Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

In fact our main "project" was to query for the minimum required password length for a local (non-AD) account; The only way we found was to enable an audit that would be sent to the Events Viewer; Would-you have another way?

Thank you!

Out of curiosity what was the audit you enabled?

beyond the audit, do you have any local policies that could be detected with something like `secedit` ?

hmm, to be honest, I don’t even know what is secedit, but i’m all ear!

image.png

just a screenshot of the log. As we don’t have a lot of windows, we usually just use local accounts that’s why. In the end, we only want to make that the password has a minimum length, and just have an alert if it is not

Got it <@U1YQUKL3X> is gonna DM you some info that will help in a few minutes. That said, we need to also write a blog post about how to best capture things in the event log generally.

But we should be able to get you sorted on this goal.

thanks, <@U1YQUKL3X> was able to help me, props to him!