Hi all, I've had my first attempt at setting up a collection based on a registry key value, specifically the HiberbootEnable flag, so that I can switch this feature off. I'm seeing systems in the results that cannot have this feature switched on though, as they are running versions of Windows prior to 10. So I don't trust that I have understood the way this works.
My scan profile looks like this.
And my collection filter looks like this.
Have I got this right?