The following is a description of the elements, types, and attributes that compose the Windows specific tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and should provide the information necessary to understand what each element and attribute represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between the different tests and their relationship to the Core Definition Schema is not outlined here. The OVAL Schema is maintained by The Mitre Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org. Windows Definition 5.3 6/22/2007 11:19:26 AM schematron validation of the Windows portion of an OVAL Definitions file - the value "" found in platform element as part of the affected element is not a valid windows platform. The access token test is used to check the properties of a Windows' access token as well as individual privileges and rights associated with it. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an accesstoken_object and the optional state element specifies the data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an accesstoken_test must reference an accesstoken_object - the state child element of an accesstoken_test must reference an accesstoken_state The accesstoken_object element is used by an access token test to define the object to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An access token object consists of a single security principle that identifies user, group, or compter account that is associated with the token. The security_principle element defines the access token being specified. Security principals include users or groups with either local or domain accounts, and computer accounts created when a computer running Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family joins a domain. User rights and permissions to access objects such as Active Directory objects, files, and registry settings are assigned to security principals. In a domain environment, security principals should be identified in the form: "domain\trustee name" For local security principals use: "computer name\trustee name" For built-in accounts on the system, use the trustee name without a domain. For example: ADMINISTRATOR, SYSTEM, NETWORK_SERVICES, ADMINISTRATORS (group), etc. Note that the built-in security principals should be all caps as that is how the windows apis return them. - datatype attribute for the security_principle entity of an accesstoken_object should be 'string' - operation attribute for the security_principle entity of an accesstoken_object should be 'equals', 'not equal', or 'pattern match' The accesstoken_state element defines the different information that can be used to evaluate the specified access tokens. This includes the multitude of user rights and permissions that can be granted. Please refer to the individual elements in the schema for more details about what each represents. The security_principle element identifies an access token to test for. Security principals include users or groups with either local or domain accounts, and computer accounts created when a computer running Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family joins a domain. User rights and permissions to access objects such as Active Directory objects, files, and registry settings are assigned to security principals. In a domain environment, security principals should be identified in the form: "domain\trustee name" For local security principals use: "computer name\trustee name" For built-in accounts on the system, use the trustee name without a domain. For example: ADMINISTRATOR, SYSTEM, NETWORK_SERVICES, ADMINISTRATORS (group), etc. Note that the built-in security principals should be all caps as that is how the windows apis return them. - datatype attribute for the security_principle entity of an accesstoken_state should be 'string' - operation attribute for the security_principle entity of an accesstoken_state should be 'equals', 'not equal', or 'pattern match' If the seassignprimarytokenprivilege privilege is enabled, it allows a parent process to replace the access token that is associated with a child process. - datatype attribute for the seassignprimarytokenprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seassignprimarytokenprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seauditprivilege privilege is enabled, it allows a process to generate audit records in the security log. The security log can be used to trace unauthorized system access. - datatype attribute for the seauditprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seauditprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sebackupprivilege privilege is enabled, it allows the user to circumvent file and directory permissions to back up the system. The privilege is selected only when an application attempts access by using the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply. - datatype attribute for the sebackupprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sebackupprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sechangenotifyprivilege privilege is enabled, it allows the user to pass through folders to which the user otherwise has no access while navigating an object path in the NTFS file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories. - datatype attribute for the sechangenotifyprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sechangenotifyprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreateglobalprivilege privilege is enabled, it allows the user to create named file mapping objects in the global namespace during Terminal Services sessions. - datatype attribute for the secreateglobalprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreateglobalprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatepagefileprivilege privilege is enabled, it allows the user to create and change the size of a pagefile. - datatype attribute for the secreatepagefileprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreatepagefileprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatepermanentprivilege privilege is enabled, it allows a process to create a directory object in the object manager. It is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode have this privilege inherently. - datatype attribute for the secreatepermanentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for thesecreatepermanentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatesymboliclinkprivilege privilege is enabled, it allows users to create symbolic links. This is new for Vista. - datatype attribute for the secreatesymboliclinkprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreatesymboliclinkprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatetokenprivilege privilege is enabled, it allows a process to create an access token by calling NtCreateToken() or other token-creating APIs. - datatype attribute for the secreatetokenprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreatetokenprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sedebugprivilege privilege is enabled, it allows the user to attach a debugger to any process. It provides access to sensitive and critical operating system components. - datatype attribute for the sedebugprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sedebugprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seenabledelegationprivilege privilege is enabled, it allows the user to change the Trusted for Delegation setting on a user or computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object. - datatype attribute for the seenabledelegationprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seenabledelegationprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seimpersonateprivilege privilege is enabled, it allows the user to impersonate a client after authentication. It is not supported on Windows XP, Windows 2000 SP3 and earlier, or Windows NT. - datatype attribute for the seimpersonateprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seimpersonateprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seincreasebasepriorityprivilege privilege is enabled, it allows a user to increase the base priority class of a process. - datatype attribute for the seincreasebasepriorityprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seincreasebasepriorityprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seincreasequotaprivilege privilege is enabled, it allows a process that has access to a second process to increase the processor quota assigned to the second process. - datatype attribute for the seincreasequotaprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seincreasequotaprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seincreaseworkingsetprivilege privilege is enabled, it allows a user to increase a process working set. This is new for Vista. - datatype attribute for the seincreaseworkingsetprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seincreaseworkingsetprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seloaddriverprivilege privilege is enabled, it allows a user to install and remove drivers for Plug and Play devices. - datatype attribute for the seloaddriverprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seloaddriverprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the selockmemoryprivilege privilege is enabled, it allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. - datatype attribute for the selockmemoryprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the selockmemoryprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the semachineaccountprivilege privilege is enabled, it allows the user to add a computer to a specific domain. - datatype attribute for the semachineaccountprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the semachineaccountprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the semanagevolumeprivilege privilege is enabled, it allows a non-administrative or remote user to manage volumes or disks. - datatype attribute for the semanagevolumeprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the semanagevolumeprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seprofilesingleprocessprivilege privilege is enabled, it allows a user to sample the performance of an application process. - datatype attribute for the seprofilesingleprocessprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seprofilesingleprocessprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the serelabelprivilege privilege is enabled, it allows a user to modify an object label. This user right is new for Vista. - datatype attribute for the serelabelprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the serelabelprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seremoteshutdownprivilege privilege is enabled, it allows a user to shut down a computer from a remote location on the network. - datatype attribute for the seremoteshutdownprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seremoteshutdownprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the serestoreprivilege privilege is enabled, it allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object. - datatype attribute for the serestoreprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the serestoreprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesecurityprivilege privilege is enabled, it allows a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. A user who has this privilege can also view and clear the security log from Event Viewer. - datatype attribute for the sesecurityprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesecurityprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seshutdownprivilege privilege is enabled, it allows a user to shut down the local computer. - datatype attribute for the seshutdownprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seshutdownprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesyncagentprivilege privilege is enabled, it allows a process to read all objects and properties in the directory, regardless of the protection on the objects and properties. It is required in order to use Lightweight Directory Access Protocol (LDAP) directory synchronization (Dirsync) services. - datatype attribute for the sesyncagentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesyncagentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemenvironmentprivilege privilege is enabled, it allows modification of system environment variables either by a process through an API or by a user through System Properties. - datatype attribute for the sesystemenvironmentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemenvironmentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemprofileprivilege privilege is enabled, it allows a user to sample the performance of system processes. - datatype attribute for the sesystemprofileprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemprofileprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemtimeprivilege privilege is enabled, it allows the user to adjust the time on the computer's internal clock. It is not required to change the time zone or other display characteristics of the system time. - datatype attribute for the sesystemtimeprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemtimeprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the setakeownershipprivilege privilege is enabled, it allows a user to take ownership of any securable object in the system, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads. - datatype attribute for the setakeownershipprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the setakeownershipprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the setcbprivilege privilege is enabled, it allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access. - datatype attribute for the setcbprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the setcbprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the setimezoneprivilege privilege is enabled, it allows the user to change the time zone. This is new for Vista. - datatype attribute for the setimezoneprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the setimezoneprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seundockprivilege privilege is enabled, it allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu. - datatype attribute for the seundockprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seundockprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seunsolicitedinputprivilege privilege is enabled, it allows the user to read unsolicited data from a terminal device. - datatype attribute for the seunsolicitedinputprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seunsolicitedinputprivilege entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sebatchlogonright right, it can log on using the batch logon type. - datatype attribute for the sebatchlogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sebatchlogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seinteractivelogonright right, it can log on using the interactive logon type. - datatype attribute for the seinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the senetworklogonright right, it can log on using the network logon type. - datatype attribute for the senetworklogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the senetworklogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seremoteinteractivelogonright right, it can log on to the computer by using a Remote Desktop connection. - datatype attribute for the seremoteinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seremoteinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seservicelogonright right, it can log on using the service logon type. - datatype attribute for the seservicelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seservicelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenybatchLogonright right, it is explicitly denied the ability to log on using the batch logon type. - datatype attribute for the sedenybatchLogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenybatchLogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyinteractivelogonright right, it is explicitly denied the ability to log on using the interactive logon type. - datatype attribute for the sedenyinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenynetworklogonright right, it is explicitly denied the ability to log on using the network logon type. - datatype attribute for the sedenynetworklogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenynetworklogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyremoteInteractivelogonright right, it is explicitly denied the ability to log on through Terminal Services. - datatype attribute for the sedenyremoteInteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyremoteInteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyservicelogonright right, it is explicitly denied the ability to log on using the service logon type. - datatype attribute for the sedenyservicelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyservicelogonright entity of an accesstoken_state should be 'equals', or 'not equal These behaviors allow a more detailed definition of the accesstoken_object being specified. If a group security principle is specified, this behavior specifies whether to include the group or not. For example, maybe you want to check the access tokens associated with every user within a group, but not the group itself. In this case, you would set the include_group behavior to 'false'. If the security_principle is not a group, then this behavior should be ignored. If a group security principle is specified, this behavior specifies whether to resolve the group into its list of users. For example, to check the access tokens of every user in a group, you could specify the group security_principle and then set the resolve_group behavior to 'true'. If the security_principle is not a group, then this behavior should be ignored. The active directory test is used to check information about specific entries in active directory. