The following is a description of the elements, types, and attributes that compose the Windows specific tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and should provide the information necessary to understand what each element and attribute represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between the different tests and their relationship to the Core Definition Schema is not outlined here. The OVAL Schema is maintained by The MITRE Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org. Windows Definition 5.6 9/9/2009 9:44:39 AM Copyright (c) 2002-2009, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the OVAL License located at http://oval.mitre.org/oval/about/termsofuse.html. See the OVAL License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the OVAL Schema, this license header must be included. - the value "" found in platform element as part of the affected element is not a valid windows platform. The access token test is used to check the properties of a Windows access token as well as individual privileges and rights associated with it. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an accesstoken_object and the optional state element specifies the data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an accesstoken_test must reference an accesstoken_object - the state child element of an accesstoken_test must reference an accesstoken_state The accesstoken_object element is used by an access token test to define the object to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An access token object consists of a single security principle that identifies user, group, or compter account that is associated with the token. The security_principle element defines the access token being specified. Security principals include users or groups with either local or domain accounts, and computer accounts created when a computer running Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family joins a domain. User rights and permissions to access objects such as Active Directory objects, files, and registry settings are assigned to security principals. In a domain environment, security principals should be identified in the form: "domain\trustee name". For local security principals use: "computer name\trustee name". For built-in accounts on the system, use the trustee name without a domain. For example: ADMINISTRATOR, SYSTEM, NETWORK_SERVICES, ADMINISTRATORS (group), etc. Note that the built-in security principals should be all caps as that is how the windows apis return them. If an operation other than equals is used to identify matching trustees (i.e. not equal, or a pattern match) then the resulting matches shall be limited to only the trustees referenced in the Local Security Authority database. The scope is limited here to avoid unnecessarily resource intensive searches for trustees. Note that the larger scope of all known trustees may be obtained through the use of variables. - datatype attribute for the security_principle entity of an accesstoken_object should be 'string' The accesstoken_state element defines the different information that can be used to evaluate the specified access tokens. This includes the multitude of user rights and permissions that can be granted. Please refer to the individual elements in the schema for more details about what each represents. The security_principle element identifies an access token to test for. Security principals include users or groups with either local or domain accounts, and computer accounts created when a computer running Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family joins a domain. User rights and permissions to access objects such as Active Directory objects, files, and registry settings are assigned to security principals. In a domain environment, security principals should be identified in the form: "domain\trustee name" For local security principals use: "computer name\trustee name" For built-in accounts on the system, use the trustee name without a domain. For example: ADMINISTRATOR, SYSTEM, NETWORK_SERVICES, ADMINISTRATORS (group), etc. Note that the built-in security principals should be all caps as that is how the windows apis return them. - datatype attribute for the security_principle entity of an accesstoken_state should be 'string' If the seassignprimarytokenprivilege privilege is enabled, it allows a parent process to replace the access token that is associated with a child process. - datatype attribute for the seassignprimarytokenprivilege entity of an accesstoken_state should be 'boolean' If the seauditprivilege privilege is enabled, it allows a process to generate audit records in the security log. The security log can be used to trace unauthorized system access. - datatype attribute for the seauditprivilege entity of an accesstoken_state should be 'boolean' If the sebackupprivilege privilege is enabled, it allows the user to circumvent file and directory permissions to back up the system. The privilege is selected only when an application attempts access by using the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply. - datatype attribute for the sebackupprivilege entity of an accesstoken_state should be 'boolean' If the sechangenotifyprivilege privilege is enabled, it allows the user to pass through folders to which the user otherwise has no access while navigating an object path in the NTFS file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories. - datatype attribute for the sechangenotifyprivilege entity of an accesstoken_state should be 'boolean' If the secreateglobalprivilege privilege is enabled, it allows the user to create named file mapping objects in the global namespace during Terminal Services sessions. - datatype attribute for the secreateglobalprivilege entity of an accesstoken_state should be 'boolean' If the secreatepagefileprivilege privilege is enabled, it allows the user to create and change the size of a pagefile. - datatype attribute for the secreatepagefileprivilege entity of an accesstoken_state should be 'boolean' If the secreatepermanentprivilege privilege is enabled, it allows a process to create a directory object in the object manager. It is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode have this privilege inherently. - datatype attribute for the secreatepermanentprivilege entity of an accesstoken_state should be 'boolean' If the secreatesymboliclinkprivilege privilege is enabled, it allows users to create symbolic links. This is new for Vista. - datatype attribute for the secreatesymboliclinkprivilege entity of an accesstoken_state should be 'boolean' If the secreatetokenprivilege privilege is enabled, it allows a process to create an access token by calling NtCreateToken() or other token-creating APIs. - datatype attribute for the secreatetokenprivilege entity of an accesstoken_state should be 'boolean' If the sedebugprivilege privilege is enabled, it allows the user to attach a debugger to any process. It provides access to sensitive and critical operating system components. - datatype attribute for the sedebugprivilege entity of an accesstoken_state should be 'boolean' If the seenabledelegationprivilege privilege is enabled, it allows the user to change the Trusted for Delegation setting on a user or computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object. - datatype attribute for the seenabledelegationprivilege entity of an accesstoken_state should be 'boolean' If the seimpersonateprivilege privilege is enabled, it allows the user to impersonate a client after authentication. It is not supported on Windows XP, Windows 2000 SP3 and earlier, or Windows NT. - datatype attribute for the seimpersonateprivilege entity of an accesstoken_state should be 'boolean' If the seincreasebasepriorityprivilege privilege is enabled, it allows a user to increase the base priority class of a process. - datatype attribute for the seincreasebasepriorityprivilege entity of an accesstoken_state should be 'boolean' If the seincreasequotaprivilege privilege is enabled, it allows a process that has access to a second process to increase the processor quota assigned to the second process. - datatype attribute for the seincreasequotaprivilege entity of an accesstoken_state should be 'boolean' If the seincreaseworkingsetprivilege privilege is enabled, it allows a user to increase a process working set. This is new for Vista. - datatype attribute for the seincreaseworkingsetprivilege entity of an accesstoken_state should be 'boolean' If the seloaddriverprivilege privilege is enabled, it allows a user to install and remove drivers for Plug and Play devices. - datatype attribute for the seloaddriverprivilege entity of an accesstoken_state should be 'boolean' If the selockmemoryprivilege privilege is enabled, it allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. - datatype attribute for the selockmemoryprivilege entity of an accesstoken_state should be 'boolean' If the semachineaccountprivilege privilege is enabled, it allows the user to add a computer to a specific domain. - datatype attribute for the semachineaccountprivilege entity of an accesstoken_state should be 'boolean' If the semanagevolumeprivilege privilege is enabled, it allows a non-administrative or remote user to manage volumes or disks. - datatype attribute for the semanagevolumeprivilege entity of an accesstoken_state should be 'boolean' If the seprofilesingleprocessprivilege privilege is enabled, it allows a user to sample the performance of an application process. - datatype attribute for the seprofilesingleprocessprivilege entity of an accesstoken_state should be 'boolean' If the serelabelprivilege privilege is enabled, it allows a user to modify an object label. This user right is new for Vista. - datatype attribute for the serelabelprivilege entity of an accesstoken_state should be 'boolean' If the seremoteshutdownprivilege privilege is enabled, it allows a user to shut down a computer from a remote location on the network. - datatype attribute for the seremoteshutdownprivilege entity of an accesstoken_state should be 'boolean' If the serestoreprivilege privilege is enabled, it allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object. - datatype attribute for the serestoreprivilege entity of an accesstoken_state should be 'boolean' If the sesecurityprivilege privilege is enabled, it allows a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. A user who has this privilege can also view and clear the security log from Event Viewer. - datatype attribute for the sesecurityprivilege entity of an accesstoken_state should be 'boolean' If the seshutdownprivilege privilege is enabled, it allows a user to shut down the local computer. - datatype attribute for the seshutdownprivilege entity of an accesstoken_state should be 'boolean' If the sesyncagentprivilege privilege is enabled, it allows a process to read all objects and properties in the directory, regardless of the protection on the objects and properties. It is required in order to use Lightweight Directory Access Protocol (LDAP) directory synchronization (Dirsync) services. - datatype attribute for the sesyncagentprivilege entity of an accesstoken_state should be 'boolean' If the sesystemenvironmentprivilege privilege is enabled, it allows modification of system environment variables either by a process through an API or by a user through System Properties. - datatype attribute for the sesystemenvironmentprivilege entity of an accesstoken_state should be 'boolean' If the sesystemprofileprivilege privilege is enabled, it allows a user to sample the performance of system processes. - datatype attribute for the sesystemprofileprivilege entity of an