as it turns out, auditing registry keys in windows is also WAY easier with osquery than it is using native windows auditing features