On 4.3.0 there is the new

screenlock

table

FYI this table only works when osquery is run from a user context (you can still run it as root, but not via

launchctl asuser 0

good to know, thanks 👍

the other thing to note is even if you run osquery with the right user id context, that user must be currently logged in otherwise the query still won't work

@terracatta so, will this table work via next version of kolide fleet using osquery with root priveleges on endpoints?

I suspect the data is stored in a keychain, or similar protected context. So unless the user is logged in, the data is inaccessible. (At least, that’s how the undocumented APIs seem)

Got it! Thanks!