Hello,

If you want to avoid status “WARNING” for “File Rename Operations”, but keep a “WARNING” in another cases, just modify the service model “Pending Reboot” and replace :

%{RebootPending} =~ /true/i

By :

%{RebootPending} =~ /true/i && (%{WindowsUpdate} =~ /true/i || %{ComponentBasedService} =~ /true/i || %{SCCMClient} =~ /true/i || %{ComputerNameChange} =~ /true/i)

yes, basically i’ll have warning status on all events but not for file rename and this the final goal.

it’s not clean because i’ll have the message: pending reboot TRUE

but at moment i like this solution. 

i’ll try to edit nsclient excluding every check related to file rename.

Thank you for your answer (i marked it as best answer), i appreciated your help.