View Other Properties


View Other Properties

How to List Environment Variables Across All Windows Devices

Using Kolide, you can easily view and query Windows Environment Variables across your fleet.


A list of Windows Environment Variables that are set in the registry under the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Sessionmanager\Environment and HKEY_USERS\<user>\Environment keys.

What Windows Environment Variable Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Windows Environment Variables from Windows devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Windows Environment Variables Schema

Column Type Description
id Primary Key

Unique identifier for the object

device_id Foreign Key

Device associated with the entry

device_name Text

Display name of the device associated with the entry

caption Text

A short description of the environment variable

description Text

The description of the environment variable

installed_at Date

The date of variable installation (usually null)

name Text

Environment Variable Name. Example: "PATH"

system_variable Boolean

Indicates whether the variable is a system variable. A system variable is set by the operating system, and is independent from user environment settings.

user_name Text

The owner of the environment variable. for variables that are system-wide (as opposed to a specific user) and for user settings

value Text

Value of environment variable

collected_at Timestamp

Time the row of data was first collected in the database

updated_at Timestamp

Time the row of data was last changed in the database

Why Should I Collect Windows Environment Variables?

Environment variables can be used to set the behaviors of different applications on your Windows hosts. They may also contain security credentials that are not being properly protected.

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

When you use Kolide to list Windows Environment Variable data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.

Share this story:

Related Device Properties:

Windows Programs
Windows Update Settings
updates, operating-system, security
Windows Pending Updates
updates, operating-system, security
View full list of Kolide's Device Properties
Book A Demo
Book A Demo