How to List Environment Variables Across All Windows Devices
Using Kolide, you can easily view and query Windows Environment Variables across your fleet.
Introduction
A list of Windows Environment Variables that are set in the registry under the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Sessionmanager\Environment and HKEY_USERS\<user>\Environment keys.
What Windows Environment Variable Data Can Kolide Collect?
Kolide's endpoint agent bundles in osquery to efficiently collect Windows Environment Variables from Windows devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.
Kolide meticulously documents every piece of data returned so you can understand the results.
Windows Environment Variables Schema
| Column | Type | Description | |
|---|---|---|---|
| id | Primary Key |
Unique identifier for the object |
|
| device_id | Foreign Key |
Device associated with the entry |
|
| device_name | Text |
Display name of the device associated with the entry |
|
| caption | Text |
A short description of the environment variable |
|
| description | Text |
The description of the environment variable |
|
| installed_at | Date |
The date of variable installation (usually null) |
|
| name | Text |
Environment Variable Name. Example: "PATH" |
|
| system_variable | Boolean |
Indicates whether the variable is a system variable. A system variable is set by the operating system, and is independent from user environment settings. |
|
| user_name | Text |
The owner of the environment variable. |
|
| value | Text |
Value of environment variable |
|
| collected_at | Timestamp |
Time the row of data was first collected in the database |
|
| updated_at | Timestamp |
Time the row of data was last changed in the database |
|
Why Should I Collect Windows Environment Variables?
Environment variables can be used to set the behaviors of different applications on your Windows hosts. They may also contain security credentials that are not being properly protected.
End-User Privacy Consideration
Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.
When you use Kolide to list Windows Environment Variable data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.
