The following is a description of the elements, types, and attributes that compose the Windows specific tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and should provide the information necessary to understand what each element and attribute represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between the different tests and their relationship to the Core Definition Schema is not outlined here. The OVAL Schema is maintained by The Mitre Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org. Windows Definition 5.0 release candidate 3 26 May 2006 schematron validation of the Windows portion of an OVAL Definitions file - the value "" found in platform element as part of the affected element is not a valid windows platform. The access token test is used to check the properties of a Windows' access token as well as individual privileges and rights associated with it. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an accesstoken_object and the optional state element specifies the data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an accesstoken_test must reference an accesstoken_object - the state child element of an accesstoken_test must reference an accesstoken_state The accesstoken_object element is used by an access token test to define the object to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An access token object consists of a single security principle that identifies user, group, or compter account that is associated with the token. The security_principle element defines the access token being specified. Security principals include users or groups with either local or domain accounts, and computer accounts created when a computer running Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family joins a domain. User rights and permissions to access objects such as Active Directory objects, files, and registry settings are assigned to security principals. - datatype attribute for the security_principle entity of an accesstoken_object should be 'string' - operation attribute for the security_principle entity of an accesstoken_object should be 'equals', 'not equal', or 'pattern match' The accesstoken_state element defines the different information that can be used to evaluate the specified access tokens. This includes the multitude of user rights and permissions that can be granted. Please refer to the individual elements in the schema for more details about what each represents. The security_principle element identifies a specific access token. Security principals include users or groups with either local or domain accounts, and computer accounts created when a computer running Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family joins a domain. - datatype attribute for the security_principle entity of an accesstoken_state should be 'string' - operation attribute for the security_principle entity of an accesstoken_state should be 'equals', 'not equal', or 'pattern match' If the seassignprimarytokenprivilege privilege is enabled, it allows a parent process to replace the access token that is associated with a child process. - datatype attribute for the seassignprimarytokenprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seassignprimarytokenprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seauditprivilege privilege is enabled, it allows a process to generate audit records in the security log. The security log can be used to trace unauthorized system access. - datatype attribute for the seauditprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seauditprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sebackupprivilege privilege is enabled, it allows the user to circumvent file and directory permissions to back up the system. The privilege is selected only when an application attempts access by using the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply. - datatype attribute for the sebackupprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sebackupprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sechangenotifyprivilege privilege is enabled, it allows the user to pass through folders to which the user otherwise has no access while navigating an object path in the NTFS file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories. - datatype attribute for the sechangenotifyprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sechangenotifyprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreateglobalprivilege privilege is enabled, it allows the user to create named file mapping objects in the global namespace during Terminal Services sessions. - datatype attribute for the secreateglobalprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreateglobalprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatepagefileprivilege privilege is enabled, it allows the user to create and change the size of a pagefile. - datatype attribute for the secreatepagefileprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreatepagefileprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatepermanentprivilege privilege is enabled, it allows a process to create a directory object in the object manager. It is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode have this privilege inherently. - datatype attribute for the secreatepermanentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for thesecreatepermanentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatetokenprivilege privilege is enabled, it allows a process to create an access token by calling NtCreateToken() or other token-creating APIs. - datatype attribute for the secreatetokenprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreatetokenprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sedebugprivilege privilege is enabled, it allows the user to attach a debugger to any process. It provides access to sensitive and critical operating system components. - datatype attribute for the sedebugprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sedebugprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seenabledelegationprivilege privilege is enabled, it allows the user to change the Trusted for Delegation setting on a user or computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object. - datatype attribute for the seenabledelegationprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seenabledelegationprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seimpersonateprivilege privilege is enabled, it allows the user to impersonate a client after authentication. It is not supported on Windows XP, Windows 2000 SP3 and earlier, or Windows NT. - datatype attribute for the seimpersonateprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seimpersonateprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seincreasebasepriorityprivilege privilege is enabled, it allows a user to increase the base priority class of a process. - datatype attribute for the seincreasebasepriorityprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seincreasebasepriorityprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seincreasequotaprivilege privilege is enabled, it allows a process that has access to a second process to increase the processor quota assigned to the second process. - datatype attribute for the seincreasequotaprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seincreasequotaprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seloaddriverprivilege privilege is enabled, it allows a user to install and remove drivers for Plug and Play devices. - datatype attribute for the seloaddriverprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seloaddriverprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the selockmemoryprivilege privilege is enabled, it allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. - datatype attribute for the selockmemoryprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the selockmemoryprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the semachineaccountprivilege privilege is enabled, it allows the user to add a computer to a specific domain. - datatype attribute for the semachineaccountprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the semachineaccountprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the semanagevolumeprivilege privilege is enabled, it allows a non-administrative or remote user to manage volumes or disks. - datatype attribute for the semanagevolumeprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the semanagevolumeprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seprofilesingleprocessprivilege privilege is enabled, it allows a user to sample the performance of an application process. - datatype attribute for the seprofilesingleprocessprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seprofilesingleprocessprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seremoteshutdownprivilege privilege is enabled, it allows a user to shut down a computer from a remote location on the network. - datatype attribute for the seremoteshutdownprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seremoteshutdownprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the serestoreprivilege privilege is enabled, it allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object. - datatype attribute for the serestoreprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the serestoreprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesecurityprivilege privilege is enabled, it allows a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. A user who has this privilege can also view and clear the security log from Event Viewer. - datatype attribute for the sesecurityprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesecurityprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seshutdownprivilege privilege is enabled, it allows a user to shut down the local computer. - datatype attribute for the seshutdownprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seshutdownprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesyncagentprivilege privilege is enabled, it allows a process to read all objects and properties in the directory, regardless of the protection on the objects and properties. It is required in order to use Lightweight Directory Access Protocol (LDAP) directory synchronization (Dirsync) services. - datatype attribute for the sesyncagentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesyncagentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemenvironmentprivilege privilege is enabled, it allows modification of system environment variables either by a process through an API or by a user through System Properties. - datatype attribute for the sesystemenvironmentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemenvironmentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemprofileprivilege privilege is enabled, it allows a user to sample the performance of system processes. - datatype attribute for the sesystemprofileprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemprofileprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemtimeprivilege privilege is enabled, it allows the user to adjust the time on the computer's internal clock. It is not required to change the time zone or other display characteristics of the system time. - datatype attribute for the sesystemtimeprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemtimeprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the setakeownershipprivilege privilege is enabled, it allows a user to take ownership of any securable object in the system, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads. - datatype attribute for the setakeownershipprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the setakeownershipprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the setcbprivilege privilege is enabled, it allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access. - datatype attribute for the setcbprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the setcbprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seundockprivilege privilege is enabled, it allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu. - datatype attribute for the seundockprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seundockprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seunsolicitedinputprivilege privilege is enabled, it allows the user to read unsolicited data from a terminal device. - datatype attribute for the seunsolicitedinputprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seunsolicitedinputprivilege entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sebatchlogonright right, it can log on using the batch logon type. - datatype attribute for the sebatchlogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sebatchlogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seinteractivelogonright right, it can log on using the interactive logon type. - datatype attribute for the seinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the senetworklogonright right, it can log on using the network logon type. - datatype attribute for the senetworklogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the senetworklogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seremoteinteractivelogonright right, it can log on to the computer by using a Remote Desktop connection. - datatype attribute for the seremoteinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seremoteinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seservicelogonright right, it can log on using the service logon type. - datatype attribute for the seservicelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seservicelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenybatchLogonright right, it is explicitly denied the ability to log on using the batch logon type. - datatype attribute for the sedenybatchLogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenybatchLogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyinteractivelogonright right, it is explicitly denied the ability to log on using the interactive logon type. - datatype attribute for the sedenyinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenynetworklogonright right, it is explicitly denied the ability to log on using the network logon type. - datatype attribute for the sedenynetworklogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenynetworklogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyremoteInteractivelogonright right, it is explicitly denied the ability to log on through Terminal Services. - datatype attribute for the sedenyremoteInteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyremoteInteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyservicelogonright right, it is explicitly denied the ability to log on using the service logon type. - datatype attribute for the sedenyservicelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyservicelogonright entity of an accesstoken_state should be 'equals', or 'not equal The active directory test is used to check information about specific entries in active directory. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an activedirectory_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an activedirectory_test must reference an activedirectory_object - the state child element of an activedirectory_test must reference an activedirectory_state The activedirectory_object element is used by an active directory test to define those objects to evaluated based on a specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An active directory object consists of three pieces of information, a naming context, a relative distinguished name, and an attribute. Each piece helps identify a specific active directory entry. Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema. - datatype attribute for the naming_context entity of an activedirectory_object should be 'string' - operation attribute for the naming_context entity of an activedirectory_object should be 'equals', or 'not equal The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the object's distinguished name except those outlined by the naming context. If the nillable attribute is set to true, then the object being specified is the higher level naming context. In this case, the relative_dn element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every relative dn under a given naming context. Note that when nil is used for the relative dn element, the attribute element should also be nilled. - datatype attribute for the relative_dn entity of an activedirectory_object should be 'string' - operation attribute for the relative_dn entity of an activedirectory_object should be 'equals', 'not equal', or 'pattern match' - attribute entity must be nil when relative_dn is nil Specifies a named value contained by the object. If the nillable attribute is set to true, then the object being specified is the higher level relative_dn. In this case, the attribute element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every attribute under a given relative dn. - datatype attribute for the attribute entity of an activedirectory_object should be 'string' - operation attribute for the attribute entity of an activedirectory_object should be 'equals', 'not equal', or 'pattern match' The activedirectory_state element defines the different information that can be used to evaluate the specified entries in active directory. An active directory test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents. Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema. - datatype attribute for the naming_context entity of an activedirectory_state should be 'string' - operation attribute for the naming_context entity of an activedirectory_state should be 'equals', or 'not equal The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the objects distinguished name except those outlined by the naming context. - datatype attribute for the relative_dn entity of an activedirectory_state should be 'string' - operation attribute for the relative_dn entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' Specifies a named value contained by the object. - datatype attribute for the attribute entity of an activedirectory_state should be 'string' - operation attribute for the attribute entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' The name of the class of which the object is an instance. - datatype attribute for the object_class entity of an activedirectory_state should be 'string' - operation attribute for the object_class entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' Specifies the type of information that the specified attribute represents. - datatype attribute for the adstype entity of an activedirectory_state should be 'string' - operation attribute for the adstype entity of an activedirectory_state should be 'equals', or 'not equal The actual value of the specified active directory attribute. - the supplied operation attribute for the value entity of an activedirectory_state is not valid given a datatype of '' The audit event policy test is used to check different types of events the system should audit. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an auditeventpolicy_test must reference an auditeventpolicy_object - the state child element of an auditeventpolicy_test must reference an auditeventpolicy_state The auditeventpolicy_object element is used by an audit event policy test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy will reference the same auditeventpolicy_object which is basically an empty object element. The auditeventpolicy_state element specifies the different system activities that can be audited. An audit event policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. The defined values are found in window's POLICY_AUDIT_EVENT_TYPE enumeration and accessed through the LsaQueryInformationPolicy when the InformationClass parameters are set to PolicyAuditEventsInformation. Please refer to the individual elements in the schema for more details about what each represents. Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection. - datatype attribute for the account_logon entity of an auditeventpolicy_state should be 'string' - operation attribute for the account_logon entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to create, delete, or change user or group accounts. Also, audit password changes. > - datatype attribute for the account_management entity of an auditeventpolicy_state should be 'string' - operation attribute for the account_management entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit specific events, such as program activation, some forms of handle duplication, indirect access to an object, and process exit. - datatype attribute for the detailed_tracking entity of an auditeventpolicy_state should be 'string' - operation attribute for the detailed_tracking entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to access the directory service. - datatype attribute for the directory_service_access entity of an auditeventpolicy_state should be 'string' - operation attribute for the directory_service_access entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection. - datatype attribute for the logon entity of an auditeventpolicy_state should be 'string' - operation attribute for the logon entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to access securable objects, such as files. > - datatype attribute for the object_access entity of an auditeventpolicy_state should be 'string' - operation attribute for the object_access entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to change Policy object rules. - datatype attribute for the policy_change entity of an auditeventpolicy_state should be 'string' - operation attribute for the policy_change entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to use privileges. - datatype attribute for the privilege_use entity of an auditeventpolicy_state should be 'string' - operation attribute for the privilege_use entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to shut down or restart the computer. Also, audit events that affect system security or the security log. - datatype attribute for the system entity of an auditeventpolicy_state should be 'string' - operation attribute for the system entity of an auditeventpolicy_state should be 'equals', or 'not equal The file test is used to check metadata associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a file_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a file_test must reference a file_object - the state child element of a file_test must reference a file_state The file_object element is used by a file test to define the specific file(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A file object defines the path and filename of the file(s). In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileBehaviors complex type for more information about specific behaviors. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a file_object should be 'string' - operation attribute for the path entity of a file_object should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. If the nillable attribute is set to true, then the object being specified is the higher level path. In this case, the filename element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a file_object should be 'string' - operation attribute for the filename entity of a file_object should be 'equals', 'not equal', or 'pattern match' The file_state element defines the different metadata associate with a Windows file. This includes the path, filename, owner, size, last modified time, version, etc. Please refer to the individual elements in the schema for more details about what each represents. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a file_state should be 'string' - operation attribute for the path entity of a file_state should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. - datatype attribute for the filename entity of a file_state should be 'string' - operation attribute for the filename entity of a file_state should be 'equals', 'not equal', or 'pattern match' The owner element is a string that contains the name of the owner. - datatype attribute for the owner entity of a file_state should be 'string' - operation attribute for the owner entity of a file_state should be 'equals', 'not equal', or 'pattern match' The size element is the size of the file in bytes. integer equals, not equal, greater than, less than, greater than or equal, less than or equal - datatype attribute for the size entity of a file_state should be 'int' - operation attribute for the size entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' Time of last access of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the a_time entity of a file_state should be 'string' - operation attribute for the a_time entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', 'less than or equal', or 'pattern match' Time of creation of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the c_time entity of a file_state should be 'string' - operation attribute for the c_time entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', 'less than or equal', or 'pattern match' Time of last modification of file. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the m_time entity of a file_state should be 'string' - operation attribute for the m_time entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', 'less than or equal', or 'pattern match' The ms_checksum element is the md5 checksum of the file as supplied by Microsoft. - datatype attribute for the ms_checksum entity of a file_state should be 'string' - operation attribute for the ms_checksum entity of a file_state should be 'equals', 'not equal', or 'pattern match' The version element is the delimited version string of the file. - datatype attribute for the version entity of a file_state should be 'version' - operation attribute for the version entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The type element marks whether the file is a directory, named pipe, standard file, etc. These types are the return values for GetFileType, with the exception of FILE_ATTRIBUTE_DIRECTORY which is obtained by looking at GetFileAttributesEx. NOTE: Should this entity be split into two in future versions of the language as there are other values associated with GetFileAttributesEx that are not represented here? - datatype attribute for the type entity of a file_state should be 'string' - operation attribute for the type entity of a file_state should be 'equals', or 'not equal' The development_class element allows the distinction to be made between the GDR development environment and the QFE development environment. This field holds the text found in front of the mmmmmm-nnnn version, for example srv03_gdr. - datatype attribute for the development_class entity of a file_state should be 'string' - operation attribute for the development_class entity of a file_state should be 'equals', 'not equal', or 'pattern match' The FileBehaviors complex type defines a number of behaviors that allow a more detailed definition of the file objects being specified. 'max_depth' defines how many directories to recurse when a recurse direction is specified. The default value is '-1' meaning no limitation. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. 'recurse_direction' defines the direction to recurse, either 'up' to parent directories, or 'down' into child directories. The default value is 'none' for no recursion. The file audit permissions test is used to check the audit permissions associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a fileauditedpermissions_test must reference a fileauditedpermissions_object - the state child element of a fileauditedpermissions_test must reference a fileauditedpermissions_state The fileauditedpermissions_object element is used by a file audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. A fileauditedpermissions_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileAuditPermissionsBehaviors complex type for more information about specific behaviors. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a fileauditedpermissions_object should be 'string' - operation attribute for the path entity of a fileauditedpermissions_object should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. If the nillable attribute is set to true, then the object being specified is the higher level path. In this case, the filename element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a fileauditedpermissions_object should be 'string' - operation attribute for the filename entity of a fileauditedpermissions_object should be 'equals', 'not equal', or 'pattern match' The trustee_name element is the unique name that associated a particular SID. A SID can be associated with a user, group, or program (such as a Windows service) - datatype attribute for the trustee_name entity of a fileauditedpermissions_object should be 'string' - operation attribute for the trustee_name entity of a fileauditedpermissions_object should be 'equals', 'not equal', or 'pattern match' The fileauditedpermissions_state element defines the different audit permissions that can be associated with a given fileauditedpermissions_object. Please refer to the individual elements in the schema for more details about what each represents. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a fileauditedpermissions_state should be 'string' - operation attribute for the path entity of a fileauditedpermissions_state should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. - datatype attribute for the filename entity of a fileauditedpermissions_state should be 'string' - operation attribute for the filename entity of a fileauditedpermissions_state should be 'equals', 'not equal', or 'pattern match' The trustee_name is the unique name associated with a particular security identifier (SID). - datatype attribute for the trustee_name entity of a fileauditedpermissions_state should be 'string' - operation attribute for the trustee_name entity of a fileauditedpermissions_state should be 'equals', 'not equal', or 'pattern match' The right to delete the object. - datatype attribute for the standard_delete entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_delete entity of a fileauditedpermissions_state should be 'equals', or 'not equal' The right to read the information in the object's security descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_read_control entity of a fileauditedpermissions_state should be 'equals', or 'not equal' The right to modify the DACL in the object's security descriptor. - datatype attribute for the standard_write_dac entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_write_dac entity of a fileauditedpermissions_state should be 'equals', or 'not equal' The right to change the owner in the object's security descriptor. - datatype attribute for the standard_write_owner entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_write_owner entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_synchronize entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a fileauditedpermissions_state should be 'string' - operation attribute for the access_system_security entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Read access. - datatype attribute for the generic_read entity of a fileauditedpermissions_state should be 'string' - operation attribute for the generic_read entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Write access. - datatype attribute for the generic_write entity of a fileauditedpermissions_state should be 'string' - operation attribute for the generic_write entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Execute access. - datatype attribute for the generic_execute entity of a fileauditedpermissions_state should be 'string' - operation attribute for the generic_execute entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Read, write, and execute access. - datatype attribute for the generic_all entity of a fileauditedpermissions_state should be 'string' - operation attribute for the generic_all entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to read data from the file - datatype attribute for the file_read_data entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_read_data entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to write data to the file. - datatype attribute for the file_write_data entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_write_data entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to append data to the file. - datatype attribute for the file_append_data entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_append_data entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to read extended attributes. - datatype attribute for the file_read_ea entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_read_ea entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to write extended attributes. - datatype attribute for the file_write_ea entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_write_ea entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to execute a file. - datatype attribute for the file_execute entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_execute entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Right to delete a directory and all the files it contains (its children), even if the files are read-only. - datatype attribute for the file_delete_child entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_delete_child entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to read file attributes. - datatype attribute for the file_read_attributes entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_read_attributes entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to change file attributes. - datatype attribute for the file_write_attributes entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_write_attributes entity of a fileauditedpermissions_state should be 'equals', or 'not equal' These behaviors allow a more detailed definition of the fileauditpermissions_objects being specified. 'max_depth' defines how many directories to recurse when a recurse direction is specified. The default value is '-1' meaning no limitation. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. 'recurse_direction' defines the direction to recurse, either 'up' to parent directories, or 'down' into child directories. The default value is 'none' for no recursion. The file effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The fileeffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileeffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a fileeffectiverights_test must reference a fileeffectiverights_object - the state child element of a fileeffectiverights_test must reference a fileeffectiverights_state The fileeffectiverights_object element is used by a file effective rights test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. A fileeffectiverights_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileEffectiveRightsBehaviors complex type for more information about specific behaviors. Specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a fileeffectiverights_object should be 'string' - operation attribute for the path entity of a fileeffectiverights_object should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. If the nillable attribute is set to true, then the object being specified is the higher level path. In this case, the filename element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a fileeffectiverights_object should be 'string' - operation attribute for the filename entity of a fileeffectiverights_object should be 'equals', 'not equal', or 'pattern match' The trustee_name element is the unique name that associated a particular SID. A SID can be associated with a user, group, or program (such as a Windows service) - datatype attribute for the trustee_name entity of a fileeffectiverights_object should be 'string' - operation attribute for the trustee_name entity of a fileeffectiverights_object should be 'equals', 'not equal', or 'pattern match' The fileeffectiverights_state element defines the different rights that can be associated with a given fileeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a fileeffectiverights_state should be 'string' - operation attribute for the path entity of a fileeffectiverights_state should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. - datatype attribute for the filename entity of a fileeffectiverights_state should be 'string' - operation attribute for the filename entity of a fileeffectiverights_state should be 'equals', 'not equal', or 'pattern match' The unique name associated with a particular security identifier (SID). - datatype attribute for the trustee_name entity of a fileeffectiverights_state should be 'string' - operation attribute for the trustee_name entity of a fileeffectiverights_state should be 'equals', 'not equal', or 'pattern match' The right to delete the object. - datatype attribute for the standard_delete entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the standard_delete entity of a fileeffectiverights_state should be 'equals', or 'not equal' The right to read the information in the object's security descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the standard_read_control entity of a fileeffectiverights_state should be 'equals', or 'not equal' The right to modify the DACL in the object's security descriptor. - datatype attribute for the standard_write_dac entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the standard_write_dac entity of a fileeffectiverights_state should be 'equals', or 'not equal' The right to change the owner in the object's security descriptor. - datatype attribute for the standard_write_owner entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the standard_write_owner entity of a fileeffectiverights_state should be 'equals', or 'not equal' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the standard_synchronize entity of a fileeffectiverights_state should be 'equals', or 'not equal' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the access_system_security entity of a fileeffectiverights_state should be 'equals', or 'not equal' Read access. - datatype attribute for the generic_read entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the generic_read entity of a fileeffectiverights_state should be 'equals', or 'not equal' Write access. - datatype attribute for the generic_write entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the generic_write entity of a fileeffectiverights_state should be 'equals', or 'not equal' Execute access. - datatype attribute for the generic_execute entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the generic_execute entity of a fileeffectiverights_state should be 'equals', or 'not equal' Read, write, and execute access. - datatype attribute for the generic_all entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the generic_all entity of a fileeffectiverights_state should be 'equals', or 'not equal' Grants the right to read data from the file - datatype attribute for the file_read_data entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_read_data entity of a fileeffectiverights_state should be 'equals', or 'not equal' Grants the right to write data to the file. - datatype attribute for the file_write_data entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_write_data entity of a fileeffectiverights_state should be 'equals', or 'not equal' Grants the right to append data to the file. - datatype attribute for the file_append_data entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_append_data entity of a fileeffectiverights_state should be 'equals', or 'not equal' Grants the right to read extended attributes. - datatype attribute for the file_read_ea entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_read_ea entity of a fileeffectiverights_state should be 'equals', or 'not equal' Grants the right to write extended attributes. - datatype attribute for the file_write_ea entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_write_ea entity of a fileeffectiverights_state should be 'equals', or 'not equal' Grants the right to execute a file. - datatype attribute for the file_execute entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_execute entity of a fileeffectiverights_state should be 'equals', or 'not equal' Right to delete a directory and all the files it contains (its children), even if the files are read-only. - datatype attribute for the file_delete_child entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_delete_child entity of a fileeffectiverights_state should be 'equals', or 'not equal' Grants the right to read file attributes. - datatype attribute for the file_read_attributes entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_read_attributes entity of a fileeffectiverights_state should be 'equals', or 'not equal' Grants the right to change file attributes. - datatype attribute for the file_write_attributes entity of a fileeffectiverights_state should be 'boolean' - operation attribute for the file_write_attributes entity of a fileeffectiverights_state should be 'equals', or 'not equal' These behaviors allow a more detailed definition of the fileeffectiverights_objects being specified. 'max_depth' defines how many directories to recurse when a recurse direction is specified. The default value is '-1' meaning no limitation. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. 'recurse_direction' defines the direction to recurse, either 'up' to parent directories, or 'down' into child directories. The default value is 'none' for no recursion. The group test allows the different users that belong to specific groups be tested. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a group_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a group_test must reference a group_object - the state child element of a group_test must reference a group_state The group_object element is used by a group test to define the specific group(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. The group element holds a string that represents the name of a particular group. - datatype attribute for the group entity of a group_object should be 'string' - operation attribute for the group entity of a group_object should be 'equals', 'not equal', or 'pattern match' The group_state element enumerates the different users associate with a Windows group. Please refer to the individual elements in the schema for more details about what each represents. The group element holds a string that represents the name of a particular group. - datatype attribute for the group entity of a group_state should be 'string' - operation attribute for the group entity of a group_state should be 'equals', 'not equal', or 'pattern match' The user element holds a string that represents the name of a particular user. This element can be included multiple times in a system characteristic item in order to record that a group contains a number of different users. Note that the entity_check attribute associated with EntityStateStringType guides the evaluation of entities like user that refer to items that can occur an unbounded number of times. - datatype attribute for the user entity of a group_state should be 'string' - operation attribute for the user entity of a group_state should be 'equals', 'not equal', or 'pattern match' The interface test enumerate various attributes about the interfaces on a system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an interface_object and the optional state element specifies the interface information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an interface_test must reference an interface_object - the state child element of an interface_test must reference an interface_state The interface_object element is used by an interface test to define the specific interfaces(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An interface object consists of a single name entity that identifies which interface is being specified. For help understanding this object, see the MIB_IFROW and MIB_IPADDRROW structures. The name element specifies the name of an interface. - datatype attribute for the name entity of a interface_object should be 'string' - operation attribute for the name entity of a interface_object should be 'equals', 'not equal', or 'pattern match' The interface_state element enumerates the different properties associate with a Windows interface. Please refer to the individual elements in the schema for more details about what each represents. The name element specifies the name of an interface. - datatype attribute for the name entity of an interface_state should be 'string' - operation attribute for the name entity of an interface_state should be 'equals', 'not equal', or 'pattern match' The index element specifies index that identifies the interface. - datatype attribute for the index entity of an interface_state should be 'int' - operation attribute for the index entity of an interface_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The type element specifies the type of interface which is limited to certain set of values. - datatype attribute for the type entity of an interface_state should be 'string' - operation attribute for the type entity of an interface_state should be 'equals', or 'not equal' The hardware_addr element specifies the the physical address of the adapter for this interface. - datatype attribute for the hardware_addr entity of an interface_state should be 'string' - operation attribute for the hardware_addr entity of an interface_state should be 'equals', 'not equal', or 'pattern match' The inet_addr element specifies the IP address. - datatype attribute for the inet_addr entity of an interface_state should be 'string' - operation attribute for the inet_addr entity of an interface_state should be 'equals', 'not equal', or 'pattern match' The broadcast_addr element specifies the broadcast address. A broadcast address is typically the IP address with the host portion set to either all zeros or all ones. - datatype attribute for the broadcast_addr entity of an interface_state should be 'string' - operation attribute for the broadcast_addr entity of an interface_state should be 'equals', 'not equal', or 'pattern match' The netmask element specifies the subnet mask for the IP address. - datatype attribute for the netmask entity of an interface_state should be 'string' - operation attribute for the netmask entity of an interface_state should be 'equals', 'not equal', or 'pattern match' The addr_type element specifies the address type or state of a specific interface. Each interface can be associated with more than one value meaning the addr_type element can occur multiple times in a system characteristic item. Note that the entity_check attribute associated with EntityStateAddrTypeType guides the evaluation of unbounded entities like addr_type. - datatype attribute for the addr_type entity of an interface_state should be 'string' - operation attribute for the addr_type entity of an interface_state should be 'equals', or 'not equal' The lockout policy test enumerates various attributes associated with lockout information for users and global groups in the security database. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a lockoutpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a lockoutpolicy_test must reference a lockoutpolicy_object - the state child element of a lockoutpolicy_test must reference a lockoutpolicy_state The lockoutpolicy_object element is used by a lockout policy test to define those objects to evaluated based on a specified state. There is actually only one object relating to lockout policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check lockout policy will reference the same lockoutpolicy_object which is basically an empty object element. The lockoutpolicy_state element specifies the various attributes associated with lockout information for users and global groups in the security database. A lockout policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents. Specifies, in seconds, the amount of time between the end of the valid logon time and the time when the user is forced to log off the network. A value of TIMEQ_FOREVER indicates that the user is never forced to log off. A value of zero indicates that the user will be forced to log off immediately when the valid logon time expires. See the USER_MODALS_INFO_0 structure returned by a call to NetUserModalsGet(). - datatype attribute for the force_logoff entity of a lockoutpolicy_state should be 'int' - operation attribute for the force_logoff entity of a lockoutpolicy_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' Specifies, in seconds, how long a locked account remains locked before it is automatically unlocked. See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet(). - datatype attribute for the lockout_duration entity of a lockoutpolicy_state should be 'int' - operation attribute for the lockout_duration entity of a lockoutpolicy_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' Specifies the maximum time, in seconds, that can elapse between any two failed logon attempts before lockout occurs. See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet(). - datatype attribute for the lockout_observation_window entity of a lockoutpolicy_state should be 'int' - operation attribute for the lockout_observation_window entity of a lockoutpolicy_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' Specifies the number of invalid password authentications that can occur before an account is marked "locked out." See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet(). - datatype attribute for the lockout_threshold entity of a lockoutpolicy_state should be 'int' - operation attribute for the lockout_threshold entity of a lockoutpolicy_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The metabase test is used to check information found in the Windows metabase. