XQL Query - look for any local administrator account on endpoint

elzahy — Wed, 18 Jun 2025 05:50:14 GMT

Hi,

I would like to create Cortex XQL query that can let me to have a list of local administrator account on endpoint (Windows)., it is possible?

Thank you.

Re: XQL Query - look for any local administrator account on endpoint

eluis — Wed, 18 Jun 2025 09:50:48 GMT

Hi Elzahy,

Please let me give you a link that might bring some light to your purpose. There was another discuss some weeks ago:

Please let me know if this solves your use case.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis