I haven't verified your path but it would be somet...
# sql
f
I haven't verified your path but it would be something like: (sorry reposted because I left out a wildcard)
Copy code
SELECT * FROM registry WHERE path LIKE 'HKEY_USERS\%\Software\Microsoft\Office\%'
h
@fritz This query is the same as the one I used here, but a colleague said it could be a permission issue. I saw that osquery was running as a system on windows, I changed it to run as an administrator and it worked.