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a metabase_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a metabase_test must reference a metabase_object - the state child element of a metabase_test must reference a metabase_state The metabase_object element is used by a metabase test to define the specific metabase item(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A metabase object defines the key and id of the item(s). The key element specifies a metabase key. - datatype attribute for the key entity of a metabase_object should be 'string' - operation attribute for the key entity of a metabase_object should be 'equals', 'not equal', or 'pattern match' The id element specifies a particular object under the metabase key. If the nillable attribute is set to true, then the object being specified is the higher level key. In this case, the id element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, says to collect every id under a given key. The most likely use for xsi:nil within a metabase object is when checking for the existance of a particular key, without regards to the different ids associated with it. integer equals, not equal, greater than, less than, greater than or equal, less than or equal - datatype attribute for the id entity of a metabase_object should be 'int' - operation attribute for the id entity of a metabase_object should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The metabase_state element defines the different metadata associate with a metabase item. This includes the name, user type, data type, and the actual data. Please refer to the individual elements in the schema for more details about what each represents. The key element specifies a metabase key. - datatype attribute for the key entity of a metabase_state should be 'string' - operation attribute for the key entity of a metabase_state should be 'equals', 'not equal', or 'pattern match' The id element specifies a particular object under the metabase key. - datatype attribute for the id entity of a metabase_state should be 'int' - operation attribute for the id entity of a metabase_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The name element describes the name of the specified metabase object. - datatype attribute for the name entity of a metabase_state should be 'string' - operation attribute for the name entity of a metabase_state should be 'equals', 'not equal', or 'pattern match' The user_type element is a DWORD that specifies the user type of the data. See the METADATA_RECORD structure. - datatype attribute for the user_type entity of a metabase_state should be 'string' - operation attribute for the user_type entity of a metabase_state should be 'equals', 'not equal', or 'pattern match' The data_type element identifies the type of data in the metabase entry. See the METADATA_RECORD structure. - datatype attribute for the data_type entity of a metabase_state should be 'string' - operation attribute for the data_type entity of a metabase_state should be 'equals', 'not equal', or 'pattern match' The actual data of the named item under the specified metabase key - the supplied operation attribute for the data entity of a metabase_state is not valid given a datatype of '' The password policy test is used to check specific policy associated with passwords. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a passwordpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. NOTE: This information is stored in the SAM or Active Directory but is encrypted or hidden so the registry_test and activedirectory_test are of no use. If this can be figured out, then the password_policy test is not needed. - the object child element of a passwordpolicy_test must reference a passwordpolicy_object - the state child element of a passwordpolicy_test must reference a passwordpolicy_state The passwordpolicy_object element is used by a password policy test to define those objects to evaluated based on a specified state. There is actually only one object relating to password policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check password policy will reference the same passwordpolicy_object which is basically an empty object element. The passwordpolicy_state element specifies the various policies associated with passwords. A password policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Specifies, in seconds, the maximum allowable password age. A value of TIMEQ_FOREVER (-1) indicates that the password never expires. The minimum valid value for this element is ONE_DAY (86400). - datatype attribute for the max_passwd_age entity of a passwordpolicy_state should be 'int' - operation attribute for the max_passwd_age entity of a passwordpolicy_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' Specifies the minimum number of seconds that can elapse between the time a password changes and when it can be changed again. A value of zero indicates that no delay is required between password updates. - datatype attribute for the min_passwd_age entity of a passwordpolicy_state should be 'int' - operation attribute for the min_passwd_age entity of a passwordpolicy_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' Specifies the minimum allowable password length. Valid values for this element are zero through PWLEN. - datatype attribute for the min_passwd_len entity of a passwordpolicy_state should be 'int' - operation attribute for the min_passwd_len entity of a passwordpolicy_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' Specifies the length of password history maintained. A new password cannot match any of the previous usrmod0_password_hist_len passwords. Valid values for this element are zero through DEF_MAX_PWHIST. - datatype attribute for the password_hist_len entity of a passwordpolicy_state should be 'int' - operation attribute for the password_hist_len entity of a passwordpolicy_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' A boolean value that signifies whether passwords must meet the complexity requirements put forth by the operating system. - datatype attribute for the password_complexity entity of an passwordpolicy_state should be 'boolean' - operation attribute for the password_complexity entity of an passwordpolicy_state should be 'equals', or 'not equal Determines whether Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional store passwords using reversible encryption. - datatype attribute for the reversible_encryption entity of an passwordpolicy_state should be 'boolean' - operation attribute for the reversible_encryption entity of an passwordpolicy_state should be 'equals', or 'not equal The port test is used to check information about the available ports on a Windows system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a port_object and the optional state element specifies the port information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a port_test must reference a port_object - the state child element of a port_test must reference a port_state The port_object element is used by a port test to define the specific port(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A port object defines the local address, port number, and protocol of the port(s). This element specifies the local IP address the listening port is bound to. - datatype attribute for the command_line entity of a port_object should be 'string' - operation attribute for the command_line entity of a port_object should be 'equals', 'not equal', or 'pattern match' This element specifies the number assigned to the local listening port. - datatype attribute for the local_port entity of a port_object should be 'string' - operation attribute for the local_port entity of a port_object should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' This element specifies the type of listening port. It is restricted to either TCP or UDP. - datatype attribute for the protocol entity of a port_object should be 'string' - operation attribute for the protocol entity of a port_object should be 'equals', or 'not equal' The port_state element defines the different metadata associate with a Windows port. This includes the local address, port number, protocol, and pid. Please refer to the individual elements in the schema for more details about what each represents. This element specifies the local IP address the listening port is bound to. - datatype attribute for the local_address entity of a port_state should be 'string' - operation attribute for the local_address entity of a port_state should be 'equals', 'not equal', or 'pattern match' This element specifies the number assigned to the local listening port. - datatype attribute for the local_port entity of a port_state should be 'int' - operation attribute for the local_port entity of a port_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' This element specifies the type of listening port. It is restricted to either TCP or UDP. - datatype attribute for the protocol entity of a port_state should be 'string' - operation attribute for the protocol entity of a port_state should be 'equals', or 'not equal' The id given to the process that is associated with the specified listening port. - datatype attribute for the pid entity of a port_state should be 'int' - operation attribute for the pid entity of a port_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The process test is used to check information found in the Windows processes. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a process_object and the optional state element specifies the process information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a process_test must reference a process_object - the state child element of a process_test must reference a process_state The process_object element is used by a process test to define the specific process(es) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A process object defines the command line used to start the process(s). The command line used to start the process. - datatype attribute for the command_line entity of a process_object should be 'string' - operation attribute for the command_line entity of a process_object should be 'equals', 'not equal', or 'pattern match' The process_state element defines the different metadata associate with a Windows process. This includes the command line, pid, ppid, image path, and current directory. Please refer to the individual elements in the schema for more details about what each represents. The command line used to start the process. - datatype attribute for the command_line entity of a process_state should be 'string' - operation attribute for the command_line entity of a process_state should be 'equals', 'not equal', or 'pattern match' The id given to the process that is created for a specified command line. - datatype attribute for the pid entity of a port_state should be 'int' - operation attribute for the pid entity of a port_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The id given to the parent of the process that is created for the specified command line - datatype attribute for the ppid entity of a port_state should be 'int' - operation attribute for the ppid entity of a port_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The base priority of the process - datatype attribute for the priority entity of a process_state should be 'string' - operation attribute for the priority entity of a process_state should be 'equals', 'not equal', or 'pattern match' This field contains the DOS Path of the image file. - datatype attribute for the image_path entity of a process_state should be 'string' - operation attribute for the image_path entity of a process_state should be 'equals', 'not equal', or 'pattern match' This field has the current path in DOS format ("C:\WINDOWS") - datatype attribute for the current_dir entity of a process_state should be 'string' - operation attribute for the current_dir entity of a process_state should be 'equals', 'not equal', or 'pattern match' The registry test is used to check metadata associated with Windows registry key. