diff --git a/WELA.ps1 b/WELA.ps1 index 8ea28ed1..f506c4e2 100644 --- a/WELA.ps1 +++ b/WELA.ps1 @@ -1339,12 +1339,13 @@ function GuideYamatoSecurity $eids = @() $channels = @("Microsoft-Windows-TaskScheduler/Operational") $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1 + $current = if ($enabled) { "Enabled" } else { "Disabled" } $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules | ForEach-Object { $_.applicable = $enabled } $auditResult += [WELA]::New( "TaskScheduler Operational", "", - "Enabled", + $current, [array]$rules, "Enabled", "Enabled", @@ -2537,12 +2538,13 @@ function GuideASD { $eids = @() $channels = @("Microsoft-Windows-TaskScheduler/Operational") $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1 + $current = if ($enabled) { "Enabled" } else { "Disabled" } $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules | ForEach-Object { $_.applicable = $enabled } $auditResult += [WELA]::New( "TaskScheduler Operational", "", - "Enabled", + $current, [array]$rules, "Enabled", "", @@ -3735,12 +3737,13 @@ function GuideMSC { $eids = @() $channels = @("Microsoft-Windows-TaskScheduler/Operational") $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1 + $current = if ($enabled) { "Enabled" } else { "Disabled" } $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules | ForEach-Object { $_.applicable = $enabled } $auditResult += [WELA]::New( "TaskScheduler Operational", "", - "Enabled", + $current, [array]$rules, "Enabled", "", @@ -4930,12 +4933,13 @@ function GuideMSS { $eids = @() $channels = @("Microsoft-Windows-TaskScheduler/Operational") $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1 + $current = if ($enabled) { "Enabled" } else { "Disabled" } $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules | ForEach-Object { $_.applicable = $enabled } $auditResult += [WELA]::New( "TaskScheduler Operational", "", - "Enabled", + $current, [array]$rules, "Enabled", "",