Installing osquery on Windows is simple and only takes a few steps.

1. Download & Install

First, download and install the .MSI package from the official osquery website.

2. Check if osquery is Running

After installation, open PowerShell and run:

  Get-Service osqueryd

If the Status shows Stopped, start the service with:

  Start-Service osqueryd

Verify again:

  Get-Service osqueryd

3. (Optional) Enable Auto-Start

To make osquery start automatically when Windows boots:

  Set-Service osqueryd -StartupType Automatic

4. Start the Interactive Shell

To use osquery interactively:

  cd "C:\Program Files\osquery"
.\osqueryi.exe

5. (Optional) Stop the Service When Finished

If you want to stop osquery after you’re done:

  Stop-Service osqueryd

You can confirm it has stopped with:

  Get-Service osqueryd

You’re now ready to query your system with osquery.