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a registry_object and the optional state element specifies the registry data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a registry_test must reference a registry_object - the state child element of a registry_test must reference a registry_state The hive that the registry key belongs to. This is restricted to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. - datatype attribute for the hive entity of a registry_object should be 'string' - operation attribute for the hive entity of a registry_object should be 'equals' or 'not equal' The key element describes a registry key to be collected. Note that the hive portion of the string should not be included, as this data should be found under the hive element. If the nillable attribute is set to true, then the object being specified is the higher level hive. In this case, the key element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match. A .* pattern match says to collect every key under a given hive. Note that when nil is used for the key element, the name element should also be nilled. - datatype attribute for the key entity of a registry_object should be 'string' - operation attribute for the key entity of a registry_object should be 'equals', 'not equal', or 'pattern match' - name entity must be nil when key is nil The name element describes the name assigned to a value associated with a specific registry key. If the nillable attribute is set to true, then the object being specified is the higher level hive/key. In this case, the name element should not be collected or used in analysis. Setting nil equal to true on an element is different than using a .* pattern match. A .* pattern match says to collect every name under a given hive/key. The most likely use for xsi:nil within a registry object is when checking for the existance of a particular key, without regards to the different names associated with it. - datatype attribute for the name entity of a registry_object should be 'string' - operation attribute for the name entity of a registry_object should be 'equals', 'not equal', or 'pattern match' The registry_state element defines the different metadata associate with a Windows registry key. This includes the hive, key, name, type, and value. Please refer to the individual elements in the schema for more details about what each represents. The hive that the registry key belongs to. This is restricted to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. - datatype attribute for the hive entity of a registry_state should be 'string' - operation attribute for the hive entity of a registry_state should be 'equals' or 'not equal' This element describes a registry key to be tested. Note that the hive portion of the string should not be inclueded, as this data should be found under the hive element. - datatype attribute for the key entity of a registry_state should be 'string' - operation attribute for the key entity of a registry_state should be 'equals', 'not equal', or 'pattern match' This element describes the name of a value of a registry key. If the nillable attribute is set to true, then the name element should not be used in analysis. - datatype attribute for the name entity of a registry_state should be 'string' - operation attribute for the name entity of a registry_state should be 'equals', 'not equal', or 'pattern match' Specifies the type of data stored by the registry key. string equals, not equal - datatype attribute for the type entity of a registry_state should be 'string' - operation attribute for the type entity of a registry_state should be 'equals', or 'not equal The actual value of the specified registry key. - the supplied operation attribute for the value entity of a registry_state is not valid given a datatype of '' The RegistryBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registry objects being specified. 'max_depth' defines how many directories to recurse when a recurse direction is specified. The default value is '-1' meaning no limitation. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. 'recurse_direction' defines the direction to recurse, either 'up' to parent directories, or 'down' into child directories. The default value is 'none' for no recursion. The registry key audited permissions test is used to check the audit permissions associated with Windows registry keys. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a regkeyauditedpermissions_test must reference a regkeyauditedpermissions_object - the state child element of a regkeyauditedpermissions_test must reference a regkeyauditedpermissions_state The regkeyauditedpermissions_object element is used by a registry key audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. A regkeyauditedpermissions_object is defined as a combination of a Windows registry key and trustee name. The hive and key elements represents the registry key to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple keys or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the RegkeyAuditPermissionsBehaviors complex type for more information about specific behaviors. The hive that the registry key belongs to. This is restricted to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. - datatype attribute for the hive entity of a regkeyauditedpermissions_object should be 'string' - operation attribute for the hive entity of a regkeyauditedpermissions_object should be 'equals', or 'not equal' The key element describes a registry key to be collected. Note that the hive portion of the string should not be included, as this data should be found under the hive element. - datatype attribute for the key entity of a regkeyauditedpermissions_object should be 'string' - operation attribute for the key entity of a regkeyauditedpermissions_object should be 'equals', 'not equal', or 'pattern match' The trustee_name element is the unique name that associated a particular SID. A SID can be associated with a user, group, or program (such as a Windows service) - datatype attribute for the trustee_name entity of a regkeyauditedpermissions_object should be 'string' - operation attribute for the trustee_name entity of a regkeyauditedpermissions_object should be 'equals', 'not equal', or 'pattern match' The regkeyauditedpermissions_state element defines the different audit permissions that can be associated with a given regkeyauditedpermissions_object. Please refer to the individual elements in the schema for more details about what each represents. This element specifies the hive of a registry key on the machine from which to retrieve the SACL. - datatype attribute for the hive entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the hive entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' This element specifies a registry key on the machine from which to retrieve the SACL. Note that the hive portion of the string should not be inclueded, as this data should be found under the hive element. - datatype attribute for the key entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key entity of a regkeyauditedpermissions_state should be 'equals', 'not equal', or 'pattern match' The unique name associated with a particular security identifier (SID). - datatype attribute for the trustee_name entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the trustee_name entity of a regkeyauditedpermissions_state should be 'equals', 'not equal', or 'pattern match' The right to delete the object. - datatype attribute for the standard_delete entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the standard_delete entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' The right to read the information in the object's security descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the standard_read_control entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' The right to modify the DACL in the object's security descriptor. - datatype attribute for the standard_write_dac entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the standard_write_dac entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' The right to change the owner in the object's security descriptor. - datatype attribute for the standard_write_owner entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the standard_write_owner entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the standard_synchronize entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the access_system_security entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' Read access. - datatype attribute for the generic_read entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the generic_read entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' Write access. - datatype attribute for the generic_write entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the generic_write entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the generic_execute entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the generic_execute entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the generic_all entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the generic_all entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_query_value entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_query_value entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_set_value entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_set_value entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_create_sub_key entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_create_sub_key entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_enumerate_sub_keys entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_enumerate_sub_keys entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_notify entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_notify entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_create_link entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_create_link entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_wow64_64key entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_wow64_64key entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_wow64_32key entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_wow64_32key entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' - datatype attribute for the key_wow64_res entity of a regkeyauditedpermissions_state should be 'string' - operation attribute for the key_wow64_res entity of a regkeyauditedpermissions_state should be 'equals' or 'not equal' The RegkeyAuditPermissionsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyauditedpermissions objects being specified. 'max_depth' defines how many directories to recurse when a recurse direction is specified. The default value is '-1' meaning no limitation. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. 