View Other Properties


View Other Properties

How to List Microsoft Licenses Across All Windows Devices

Using Kolide, you can easily view and query Windows Microsoft Licenses across your fleet.


Microsoft Windows includes a software licensing service utility which can verify and/or alert users about the license status of their official Microsoft products (eg. Microsoft Windows, Microsoft Office).

License details include the specific version and family of the product (eg. Microsoft Office 2019 Pro Plus - Retail), the genuine / licensed state of the software, and the partial product key associated with the installation.

What Windows Microsoft License Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Windows Microsoft Licenses from Windows devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Windows Microsoft Licenses Schema

Column Type Description
id Primary Key

Unique identifier for the object

device_id Foreign Key

Device associated with the entry

device_name Text

Display name of the device associated with the entry

genuine Boolean

true if the product passes Genuine Advantage check; otherwise false

identifier Text

The product identifier

license_family Text

Specifies the group identifier for the SKU used to determine license relationships for add-ons

license_status Enum::Text

Specifies the license status of this product application

Can be one of the following:

  • Unlicensed
  • Licensed
  • Out-Of-Box Grace
  • Out-Of-Tolerance Grace
  • Non-Genuine Grace
  • Notification
  • Extended Grace
license_status_reason Text

Specifies the license status. Provides additional information about why a computer is in a specific licensing state

name Text

The display name of the product

partial_product_key Text

Specifies the last five characters of the product key

Special Values:

  • NULL - Product key is not installed
product_key_channel Text

The source of the product key (ex: Volume, OEM, Retail, etc)

product_key_id Text

Specifies the product key ID

Special Values:

  • NULL - Product key is not installed
collected_at Timestamp

Time the row of data was first collected in the database

updated_at Timestamp

Time the row of data was last changed in the database

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

Identify system extensions which have been installed but not approved by the end-user and require additional permissions before they can be utilized
Kolide SQL
  team AS ext_team,
  state AS ext_state,
  version AS ext_version,
  identifier AS ext_identifier
FROM mac_system_extensions 
WHERE state = 'activated_waiting_for_user';
Example Results
ext_team ext_state device_name ext_version ext_identifier
6KALHUIASD8 activated_waiting_for_user Jessicas-MacBook-Air-2 3.0.36471 com.f-secure.fsmac.gui.FSCSystemExtension
JH4SD6P446 activated_waiting_for_user Daves-MacBook-Pro-2288 6.36 com.crowdstrike.falcon.Agent
52985DC85C activated_waiting_for_user Lukes-MacBook-Pro 6.0.1 com.carbonblack.endpointseagent
87JHSAD6SC activated_waiting_for_user Brians-MacBook-Air 3.1.86425 com.f-secure.fsmac.gui.FSCSystemExtension
LKC845671X activated_waiting_for_user Karas-MacBook-Pro 3.0.41898 com.f-secure.fsmac.gui.FSCSystemExtension
Find devices whose grace period for Office has expired
Kolide SQL
FROM windows_microsoft_licenses
WHERE name ILIKE '%Office%'
  AND genuine = 'false'
  AND license_status_reason LIKE '%grace period%'
Example Results
name device_name product_key_channel license_status_reason
Office 19, Office19Excel2019R_Grace edition dave-xps Retail The Software Licensing Service reported that the grace period expired
Office 19, Office19ProPlus2019R_Retail edition razer.local Retail The Software Licensing Service reported that the grace period expired
Office 16, Office16O365HomePremR_Grace edition Desktop-549CK Retail The Software Licensing Service reported that the grace period expired

Why Should I Collect Windows Microsoft Licenses?

Software licenses are an important item for many IT teams to track and audit. In some cases, the unlicensed installation of Microsoft products has resulted in organizations being audited and penalized by Microsoft via backdated fines.

Likewise, pirated versions of Windows and Office have been linked to malware infection in the past and are strongly recommended against from a device security standpoint.

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

While no personally identifiable information is communicated as part of these licenses, the unauthorized installation of unlicensed or pirated Microsoft software may violate the Acceptable Use Policy of your organization.

When you use Kolide to list Windows Microsoft License data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.

Share this story:

Related Device Properties:

Mac Apps
apps, software
Linux RPM Packages
centos, rpm, software, packages
Linux Debian Packages
debian, software, packages
View full list of Kolide's Device Properties
Book A Demo
Book A Demo