accesstoken_state should be 'boolean' If the sesystemtimeprivilege privilege is enabled, it allows the user to adjust the time on the computer's internal clock. It is not required to change the time zone or other display characteristics of the system time. - datatype attribute for the sesystemtimeprivilege entity of an accesstoken_state should be 'boolean' If the setakeownershipprivilege privilege is enabled, it allows a user to take ownership of any securable object in the system, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads. - datatype attribute for the setakeownershipprivilege entity of an accesstoken_state should be 'boolean' If the setcbprivilege privilege is enabled, it allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access. - datatype attribute for the setcbprivilege entity of an accesstoken_state should be 'boolean' If the setimezoneprivilege privilege is enabled, it allows the user to change the time zone. This is new for Vista. - datatype attribute for the setimezoneprivilege entity of an accesstoken_state should be 'boolean' If the seundockprivilege privilege is enabled, it allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu. - datatype attribute for the seundockprivilege entity of an accesstoken_state should be 'boolean' If the seunsolicitedinputprivilege privilege is enabled, it allows the user to read unsolicited data from a terminal device. - datatype attribute for the seunsolicitedinputprivilege entity of an accesstoken_state should be 'boolean' If an account is assigned the sebatchlogonright right, it can log on using the batch logon type. - datatype attribute for the sebatchlogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the seinteractivelogonright right, it can log on using the interactive logon type. - datatype attribute for the seinteractivelogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the senetworklogonright right, it can log on using the network logon type. - datatype attribute for the senetworklogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the seremoteinteractivelogonright right, it can log on to the computer by using a Remote Desktop connection. - datatype attribute for the seremoteinteractivelogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the seservicelogonright right, it can log on using the service logon type. - datatype attribute for the seservicelogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the sedenybatchLogonright right, it is explicitly denied the ability to log on using the batch logon type. - datatype attribute for the sedenybatchLogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the sedenyinteractivelogonright right, it is explicitly denied the ability to log on using the interactive logon type. - datatype attribute for the sedenyinteractivelogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the sedenynetworklogonright right, it is explicitly denied the ability to log on using the network logon type. - datatype attribute for the sedenynetworklogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the sedenyremoteInteractivelogonright right, it is explicitly denied the ability to log on through Terminal Services. - datatype attribute for the sedenyremoteInteractivelogonright entity of an accesstoken_state should be 'boolean' If an account is assigned the sedenyservicelogonright right, it is explicitly denied the ability to log on using the service logon type. - datatype attribute for the sedenyservicelogonright entity of an accesstoken_state should be 'boolean' The AccesstokenBehaviors complex type defines a number of behaviors that allow a more detailed definition of the accesstoken_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. If a group security principle is specified, this behavior specifies whether to include the group or not. For example, maybe you want to check the access tokens associated with every user within a group, but not the group itself. In this case, you would set the include_group behavior to 'false'. If the security_principle is not a group, then this behavior should be ignored. The 'resolve_group' behavior defines whether an object set defined by a group sid should be resolved to return a set that contains all the user sids that are a member of that group. Note that all child groups should also be resolved and any valid domain users that are members of the group should also be included. The intent of this behavior is to end up with a list of all individual users from that system that make up the group once everything has been resolved. 5.6 The 'resolve_group' behavior has been deprecated in favor of using variables to reference more efficient objects for expanding groups. Consider using a sid_object or similar to resolve the members of a group. DEPRECATED BEHAVIOR IN: win-def:accesstoken_object The active directory test is used to check information about specific entries in active directory. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an activedirectory_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an activedirectory_test must reference an activedirectory_object - the state child element of an activedirectory_test must reference an activedirectory_state The activedirectory_object element is used by an active directory test to define those objects to evaluated based on a specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An active directory object consists of three pieces of information, a naming context, a relative distinguished name, and an attribute. Each piece helps identify a specific active directory entry. Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema. - datatype attribute for the naming_context entity of an activedirectory_object should be 'string' The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the object's distinguished name except those outlined by the naming context. If the nillable attribute is set to true, then the object being specified is the higher level naming context. In this case, the relative_dn element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every relative dn under a given naming context. - datatype attribute for the relative_dn entity of an activedirectory_object should be 'string' Specifies a named value contained by the object. If the nillable attribute is set to true, the attribute element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every attribute under a given relative dn. - datatype attribute for the attribute entity of an activedirectory_object should be 'string' The activedirectory_state element defines the different information that can be used to evaluate the specified entries in active directory. An active directory test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents. Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema. - datatype attribute for the naming_context entity of an activedirectory_state should be 'string' The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the objects distinguished name except those outlined by the naming context. - datatype attribute for the relative_dn entity of an activedirectory_state should be 'string' Specifies a named value contained by the object. - datatype attribute for the attribute entity of an activedirectory_state should be 'string' The name of the class of which the object is an instance. - datatype attribute for the object_class entity of an activedirectory_state should be 'string' Specifies the type of information that the specified attribute represents. - datatype attribute for the adstype entity of an activedirectory_state should be 'string' The actual value of the specified active directory attribute. - The datatype has been set to 'int' but the value is not an integer. The audit event policy test is used to check different types of events the system should audit. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an auditeventpolicy_test must reference an auditeventpolicy_object - the state child element of an auditeventpolicy_test must reference an auditeventpolicy_state The auditeventpolicy_object element is used by an audit event policy test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy will reference the same auditeventpolicy_object which is basically an empty object element. The auditeventpolicy_state element specifies the different system activities that can be audited. An audit event policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. The defined values are found in window's POLICY_AUDIT_EVENT_TYPE enumeration and accessed through the LsaQueryInformationPolicy when the InformationClass parameters are set to PolicyAuditEventsInformation. Please refer to the individual elements in the schema for more details about what each represents. Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection. - datatype attribute for the account_logon entity of an auditeventpolicy_state should be 'string' Audit attempts to create, delete, or change user or group accounts. Also, audit password changes. - datatype attribute for the account_management entity of an auditeventpolicy_state should be 'string' Audit specific events, such as program activation, some forms of handle duplication, indirect access to an object, and process exit. Note that this activitiy is also known as process tracking. - datatype attribute for the detailed_tracking entity of an auditeventpolicy_state should be 'string' Audit attempts to access the directory service. - datatype attribute for the directory_service_access entity of an auditeventpolicy_state should be 'string' Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection. - datatype attribute for the logon entity of an auditeventpolicy_state should be 'string' Audit attempts to access securable objects, such as files. - datatype attribute for the object_access entity of an auditeventpolicy_state should be 'string' Audit attempts to change Policy object rules. - datatype attribute for the policy_change entity of an auditeventpolicy_state should be 'string' Audit attempts to use privileges. - datatype attribute for the privilege_use entity of an auditeventpolicy_state should be 'string' Audit attempts to shut down or restart the computer. Also, audit events that affect system security or the security log. - datatype attribute for the system entity of an auditeventpolicy_state should be 'string' The audit event policy subcategories test is used to check different types of events the system should audit. These subcategories are new for Windows Vista. The test extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an auditeventpolicysubcategories_test must reference an auditeventpolicysubcategories_object - the state child element of an auditeventpolicysubcategories_test must reference an auditeventpolicysubcategories_state The auditeventpolicysubcategories_object element is used by an audit event policy subcategories test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy subcategories and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy subcategories will reference the same auditeventpolicysubcategories_object which is basically an empty object element. The auditeventpolicysubcategories_state element specifies the different system activities that can be audited. An audit event policy subcategories test will reference a specific instance of this state that defines the exact subcategories that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents. - datatype attribute for the credential_validation entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the kerberos_ticket_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the other_account_logon_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the application_group_management entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the