Anyone able to fetch 'Assigned to' attribute using ACC-V

[pratik0306]

Hi All,

Anyone able to fetch 'Assigned to' attribute using ACC-V approach? I see that this feature has been made available and it requres system property to be enabled plus local admin access for the user on the system where agent is deployed.

Would like to know if anyone has done it successfully.

[pratik0306 · Accepted solution]

Hi @MDAQUIBK ,

You need to enable the system property which James mentioned here in thread and also the agent should be running under System user istself and not as a service account. So if you are deploying the agent from third party then make sure u pass the option for LOCALUSERNAME=System so that post install it doesnt run under any other user

[James Hammond]

@pratik0306& @MDAQUIBK 
The docs site has an article that shows how to pull the information, using System Properties on your instance

Populating Assigned To attribute in Computer CI for ACC-V 

If this isn't working, let us know on the thread

Regards

James

[Doci1]

I would start with default check definiton "TestCheck - OSQuery [Windows]", there is a parameter "5. SELECT * FROM logged_in_users JOIN users WHERE users.type = 'local' OR users.type = 'roaming'"

Run it against several target devices and if it is what you want, create simple check with plugin osquery and process the result for IRE. 

[MDAQUIBK]

Hi @Doci1 ,

I tried to test the check definition using test check related links but no luck . Could you please help me ?

Do we need any specific role or user access to test the osquery?

Please find the screenshot below of the error message:

[Doci1]

Interesting, our ACCs are running under SYSTEM and yes, if I run that Test check, it gives me a valid result. Do a print screen of the whole test check.