Hey guys, has anyone used the 'ntfs_acl_permissions' table? Can't seem to figure out how it should be used, 

select * from ntfs_acl_permissions where path LIKE

  with any path or file doesn't seem to give any results.

Does it work with an explicit path? A common osquery pattern is to require path, and if you want wildcards join against the file table for that expansion

Hey @seph I also tried with different paths and there are no results, are there any specific requirements to get NTFS ACL results?

@SK What does your path look like? Can we see an example query?

The one I use to test.

select * from ntfs_acl_permissions where path = 'C:\Program Files\osquery\osqueryi.exe';

This query does not result anything.

@SK my windows internals knowledge is not terrific, however i just did some of my own testing and it appears that certain files will produce output and others will not.

I’ve seen this as well, and I’ve always assumed it’s that I don’t understand which things are ntfs acls, vs some other windows filesysytem acl.

That is interesting....

> select * from ntfs_acl_permissions where path = 'C:\Program Files\';
+-------------------+-------+-------------------------------------+--------------------------------------------------------------------------------------------------------------+----------------+
| path              | type  | principal                           | access                                                                                                       | inherited_from |
+-------------------+-------+-------------------------------------+--------------------------------------------------------------------------------------------------------------+----------------+
| C:\Program Files\ | Grant | TrustedInstaller                    | Specific Rights All,Delete,Read Control,Write DAC,Write Owner,Std Rights Required,Synchronize,Std Rights All | No Inheritance |
| C:\Program Files\ | Grant | TrustedInstaller                    | Generic All                                                                                                  | Unknown        |

Did not expect that to work at all. @fritz it seems to only work on folders not files, am I correct?

That was the behavior which I encountered.

Thanks for your help @fritz, I thought i understood NTFS ACLs but this table does not work as I would have expected, it might need a rework, but I am not knowledgeable enough to do it.

Files do have ACLs, this is probably an osquery bug

@Mike Myers I also think so, and I couldn't get deeper into "program files" I will file a bug report for this