diff --git a/WELA.ps1 b/WELA.ps1 index 232eb2da..8ea28ed1 100644 --- a/WELA.ps1 +++ b/WELA.ps1 @@ -1338,7 +1338,7 @@ function GuideYamatoSecurity $guid = "" $eids = @() $channels = @("Microsoft-Windows-TaskScheduler/Operational") - $enabled = $true + $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1 $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules | ForEach-Object { $_.applicable = $enabled } $auditResult += [WELA]::New( @@ -2536,7 +2536,7 @@ function GuideASD { $guid = "" $eids = @() $channels = @("Microsoft-Windows-TaskScheduler/Operational") - $enabled = $true + $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1 $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules | ForEach-Object { $_.applicable = $enabled } $auditResult += [WELA]::New( @@ -3734,7 +3734,7 @@ function GuideMSC { $guid = "" $eids = @() $channels = @("Microsoft-Windows-TaskScheduler/Operational") - $enabled = $true + $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1 $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules | ForEach-Object { $_.applicable = $enabled } $auditResult += [WELA]::New( @@ -4929,7 +4929,7 @@ function GuideMSS { $guid = "" $eids = @() $channels = @("Microsoft-Windows-TaskScheduler/Operational") - $enabled = $true + $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1 $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules | ForEach-Object { $_.applicable = $enabled } $auditResult += [WELA]::New(