computer_account_management entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the distribution_group_management entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the other_account_management_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the security_group_management entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the user_account_management entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the dpapi_activity entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the process_creation entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the process_termination entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the rpc_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the directory_service_access entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the directory_service_changes entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the directory_service_replication entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the detailed_directory_service_replication entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the account_lockout entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the ipsec_extended_mode entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the ipsec_main_mode entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the ipsec_quick_mode entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the logoff entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the logon entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the other_logon_logoff_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the special_logon entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the application_generated entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the certification_services entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the file_share entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the file_system entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the filtering_platform_connection entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the filtering_platform_packet_drop entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the handle_manipulation entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the kernel_object entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the other_object_access_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the registry entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the sam entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the audit_policy_change entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the authentication_policy_change entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the authorization_policy_change entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the filtering_platform_policy_change entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the mpssvc_rule_level_policy_change entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the other_policy_change_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the non_sensitive_privilege_use entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the other_privilege_use_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the sensitive_privilege_use entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the ipsec_driver entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the other_system_events entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the security_state_change entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the security_system_extension entity of an auditeventpolicysubcategories_state should be 'string' - datatype attribute for the system_integrity entity of an auditeventpolicysubcategories_state should be 'string' The file test is used to check metadata associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a file_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a file_test must reference a file_object - the state child element of a file_test must reference a file_state The file_object element is used by a file test to define the specific file(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A file object defines the path and filename or complete filepath of the file(s). In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileBehaviors complex type for more information about specific behaviors. The set of files to be evaluated may be identified with either a complete filepath or a path and filename. Only one of these options may be selected. It is important to note that the ‘max_depth’ and ‘recurse_direction’ attributes of the ‘behaviors’ element do not apply to the ‘filepath’ element, only to the ‘path’ and ‘filename’ elements. This is because the ‘filepath’ element represents an absolute path to a particular file and it is not possible to recurse over a file. The filepath element specifies the absolute path for a file on the machine. - datatype attribute for the filepath entity of a file_object should be 'string' The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a file_object should be 'string' The filename element specifies the name of a file to evaluate. If the nillable attribute is set to true, then the object being specified is the higher level directory object (not all the files in the directory). In this case, the filename element should not be used during collection and would result in the set of collected objects being the directories themselves. For example, one would set nillable to true if the desire was to test the attributes or permissions associated with a directory. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a file_object should be 'string' - filename entity can not contain the characters / \ : * ? > | The file_state element defines the different metadata associate with a Windows file. This includes the path, filename, owner, size, last modified time, version, etc. Please refer to the individual elements in the schema for more details about what each represents. The filepath element specifies the absolute path for a file on the machine. - datatype attribute for the filepath entity of a file_state should be 'string' The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a file_state should be 'string' The filename element specifies the name of the file. - datatype attribute for the filename entity of a file_state should be 'string' - filename entity can not contain the characters / \ : * ? > | The owner element is a string that contains the name of the owner. - datatype attribute for the owner entity of a file_state should be 'string' The size element is the size of the file in bytes. - datatype attribute for the size entity of a file_state should be 'int' Time of last access of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the a_time entity of a file_state should be 'int' Time of creation of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the c_time entity of a file_state should be 'int' Time of last modification of file. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the m_time entity of a file_state should be 'int' The ms_checksum element is the md5 checksum of the file as supplied by Microsoft. - datatype attribute for the ms_checksum entity of a file_state should be 'string' The version element is the delimited version string of the file. - datatype attribute for the version entity of a file_state should be 'version' The type element marks whether the file is a directory, named pipe, standard file, etc. These types are the return values for GetFileType, with the exception of FILE_ATTRIBUTE_DIRECTORY which is obtained by looking at GetFileAttributesEx. NOTE: Should this entity be split into two in future versions of the language as there are other values associated with GetFileAttributesEx that are not represented here? - datatype attribute for the type entity of a file_state should be 'string' The development_class element allows the distinction to be made between the GDR development environment and the QFE development environment. This field holds the text found in front of the mmmmmm-nnnn version, for example srv03_gdr. - datatype attribute for the development_class entity of a file_state should be 'string' This entity defines a company name to be found within the version-information structure. - datatype attribute for the company entity of a file_state should be 'string' This entity defines an internal name to be found within the version-information structure. - datatype attribute for the internal_name entity of a file_state should be 'string' This entity defines a language to be found within the version-information structure. - datatype attribute for the language entity of a file_state should be 'string' This entity defines an original filename to be found within the version-information structure. - datatype attribute for the original_filename entity of a file_state should be 'string' This entity defines a product name to be found within the version-information structure. - datatype attribute for the product_name entity of a file_state should be 'string' This entity defines a product version to be found within the version-information structure. - datatype attribute for the product_version entity of a file_state should be 'string' The FileBehaviors complex type defines a number of behaviors that allow a more detailed definition of the file_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. It is important to note that the ‘max_depth’ and ‘recurse_direction’ attributes of the ‘behaviors’ element do not apply to the ‘filepath’ element, only to the ‘path’ and ‘filename’ elements. This is because the ‘filepath’ element represents an absolute path to a particular file and it is not possible to recurse over a file. 'max_depth' defines the maximum depth of recursion to perform when a recurse_direction is specified. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. The default value is '-1' meaning no limitation. Note that the default recurse_direction behavior is 'none' so even though max_depth specifies no limitation by default, the recurse_direction behavior turns recusion off. 'recurse_direction' defines the direction, either 'up' to parent directories, or 'down' into child directories to recursively search for files. When recursing up or down, one is limited by the max_depth behavior. Note that it is not an error if max_depth specifies a certain level of recursion and that level does not exist. Recursing should only go as deep as available. The default value is 'none' for no recursion. The file audit permissions test is used to check the audit permissions associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a fileauditedpermissions53_test must reference a fileauditedpermissions53_object - the state child element of a fileauditedpermissions53_test must reference a fileauditedpermissions53_state The fileauditedpermissions53_object element is used by a file audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. A fileauditedpermissions53_object is defined as a combination of a Windows file and trustee sid. The file represents the file to be evaluated while the trustee sid represents the account (sid) to check audited permissions of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileAuditPermissions53Behaviors complex type for more information about specific behaviors. The set of files to be evaluated may be identified with either a complete filepath or a path and filename. Only one of these options may be selected. It is important to note that the ‘max_depth’ and ‘recurse_direction’ attributes of the ‘behaviors’ element do not apply to the ‘filepath’ element, only to the ‘path’ and ‘filename’ elements. This is because the ‘filepath’ element represents an absolute path to a particular file and it is not possible to recurse over a file. The filepath element specifies the absolute path for a file on the machine. - datatype attribute for the filepath entity of a fileauditedpermissions53_object should be 'string' The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a fileauditedpermissions53_object should be 'string' The filename element specifies the name of a file to evaluate. If the nillable attribute is set to true, then the object being specified is the higher level directory object (not all the files in the directory). In this case, the filename element should not be used during collection and would result in the set of collected objects being the directories themselves. For example, one would set nillable to true if the desire was to test the attributes or permissions associated with a directory. