Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
users
users
Local user accounts (including domain accounts that have logged on locally (Windows)).
| Column | Type | Description |
|---|---|---|
| description | text | Optional user description Only available on macOS, Windows, and Linux |
| directory | text | User's home directory Only available on macOS, Windows, and Linux |
| text | Email Only available on chrome |
|
| gid | bigint | Group ID (unsigned) Only available on macOS, Windows, and Linux |
| gid_signed | bigint | Default group ID as int64 signed (Apple) Only available on macOS, Windows, and Linux |
| is_hidden | integer | IsHidden attribute set in OpenDirectory Only available on macOS |
| pid_with_namespace | integer | Pids that contain a namespace Only available on Linux |
| shell | text | User's configured default shell Only available on macOS, Windows, and Linux |
| type | text | Whether the account is roaming (domain), local, or a system profile Only available on Windows |
| uid | bigint | User ID |
| uid_signed | bigint | User ID as int64 signed (Apple) Only available on macOS, Windows, and Linux |
| username | text | Username |
| uuid | text | User's UUID (Apple) or SID (Windows) |
Example
List users that have interactive access via a shell that isn't false.
SELECT * FROM users WHERE shell!='/usr/bin/false';Notes
- On ChromeOS, this table requires the fleetd Chrome extension.
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