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an activedirectory_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an activedirectory_test must reference an activedirectory_object - the state child element of an activedirectory_test must reference an activedirectory_state The activedirectory_object element is used by an active directory test to define those objects to evaluated based on a specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An active directory object consists of three pieces of information, a naming context, a relative distinguished name, and an attribute. Each piece helps identify a specific active directory entry. Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema. - datatype attribute for the naming_context entity of an activedirectory_object should be 'string' - operation attribute for the naming_context entity of an activedirectory_object should be 'equals', or 'not equal The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the object's distinguished name except those outlined by the naming context. If the nillable attribute is set to true, then the object being specified is the higher level naming context. In this case, the relative_dn element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every relative dn under a given naming context. Note that when nil is used for the relative dn element, the attribute element should also be nilled. - datatype attribute for the relative_dn entity of an activedirectory_object should be 'string' - operation attribute for the relative_dn entity of an activedirectory_object should be 'equals', 'not equal', or 'pattern match' - attribute entity must be nil when relative_dn is nil Specifies a named value contained by the object. If the nillable attribute is set to true, then the object being specified is the higher level relative_dn. In this case, the attribute element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every attribute under a given relative dn. - datatype attribute for the attribute entity of an activedirectory_object should be 'string' - operation attribute for the attribute entity of an activedirectory_object should be 'equals', 'not equal', or 'pattern match' The activedirectory_state element defines the different information that can be used to evaluate the specified entries in active directory. An active directory test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents. Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema. - datatype attribute for the naming_context entity of an activedirectory_state should be 'string' - operation attribute for the naming_context entity of an activedirectory_state should be 'equals', or 'not equal The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the objects distinguished name except those outlined by the naming context. - datatype attribute for the relative_dn entity of an activedirectory_state should be 'string' - operation attribute for the relative_dn entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' Specifies a named value contained by the object. - datatype attribute for the attribute entity of an activedirectory_state should be 'string' - operation attribute for the attribute entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' The name of the class of which the object is an instance. - datatype attribute for the object_class entity of an activedirectory_state should be 'string' - operation attribute for the object_class entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' Specifies the type of information that the specified attribute represents. - datatype attribute for the adstype entity of an activedirectory_state should be 'string' - operation attribute for the adstype entity of an activedirectory_state should be 'equals', or 'not equal The actual value of the specified active directory attribute. - the supplied operation attribute for the value entity of an activedirectory_state is not valid given a datatype of '' The audit event policy test is used to check different types of events the system should audit. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an auditeventpolicy_test must reference an auditeventpolicy_object - the state child element of an auditeventpolicy_test must reference an auditeventpolicy_state The auditeventpolicy_object element is used by an audit event policy test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy will reference the same auditeventpolicy_object which is basically an empty object element. The auditeventpolicy_state element specifies the different system activities that can be audited. An audit event policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. The defined values are found in window's POLICY_AUDIT_EVENT_TYPE enumeration and accessed through the LsaQueryInformationPolicy when the InformationClass parameters are set to PolicyAuditEventsInformation. Please refer to the individual elements in the schema for more details about what each represents. Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection. - datatype attribute for the account_logon entity of an auditeventpolicy_state should be 'string' - operation attribute for the account_logon entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to create, delete, or change user or group accounts. Also, audit password changes. > - datatype attribute for the account_management entity of an auditeventpolicy_state should be 'string' - operation attribute for the account_management entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit specific events, such as program activation, some forms of handle duplication, indirect access to an object, and process exit. - datatype attribute for the detailed_tracking entity of an auditeventpolicy_state should be 'string' - operation attribute for the detailed_tracking entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to access the directory service. - datatype attribute for the directory_service_access entity of an auditeventpolicy_state should be 'string' - operation attribute for the directory_service_access entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection. - datatype attribute for the logon entity of an auditeventpolicy_state should be 'string' - operation attribute for the logon entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to access securable objects, such as files. > - datatype attribute for the object_access entity of an auditeventpolicy_state should be 'string' - operation attribute for the object_access entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to change Policy object rules. - datatype attribute for the policy_change entity of an auditeventpolicy_state should be 'string' - operation attribute for the policy_change entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to use privileges. - datatype attribute for the privilege_use entity of an auditeventpolicy_state should be 'string' - operation attribute for the privilege_use entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to shut down or restart the computer. Also, audit events that affect system security or the security log. - datatype attribute for the system entity of an auditeventpolicy_state should be 'string' - operation attribute for the system entity of an auditeventpolicy_state should be 'equals', or 'not equal The audit event policy subcategories test is used to check different types of events the system should audit. These subcategories are new for Windows Vista. The test extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an auditeventpolicysubcategories_test must reference an auditeventpolicysubcategories_object - the state child element of an auditeventpolicysubcategories_test must reference an auditeventpolicysubcategories_state