C:\Program Files\osquery\osquery.flags"
Mystery Incorporated

Mystery Incorporated

06/22/2021, 5:27 PM
"C:\Program Files\osquery\osqueryd\osqueryd.exe" --flagfile="C:\Program Files\osquery\osquery.flags"
Chris

Chris

06/22/2021, 5:29 PM
You may need to tweak the service to not have the executable quoted, only the flagfile parameter quoted
Mystery Incorporated

Mystery Incorporated

06/22/2021, 5:29 PM
Looks like that gonna be a PwrShl thing eh? No ability with UI
Chris

Chris

06/22/2021, 5:31 PM
Ya. https://osquery.readthedocs.io/en/stable/installation/install-windows/ Look under the "Install manually" section. There are a couple of ways to do it. I wish I could remember which one worked for me, but I did have trouble with it.
5:32 PM
What version of Windows are you on? I had these issues on 2012 R2, but the installation worked fine on 2016