SAM Advanced Metering: user_name sent as null on endpoints where osquery cannot resolve domain user SIDs under the LocalSystem context - Known Error

SAM Advanced Metering: user_name sent as null on endpoints where osquery cannot resolve domain user SIDs under the LocalSystem context Description On certain Windows endpoints, records produced by the SAM Advanced Metering check are reported to the instance with user_name = null , even though user accounts are actively logged in and running metered software.

The check identifies the process owner by reading the user name column from osquery's users table. On Windows, that column is populated by translating the account SID to a name under the local-system context in which the ACC agent runs. On endpoints where this translation cannot be performed for domain accounts, the field is returned empty, and the check has no fallback source for the user name, resulting in user_name = null in the payload.

Steps to Reproduce

1. On the endpoint (as LocalSystem), run: osqueryi "SELECT uid, type, username FROM users;" → domain (roaming) rows for logged-in users have username = "". 2. Run: osqueryi "SELECT logon_sid, user FROM logon_sessions;" → the same SIDs have a populated user. 3. Trigger the SAM Advanced Metering collection and check the payload / sam_sw_usage staging table on the instance. Expected: user_name populated with the logged-in domain user. Actual: user_name is null for every record from that endpoint.* Workaround No workaround is available for this issue. This problem is currently under review and targeted to be fixed in a future release.