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a fileauditedpermissions53_object should be 'string' - filename entity can not contain the characters / \ : * ? > | The trustee_sid entity identifies a unique sid associated with a user, group, system, or program (such as a Windows service). If an operation other than equals is used to identify matching trustees (i.e. not equal, or a pattern match) then the resulting matches shall be limited to only the trustees referenced in the file's Security Descriptor. The scope is limited here to avoid unnecessarily resource intensive searches for trustees. Note that the larger scope of all known trustees may be obtained through the use of variables. - datatype attribute for the trustee_sid entity of a fileauditedpermissions53_object should be 'string' The fileauditedpermissions53_state element defines the different audit permissions that can be associated with a given fileauditedpermissions53_object. Please refer to the individual elements in the schema for more details about what each represents. The filepath element specifies the absolute path for a file on the machine. - datatype attribute for the filepath entity of a fileauditedpermissions53_state should be 'string' The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a fileauditedpermissions53_state should be 'string' The filename element specifies the name of a file to test for. - datatype attribute for the filename entity of a fileauditedpermissions53_state should be 'string' - filename entity can not contain the characters / \ : * ? > | The trustee_sid element is the unique sid that associated a user, group, system, or program (such as a Windows service). - datatype attribute for the trustee_sid entity of a fileauditedpermissions53_state should be 'string' The right to delete the object. - datatype attribute for the standard_delete entity of a fileauditedpermissions53_state should be 'string' The right to read the information in the object's Security Descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a fileauditedpermissions53_state should be 'string' The right to modify the DACL in the object's Security Descriptor. - datatype attribute for the standard_write_dac entity of a fileauditedpermissions53_state should be 'string' The right to change the owner in the object's Security Descriptor. - datatype attribute for the standard_write_owner entity of a fileauditedpermissions53_state should be 'string' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a fileauditedpermissions53_state should be 'string' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a fileauditedpermissions53_state should be 'string' Read access. - datatype attribute for the generic_read entity of a fileauditedpermissions53_state should be 'string' Write access. - datatype attribute for the generic_write entity of a fileauditedpermissions53_state should be 'string' Execute access. - datatype attribute for the generic_execute entity of a fileauditedpermissions53_state should be 'string' Read, write, and execute access. - datatype attribute for the generic_all entity of a fileauditedpermissions53_state should be 'string' Grants the right to read data from the file. - datatype attribute for the file_read_data entity of a fileauditedpermissions53_state should be 'string' Grants the right to write data to the file. - datatype attribute for the file_write_data entity of a fileauditedpermissions53_state should be 'string' Grants the right to append data to the file. - datatype attribute for the file_append_data entity of a fileauditedpermissions53_state should be 'string' Grants the right to read extended attributes. - datatype attribute for the file_read_ea entity of a fileauditedpermissions53_state should be 'string' Grants the right to write extended attributes. - datatype attribute for the file_write_ea entity of a fileauditedpermissions53_state should be 'string' Grants the right to execute a file. - datatype attribute for the file_execute entity of a fileauditedpermissions53_state should be 'string' Right to delete a directory and all the files it contains (its children), even if the files are read-only. - datatype attribute for the file_delete_child entity of a fileauditedpermissions53_state should be 'string' Grants the right to read file attributes. - datatype attribute for the file_read_attributes entity of a fileauditedpermissions53_state should be 'string' Grants the right to change file attributes. - datatype attribute for the file_write_attributes entity of a fileauditedpermissions53_state should be 'string' The FileAuditPermissions53Behaviors complex type defines a number of behaviors that allow a more detailed definition of the fileauditpermissions53_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. It is important to note that the ‘max_depth’ and ‘recurse_direction’ attributes of the ‘behaviors’ element do not apply to the ‘filepath’ element, only to the ‘path’ and ‘filename’ elements. This is because the ‘filepath’ element represents an absolute path to a particular file and it is not possible to recurse over a file. 'max_depth' defines the maximum depth of recursion to perform when a recurse_direction is specified. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. The default value is '-1' meaning no limitation. Note that the default recurse_direction behavior is 'none' so even though max_depth specifies no limitation by default, the recurse_direction behavior turns recusion off. 'recurse_direction' defines the direction, either 'up' to parent directories, or 'down' into child directories to recursively search for files. When recursing up or down, one is limited by the max_depth behavior. Note that it is not an error if max_depth specifies a certain level of recursion and that level does not exist. Recursing should only go as deep as available. The default value is 'none' for no recursion. 'include_group' defines whether the group sid should be included in the object when the object is defined by a group sid. For example, the intent of an object defined by a group sid might be to retrieve all the user sids that are a member of the group, but not the group sid itself. The 'resolve_group' behavior defines whether an object set defined by a group sid should be resolved to return a set that contains all the user sids that are a member of that group. Note that all child groups should also be resolved any valid domain users that are members of the group should also be included. The intent of this behavior is to end up with a list of all individual users from that system that make up the group once everything has been resolved. 5.6 The 'resolve_group' behavior has been deprecated in favor of using variables to reference more efficient objects for expanding groups. Consider using a sid_sid_object or similar to resolve the members of a group. DEPRECATED BEHAVIOR IN: fileauditedpermissions53_object The file audited permissions test is used to check the audit permissions associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileauditedpermissions_object, and the optional state element references a fileauditedpermissions_state that specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. 5.3 Replaced by the fileauditedpermissions53_test. This test uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. See the fileauditedpermissions53_test. This test has been deprecated and will be removed in version 6.0 of the language. DEPRECATED TEST: ID: - the object child element of a fileauditedpermissions_test must reference a fileauditedpermissions_object - the state child element of a fileauditedpermissions_test must reference a fileauditedpermissions_state The fileauditedpermissions_object element is used by a file audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. A fileauditedpermissions_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileAuditPermissionsBehaviors complex type for more information about specific behaviors. 5.3 Replaced by the fileauditedpermissions53_object. This object uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new object was created to use trustee SIDs, which are unique. See the fileauditedpermissions53_object. This object has been deprecated and will be removed in version 6.0 of the language. DEPRECATED OBJECT: ID: The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a fileauditedpermissions_object should be 'string' The filename element specifies the name of a file to evaluate. If the nillable attribute is set to true, then the object being specified is the higher level directory object (not all the files in the directory). In this case, the filename element should not be used during collection and would result in the set of collected objects being the directories themselves. For example, one would set nillable to true if the desire was to test the attributes or permissions associated with a directory. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a fileauditedpermissions_object should be 'string' - filename entity can not contain the characters / \ : * ? > | The trustee_name element is the unique name that associated a particular SID. A SID can be associated with a user, group, or program (such as a Windows service). In a domain environment, trustee names should be identified in the form: "domain\trustee name" For local trustee names use: "computer name\trustee name" For built-in accounts on the system, use the trustee name without a domain. For example: ADMINISTRATOR, SYSTEM, NETWORK_SERVICES, ADMINISTRATORS (group), etc. Note that the built-in trustee names should be all caps as that is how the windows apis return them. - datatype attribute for the trustee_name entity of a fileauditedpermissions_object should be 'string' The fileauditedpermissions_state element defines the different audit permissions that can be associated with a given fileauditedpermissions_object. Please refer to the individual elements in the schema for more details about what each represents. 