@Jordan I’d recommend checking you’re config with osqueryi —config_check —config_path=C:\Path\to\osquery.conf as well as all of your packs. You can also startup the shell with that conf and select * from osquery_flags where value <> default_value