I saw that this question was asked before but I did not see

Question

I saw that this question was asked before but I did not see an answer so I apologize if this is repetitive Is there any way to use osquery to get visibility into the Group Policy configurations deployed on a system

seph · Answer

Are they in the registry

seph · Answer

Anyhow the internet suggests a couple of interesting blog posts

Guillaume · Answer

Most GPO settings are in the registry

Guillaume · Answer

Some are very easy to query for and obvious others are a bit of a PITA because they aren t boolean or simple values but bitmasks

Guillaume · Answer

for example the password policy if I remember correctly

Guillaume · Answer

that being said if you have some specific examples I can probably help you out

Harrison · Answer

Thanks for the responses I would be interested in the password information and also to ensure that screen locks after a specified time of inactivity are configured

Harrison · Answer

< Guillaume> Any example of a GPO would be great

Guillaume · Answer

OK sure so since most GPO settings are in the registry you can usually figure out what the keys and values are by opening ADM files

Guillaume · Answer

Then osquery has a registry table that lets you select all of it including wildcards

seph · Answer

The uptycs blog post had an example of this

Guillaume · Answer

haha I was about to post it I wrote it slightly smiling face

seph · Answer

I assumed stuck out tongue

Guillaume · Answer

So there is an example with StickyKeys in it <https www uptycs com blog windows registry osquery the easy way to ensure users are secured>

Guillaume · Answer

The thing that makes it a bit of a pain sometimes is you have to be careful about 2 things some policies are per computer easy enough and some are per user a bit harder use wildcards and map back to the users table The second thing is the simple examples are good for understanding how it works but in reality you should also query for the existence of a key and fail on the lack of it

Guillaume · Answer

ex you are checking registry key X for value 1 by selecting it where =1 well it could be set to 0 or it could also not exist