Is it right to say that the users listed in fleet for linux devices are only users that have a shell? So for example, it is not listing the nginx www-data user.

I tested this in our Fleet environment and that user is returned. Can you share the query you're using?

@Kathy Satterlee I’m just letting fleet do whatever it does by default