Add group information to Windows.sys.users #2004
phillmoore-ccx
started this conversation in
Ideas
Replies: 1 comment
-
Maybe this is better done as a normal hunt? there has to be a line between what we do in an interrogation flow and a regular artifact collection. We typically would only gather essential information in an interrogation flow (for populating the internal index for searching etc) but we did experience a bit of scope creep lately with Generc.Client.Info. In any case you can extend Generic.Client.Info as you wish - if you name the new artifact Custom.Generic.Client.Info it will be used instead during enrollment so you can have whatever extra data you need. You can also update the dashboard visible in Host Info screen the same way. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
From an audit perspective it would be useful to query the group information of all users returned by Windows.sys.users per host
would have to cover both local and domain accounts in both local and non-domain-joined workstations
Beta Was this translation helpful? Give feedback.
All reactions