Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hey guys, has anyone used the 'ntfs_acl_permissions' table? Can't seem to figure out how it should be used, `select * from ntfs_acl_permissions where path LIKE`  with any path or file doesn't seem to give any results.

Does it work with an explicit path? A common osquery pattern is to require path, and if you want wildcards join against the file table for that expansion

Hey <@U7QP20JQH> I also tried with different paths and there are no results, are there any specific requirements to get NTFS ACL results?

Commands Get-Acl and icacls both give me NTFS ACL data but the query does not give me anything.

<@UFD00523D> What does your path look like? Can we see an example query?

The one I use to test.
`select * from ntfs_acl_permissions where path = 'C:\Program Files\osquery\osqueryi.exe';`
This query does not result anything.

Results from Get-Acl
```&gt; Get-Acl -Path 'C:\Program Files\osquery\osqueryi.exe'


    Directory: C:\Program Files\osquery


Path         Owner               Access
----         -----               ------
osqueryi.exe NT AUTHORITY\SYSTEM NT AUTHORITY\SYSTEM Allow  FullControl...```

<@UFD00523D> my windows internals knowledge is not terrific, however i just did some of my own testing and it appears that certain files will produce output and others will not.

For example on your test device try running: `select * from ntfs_acl_permissions where path = '\Program Files'`

I’ve seen this as well, and I’ve always assumed it’s that I don’t understand which things are ntfs acls, vs some other windows filesysytem acl.

That is interesting....
```&gt; select * from ntfs_acl_permissions where path = 'C:\Program Files\';
+-------------------+-------+-------------------------------------+--------------------------------------------------------------------------------------------------------------+----------------+
| path              | type  | principal                           | access                                                                                                       | inherited_from |
+-------------------+-------+-------------------------------------+--------------------------------------------------------------------------------------------------------------+----------------+
| C:\Program Files\ | Grant | TrustedInstaller                    | Specific Rights All,Delete,Read Control,Write DAC,Write Owner,Std Rights Required,Synchronize,Std Rights All | No Inheritance |
| C:\Program Files\ | Grant | TrustedInstaller                    | Generic All                                                                                                  | Unknown        |```
Did not expect that to work at all.
<@U1YQUKL3X> it seems to only work on folders not files, am I correct?

That was the behavior which I encountered.

I know nothing about ntfs acl so I can't comment on what the expected behavior should be.

Thanks for your help <@U1YQUKL3X>, I thought i understood NTFS ACLs but this table does not work as I would have expected, it might need a rework, but I am not knowledgeable enough to do it.

Files do have ACLs, this is probably an osquery bug

<@U7DT2E8B0> I also think so, and I couldn't get deeper into "program files" I will file a bug report for this