Configuration drift
11sources
38reasons
14conditions
13decode tables
A host setting, inventory value or scheduled task changed outside the expected configuration.
Changes somebody made are catalogued by the object they acted on: the change catalogue lists every one and what reports it.
What is scored here
| Source | Signals | What they are |
|---|---|---|
| Agent overhead | 3 | sparklogs agent cpu over budget, sparklogs agent handle over budget, sparklogs agent memory over budget |
| Device drivers | 3 | driver updated, driver added, driver removed |
| Installed products | 3 | product installed, product removed, product version changed |
| System information | 5 | reboot pending, Secure Boot state changed, TPM state changed, host roles changed, OS build changed |
| Windows Application event log | 6 | group policy drive map failed, group policy extension apply failed, group policy preference item failed, office subscription licensing failed, win user profile load failed, wmi provider registered as localsystem |
| Windows identity and security event channels | 6 | device registration failed, entra device certificate update failed, group policy domain controller unresolved, group policy extension apply failed, group policy file share unhardened, group policy processing failed |
| Windows management event channels | 14 | bitlocker policy noncompliant, hyperv replication failed, hyperv vm backup checkpoint failed, hyperv vm start failed, hyperv vm storage request slow, hyperv vm vhd chain corrupted, mdm policy apply failed, print connection reopen failed, printer driver install failed, scheduled task engine failed, scheduled task load failed, scheduled task sign in failed, scheduled task start failed, win locale registry read failed |
| Windows network event channels | 1 | rds redirected printer setup failed |
| Windows platform event channels | 1 | os clock drift |
| Windows Security event log | 5 | scheduled task created, scheduled task deleted, scheduled task disabled, scheduled task updated, system time changed |
| Windows System event log | 5 | hyperv vswitch config restore failed, rds license server unactivated, rds license tracking failed, rds licensing service failed, time sync failed |