fleet/orbit/pkg/table/extension_windows.go

//go:build windows

package table

import (
	"fmt"

	"github.com/fleetdm/fleet/v4/orbit/pkg/table/adobe_plugins"
	"github.com/fleetdm/fleet/v4/orbit/pkg/table/bitlocker_key_protectors"
	cisaudit "github.com/fleetdm/fleet/v4/orbit/pkg/table/cis_audit"
	"github.com/fleetdm/fleet/v4/orbit/pkg/table/mdm_bridge"
	"github.com/fleetdm/fleet/v4/orbit/pkg/table/windowsupdatetable"
	"github.com/rs/zerolog/log"
	"golang.org/x/sys/windows/registry"

	"github.com/osquery/osquery-go"
	"github.com/osquery/osquery-go/plugin/table"
)

func PlatformTables(_ PluginOpts) ([]osquery.OsqueryPlugin, error) {
	plugins := []osquery.OsqueryPlugin{
		// Fleet tables
		adobe_plugins.TablePlugin(log.Logger),
		table.NewPlugin("cis_audit", cisaudit.Columns(), cisaudit.Generate),

		bitlocker_key_protectors.TablePlugin(log.Logger),

		windowsupdatetable.TablePlugin(windowsupdatetable.UpdatesTable, log.Logger), // table name is "windows_updates"
	}

	windowsServer, err := IsWindowsServer()
	if err != nil {
		return nil, err
	}

	if !windowsServer {
		plugins = append(plugins, table.NewPlugin("mdm_bridge", mdm_bridge.Columns(), mdm_bridge.Generate))
	}

	return plugins, nil
}

func IsWindowsServer() (bool, error) {
	k, err := registry.OpenKey(registry.LOCAL_MACHINE, `SOFTWARE\Microsoft\Windows NT\CurrentVersion`, registry.QUERY_VALUE)
	if err != nil {
		return false, fmt.Errorf("windows server check: %w", err)
	}
	defer k.Close()

	s, _, err := k.GetStringValue("InstallationType")
	if err != nil {
		return false, fmt.Errorf("windows server check: %w", err)
	}

	if s == "Server" {
		return true, nil
	}

	return false, nil
}