'recurse_direction' defines the direction to recurse, either 'up' to parent directories, or 'down' into child directories. The default value is 'none' for no recursion. The registry key effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The regkeyeffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyeffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a regkeyeffectiverights_test must reference a regkeyeffectiverights_object - the state child element of a regkeyeffectiverights_test must reference a regkeyeffectiverights_state The hive that the registry key belongs to. This is restricted to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. - datatype attribute for the hive entity of a regkeyeffectiverights_object should be 'string' - operation attribute for the hive entity of a regkeyeffectiverights_object should be 'equals', or 'not equal' The key element describes a registry key to be collected. Note that the hive portion of the string should not be included, as this data should be found under the hive element. - datatype attribute for the key entity of a regkeyeffectiverights_object should be 'string' - operation attribute for the key entity of a regkeyeffectiverights_object should be 'equals', 'not equal', or 'pattern match' The trustee_name element is the unique name that associated a particular SID. A SID can be associated with a user, group, or program (such as a Windows service) - datatype attribute for the trustee_name entity of a regkeyeffectiverights_object should be 'string' - operation attribute for the trustee_name entity of a regkeyeffectiverights_object should be 'equals', 'not equal', or 'pattern match' The regkeyeffectiverights_state element defines the different rights that can be associated with a given regkeyeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents. This element specifies the hive of a registry key on the machine from which to retrieve the SACL. - datatype attribute for the hive entity of a regkeyeffectiverights_state should be 'string' - operation attribute for the hive entity of a regkeyeffectiverights_state should be 'equals' or 'not equal' This element specifies a registry key on the machine from which to retrieve the SACL. Note that the hive portion of the string should not be inclueded, as this data should be found under the hive element. - datatype attribute for the key entity of a regkeyeffectiverights_state should be 'string' - operation attribute for the key entity of a regkeyeffectiverights_state should be 'equals', 'not equal', or 'pattern match' The unique name associated with a particular security identifier (SID). - datatype attribute for the trustee_name entity of a regkeyeffectiverights_state should be 'string' - operation attribute for the trustee_name entity of a regkeyeffectiverights_state should be 'equals', 'not equal', or 'pattern match' The right to delete the object. - datatype attribute for the standard_delete entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the standard_delete entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the standard_read_control entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the standard_read_control entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the standard_write_dac entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the standard_write_dac entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the standard_write_owner entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the standard_write_owner entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the standard_synchronize entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the standard_synchronize entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the access_system_security entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the access_system_security entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the generic_read entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the generic_read entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the generic_write entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the generic_write entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the generic_execute entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the generic_execute entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the generic_all entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the generic_all entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_query_value entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_query_value entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_set_value entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_set_value entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_create_sub_key entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_create_sub_key entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_enumerate_sub_keys entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_enumerate_sub_keys entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_notify entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_notify entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_create_link entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_create_link entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_wow64_64key entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_wow64_64key entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_wow64_32key entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_wow64_32key entity of a regkeyeffectiverights_state should be 'equals', or 'not equal - datatype attribute for the key_wow64_res entity of a regkeyeffectiverights_state should be 'boolean' - operation attribute for the key_wow64_res entity of a regkeyeffectiverights_state should be 'equals', or 'not equal The RegkeyEffectiveRightsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyeffectiverights objects being specified. 'max_depth' defines how many directories to recurse when a recurse direction is specified. The default value is '-1' meaning no limitation. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. 'recurse_direction' defines the direction to recurse, either 'up' to parent directories, or 'down' into child directories. The default value is 'none' for no recursion. The sid test is used to check properties associated with the specified sid. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a sid_test must reference a sid_object - the state child element of a sid_test must reference a sid_state The trustee_name element is the unique name that associated a particular SID. A SID can be associated with a user, group, or program (such as a Windows service) - datatype attribute for the trustee_name entity of a sid_object should be 'string' - operation attribute for the trustee_name entity of a sid_object should be 'equals', 'not equal', or 'pattern match' This element specifies the trustee name associated with a particular SID. - datatype attribute for the trustee_name entity of a sid_state should be 'string' - operation attribute for the trustee_name entity of a sid_state should be 'equals', 'not equal', or 'pattern match' The security identifier (SID) of the specified trustee name. - datatype attribute for the trustee_sid entity of a sid_state should be 'string' - operation attribute for the trustee_sid entity of a sid_state should be 'equals', 'not equal', or 'pattern match' The domain of the specified trustee name. - datatype attribute for the trustee_domain entity of a sid_state should be 'string' - operation attribute for the trustee_domain entity of a sid_state should be 'equals', 'not equal', or 'pattern match' The SidBehaviors complex type defines a number of behaviors that allow a more detailed definition of the sid objects being specified. 'include_group' defines whether the group sid should be included in the object when the object is defined by a group sid. For example, the intension of an object defined by a group sid might be to retrieve all the user sids that are a member of the group, but not the group sid itself. 'resolve_group' defines whether an object defined by a group sid should be resolved to return all the user sids that are a member of that group. The user test is used to check information fabout Windows users. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a user_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a user_test must reference a user_object - the state child element of a user_test must reference a user_state A string that represents the name of a particular user. - datatype attribute for the user entity of a user_object should be 'string' - operation attribute for the user entity of a user_object should be 'equals', 'not equal', or 'pattern match' A string that represents the name of a particular user. - datatype attribute for the user entity of a user_state should be 'string' - operation attribute for the user entity of a user_state should be 'equals', 'not equal', or 'pattern match' This element holds a boolean value that specifies whether the particular user account is enabled or not. - datatype attribute for the enabled entity of a user_state should be 'boolean' - operation attribute for the enabled entity of a user_state should be 'equals', or 'not equal' A string the represents the name of a particular group. This element can be included multiple times in a system characteristic item sincea user is a member of a number of different groups. - datatype attribute for the group entity of a user_state should be 'string' - operation attribute for the group entity of a user_state should be 'equals', 'not equal', or 'pattern match' The volume test is used to check information about different storage volumes found on a Windows system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a volume_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a volume_test must reference a volume_object - the state child element of a volume_test must reference a volume_state The volume_object element is used by a volume test to define the specific volume(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A volume object defines the rootpath of the volume(s). A string that contains the root directory of the volume to be described. A trailing backslash is required. For example, you would specify \\MyServer\MyShare as "\\MyServer\MyShare\", or the C drive as "C:\". - datatype attribute for the rootpath entity of a volume_object should be 'string' - operation attribute for the rootpath entity of a volume_object should be 'equals', 'not equal', or 'pattern match' The volume_state element defines the different metadata associate with a storage volume in Windows. This includes the rootpat, the file system type, name, and serial number, as well as any associated flags. Please refer to the individual elements in the schema for more details about what each represents. The GetVolumeInformation function as defined by Microsoft is also a good place to look for information. A string that contains the root directory of the volume to be described. A trailing backslash is required. For example, you would specify \\MyServer\MyShare as "\\MyServer\MyShare\", or the C drive as "C:\". - datatype attribute for the rootpath entity of a volume_state should be 'string' - operation attribute for the rootpath entity of a volume_state should be 'equals', 'not equal', or 'pattern match' The type of filesystem. For example FAT or NTFS. - datatype attribute for the file_system entity of a volume_state should be 'string' - operation attribute for the file_system entity of a volume_state should be 'equals', 'not equal', or 'pattern match' The name of the volume. - datatype attribute for the name entity of a volume_state should be 'string' - operation attribute for the name entity of a volume_state should be 'equals', 'not equal', or 'pattern match' The volume_max_component_length element specifies the maximum length, in TCHARs, of a file name component that a specified file system supports. A file name component is the portion of a file name between backslashes. The value that is stored in the variable that *lpMaximumComponentLength points to is used to indicate that a specified file system supports long names. For example, for a FAT file system that supports long names, the function stores the value 255, rather than the previous 8.3 indicator. Long names can also be supported on systems that use the NTFS file system. - datatype attribute for the volume_max_component_length entity of a volume_state should be 'int' - operation attribute for the volume_max_component_length entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The volume serial