https://github.com/osquery/osquery logo
#kolide
Title
# kolide
m

maxwhite

07/22/2022, 6:13 PM
In fact our main "project" was to query for the minimum required password length for a local (non-AD) account; The only way we found was to enable an audit that would be sent to the Events Viewer; Would-you have another way? Thank you!
t

terracatta

07/22/2022, 6:22 PM
Out of curiosity what was the audit you enabled?
m

Mathieu Marcotte

07/22/2022, 6:24 PM
MinimumPasswordLengthAudit
t

terracatta

07/22/2022, 6:25 PM
beyond the audit, do you have any local policies that could be detected with something like
secedit
?
If so, we may be able to help there.
m

Mathieu Marcotte

07/22/2022, 6:27 PM
hmm, to be honest, I don’t even know what is secedit, but i’m all ear!
just a screenshot of the log. As we don’t have a lot of windows, we usually just use local accounts that’s why. In the end, we only want to make that the password has a minimum length, and just have an alert if it is not
t

terracatta

07/22/2022, 6:33 PM
Got it @fritz is gonna DM you some info that will help in a few minutes. That said, we need to also write a blog post about how to best capture things in the event log generally. But we should be able to get you sorted on this goal.
m

Mathieu Marcotte

07/22/2022, 6:46 PM
thanks, @fritz was able to help me, props to him!
t

terracatta

07/22/2022, 6:46 PM
he’s the best.
f

fritz

07/22/2022, 6:48 PM
🥳 🦜
2 Views