# Osquerybeat Permission Error - No Queries possible **URL:** \ **Category:** Elastic Agent\ **Tags:** beats-module\ **Created:** [December 3, 2024, 3:57pm UTC](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400 "2024-12-03T15:57:48Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![matled](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@matled](https://discuss.elastic.co/u/matled)\ **Post date:** [December 3, 2024, 3:57pm UTC](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400/1 "2024-12-03T15:57:48Z")
We are using Elastic-Stack 8.16.1 and also Elastic-Agents 8.16.1 integrated in Elastic Fleet. Currently, we are having problems with Osquery on Windows Systems where we traced the problem down to the following errors: ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5007edb9748af348f893fe3b41f4b61b6192bc1.png) In the osquerybeat logs we see the following errors: ```auto 16:40:12.234 elastic_agent.osquerybeat osquery-default [elastic_agent.osquerybeat][info] osquerybeat stopped. 16:40:12.234 elastic_agent.osquerybeat osquery-default [elastic_agent.osquerybeat][error] Exiting: W1203 16:40:11.932215 14944 extensions.cpp:426] Will not autoload extension with unsafe directory permissions: C:\Program Files\Elastic\Agent\data\elastic-agent-8.16.1-b6da7f\components\osquery-extension.exe W1203 16:40:12.007649 14944 fileops.cpp:1339] Failed to apply safe permssions to the database E1203 16:40:12.022356 14944 shutdown.cpp:79] Cannot activate osq_config config plugin: Unknown registry plugin: osq_config: exit status 78 16:40:12.234 elastic_agent.osquerybeat osquery-default [elastic_agent.osquerybeat][error] Exiting: W1203 16:40:11.932215 14944 extensions.cpp:426] Will not autoload extension with unsafe directory permissions: C:\Program Files\Elastic\Agent\data\elastic-agent-8.16.1-b6da7f\components\osquery-extension.exe 16:40:12.234 elastic_agent.osquerybeat osquery-default [elastic_agent.osquerybeat][error] W1203 16:40:12.007649 14944 fileops.cpp:1339] Failed to apply safe permssions to the database 16:40:12.234 elastic_agent osquery-default [elastic_agent][info] Unit state changed osquery-default-8615bf9b-fad7-4cb2-ad5c-742f22f5f330 (HEALTHY->STOPPING): Stopping 16:40:12.234 elastic_agent osquery-default [elastic_agent][info] Unit state changed osquery-default (HEALTHY->STOPPING): Stopping 16:40:12.235 elastic_agent.osquerybeat osquery-default [elastic_agent.osquerybeat][error] E1203 16:40:12.022356 14944 shutdown.cpp:79] Cannot activate osq_config config plugin: Unknown registry plugin: osq_config: exit status 78 16:40:12.243 elastic_agent osquery-default [elastic_agent][info] Component state changed osquery-default (HEALTHY->STOPPED): Suppressing FAILED state due to restart for '13820' exited with code '1' 16:40:12.243 elastic_agent osquery-default [elastic_agent][info] Unit state changed osquery-default-8615bf9b-fad7-4cb2-ad5c-742f22f5f330 (STOPPING->STOPPED): Suppressing FAILED state due to restart for '13820' exited with code '1' 16:40:12.243 elastic_agent osquery-default [elastic_agent][info] Unit state changed osquery-default (STOPPING->STOPPED): Suppressing FAILED state due to restart for '13820' exited with code '1' ``` We have this issue since Upgrade to Elastic-Stack 8.16.1 and rollout out the new Agents to 8.16.1. Bevore we were areound 8.15.x. ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c589bd26c8a1b964fad8180caa1a8242e4353e51.jpeg) What we found as a workaround: In the folder "C:\Program Files\Elastic\Agent\data\elastic-agent-8.16.1-b6da7f\run\osquery-default\osquery" editing the file "osquery.flags" and adding the line "--allow\_unsafe" seems to resolve the issue however this is not recommended to do so according to the osquery documentation. ---
**Author:** ![matled](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@matled](https://discuss.elastic.co/u/matled)\ **Post date:** [December 3, 2024, 4:16pm UTC](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400/2 "2024-12-03T16:16:52Z")
and ofc. when setting the option in the osquery manager integration policy it works too: ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af68b7c52f6708dbeaf58c529f2980655bbae572.png) ---
**Author:** ![Julien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julien/32/19688_2.png) [@Julien](https://discuss.elastic.co/u/Julien)\ **Post date:** [December 13, 2024, 4:48pm UTC](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400/3 "2024-12-13T16:48:42Z")
* * * [osquery/osquery#3727](https://github.com/osquery/osquery/pull/3727) mentions : In order for an osquery binary, daemon or extension, to be considered “safe”, the following must hold true: 1. The owner of the binary and containing parent directory is the `Administrators` group 2. No lower privileged user account has `Write` permissions on either the binary or the containing parent directory. 3. (Optional) the `SYSTEM` account may have full permissions on the binary and the containing parent directory. * * * Can you check that under `C:\Program Files\Elastic\Agent` that the above conditions apply command `C:\Program Files\Elastic\Agent\data\elastic-agent-8.16.1-b6da7f> icacls *` might help to verify why it is considered unsafe for osquery binaries or their parent folder (if osquery binaries have permissions outside of `Administrators` group that is inherited from a parent folder that would lead to the issue) ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [March 8, 2025, 10:46am UTC](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400/4 "2025-03-08T10:46:40Z")
Hello, Just noticed we have similar issue on some servers: `runOsquery exited with error: W0308 11:36:35.433602 11404 extensions.cpp:426] Will not autoload extension with unsafe directory permissions: C:\Program Files\Elastic\Agent\data\elastic-agent-8.16.3-7f58fa\components\osquery-extension.exe` `Cannot activate osq_config config plugin: Unknown registry plugin: osq_config: exit status 78` The Agent runs as admin. I have no access to the server atm, but if I find some time next week, I'll try provide the icacls \* Grtz Willem ---
**Author:** ![CD9820](https://avatars.discourse-cdn.com/v4/letter/c/e9c0ed/32.png) [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Post date:** [March 10, 2025, 12:27pm UTC](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400/5 "2025-03-10T12:27:57Z")
Hello, I checked the permission requirements and those are fine, even with SYSTEM added the issue still persists. Best regards Christophe