greetings all, 2 part question. 1) when stopping osqueryd service, there still remains an osqueryd.exe process, which I assume is the watchdog process. this looks to keep a lock on osquery.db/, which prevents a clean uninstall. is that expected behavior? 2) I'm trying to build a custom msi with the WiX toolset and using a custom action to taskkill osqueryd.exe, but that doesn't work. anyone have some experience there? I'm using 3.3.1 from git as my source and testing on Windows 10.

1.) Not expected behavior. If you can reliable repro this would you mind cutting an issue for us? We had issues with this previously, and we've seen it happening in our environment, but specifically it's only when we have extensions running with the watchdog process disabled. Osquery on it's own, no extensions, with watchdog enabled doesn't seem to have this issue from what I've seen on 3.3.1

1) We are running with the watchdog process enabled with extensions. I can reliably reproduce this, so I'll file a bug for you.

Thanks!