@theopolis updated the issue. https://github.com/facebook/osquery/issues/3501#issuecomment-318494941 It appears that when you click on a GUI element, the preference will be set at ByHost, at least sometimes