Real-Time Trust Factor Evaluation

Which Trust Factors re-evaluate the moment a device setting changes, and which stay on the 5-minute timer

  • Last validated: Oct 16, 2026
  • 5 minutes to read
  • Contributors

Overview

Real-time evaluation is a feature of the CSE desktop app that re-checks a Trust Factor as soon as the device setting behind it changes. The app subscribes to an operating system notification for that setting. When the setting changes, the app evaluates the factor and reports the result to the Command Center only if the value changed.

Earlier versions of the app checked every factor on a 5-minute timer. A user who turned BitLocker back on waited up to 5 minutes for the device Trust Level to catch up. Most factors now update in seconds.

Requirements. Real-time evaluation needs version 4.7.0 or later of the CSE desktop app for Windows or macOS. Devices on earlier versions check every factor on the 5-minute timer. Linux devices check every factor on the 5-minute timer.

Benefits

  • Remediation feels immediate. A user who enables disk encryption or the firewall regains access without waiting out a timer.
  • Policy changes land faster. A firewall setting pushed by Group Policy reaches the Command Center as soon as Windows logs it.
  • Windows devices no longer run PowerShell for Trust Factor collection, which removes the failures that a restricted or slow PowerShell caused.

Windows

The app collects every Windows Trust Factor through a COM interface, a Win32 API, or the registry API. Version 4.7.0 removed PowerShell from collection entirely.

Trust Factor Evaluation What triggers re-evaluation
Disk Encryption Real time A change to either BitLocker registry key
Firewall Real time A Windows event with ID 2002, 2003, 2082, or 2083
File Check Real time A change to a configured file
Registry Key Check Real time A change to a configured registry key
Auto Update Every 5 minutes Nothing to subscribe to
Application Check Every 5 minutes Nothing to subscribe to
Trust Integrations Every 5 minutes Nothing to subscribe to

How the app collects each Windows factor

  • Disk Encryption. A Win32 API query reads ConversionStatus and ProtectionStatus for the C: drive. The watcher re-evaluates the factor when either HKLM\SYSTEM\CurrentControlSet\Control\BitLocker or HKLM\SYSTEM\CurrentControlSet\Services\BDESVC changes.
  • Firewall. The app calls INetFwPolicy2::get_FirewallEnabled and reads the EnableFirewall value under HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall, in the subkey for each profile. Each source describes a different state. The COM call reports whether the firewall is enabled locally on the device. The registry value holds the state set by Group Policy. Reading one source alone would miss either a local change or a policy change.
  • File Check. A ReadDirectoryChangesW subscription watches the directory holding each configured file. The app filters those events down to the file names you configured.
  • Registry Key Check. A RegNotifyChangeKeyValue subscription watches each configured key.
  • Auto Update. The app calls IAutomaticUpdatesSettings::get_NotificationLevel. Windows publishes no notification when that level changes, so this factor stays on the timer.
  • Application Check. The app calls CreateToolhelp32Snapshot and walks the result with Process32First and Process32Next.
  • Trust Integrations. The app reads the CrowdStrike agent ID from HKLM\SYSTEM\CurrentControlSet\Services\CSAgent\Sim and converts it from binary. The SentinelOne integration is unchanged, because SentinelOne exposes its agent ID only through its own shell command.

Windows collection before and after 4.7.0

Version 4.6 and earlier ran a PowerShell command for most factors. Version 4.7.0 replaced each one:

  • Auto Update. (New-Object -com Microsoft.Update.AutoUpdate).Settings.NotificationLevel became IAutomaticUpdatesSettings::get_NotificationLevel.
  • Disk Encryption. Get-BitlockerVolume became a Win32 API query.
  • Firewall. Get-NetFirewallProfile -PolicyStore ActiveStore became the COM call plus the registry read.
  • Application Check. tasklist /fo csv /nh became CreateToolhelp32Snapshot.
  • Trust Integrations. reg query against the CrowdStrike Sim key became a registry API read of the same key.

macOS

macOS collection commands are unchanged in 4.7.0. The app now watches the property list files it was already reading, using FSNotify, and re-evaluates the factor when one of those files changes.

Trust Factor Evaluation
Auto Update Real time
Firewall Real time
File Check Real time
Property List Check Real time
Disk Encryption Every 5 minutes
Application Check Every 5 minutes
Trust Integrations Every 5 minutes

What the app watches on macOS

  • Auto Update. /Library/Preferences/com.apple.SoftwareUpdate.plist and /var/db/ConfigurationProfiles/Settings/.profilesAreInstalled. The second file holds the data behind the /usr/bin/profiles command.
  • Firewall. /Library/Preferences/com.apple.alf.plist on macOS 14 and earlier. com.apple.networkextension.plist on macOS 15 and later.
  • File Check. Each file you configure for the file check.
  • Property List Check. Each property list file you configure in the Command Center.

Limitations

Some factors cannot be watched, so they stay on the 5-minute timer. A change to one of them takes up to 5 minutes to affect the device Trust Level, plus the next sync to the Command Center.

  • Application Check, on Windows and macOS. Neither operating system offers a usable subscription for applications starting and stopping. On macOS, the only general-purpose source is the Endpoint Security framework, which requires an Apple-approved entitlement and Full Disk Access on every device. Re-reading the full process list on every change would also be costly on a busy device.
  • Trust Integrations, on Windows and macOS. The CrowdStrike and SentinelOne agent IDs are not stored anywhere the app can subscribe to, and no API exposes them for watching. An agent ID rarely changes on a registered device, so the timer is sufficient.
  • Auto Update, on Windows. Windows publishes no notification for a change to the update notification level. The macOS Auto Update factor is real time, because macOS holds the setting in a property list file.
  • Disk Encryption, on macOS. macOS exposes no low-level call for FileVault status and no property list to query for it. The Windows Disk Encryption factor is real time, because BitLocker state changes appear as registry changes.

Troubleshooting

If a device Trust Level does not update after a user changes a setting, check which factor is involved.

  1. Find the factor in the Windows or macOS table above. If it is on the 5-minute timer, wait 5 minutes. That is the expected behavior.
  2. Confirm the device runs app version 4.7.0 or later. Use the App Version Trust Factor to check versions across your fleet.
  3. Allow for the sync to the Command Center. The app syncs changed data as it happens, and falls back to a sync every 60 minutes. You can reduce the fallback to 15 minutes with MDM configuration.

Real-time evaluation changes when a factor is evaluated. It does not change what the factor evaluates, or how the Trust Level is calculated.

Learn more

Was this page helpful?