5.3 Replaced by the fileauditedpermissions53_state. This state uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new state was created to use trustee SIDs, which are unique. See the fileauditedpermissions53_state. This state has been deprecated and will be removed in version 6.0 of the language. DEPRECATED STATE: ID: The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a fileauditedpermissions_state should be 'string' The filename element specifies the name of a file to test for. - datatype attribute for the filename entity of a fileauditedpermissions_state should be 'string' - filename entity can not contain the characters / \ : * ? > | The trustee_name is the unique name associated with a particular security identifier (SID). In a domain environment, trustee names should be identified in the form: "domain\trustee name" For local trustee names use: "computer name\trustee name" For built-in accounts on the system, use the trustee name without a domain. For example: ADMINISTRATOR, SYSTEM, NETWORK_SERVICES, ADMINISTRATORS (group), etc. Note that the built-in trustee names should be all caps as that is how the windows apis return them. - datatype attribute for the trustee_name entity of a fileauditedpermissions_state should be 'string' The right to delete the object. - datatype attribute for the standard_delete entity of a fileauditedpermissions_state should be 'string' The right to read the information in the object's Security Descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a fileauditedpermissions_state should be 'string' The right to modify the DACL in the object's Security Descriptor. - datatype attribute for the standard_write_dac entity of a fileauditedpermissions_state should be 'string' The right to change the owner in the object's Security Descriptor. - datatype attribute for the standard_write_owner entity of a fileauditedpermissions_state should be 'string' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a fileauditedpermissions_state should be 'string' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a fileauditedpermissions_state should be 'string' Read access. - datatype attribute for the generic_read entity of a fileauditedpermissions_state should be 'string' Write access. - datatype attribute for the generic_write entity of a fileauditedpermissions_state should be 'string' Execute access. - datatype attribute for the generic_execute entity of a fileauditedpermissions_state should be 'string' Read, write, and execute access. - datatype attribute for the generic_all entity of a fileauditedpermissions_state should be 'string' Grants the right to read data from the file. - datatype attribute for the file_read_data entity of a fileauditedpermissions_state should be 'string' Grants the right to write data to the file. - datatype attribute for the file_write_data entity of a fileauditedpermissions_state should be 'string' Grants the right to append data to the file. - datatype attribute for the file_append_data entity of a fileauditedpermissions_state should be 'string' Grants the right to read extended attributes. - datatype attribute for the file_read_ea entity of a fileauditedpermissions_state should be 'string' Grants the right to write extended attributes. - datatype attribute for the file_write_ea entity of a fileauditedpermissions_state should be 'string' Grants the right to execute a file. - datatype attribute for the file_execute entity of a fileauditedpermissions_state should be 'string' Right to delete a directory and all the files it contains (its children), even if the files are read-only. - datatype attribute for the file_delete_child entity of a fileauditedpermissions_state should be 'string' Grants the right to read file attributes. - datatype attribute for the file_read_attributes entity of a fileauditedpermissions_state should be 'string' Grants the right to change file attributes. - datatype attribute for the file_write_attributes entity of a fileauditedpermissions_state should be 'string' The FileAuditPermissionsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the fileauditpermissions_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. 5.3 Replaced by the FileAuditPermissionsBehaviors53. The FileAuditPermissionsBehaviors complex type is used by the fileauditedpermissions_test which uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. This new test utilizes the FileAuditPermissionsBehaviors53 complex type, and as a result, the FileAuditPermissionsBehaviors complex type is no longer needed. This complex type has been deprecated and will be removed in version 6.0 of the language. 'max_depth' defines the maximum depth of recursion to perform when a recurse_direction is specified. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. The default value is '-1' meaning no limitation. Note that the default recurse_direction behavior is 'none' so even though max_depth specifies no limitation by default, the recurse_direction behavior turns recusion off. 'recurse_direction' defines the direction, either 'up' to parent directories, or 'down' into child directories to recursively search for files. When recursing up or down, one is limited by the max_depth behavior. Note that it is not an error if max_depth specifies a certain level of recursion and that level does not exist. Recursing should only go as deep as available. The default value is 'none' for no recursion. 'include_group' defines whether the group trustee name should be included in the object when the object is defined by a group trustee name. For example, the intent of an object defined by a group trustee name might be to retrieve all the user sids that are a member of the group, but not the group trustee name itself. The 'resolve_group' behavior defines whether an object set defined by a group sid should be resolved to return a set that contains all the user sids that are a member of that group. Note that all child groups should also be resolved any valid domain users that are members of the group should also be included. The intent of this behavior is to end up with a list of all individual users from that system that make up the group once everything has been resolved. 5.6 The 'resolve_group' behavior has been deprecated in favor of using variables to reference more efficient objects for expanding groups. Consider using a sid_object or similar to resolve the members of a group. DEPRECATED BEHAVIOR IN: fileauditedpermissions_object The file effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The fileeffectiverights53_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileeffectiverights53_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a fileeffectiverights53_test must reference a fileeffectiverights53_object - the state child element of a fileeffectiverights53_test must reference a fileeffectiverights53_state The fileeffectiverights53_object element is used by a file effective rights test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. A fileeffectiverights53_object is defined as a combination of a Windows file and trustee sid. The file represents the file to be evaluated while the trustee sid represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileEffectiveRights53Behaviors complex type for more information about specific behaviors. The set of files to be evaluated may be identified with either a complete filepath or a path and filename. Only one of these options may be selected. It is important to note that the ‘max_depth’ and ‘recurse_direction’ attributes of the ‘behaviors’ element do not apply to the ‘filepath’ element, only to the ‘path’ and ‘filename’ elements. This is because the ‘filepath’ element represents an absolute path to a particular file and it is not possible to recurse over a file. The filepath element specifies the absolute path for a file on the machine. - datatype attribute for the filepath entity of a fileeffectiverights53_object should be 'string' The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a fileeffectiverights53_object should be 'string' The filename element specifies the name of a file to evaluate. If the nillable attribute is set to true, then the object being specified is the higher level directory object (not all the files in the directory). In this case, the filename element should not be used during collection and would result in the set of collected objects being the directories themselves. For example, one would set nillable to true if the desire was to test the attributes or permissions associated with a directory. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path.. - datatype attribute for the filename entity of a fileeffectiverights53_object should be 'string' - filename entity can not contain the characters / \ : * ? > | The trustee_sid entity identifies a unique sid associated with a user, group, system, or program (such as a Windows service). If an operation other than equals is used to identify matching trustees (i.e. not equal, or a pattern match) then the resulting matches shall be limited to only the trustees referenced in the file's Security Descriptor. The scope is limited here to avoid unnecessarily resource intensive searches for trustees. Note that the larger scope of all known trustees may be obtained through the use of variables. - datatype attribute for the trustee_sid entity of a fileeffectiverights53_object should be 'string' The fileeffectiverights53_state element defines the different rights that can be associated with a given fileeffectiverights53_object. Please refer to the individual elements in the schema for more details about what each represents. The filepath element specifies the absolute path for a file on the machine. - datatype attribute for the filepath entity of a fileeffectiverights53_state should be 'string' The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a fileeffectiverights53_state should be 'string' The filename element specifies the name of the file. - datatype attribute for the filename entity of a fileeffectiverights53_state should be 'string' - filename entity can not contain the characters / \ : * ? > | The trustee_sid element is the unique sid that associated a user, group, system, or program (such as a Windows service). - datatype attribute for the trustee_sid entity of a fileeffectiverights53_state should be 'string' The right to delete the object. - datatype attribute for the standard_delete entity of a fileeffectiverights53_state should be 'boolean' The right to read the information in the object's Security Descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a fileeffectiverights53_state should be 'boolean' The right to modify the DACL in the object's Security Descriptor. - datatype attribute for the standard_write_dac entity of a fileeffectiverights53_state should be 'boolean' The right to change the owner in the object's Security Descriptor. - datatype attribute for the standard_write_owner entity of a fileeffectiverights53_state should be 'boolean' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a fileeffectiverights53_state should be 'boolean' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a fileeffectiverights53_state should be 'boolean' Read access. - datatype attribute for the generic_read entity of a fileeffectiverights53_state should be 'boolean' Write access. - datatype attribute for the generic_write entity of a fileeffectiverights53_state should be 'boolean' Execute access. - datatype attribute for the generic_execute entity of a fileeffectiverights53_state should be 'boolean' Read, write, and execute access. - datatype attribute for the generic_all entity of a fileeffectiverights53_state should be 'boolean' Grants the right to read data from the file, or if a directory, grants the right to list the contents of the directory. - datatype attribute for the file_read_data entity of a fileeffectiverights53_state should be 'boolean' Grants the right to write data to the file, or if a directory, grants the right to add a file to the directory. - datatype attribute for the file_write_data entity of a fileeffectiverights53_state should be 'boolean' Grants the right to append data to the file, or if a directory, grants the right to add a sub-directory to the directory. - datatype attribute for the file_append_data entity of a fileeffectiverights53_state should be 'boolean' Grants the right to read extended attributes. - datatype attribute for the file_read_ea entity of a fileeffectiverights53_state should be 'boolean' Grants the right to write extended attributes. - datatype attribute for the file_write_ea entity of a fileeffectiverights53_state should be 'boolean' Grants the right to execute a file, or if a directory, the right to traverse the directory. - datatype attribute for the file_execute entity of a fileeffectiverights53_state should be 'boolean' Right to delete a directory and all the files it contains (its children), even if the files are read-only. - datatype attribute for the file_delete_child entity of a fileeffectiverights53_state should be 'boolean' Grants the right to read file, or directory, attributes. - datatype attribute for the file_read_attributes entity of a fileeffectiverights53_state should be 'boolean' Grants the right to change file, or directory, attributes. - datatype attribute for the file_write_attributes entity of a fileeffectiverights53_state should be 'boolean' The FileEffectiveRights53Behaviors complex type defines a number of behaviors that allow a more detailed definition of the fileeffectiverights53_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. It is important to note that the ‘max_depth’ and ‘recurse_direction’ attributes of the ‘behaviors’ element do not apply to the ‘filepath’ element, only to the ‘path’ and ‘filename’ elements. This is because the ‘filepath’ element represents an absolute path to a particular file and it is not possible to recurse over a file. 