10/29/2019, 1:11 PM
Hello, I have an issue with Windows permission. I followed the documentation instruction but it hasn't worked. I obtain the following error when executing osquery_utils.ps1:
Exception when calling "RemoveAccessRule" with arguments "1": "Some or all identity references could not be converted."
1:11 PM
The code which fails is (lines 73-79):
$acl = Get-Acl $target

    # First, to ensure success, we remove the entirety of the ACL
    $acl.SetAccessRuleProtection($true, $false)
    foreach ($access in $acl.Access) {
I think it's due to osquery_utils try to remove permission to ALL APPLICATION PACKAGES and it fails. Also, I think the permissions are correct. I have disabled the inheritance and the only ones have permissions are SYSTEM, Administrators and ALL APPLICATION PACKAGES.
1:12 PM
I have Windows Server 2019 and Osquery 4.0.2. The fact to change permissions is due I have obtained the error
osqueryd has unsafe permissions: C:\Program Files\osquery\osqueryd\osqueryd.exe
I already wrote about it: https://osquery.slack.com/archives/C08V7KTJB/p1571911570146100 Could you help me?