This works even when the workstation is locked
AutoItSetOption ( "SendKeyDelay", 1000 )
$strComputer = "."
$objWMIService = ObjGet("winmgmts:" & $strComputer & "rootdefault")
$colEvents = $objWMIService.ExecNotificationQuery _
("SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _
"KeyPath='SOFTWAREMcAfeeVSCoreOn Access ScannerMcShieldConfigurationDefault'" & _
"AND ValueName='bScanOutgoing'")
while 1
$var = RegRead("HKEY_LOCAL_MACHINESoftwareMcAfeeVSCoreOn Access ScannerMcShieldConfigurationDefault", "bScanOutgoing")
if $var = 1 THEN
Run('C:Program FilesMcAfeeVirusScan Enterpriseshcfg32.exe')
WinWait("On-Access Scan Properties")
ControlSend("On-Access Scan Properties", "", 103,"!e")
sleep(500)
ControlSend("On-Access Scan Properties", "", 137,"!x")
sleep(500)
ControlSend("On-Access Scan Properties", "", 139,"999")
sleep(500)
ControlClick("On-Access Scan Properties", "", 102,"left",1,52,129)
sleep(500)
ControlClick("On-Access Scan Properties", "", 163,"left",1,89,13)
sleep(500)
ControlSend("On-Access Scan Properties", "", 127,"!n")
sleep(500)
ControlSend("On-Access Scan Properties", "", 1093,"!p")
sleep(500)
ControlSend("On-Access Scan Properties", "", 1097,"!z")
sleep(500)
ControlSend("On-Access Scan Properties", "", 1098,"!d")
sleep(500)
ControlSend("On-Access Scan Properties", "", "","{ENTER}")
EndIf
$objEvent = $colEvents.NextEvent
sleep (1000)
WEnd