Hey I m looking to query AzureAD users that have local admin

Question

Hey I m looking to query AzureAD users that have local administrator rights to their local machine it looks like this isn t possible as osquery will only report back the local users Instead I thought we could target the windows event log for Security event ID 4732 however when running this against a machine it does not report back anything from the event log

Tilman Bender · Answer

Have you had a look at the logon sessions table

Tilman Bender · Answer

Not sure logins using an AzreAD account would show up in there but it might be worth a try

Luke Wolfenden · Answer

```SELECT FROM logon sessions ```

Luke Wolfenden · Answer

shows the AzureAD accounts but does not show what local groups they belong to

Tilman Bender · Answer

hhmmm does it show a SID

Tilman Bender · Answer

I wrote a query just yesterday to detect local admins logged in interactively

Luke Wolfenden · Answer

yes shows logon sid here are the full results

Luke Wolfenden · Answer

ElonMusk is the logged on user that I m trying to query

Luke Wolfenden · Answer

for this particular device but that would change depending on the device

Tilman Bender · Answer

hang on I ll grab my query for local admin maybe you can work from there

Luke Wolfenden · Answer

woop thanks

Tilman Bender · Answer

`SELECT FROM logon sessions` `INNER JOIN users ON logon sessions logon sid = users uuid` `WHERE logon type= Interactive AND gid=544 `

Tilman Bender · Answer

so this is for interactive logons for users whose gid matches 544 which seems to be the gid for the local Administrators group

Luke Wolfenden · Answer

alright I ll have a look slightly smiling face

Luke Wolfenden · Answer

doesn t work for AzureAD accounts the gid doesn t correlate to the local gid s possibly because it s not the primary gid for example my one for ElonMusk is 2750818564 it was worth a try though

Luke Wolfenden · Answer

I think windows event logs might be able to help here but it doesn t seem to be letting me query event logs by default on windows devices

Tilman Bender · Answer

Ah pity EIther way we learned sth new slightly smiling face