Has anyone tried parsing Windows sdb files with os...
# core
d
Has anyone tried parsing Windows sdb files with osquery? For example,
windir%\security\database\secedit.sdb
, which stores local policy configuration (password complexity requirements, etc) Unfortunately its contents are binary encoded, so its not as simple as using augeas (unless I am missing something)
s
Is this data what
secedit /export
dumps? (launcher has a wrapper over that)
d
Yes exactly
Can you remind me - are those tables licensed FOSS?