diff --git a/changes/17562-windows-server-2019-os-details b/changes/17562-windows-server-2019-os-details new file mode 100644 index 000000000..e3aa773a0 --- /dev/null +++ b/changes/17562-windows-server-2019-os-details @@ -0,0 +1 @@ +- Fixed a bug where OS version information would not get detected on Windows Server 2019 diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go index 030294f5e..e65124e4e 100644 --- a/server/service/osquery_utils/queries.go +++ b/server/service/osquery_utils/queries.go @@ -172,14 +172,24 @@ var hostDetailQueries = map[string]DetailQuery{ }, }, "os_version_windows": { + // display_version is not available in some versions of + // Windows (Server 2019). By including it using a JOIN it can + // return no rows and the query will still succeed Query: ` - SELECT os.name, r.data as display_version, k.version + WITH display_version_table AS ( + SELECT data as display_version + FROM registry + WHERE path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion' + ) + SELECT + os.name, + COALESCE(d.display_version, '') AS display_version, + k.version FROM - registry r, os_version os, kernel_info k - WHERE r.path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion' - `, + LEFT JOIN + display_version_table d`, Platforms: []string{"windows"}, IngestFunc: func(ctx context.Context, logger log.Logger, host *fleet.Host, rows []map[string]string) error { if len(rows) != 1 { @@ -531,20 +541,29 @@ var extraDetailQueries = map[string]DetailQuery{ // This query is used to populate the `operating_systems` and `host_operating_system` // tables. Separately, the `hosts` table is populated via the `os_version` and // `os_version_windows` detail queries above. + // + // DisplayVersion doesn't exist on all versions of Windows (Server 2019). + // To prevent the query from failing in those cases, we join + // the values in when they exist, alternatively the column is + // just empty. Query: ` + WITH display_version_table AS ( + SELECT data as display_version + FROM registry + WHERE path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion' + ) SELECT os.name, os.platform, os.arch, k.version as kernel_version, os.version, - r.data as display_version + COALESCE(d.display_version, '') AS display_version FROM os_version os, - kernel_info k, - registry r - WHERE - r.path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion'`, + kernel_info k + LEFT JOIN + display_version_table d`, Platforms: []string{"windows"}, DirectIngestFunc: directIngestOSWindows, },