number. - datatype attribute for the serial_number entity of a volume_state should be 'int' - operation attribute for the serial_number entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports case-sensitive file names. - datatype attribute for the file_case_sensitive_search entity of a volume_state should be 'int' - operation attribute for the file_case_sensitive_search entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system preserves the case of file names when it places a name on disk. - datatype attribute for the file_case_preserved_names entity of a volume_state should be 'int' - operation attribute for the file_case_preserved_names entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports Unicode in file names as they appear on disk. - datatype attribute for the file_unicode_on_disk entity of a volume_state should be 'int' - operation attribute for the file_unicode_on_disk entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system preserves and enforces ACLs. For example, NTFS preserves and enforces ACLs, and FAT does not. - datatype attribute for the file_persistent_acls entity of a volume_state should be 'int' - operation attribute for the file_persistent_acls entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports file-based compression. - datatype attribute for the file_file_compression entity of a volume_state should be 'int' - operation attribute for the file_file_compression entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports disk quotas. - datatype attribute for the file_volume_quotas entity of a volume_state should be 'int' - operation attribute for the file_volume_quotas entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports sparse files. - datatype attribute for the file_supports_sparse_files entity of a volume_state should be 'int' - operation attribute for the file_supports_sparse_files entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports reparse points. - datatype attribute for the file_supports_reparse_points entity of a volume_state should be 'int' - operation attribute for the file_supports_reparse_points entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The specified volume is a compressed volume; for example, a DoubleSpace volume. - datatype attribute for the file_supports_remote_storage entity of a volume_state should be 'int' - operation attribute for the file_supports_remote_storage entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The specified volume is a compressed volume; for example, a DoubleSpace volume. - datatype attribute for the file_volume_is_compressed entity of a volume_state should be 'int' - operation attribute for the file_volume_is_compressed entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports object identifiers. - datatype attribute for the file_supports_object_ids entity of a volume_state should be 'int' - operation attribute for the file_supports_object_ids entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports the Encrypted File System (EFS). - datatype attribute for the file_supports_encryption entity of a volume_state should be 'int' - operation attribute for the file_supports_encryption entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The file system supports named streams. - datatype attribute for the file_named_streams entity of a volume_state should be 'int' - operation attribute for the file_named_streams entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The specified volume is read-only. This flag was added in Windows XP. - datatype attribute for the file_read_only_volume entity of a volume_state should be 'int' - operation attribute for the file_read_only_volume entity of a volume_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The wmi test is used to check information access by WMI. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a wmi_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a wmi_test must reference a wmi_object - the state child element of a wmi_test must reference a wmi_state Specifies which WMI namespace to look under. Each WMI provider normally registers its own WMI namespace and then all its classes within that namespace. For example, all Win32 WMI classes can be found in the namespace "root\cimv2", all IIS WMI classes can be found at "root\microsoftiisv2", and all LDAP WMI classes can be found at "root\directory\ldap". - datatype attribute for the namespace entity of a wmi_object should be 'string' - operation attribute for the namespace entity of a wmi_object should be 'equals' A WQL query used to identify the object(s) to test against. Any valid WQL query is usable with one exception, at most one field is allowed in the SELECT portion of the query. For example SELECT name FROM ... is valid, as is SELECT 'true' FROM ..., but SELECT name, number FROM ... is not valid. This is because the result element in the data section is only designed to work against a single field. - datatype attribute for the wql entity of a wmi_object should be 'string' - operation attribute for the wql entity of a wmi_object should be 'equals' Specifies which WMI namespace to look under. Each WMI provider normally registers its own WMI namespace and then all its classes within that namespace. For example, all Win32 WMI classes can be found in the namespace "root\cimv2", all IIS WMI classes can be found at "root\microsoftiisv2", and all LDAP WMI classes can be found at "root\directory\ldap". - datatype attribute for the namespace entity of a wmi_state should be 'string' - operation attribute for the namespace entity of a wmi_state should be 'equals', 'not equal', or 'pattern match' A WQL query used to identify the object(s) to test against. Any valid WQL query is usable with one exception, at most one field is allowed in the SELECT portion of the query. For example SELECT name FROM ... is valid, as is SELECT 'true' FROM ..., but SELECT name, number FROM ... is not valid. This is because the result element in the data section is only designed to work against a single field. - datatype attribute for the wql entity of a wmi_state should be 'string' - operation attribute for the wql entity of a wmi_state should be 'equals', 'not equal', or 'pattern match' The result element specifies how to test objects in the result set of the specified WQL statement. Only one comparable field is allowed. So if the WQL statement look like 'SELECT name FROM ...', then a result element with a value of 'Fred' would test that value against the names returned by the WQL statement. - the supplied operation attribute for the result entity of a wmi_state is not valid given a datatype of '' The EntityStateAddrTypeType complex type restricts a string value to a specific set of values that describe address types associated with an interface. The empty string is also allowed to support empty emlement associated with variable references. The address is being deleted. The address is on disconnected interface. The stated address is a dynamic IP address. The stated address is a primary IP address. The stated address is a transient address. The EntityStateAdstypeType complex type restricts a string value to a specific set of values that specify the different types of information that an active directory attribute can represents. For more information look at the ADSTYPEENUM enumeration defined by Microsoft. The empty string is also allowed to support empty emlement associated with variable references. The data type is invalid. The string is of Distinguished Name (path) of a directory service object. The string is of the case-sensitive type. The string is of the case-insensitive type. The string is displayable on screen or in print. The string is of a numeral to be interpreted as text. The data is of a Boolean value. The data is of an integer value. The string is of a byte array. The data is of the universal time as expressed in Universal Time Coordinate (UTC). The data is of a long integer value. The string is of a provider-specific string. Not used. The data is of a list of case insensitive strings. The data is of a list of octet strings. The string is of a directory path. The string is of the postal address type. The data is of a time stamp in seconds. The string is of a back link. The string is of a typed name. The data is of the Hold data structure. The string is of a net address. The data is of a replica pointer. The string is of a fax number. The data is of an e-mail message. The data is of Windows NT/Windows 2000 security descriptor as represented by a byte array. The data is of an undefined type. The data is of ADS_DN_WITH_BINARY used for mapping a distinguished name to a non varying GUID. The data is of ADS_DN_WITH_STRING used for mapping a distinguished name to a non-varying string value. The EntityStateAuditType complex type restricts a string value to a specific set of values: AUDIT_NONE, AUDIT_SUCCESS, AUDIT_FAILURE, and AUDIT_SUCCESS_FAILURE. These values describe which audit records should be generated. The empty string is also allowed to support empty emlement associated with variable references. The EntityStateInterfaceTypeType complex type restricts a string value to a specific set of values. These values describe the different interface types. The empty string is also allowed to support empty emlement associated with variable references. The EntityStateFileTypeType complex type restricts a string value to a specific set of values. These values describe the type of file being represented. For more information see the GetFileType and GetFileAttributesEx functions as defined by Microsoft. The empty string is also allowed to support empty emlement associated with variable references. The handle identifies a directory. The specified file is a character file, typically an LPT device or a console. The specified file is a disk file. The specified file is a socket, a named pipe, or an anonymous pipe. Unused. Either the type of the specified file is unknown, or the function failed. The EntityObjectNamingContextType restricts a string value to a specific set of values: domain, configuration, and schema. These values describe the different default naming context found in active directory. A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. The empty string is also allowed to support empty emlement associated with variable references. The EntityObjectNamingContextType restricts a string value to a specific set of values: domain, configuration, and schema. These values describe the different default naming context found in active directory. A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. The empty string is also allowed to support empty emlement associated with variable references. The EntityObjectProtocolType restricts a string value to a specific set of values: TCP and UDP. These values describe the different protocols available to a port. The empty string is also allowed to support empty emlement associated with variable references. The EntityStateProtocolType restricts a string value to a specific set of values: TCP and UDP. These values describe the different protocols available to a port. The empty string is also allowed to support empty emlement associated with variable references. The EntityObjectRegistryHiveType restricts a string value to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. These values describe the possible hives in the registry. The empty string is also allowed to support empty emlement associated with variable references. The EntityStateRegistryHiveType restricts a string value to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. These values describe the possible hives in the registry. The empty string is also allowed to support empty emlement associated with variable references. The EntityStateRegistryTypeType complex type restricts a string value to a specific set of values. These values describe the possible types of data stored in a registry key. The empty string is also allowed to support empty emlement associated with variable references. Binary data in any form. A 32-bit number. Null-terminated string that contains unexpanded references to environment variables (for example, "%PATH%"). Array of null-terminated strings, terminated by two null characters. A 64-bit number. Null-terminated string.