Title
#sql
f

fritz

04/12/2021, 3:35 PM
I haven't verified your path but it would be something like: (sorry reposted because I left out a wildcard)
SELECT * FROM registry WHERE path LIKE 'HKEY_USERS\%\Software\Microsoft\Office\%'
Hello_There

Hello_There

04/12/2021, 5:06 PM
@fritz This query is the same as the one I used here, but a colleague said it could be a permission issue. I saw that osquery was running as a system on windows, I changed it to run as an administrator and it worked.