Live Discover Query - identify devices where Tamper Protection is disabled

/cfs-file/__key/commentfiles/fb5d84b10a5745448a7a45dafc1faa43-a278b39e-c981-4508-92a2-147f9cca12a9/pastedimage1593430621802v1.png REVIEWED by Sophos  no logic changes, just slightly nicer output:   SELECT    CASE    WHEN data LIKE '0' THEN 'DISABLED'    end Tamper_Protection FROM registry where key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config' AND name='SEDEnabled' AND data=0;

Thanks for this one, the ability to do this has actually been raised by customer's as a product enhancement: ideas.sophos.com/.../38987794-list-machines-with-tamper-protection-disabled