From 8b82ff216bf4b3f1262d4eec9a7290c580e9c235 Mon Sep 17 00:00:00 2001
From: fukusuket <41001169+fukusuket@users.noreply.github.com>
Date: Sun, 5 Oct 2025 16:04:28 +0900
Subject: [PATCH] fix: update Task Scheduler operational status reporting

---
 WELA.ps1 | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/WELA.ps1 b/WELA.ps1
index 8ea28ed1..f506c4e2 100644
--- a/WELA.ps1
+++ b/WELA.ps1
@@ -1339,12 +1339,13 @@ function GuideYamatoSecurity
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
     $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
+    $current  = if ($enabled) { "Enabled" } else { "Disabled" }
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
             "TaskScheduler Operational",
             "",
-            "Enabled",
+            $current,
             [array]$rules,
             "Enabled",
             "Enabled",
@@ -2537,12 +2538,13 @@ function GuideASD {
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
     $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
+    $current  = if ($enabled) { "Enabled" } else { "Disabled" }
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
             "TaskScheduler Operational",
             "",
-            "Enabled",
+            $current,
             [array]$rules,
             "Enabled",
             "",
@@ -3735,12 +3737,13 @@ function GuideMSC {
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
     $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
+    $current  = if ($enabled) { "Enabled" } else { "Disabled" }
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
             "TaskScheduler Operational",
             "",
-            "Enabled",
+            $current,
             [array]$rules,
             "Enabled",
             "",
@@ -4930,12 +4933,13 @@ function GuideMSS {
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
     $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
+    $current  = if ($enabled) { "Enabled" } else { "Disabled" }
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
             "TaskScheduler Operational",
             "",
-            "Enabled",
+            $current,
             [array]$rules,
             "Enabled",
             "",