'max_depth' defines the maximum depth of recursion to perform when a recurse_direction is specified. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. The default value is '-1' meaning no limitation. Note that the default recurse_direction behavior is 'none' so even though max_depth specifies no limitation by default, the recurse_direction behavior turns recusion off. 'recurse_direction' defines the direction, either 'up' to parent directories, or 'down' into child directories to recursively search for files. When recursing up or down, one is limited by the max_depth behavior. Note that it is not an error if max_depth specifies a certain level of recursion and that level does not exist. Recursing should only go as deep as available. The default value is 'none' for no recursion. 'include_group' defines whether the group sid should be included in the object when the object is defined by a group sid. For example, the intent of an object defined by a group sid might be to retrieve all the user sids that are a member of the group, but not the group sid itself. The 'resolve_group' behavior defines whether an object set defined by a group sid should be resolved to return a set that contains all the user sids that are a member of that group. Note that all child groups should also be resolved any valid domain users that are members of the group should also be included. The intent of this behavior is to end up with a list of all individual users from that system that make up the group once everything has been resolved. 5.6 The 'resolve_group' behavior has been deprecated in favor of using variables to reference more efficient objects for expanding groups. Consider using a sid_sid_object or similar to resolve the members of a group. DEPRECATED BEHAVIOR IN: fileeffectiverights53_object The file effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The fileeffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileeffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. 5.3 Replaced by the fileeffectiverights53_test. This test uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. See the fileeffectiverights53_test. This test has been deprecated and will be removed in version 6.0 of the language. DEPRECATED TEST: ID: - the object child element of a fileeffectiverights_test must reference a fileeffectiverights_object - the state child element of a fileeffectiverights_test must reference a fileeffectiverights_state The fileeffectiverights_object element is used by a file effective rights test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. A fileeffectiverights_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileEffectiveRightsBehaviors complex type for more information about specific behaviors. 5.3 Replaced by the fileeffectiverights_object. This object uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new object was created to use trustee SIDs, which are unique. See the fileeffectiverights53_object. This object has been deprecated and will be removed in version 6.0 of the language. DEPRECATED OBJECT: ID: The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a fileeffectiverights_object should be 'string' The filename element specifies the name of a file to evaluate. If the nillable attribute is set to true, then the object being specified is the higher level directory object (not all the files in the directory). In this case, the filename element should not be used during collection and would result in the set of collected objects being the directories themselves. For example, one would set nillable to true if the desire was to test the attributes or permissions associated with a directory. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a fileeffectiverights_object should be 'string' - filename entity can not contain the characters / \ : * ? > | The trustee_name element is the unique name that associated a particular SID. A SID can be associated with a user, group, or program (such as a Windows service). In a domain environment, trustee names should be identified in the form: "domain\trustee name" For local trustee names use: "computer name\trustee name" For built-in accounts on the system, use the trustee name without a domain. For example: ADMINISTRATOR, SYSTEM, NETWORK_SERVICES, ADMINISTRATORS (group), etc. Note that the built-in trustee names should be all caps as that is how the windows apis return them. - datatype attribute for the trustee_name entity of a fileeffectiverights_object should be 'string' The fileeffectiverights_state element defines the different rights that can be associated with a given fileeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents. 5.3 Replaced by the fileeffectiverights53_state. This state uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new state was created to use trustee SIDs, which are unique. See the fileeffectiverights53_state. This state has been deprecated and will be removed in version 6.0 of the language. DEPRECATED STATE: ID: The path element specifies the directory component of the absolute path to a file on the machine. - datatype attribute for the path entity of a fileeffectiverights_state should be 'string' The filename element specifies the name of the file. - datatype attribute for the filename entity of a fileeffectiverights_state should be 'string' - filename entity can not contain the characters / \ : * ? > | The unique name associated with a particular security identifier (SID). In a domain environment, trustee names should be identified in the form: "domain\trustee name" For local trustee names use: "computer name\trustee name" For built-in accounts on the system, use the trustee name without a domain. For example: ADMINISTRATOR, SYSTEM, NETWORK_SERVICES, ADMINISTRATORS (group), etc. Note that the built-in trustee names should be all caps as that is how the windows apis return them. - datatype attribute for the trustee_name entity of a fileeffectiverights_state should be 'string' The right to delete the object. - datatype attribute for the standard_delete entity of a fileeffectiverights_state should be 'boolean' The right to read the information in the object's Security Descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a fileeffectiverights_state should be 'boolean' The right to modify the DACL in the object's Security Descriptor. - datatype attribute for the standard_write_dac entity of a fileeffectiverights_state should be 'boolean' The right to change the owner in the object's Security Descriptor. - datatype attribute for the standard_write_owner entity of a fileeffectiverights_state should be 'boolean' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a fileeffectiverights_state should be 'boolean' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a fileeffectiverights_state should be 'boolean' Read access. - datatype attribute for the generic_read entity of a fileeffectiverights_state should be 'boolean' Write access. - datatype attribute for the generic_write entity of a fileeffectiverights_state should be 'boolean' Execute access. - datatype attribute for the generic_execute entity of a fileeffectiverights_state should be 'boolean' Read, write, and execute access. - datatype attribute for the generic_all entity of a fileeffectiverights_state should be 'boolean' Grants the right to read data from the file, or if a directory, grants the right to list the contents of the directory. - datatype attribute for the file_read_data entity of a fileeffectiverights_state should be 'boolean' Grants the right to write data to the file, or if a directory, grants the right to add a file to the directory. - datatype attribute for the file_write_data entity of a fileeffectiverights_state should be 'boolean' Grants the right to append data to the file, or if a directory, grants the right to add a sub-directory to the directory. - datatype attribute for the file_append_data entity of a fileeffectiverights_state should be 'boolean' Grants the right to read extended attributes. - datatype attribute for the file_read_ea entity of a fileeffectiverights_state should be 'boolean' Grants the right to write extended attributes. - datatype attribute for the file_write_ea entity of a fileeffectiverights_state should be 'boolean' Grants the right to execute a file, or if a directory, the right to traverse the directory. - datatype attribute for the file_execute entity of a fileeffectiverights_state should be 'boolean' Right to delete a directory and all the files it contains (its children), even if the files are read-only. - datatype attribute for the file_delete_child entity of a fileeffectiverights_state should be 'boolean' Grants the right to read file, or directory, attributes. - datatype attribute for the file_read_attributes entity of a fileeffectiverights_state should be 'boolean' Grants the right to change file, or directory, attributes. - datatype attribute for the file_write_attributes entity of a fileeffectiverights_state should be 'boolean' The FileEffectiveRightsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the fileeffectiverights_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. 5.3 Replaced by the FileEffectiveRightsBehaviors53. The FileEffectiveRightsBehaviors complex type is used by the fileeffectiverights_test which uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. This new test utilizes the FileEffectiveRightsBehaviors53 complex type, and as a result, the FileEffectiveRightsBehaviors complex type is no longer needed. This complex type has been deprecated and will be removed in version 6.0 of the language. 'max_depth' defines the maximum depth of recursion to perform when a recurse_direction is specified. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. The default value is '-1' meaning no limitation. Note that the default recurse_direction behavior is 'none' so even though max_depth specifies no limitation by default, the recurse_direction behavior turns recusion off. 'recurse_direction' defines the direction, either 'up' to parent directories, or 'down' into child directories to recursively search for files. When recursing up or down, one is limited by the max_depth behavior. Note that it is not an error if max_depth specifies a certain level of recursion and that level does not exist. Recursing should only go as deep as available. The default value is 'none' for no recursion. 