Contents

How to List Microsoft Licenses Across All Windows Devices

Using Kolide, you can easily view and query Windows Microsoft Licenses across your fleet.

Introduction

Microsoft Windows includes a software licensing service utility which can verify and/or alert users about the license status of their official Microsoft products (eg. Microsoft Windows, Microsoft Office).

License details include the specific version and family of the product (eg. Microsoft Office 2019 Pro Plus - Retail), the genuine / licensed state of the software, and the partial product key associated with the installation.

What Windows Microsoft License Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Windows Microsoft Licenses from Windows devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Windows Microsoft Licenses Schema

Column	Type	Description
id	Primary Key	Unique identifier for the object
device_id	Foreign Key	Device associated with the entry
device_name	Text	Display name of the device associated with the entry
genuine	Boolean	`true` if the product passes Genuine Advantage check; otherwise `false`
identifier	Text	The product identifier
license_family	Text	Specifies the group identifier for the SKU used to determine license relationships for add-ons
license_status	Enum::Text	Specifies the license status of this product application Can be one of the following: `Unlicensed` `Licensed` `Out-Of-Box Grace` `Out-Of-Tolerance Grace` `Non-Genuine Grace` `Notification` `Extended Grace`
license_status_reason	Text	Specifies the license status. Provides additional information about why a computer is in a specific licensing state
name	Text	The display name of the product
partial_product_key	Text	Specifies the last five characters of the product key Special Values: `NULL` - Product key is not installed
product_key_channel	Text	The source of the product key (ex: Volume, OEM, Retail, etc)
product_key_id	Text	Specifies the product key ID Special Values: `NULL` - Product key is not installed
collected_at	Timestamp	Time the row of data was first collected in the database
updated_at	Timestamp	Time the row of data was last changed in the database

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

Identify system extensions which have been installed but not approved by the end-user and require additional permissions before they can be utilized

Show Query

Find devices whose grace period for Office has expired

Show Query

Identify system extensions which have been installed but not approved by the end-user and require additional permissions before they can be utilized

Kolide SQL

SELECT
  device_name,
  team AS ext_team,
  state AS ext_state,
  version AS ext_version,
  identifier AS ext_identifier
FROM mac_system_extensions 
WHERE state = 'activated_waiting_for_user';

Example Results

ext_team	ext_state	device_name	ext_version	ext_identifier
6KALHUIASD8	activated_waiting_for_user	Jessicas-MacBook-Air-2	3.0.36471	com.f-secure.fsmac.gui.FSCSystemExtension
JH4SD6P446	activated_waiting_for_user	Daves-MacBook-Pro-2288	6.36	com.crowdstrike.falcon.Agent
52985DC85C	activated_waiting_for_user	Lukes-MacBook-Pro	6.0.1	com.carbonblack.endpointseagent
87JHSAD6SC	activated_waiting_for_user	Brians-MacBook-Air	3.1.86425	com.f-secure.fsmac.gui.FSCSystemExtension
LKC845671X	activated_waiting_for_user	Karas-MacBook-Pro	3.0.41898	com.f-secure.fsmac.gui.FSCSystemExtension

Find devices whose grace period for Office has expired

Kolide SQL

SELECT
  device_name,
  name,
  product_key_channel,
  license_status_reason
FROM windows_microsoft_licenses
WHERE name ILIKE '%Office%'
  AND genuine = 'false'
  AND license_status_reason LIKE '%grace period%'

Example Results

name	device_name	product_key_channel	license_status_reason
Office 19, Office19Excel2019R_Grace edition	dave-xps	Retail	The Software Licensing Service reported that the grace period expired
Office 19, Office19ProPlus2019R_Retail edition	razer.local	Retail	The Software Licensing Service reported that the grace period expired
Office 16, Office16O365HomePremR_Grace edition	Desktop-549CK	Retail	The Software Licensing Service reported that the grace period expired

Why Should I Collect Windows Microsoft Licenses?

Software licenses are an important item for many IT teams to track and audit. In some cases, the unlicensed installation of Microsoft products has resulted in organizations being audited and penalized by Microsoft via backdated fines.

Likewise, pirated versions of Windows and Office have been linked to malware infection in the past and are strongly recommended against from a device security standpoint.

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

While no personally identifiable information is communicated as part of these licenses, the unauthorized installation of unlicensed or pirated Microsoft software may violate the Acceptable Use Policy of your organization.

When you use Kolide to list Windows Microsoft License data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.