Configuration drift
7sources
16reasons
14conditions
7decode tables
A host setting, inventory value or scheduled task changed outside the expected configuration.
Changes somebody made are catalogued by the object they acted on: the change catalogue lists every one and what reports it.
What is scored here
| Source | Signals | What they are |
|---|---|---|
| Agent overhead | 3 | agent cpu over budget, agent handle over budget, agent ram over budget |
| Device drivers | 3 | driver updated, driver added, driver removed |
| Installed products | 3 | product installed, product removed, product version changed |
| System information | 5 | reboot pending, Secure Boot state changed, TPM state changed, host roles changed, OS build changed |
| Windows Application event log | 6 | group policy cse apply failed, group policy drive map failed, group policy pref item failed, office subscription licensing failed, win user profile load failed, wmi provider registered as localsystem |
| Windows Security event log | 5 | scheduled task created, scheduled task deleted, scheduled task disabled, scheduled task updated, system time changed |
| Windows System event log | 5 | rds license server unactivated, rds license tracking failed, rds licensing service failed, time sync failed, vswitch config restore failed |