'include_group' defines whether the group trustee name should be included in the object when the object is defined by a group trustee name. For example, the intent of an object defined by a group sid might be to retrieve all the user trustee names that are members of the group, but not the group trustee name itself. The 'resolve_group' behavior defines whether an object set defined by a group sid should be resolved to return a set that contains all the user sids that are a member of that group. Note that all child groups should also be resolved any valid domain users that are members of the group should also be included. The intent of this behavior is to end up with a list of all individual users from that system that make up the group once everything has been resolved. 5.6 The 'resolve_group' behavior has been deprecated in favor of using variables to reference more efficient objects for expanding groups. Consider using a sid_object or similar to resolve the members of a group. DEPRECATED BEHAVIOR IN: fileeffectiverights_object The group_test allows the different users that belong to specific groups (identified by name) to be tested. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a group_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a group_test must reference a group_object - the state child element of a group_test must reference a group_state The group_object element is used by a group test to define the specific group(s) (identified by name) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. The group element holds a string that represents the name of a particular group. In Windows, group names are case-insensitive and thus case does not matter for this entity. In a domain environment, groups should be identified in the form: "domain\group name" For local groups use: "computer name\group name" For built-in accounts on the system, use the group name without a domain. For example: ADMINISTRATORS, etc. Note that the built-in group names should be all caps to help improve readability as that is how the windows apis return them. Of course techincally it does not matter since the names are case-insensitive. - datatype attribute for the group entity of a group_object should be 'string' The group_state element enumerates the different users associate with a Windows group. Please refer to the individual elements in the schema for more details about what each represents. The group element holds a string that represents the name of a particular group. In Windows, group names are case-insensitive and thus case does not matter for this entity. In a domain environment, groups should be identified in the form: "domain\group name" For local groups use: "computer name\group name" For built-in accounts on the system, use the group name without a domain. For example: ADMINISTRATORS, etc. Note that the built-in group names should be all caps to help improve readability as that is how the windows apis return them. Of course techincally it does not matter since the names are case-insensitive. - datatype attribute for the group entity of a group_state should be 'string' The user element holds a string that represents the name of a particular user. In Windows, user names are case-insensitive and thus case does not matter for this entity. In a domain environment, users should be identified in the form: "domain\user name" For local users use: "computer name\user name" For built-in accounts on the system, use the user name without a domain. For example: ADMINISTRATOR, SYSTEM, etc. Note that the built-in user names should be all caps to help improve readability as that is how the windows apis return them. Of course techincally it does not matter since the names are case-insensitive. The user element can be included multiple times in a system characteristic item in order to record that a group contains a number of different users. Note that the entity_check attribute associated with EntityStateStringType guides the evaluation of entities like user that refer to items that can occur an unbounded number of times. - datatype attribute for the user entity of a group_state should be 'string' The group_sid_test allows the different users that belong to specific groups (identified by SID) to be tested. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a group_sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a group_sid_test must reference a group_sid_object - the state child element of a group_sid_test must reference a group_sid_state The group_sid_object element is used by a group_test to define the specific group(s) (identified by SID) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. The group_sid entity holds a string that represents the SID of a particular group. - datatype attribute for the group_sid entity of a group_sid_object should be 'string' The group_state element enumerates the different users associated with a Windows group. Please refer to the individual elements in the schema for more details about what each represents. The group_sid entity holds a string that represents the SID of a particular group. - datatype attribute for the group_sid entity of a group_sid_state should be 'string' The user entity holds a string that represents the SID of a particular user. This entity can be included multiple times in a system characteristic item in order to record that a group contains a number of different users. Note that the entity_check attribute associated with EntityStateStringType guides the evaluation of entities like user that refer to items that can occur an unbounded number of times. - datatype attribute for the user_sid entity of a group_sid_state should be 'string' The interface test enumerate various attributes about the interfaces on a system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an interface_object and the optional state element specifies the interface information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an interface_test must reference an interface_object - the state child element of an interface_test must reference an interface_state The interface_object element is used by an interface test to define the specific interfaces(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An interface object consists of a single name entity that identifies which interface is being specified. For help understanding this object, see the MIB_IFROW and MIB_IPADDRROW structures. The name element specifies the name of an interface. - datatype attribute for the name entity of a interface_object should be 'string' The interface_state element enumerates the different properties associate with a Windows interface. Please refer to the individual elements in the schema for more details about what each represents. The name element specifies the name of an interface. - datatype attribute for the name entity of an interface_state should be 'string' The index element specifies index that identifies the interface. - datatype attribute for the index entity of an interface_state should be 'int' The type element specifies the type of interface which is limited to certain set of values. - datatype attribute for the type entity of an interface_state should be 'string' The hardware_addr entity is the hardware or MAC address of the physical network card. MAC addresses should be formatted according to the IEEE 802-2001 standard which states that a MAC address is a sequence of six octet values, separated by hyphens, where each octet is represented by two hexadecimal digits. Uppercase letters should also be used to represent the hexadecimal digits A through F. - datatype attribute for the hardware_addr entity of an interface_state should be 'string' The inet_addr element specifies the IP address. - datatype attribute for the inet_addr entity of an interface_state should be 'string' The broadcast_addr element specifies the broadcast address. A broadcast address is typically the IP address with the host portion set to either all zeros or all ones. - datatype attribute for the broadcast_addr entity of an interface_state should be 'string' The netmask element specifies the subnet mask for the IP address. - datatype attribute for the netmask entity of an interface_state should be 'string' The addr_type element specifies the address type or state of a specific interface. Each interface can be associated with more than one value meaning the addr_type element can occur multiple times in a system characteristic item. Note that the entity_check attribute associated with EntityStateAddrTypeType guides the evaluation of unbounded entities like addr_type. - datatype attribute for the addr_type entity of an interface_state should be 'string' The lockout policy test enumerates various attributes associated with lockout information for users and global groups in the security database. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a lockoutpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a lockoutpolicy_test must reference a lockoutpolicy_object - the state child element of a lockoutpolicy_test must reference a lockoutpolicy_state The lockoutpolicy_object element is used by a lockout policy test to define those objects to evaluated based on a specified state. There is actually only one object relating to lockout policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check lockout policy will reference the same lockoutpolicy_object which is basically an empty object element. The lockoutpolicy_state element specifies the various attributes associated with lockout information for users and global groups in the security database. A lockout policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents. Specifies, in seconds, the amount of time between the end of the valid logon time and the time when the user is forced to log off the network. A value of TIMEQ_FOREVER (-1) indicates that the user is never forced to log off. A value of zero indicates that the user will be forced to log off immediately when the valid logon time expires. See the USER_MODALS_INFO_0 structure returned by a call to NetUserModalsGet(). - datatype attribute for the force_logoff entity of a lockoutpolicy_state should be 'int' Specifies, in seconds, how long a locked account remains locked before it is automatically unlocked. See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet(). - datatype attribute for the lockout_duration entity of a lockoutpolicy_state should be 'int' Specifies the maximum time, in seconds, that can elapse between any two failed logon attempts before lockout occurs. See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet(). - datatype attribute for the lockout_observation_window entity of a lockoutpolicy_state should be 'int' Specifies the number of invalid password authentications that can occur before an account is marked "locked out." See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet(). - datatype attribute for the lockout_threshold entity of a lockoutpolicy_state should be 'int' The metabase test is used to check information found in the Windows metabase. