Hey does anyone know why I can get results running

SELECT * FROM screenlock

from

osqueryi

but when the daemon runs it as scheduled query I get none results?

It will only return results when running under the user’s context. See https://github.com/osquery/osquery/pull/6243

I am logged in, wondering if the reason is because I am logged in as a user using

osqueryi

but

osqueryd

runs as root and it is not logged in?

Exactly right @Julian Scala

Cool! Thanks for the help! osquery

Saw there was some work being done with

kolide_screenlock

table… is there any way to get screenlock info from the current version of launcher/osquery?

Hi @Kyle! Yes you can use launcher and the

kolide_screenlock

table to query the screenlock settings remotely:

osquery> SELECT * FROM kolide_screenlock WHERE user = 'fritz-imac';
+---------+--------------+------------+
| enabled | grace_period | user       |
+---------+--------------+------------+
| 1       | 0            | fritz-imac |
+---------+--------------+------------+

@fritz Works like a charm, cheers!

@fritz hello! Do I understand correctly that this is a proprietary Kolide table and there is no plan to do something similar in the generic version of osquery? (now it is not possible to use the screenlock table remotely) Is it allowed to use kolide_screenlock table without Launcher? For example, to make a standalone extension with this table.

Hey Artem, none of the work is proprietary it is released under the MIT license feel free to use the code in any manner you choose including in your own extensions.

Got it! Thanks!