How to List Users Across All Mac, Windows, and Linux Devices

Introduction

Most modern operating systems (including macOS, Windows and common Linux distributions) include the concept of users. A user (account) allows an end-user to authenticate (typically login via password) to a system and access the resources to which they have adequate permission to view/modify.

Each user on a device is represented by a unique identifier (typically a UID), which allows the operating system to correlate that user with the various resources and their individual access permissions.

Each user account typically has a home directory where they can store data, which is inaccessible to other users on the device (without authentication).

Users can be part of one or many user groups which grant them additional privileges or permissions. For example on a macOS device a user may be part of the 'admin' group which allows them to perform certain actions (such as creating or deleting other user accounts, and changing system-wide settings).

What User Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Users from Mac, Windows, and Linux devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Users Schema

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

SELECT 
  device_name, 
  username, 
  password_last_set_at,
  ROUND(EXTRACT(epoch FROM CURRENT_TIMESTAMP(0)::TIMESTAMP WITHOUT TIME ZONE - password_last_set_at)/86400) AS password_age_days
FROM device_users 
WHERE password_last_set_at IS NOT NULL
-- Specify threshold for password age
AND password_last_set_at < (NOW() - interval '90 days')
-- Omit system accounts on macOS
AND uuid NOT LIKE 'FFFFEEEE%'

WITH
_human_users AS (
  SELECT 
    device_name, uid, username, directory, shell, uuid, d.type AS device_type
  FROM device_users du
  JOIN devices d ON du.device_id = d.id
  WHERE SUBSTR(uuid,1,7) != 'FFFFEEE' 
  AND shell != '/usr/bin/false'
  AND directory LIKE '/Users/%'
  AND d.type = 'Mac'
  GROUP BY device_name, username, uid, directory, shell, uuid, d.type
),
merge_user_data AS (
  SELECT
  device_name, uid, username, shell
  FROM _human_users)
SELECT * FROM merge_user_data;

Why Should I Collect Users?

Understanding the user accounts on a device, and the level of permission which they have, is a common device compliance requirement for Security and IT teams. It is generally recommended that you do not have any more accounts with admin level privileges than absolutely necessary.

Many applications are installed on a per-user basis and it can be important to collect user information in order to correlate specific software or preferences with an individual user account.

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

User information may contain usernames or full names of private (non-work) accounts which are not intended to be shared with an employer. For example, if you are using a BYOD device and you keep a separate user account for contracting work for another company, you may wish not to share this information with your organization.

When you use Kolide to list User data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.