From a4a9ba23ce40e236a2b104c151e1f91d89abf3bb Mon Sep 17 00:00:00 2001
From: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com>
Date: Thu, 30 Jan 2025 14:21:18 -0500
Subject: [PATCH] Revert "Revert "Add SystemDrive env var to osqueryd if
 present in orbit"" (#25243)

Reverts fleetdm/fleet#25239
---
 orbit/changes/8986-systemdrive-env-passthrough | 1 +
 orbit/cmd/orbit/orbit.go                       | 6 ++++++
 2 files changed, 7 insertions(+)
 create mode 100644 orbit/changes/8986-systemdrive-env-passthrough

diff --git a/orbit/changes/8986-systemdrive-env-passthrough b/orbit/changes/8986-systemdrive-env-passthrough
new file mode 100644
index 0000000000..4724604281
--- /dev/null
+++ b/orbit/changes/8986-systemdrive-env-passthrough
@@ -0,0 +1 @@
+- Pass `SystemDrive` Environemt variable to osqueryd when present in Orbit
diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
index 40e7b46099..d8eaa90b8c 100644
--- a/orbit/cmd/orbit/orbit.go
+++ b/orbit/cmd/orbit/orbit.go
@@ -815,6 +815,12 @@ func main() {
 			)
 		}
 
+		if runtime.GOOS == "windows" {
+			if systemDrive, ok := os.LookupEnv("SystemDrive"); ok {
+				options = append(options, osquery.WithEnv([]string{fmt.Sprintf("SystemDrive=%s", systemDrive)}))
+			}
+		}
+
 		var certPath string
 		if fleetURL != "https://" && c.Bool("insecure") {
 			proxy, err := insecure.NewTLSProxy(fleetURL)