https://github.com/osquery/osquery logo
Title
t

tokcum

06/24/2022, 7:41 AM
Hi, I'm trying to figure out local Admins on Windows endpoints but I'm struggling because osquery only returns local accounts. User accounts from the domain are missing. Here is the query I use:
SELECT * FROM users JOIN user_groups ON users.uid = user_groups.uid WHERE user_groups.gid = 544;
A quick look at the user_groups table reveals that only local user accounts are related to local groups.
SELECT * FROM user_groups;
Am I missing something?
s

seph

06/27/2022, 2:27 AM
Yes — osquery limits the scope of what it gathers to local users. I believe this is mentioned in the table schema. At least one of the reasons for this, is that most domains have a lot of users, and it tends to not be what people want returned. (Imagine a domain with thousands of users)