https://github.com/osquery/osquery logo
Join Slack
Powered by
If that script isn’t working, I’d probably look at...
# windows
s
If that script isn’t working, I’d probably look at setting the permissions manually. What are they set to now?
e
Hello Seph, Yes, I do it. But I can't modify permissions for ALL APPLICATIONS PACKAGES, it have special permissions.
s
I am by no means a windows expert.
But I’d start by looking at the permissions, and trying to manually correct them.
What are the permissions there?
e
I try to remove write and delete permisions but it doesn't work. They are: + Show folder/read data. + Read extended attributes. + Write extended attributes. + Delete. + Read permissions.
s
Could you please show what you’re doing? I can’t be a second set of eyes, if I can’t see the commands you’re running
e
These's the groups which have permisions in 
osqueryd
directory:
s
Can you manually remove the ALL APPLICATIONS PACKAGES grant there?
e
And ALL PACKAGES APPLICATION have the following special permisions are:
Windows doesn't allow
s
From a powershell window, can you run 
icacls.exe
with the directory osquery is in?
e
s
Can you runn that against the directory, not the binary?
from there 
icacls.exe .
should work
I’m trying to read docs about what this is, and whether or not it’s possible to remove that permission grant
What version of windows is this?
e
Windows Server 2019
It doesn't work. I think this group is used to can execute the programs. And the permissions could be correct. But I don't know why it fails.
s
That group has write access. osquery doesn’t like that.
You can either remove the write access, or run osquery with 
--allow_unsafe
flag. I’m less sure whether this represents an osquery bug.
e
I removed it and it does't work
s
Removed what? The permissions? What do you mean didn’t work? Windows doesn’t support removing it?
e
I removed write permissions and osquery report the same error
s
does icacls.exe show the permissions as gone?
I’ve copied this information into https://github.com/osquery/osquery/issues/5965 Hopefully more windows oriented people can take a look
e
okay, Thanks! And yes, without write permission also doesn't work
s
Can you show that with icacls?
e
s
Can you run that on the enclosing folder, not the binary?
e
s
can you also 
get-acl
in that directory?
e
s
And the directory please.
e
This is the directory
s
Thgat looks like 
get-acl osqueryd
which is the binary. Can you also 
get-acl .
e
s
Thank you. Those permissions seem to match the docs
I don’t know if I’m going to be able to dig into it. but https://github.com/osquery/osquery/issues/5965 exists at least
2 Views
Open in Slack
PreviousNext
Powered by