Collector: decode StartupApproved 0x04 and 0x05
The post-fix capture from 579C144 reported three entries as unknown(0x04) - SecurityHealth, RtkAudUService, WavesSvc. The decoder only knew 02/06 enabled and 03/07 disabled. 04 is also enabled and 05 also disabled; without them the report says 'unknown' for entries that are perfectly ordinary.
This commit is contained in:
@@ -188,7 +188,7 @@ Section 'autostart.txt' {
|
||||
foreach ($n in $props.Property) {
|
||||
$v = (Get-ItemProperty $k -Name $n).$n
|
||||
$state = if ($v -is [byte[]] -and $v.Length -ge 1) {
|
||||
switch ($v[0]) { 2 {'ENABLED'} 6 {'ENABLED'} 3 {'disabled'} 7 {'disabled'} default {"unknown(0x{0:X2})" -f $v[0]} }
|
||||
switch ($v[0]) { 2 {'ENABLED'} 4 {'ENABLED'} 6 {'ENABLED'} 3 {'disabled'} 5 {'disabled'} 7 {'disabled'} default {"unknown(0x{0:X2})" -f $v[0]} }
|
||||
} else { 'unknown' }
|
||||
"{0,-10} {1}" -f $state, $n
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user