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a metabase_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a metabase_test must reference a metabase_object - the state child element of a metabase_test must reference a metabase_state The metabase_object element is used by a metabase test to define the specific metabase item(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A metabase object defines the key and id of the item(s). The key element specifies a metabase key. - datatype attribute for the key entity of a metabase_object should be 'string' The id element specifies a particular object under the metabase key. If the nillable attribute is set to true, then the object being specified is the higher level key. In this case, the id element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, says to collect every id under a given key. The most likely use for xsi:nil within a metabase object is when checking for the existence of a particular key, without regards to the different ids associated with it. - datatype attribute for the id entity of a metabase_object should be 'int' The metabase_state element defines the different metadata associate with a metabase item. This includes the name, user type, data type, and the actual data. Please refer to the individual elements in the schema for more details about what each represents. The key element specifies a metabase key. - datatype attribute for the key entity of a metabase_state should be 'string' The id element specifies a particular object under the metabase key. - datatype attribute for the id entity of a metabase_state should be 'int' The name element describes the name of the specified metabase object. - datatype attribute for the name entity of a metabase_state should be 'string' The user_type element is a DWORD that specifies the user type of the data. See the METADATA_RECORD structure. - datatype attribute for the user_type entity of a metabase_state should be 'string' The data_type element identifies the type of data in the metabase entry. See the METADATA_RECORD structure. - datatype attribute for the data_type entity of a metabase_state should be 'string' The actual data of the named item under the specified metabase key - The datatype has been set to 'int' but the value is not an integer. The password policy test is used to check specific policy associated with passwords. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a passwordpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. NOTE: This information is stored in the SAM or Active Directory but is encrypted or hidden so the registry_test and activedirectory_test are of no use. If this can be figured out, then the password_policy test is not needed. - the object child element of a passwordpolicy_test must reference a passwordpolicy_object - the state child element of a passwordpolicy_test must reference a passwordpolicy_state The passwordpolicy_object element is used by a password policy test to define those objects to evaluated based on a specified state. There is actually only one object relating to password policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check password policy will reference the same passwordpolicy_object which is basically an empty object element. The passwordpolicy_state element specifies the various policies associated with passwords. A password policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Specifies, in seconds, the maximum allowable password age. A value of TIMEQ_FOREVER (-1) indicates that the password never expires. The minimum valid value for this element is ONE_DAY (86400). - datatype attribute for the max_passwd_age entity of a passwordpolicy_state should be 'int' Specifies the minimum number of seconds that can elapse between the time a password changes and when it can be changed again. A value of zero indicates that no delay is required between password updates. - datatype attribute for the min_passwd_age entity of a passwordpolicy_state should be 'int' Specifies the minimum allowable password length. Valid values for this element are zero through PWLEN. - datatype attribute for the min_passwd_len entity of a passwordpolicy_state should be 'int' Specifies the length of password history maintained. A new password cannot match any of the previous usrmod0_password_hist_len passwords. Valid values for this element are zero through DEF_MAX_PWHIST. - datatype attribute for the password_hist_len entity of a passwordpolicy_state should be 'int' A boolean value that signifies whether passwords must meet the complexity requirements put forth by the operating system. - datatype attribute for the password_complexity entity of an passwordpolicy_state should be 'boolean' Determines whether Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional store passwords using reversible encryption. - datatype attribute for the reversible_encryption entity of an passwordpolicy_state should be 'boolean' The port test is used to check information about the available ports on a Windows system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a port_object and the optional state element specifies the port information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a port_test must reference a port_object - the state child element of a port_test must reference a port_state The port_object element is used by a port test to define the specific port(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A port object defines the local address, port number, and protocol of the port(s). This element specifies the local IP address the listening port is bound to. - datatype attribute for the local_address entity of a port_object should be 'string' This element specifies the number assigned to the local listening port. - datatype attribute for the local_port entity of a port_object should be 'string' This element specifies the type of listening port. It is restricted to either TCP or UDP. - datatype attribute for the protocol entity of a port_object should be 'string' The port_state element defines the different metadata associate with a Windows port. This includes the local address, port number, protocol, and pid. Please refer to the individual elements in the schema for more details about what each represents. This element specifies the local IP address the listening port is bound to. - datatype attribute for the local_address entity of a port_state should be 'string' This element specifies the number assigned to the local listening port. - datatype attribute for the local_port entity of a port_state should be 'int' This element specifies the type of listening port. It is restricted to either TCP or UDP. - datatype attribute for the protocol entity of a port_state should be 'string' The id given to the process that is associated with the specified listening port. - datatype attribute for the pid entity of a port_state should be 'int' The printer effective rights test is used to check the effective rights associated with Windows printers. The printereffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a printereffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a printereffectiverights_test must reference a printereffectiverights_object - the state child element of a printereffectiverights_test must reference a printereffectiverights_state The printer_name element describes a printer that a user may have rights on. - datatype attribute for the kprinter_nameey entity of a printereffectiverights_object should be 'string' The trustee_sid entity identifies a unique sid associated with a user, group, system, or program (such as a Windows service). If an operation other than equals is used to identify matching trustees (i.e. not equal, or a pattern match) then the resulting matches shall be limited to only the trustees referenced in the printer's Security Descriptor. The scope is limited here to ensure that it is possible to avoid unnecessarily resource intensive searches for trustees. Note that the larger scope of all known trustees may be obtained through the use of variables. - datatype attribute for the trustee_sid entity of a printereffectiverights_object should be 'string' The printereffectiverights_state element defines the different rights that can be associated with a given printereffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents. This element specifies the name of the printer. - datatype attribute for the printer_name entity of a printereffectiverights_state should be 'string' The trustee_sid element is the unique sid that associated a user, group, system, or program (such as a Windows service). - datatype attribute for the trustee_sid entity of a printereffectiverights_state should be 'string' The right to delete the object. - datatype attribute for the standard_delete entity of a printereffectiverights_state should be 'boolean' The right to read the information in the object's Security Descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a printereffectiverights_state should be 'boolean' The right to modify the DACL in the object's Security Descriptor. - datatype attribute for the standard_write_dac entity of a printereffectiverights_state should be 'boolean' The right to change the owner in the object's Security Descriptor. - datatype attribute for the standard_write_owner entity of a printereffectiverights_state should be 'boolean' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a printereffectiverights_state should be 'boolean' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a printereffectiverights_state should be 'boolean' Read access. - datatype attribute for the generic_read entity of a printereffectiverights_state should be 'boolean' Write access. - datatype attribute for the generic_write entity of a printereffectiverights_state should be 'boolean' Execute access. - datatype attribute for the generic_execute entity of a printereffectiverights_state should be 'boolean' Read, write, and execute access. - datatype attribute for the generic_all entity of a printereffectiverights_state should be 'boolean' - datatype attribute for the printer_access_administer entity of a printereffectiverights_state should be 'boolean' - datatype attribute for the printer_access_use entity of a printereffectiverights_state should be 'boolean' - datatype attribute for the job_access_administer entity of a printereffectiverights_state should be 'boolean' - datatype attribute for the job_access_read entity of a printereffectiverights_state should be 'boolean' The PrinterEffectiveRightsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the pritnereffectiverights_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. 'include_group' defines whether the group trustee name should be included in the object when the object is defined by a group trustee name. For example, the intent of an object defined by a group trustee name might be to retrieve all the user trustee names that are members of the group, but not the group trustee name itself. The 'resolve_group' behavior defines whether an object set defined by a group sid should be resolved to return a set that contains all the user sids that are a member of that group. Note that all child groups should also be resolved any valid domain users that are members of the group should also be included. The intent of this behavior is to end up with a list of all individual users from that system that make up the group once everything has been resolved. 5.6 The 'resolve_group' behavior has been deprecated in favor of using variables to reference more efficient objects for expanding groups. Consider using a sid_sid_object or similar to resolve the members of a group. DEPRECATED BEHAVIOR IN: printereffectiverights_object The process test is used to check information found in the Windows processes. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a process_object and the optional state element specifies the process information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a process_test must reference a process_object - the state child element of a process_test must reference a process_state The process_object element is used by a process test to define the specific process(es) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A process object defines the command line used to start the process(s). The command_line entity is the string used to start the process. This includes any parameters that are part of the command line. - datatype attribute for the command_line entity of a process_object should be 'string'