%WINDIR%\SoftwareDistribution\PostRebootEventCache.V2\* [*] %WINDIR%\SoftwareDistribution\EventCache.V2\* [*] %WINDIR%\SoftwareDistribution [ReportingEvents.log] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\EventCache.v2\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgradeHistory\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate [SusClientId] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate [SusClientIdValidation] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\DeploymentCallbackInfo\* [*]