How to find users' Internet Explorer history on Terminal Server (Windows 2008 R2)

Question

Some of my keywords contain and/or. The string query I made breaks when I use that data. My string queries need to be able to handle that data within its queries

Here is my query and error:

Query:

POST /test/_doc
{
  "keyword":"pizza oven and/or pizza"
}

GET /test/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "query_string": {
            "default_field": "keywords.english",
            "query": "(pizza oven and/or pizza) OR (bread)"
          }
       }
      ]
    }
  }
}

Error:

  {
    "shard": 0,
    "index": "test",
    "node": "V3XGiCPAS0ej2PmYuk12qw",
    "reason": {
      "type": "query_shard_exception",
      "reason": "Failed to parse query [(pizza oven and/or pizza) OR (bread)]",
      "index_uuid": "OXSS-p_DTqeddnFkSjwWOw",
      "index": "test",
      "caused_by": {
        "type": "parse_exception",
        "reason": "parse_exception: Cannot parse '(pizza oven and/or pizza) OR (bread)': Lexical error at line 1, column 37.  Encountered: <EOF> after : \"/or pizza) OR (bread)\"",
        "caused_by": {
          "type": "token_mgr_error",
          "reason": "token_mgr_error: Lexical error at line 1, column 37.  Encountered: <EOF> after : \"/or pizza) OR (bread)\""
        }
      }
    }
  }

How can I make that the and/or doesn't break the string query?

Solution

IE histories are stored here :

%userprofile%\AppData\Local\Microsoft\Windows\History

Actually, as far as i know, there is not an easier way than going to each users folder. But this could be easily automated using powershell.

Comments

[Ryan Ries]

IE history is one of those things that changes location with practically every version of Windows AND every version of IE. You'll most likely find it in a .dat file *somewhere in the user's profile, that needs a special application to be able to read it. forensicswiki.org/wiki/Internet_Explorer_History_File_Format

[user202590]

I can't find nothing that looks like history. Can you be more specific please? Thanks a lot.

[krisFR]

Have you checked "show hidden files and folders" AND unchecked "hide files protected by the system OS" ? (sorry i am french my os is french, i don't know the real traduction for it)