From 5865ac6a1da61e5d430ae62a3f597922fda6f2d4 Mon Sep 17 00:00:00 2001
From: fukusuket <41001169+fukusuket@users.noreply.github.com>
Date: Sun, 5 Oct 2025 15:54:47 +0900
Subject: [PATCH] fix: update Task Scheduler operational channel enabled state
 check

---
 WELA.ps1 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/WELA.ps1 b/WELA.ps1
index 232eb2da..8ea28ed1 100644
--- a/WELA.ps1
+++ b/WELA.ps1
@@ -1338,7 +1338,7 @@ function GuideYamatoSecurity
     $guid    = ""
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
-    $enabled  = $true
+    $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
@@ -2536,7 +2536,7 @@ function GuideASD {
     $guid    = ""
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
-    $enabled  = $true
+    $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
@@ -3734,7 +3734,7 @@ function GuideMSC {
     $guid    = ""
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
-    $enabled  = $true
+    $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
@@ -4929,7 +4929,7 @@ function GuideMSS {
     $guid    = ""
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
-    $enabled  = $true
+    $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(