Thanks for the response and the KB article. It doesn't appear to apply to my scenario unfortunately. The number of records for the DATA_TYPE SCORInventory, at least percentage wise, is on par with my baseline. I'm trying to nail down exactly what functions performed on the endpoints result in a record being logged to this table. From the values in the DATA_TYPES column it looks like inventory, diagnostics, and command line tasks and I'm hoping to proof that out in a lab.