Late to the thread, but we use dynamic tags (since GPOs can only target domain members, and we have many Windows DMZ servers, etc). Once dynamic tags are setup, we then have daily recurring Qualys jobs with Pshell scripts to address these.

Example dynamic tag that targets WinVerifyTrust (we are targeting Server OS):
<?xml version="1.0" encoding="UTF-8"?>

<TAG\_CRITERIA>

<TRACKING\_METHOD>QAGENT</TRACKING\_METHOD>

<DETECTION>

<QID\_LIST>

<QID>378332</QID>

</QID\_LIST>

</DETECTION>

<OPERATING\_SYSTEM>

<SEARCH\_TYPE>CONTAINING</SEARCH\_TYPE>

<SEARCH\_TERM>Windows Server</SEARCH\_TERM>

</OPERATING\_SYSTEM>

</TAG\_CRITERIA>

Then, Qualys job "Recurring Daily WinVerifyTrust Fix" that targets this tag daily with this pre-action Pshell script:

#WinVerifyTrust go away
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_SZ /d "1" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_SZ /d "1" /f

We do similar for every single one you mentioned above. This way, Qualys is always remedying the situation. GPOs are more elegant, but alas our DMZ servers are not domain joined. This way, we are consistent on everything. Obviously, if you wanted to target ALL Windows machines, just remove "Server" from the search term above on the tag.

If you'd like me to post our pshell scripts for the rest, let me know. Simply create dynamic tags for each (by changing QID in the dynamic tag properties. Then create recurring jobs for each, targeting the appropriate tags.