silly me, that 'version' is also at the same registry path as "DisplayVersion"

Hey Allister, does querying the

registry

table with the DisplayVersion path work? Do you see something like “21H2” ?

pardon, that was what I was saying in my inscrutable way (I'm not good at words sometimes) 😅

Ah, no worries. I was just confirming. Also curious if DisplayVersion returns something like edition + version like “Windows 10 Pro 21H2.” Or, if it just returns “H2"

It returns the ‘version’ you'd see in the GUI, 21H2

What osquery query did you run to get this info?

a variation of this, the last part of the path just would be changed to

Display Version

https://osquery.slack.com/archives/C0FHNQ2N6/p1656076744498079