From 5865ac6a1da61e5d430ae62a3f597922fda6f2d4 Mon Sep 17 00:00:00 2001
From: fukusuket <41001169+fukusuket@users.noreply.github.com>
Date: Sun, 5 Oct 2025 15:54:47 +0900
Subject: [PATCH 1/3] fix: update Task Scheduler operational channel enabled
 state check

---
 WELA.ps1 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/WELA.ps1 b/WELA.ps1
index 232eb2da..8ea28ed1 100644
--- a/WELA.ps1
+++ b/WELA.ps1
@@ -1338,7 +1338,7 @@ function GuideYamatoSecurity
     $guid    = ""
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
-    $enabled  = $true
+    $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
@@ -2536,7 +2536,7 @@ function GuideASD {
     $guid    = ""
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
-    $enabled  = $true
+    $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
@@ -3734,7 +3734,7 @@ function GuideMSC {
     $guid    = ""
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
-    $enabled  = $true
+    $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
@@ -4929,7 +4929,7 @@ function GuideMSS {
     $guid    = ""
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
-    $enabled  = $true
+    $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(

From 8b82ff216bf4b3f1262d4eec9a7290c580e9c235 Mon Sep 17 00:00:00 2001
From: fukusuket <41001169+fukusuket@users.noreply.github.com>
Date: Sun, 5 Oct 2025 16:04:28 +0900
Subject: [PATCH 2/3] fix: update Task Scheduler operational status reporting

---
 WELA.ps1 | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/WELA.ps1 b/WELA.ps1
index 8ea28ed1..f506c4e2 100644
--- a/WELA.ps1
+++ b/WELA.ps1
@@ -1339,12 +1339,13 @@ function GuideYamatoSecurity
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
     $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
+    $current  = if ($enabled) { "Enabled" } else { "Disabled" }
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
             "TaskScheduler Operational",
             "",
-            "Enabled",
+            $current,
             [array]$rules,
             "Enabled",
             "Enabled",
@@ -2537,12 +2538,13 @@ function GuideASD {
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
     $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
+    $current  = if ($enabled) { "Enabled" } else { "Disabled" }
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
             "TaskScheduler Operational",
             "",
-            "Enabled",
+            $current,
             [array]$rules,
             "Enabled",
             "",
@@ -3735,12 +3737,13 @@ function GuideMSC {
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
     $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
+    $current  = if ($enabled) { "Enabled" } else { "Disabled" }
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
             "TaskScheduler Operational",
             "",
-            "Enabled",
+            $current,
             [array]$rules,
             "Enabled",
             "",
@@ -4930,12 +4933,13 @@ function GuideMSS {
     $eids     = @()
     $channels = @("Microsoft-Windows-TaskScheduler/Operational")
     $enabled  = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational" -valueName "Enabled" -expectedValue 1
+    $current  = if ($enabled) { "Enabled" } else { "Disabled" }
     $rules    = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
     $rules    | ForEach-Object { $_.applicable = $enabled }
     $auditResult += [WELA]::New(
             "TaskScheduler Operational",
             "",
-            "Enabled",
+            $current,
             [array]$rules,
             "Enabled",
             "",

From 5246b0dbf07be9af12c6ac0759b955948b1703e2 Mon Sep 17 00:00:00 2001
From: YamatoSecurity <tanaka@tanakazakku.com>
Date: Sun, 5 Oct 2025 16:31:44 +0900
Subject: [PATCH 3/3] update changelog

---
 CHANGELOG-Japanese.md | 1 +
 CHANGELOG.md          | 1 +
 2 files changed, 2 insertions(+)

diff --git a/CHANGELOG-Japanese.md b/CHANGELOG-Japanese.md
index d0a2877d..6d3775cd 100644
--- a/CHANGELOG-Japanese.md
+++ b/CHANGELOG-Japanese.md
@@ -5,6 +5,7 @@
 **バグ修正:**
 
 - ルールカウントの一部が正確ではなかった。 (#99) (@fukusuket)
+- タスクスケジューラのログ設定が正確に報告されていなかった。 (#100 (@fukusuket))
 
 ## 1.0.0 [2025/05/20] - AUSCERT/SINCON リリース
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d565fa23..a29b9ef1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 **Bug Fixes:**
 
 - Some of the rule count was not accurate. (#99) (@fukusuket)
+- TaskScheduler log settings were not accurately reported. (#100 (@fukusuket))
 
 ## 1.0.0 [2025/05/20] - AUSCERT/SINCON Release