Add "account enabled" column to users table

Feature request

What new feature do you want?

When it comes to threat hunting, logons success and failed logons happens every day but logons from invalid or disabled user accounts should be suspicious.

At the moment, the Windows user table does not return a column to specify if current status (enabled disabled), which can be a good way to track malware or suspicious activities performed by a threat actor.

I'm using osquery 3.3.0 using SQLite 3.19.3.

This feature can help to write queries focused on identifying when disabled accounts are trying to perform any action in the system.

This request might apply to other platforms as well but I'm focused on Windows at the moment.

How is this new feature useful?

We could write queries filtering the account status and monitor when suspicious activities are happening, for example we should try logon attempts from disabled accounts as suspicious.
The more visibility we have about what is going on in the system will considerable help to detect threat actors earlier in their TTPs.

How can this be implemented?

According to a conversation in the slack channel, I got feedback about how this could be implemented:

it`s bcs NetUserGetInfo with level 3 used
level 4 can return USER_INFO_4 with usri4_flags where UF_ACCOUNTDISABLE stored

well, not hard to make patch

add field in users.table and filling of this field in windows\users.cpp, function processLocalAccounts as far I see

Start in windows/users.cpp, specifically processLocalAccounts, and review how the users table currently obtains account data through NetUserGetInfo. Check the referenced USER_INFO_4 and UF_ACCOUNTDISABLE details, then trace the users table schema. Done means the Windows users table exposes whether an account is enabled so queries can filter disabled accounts.