The following is a description of the elements, types, and attributes that compose the Windows specific tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and should provide the information necessary to understand what each element and attribute represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between the different tests and their relationship to the Core Definition Schema is not outlined here. The OVAL Schema is maintained by The Mitre Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org. Windows Definition 5.0 release candidate 3 26 May 2006 schematron validation of the Windows portion of an OVAL Definitions file - the value "" found in platform element as part of the affected element is not a valid windows platform. The access token test is used to check the properties of a Windows' access token as well as individual privileges and rights associated with it. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an accesstoken_object and the optional state element specifies the data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an accesstoken_test must reference an accesstoken_object - the state child element of an accesstoken_test must reference an accesstoken_state The accesstoken_object element is used by an access token test to define the object to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An access token object consists of a single security principle that identifies user, group, or compter account that is associated with the token. The security_principle element defines the access token being specified. Security principals include users or groups with either local or domain accounts, and computer accounts created when a computer running Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family joins a domain. User rights and permissions to access objects such as Active Directory objects, files, and registry settings are assigned to security principals. - datatype attribute for the security_principle entity of an accesstoken_object should be 'string' - operation attribute for the security_principle entity of an accesstoken_object should be 'equals', 'not equal', or 'pattern match' The accesstoken_state element defines the different information that can be used to evaluate the specified access tokens. This includes the multitude of user rights and permissions that can be granted. Please refer to the individual elements in the schema for more details about what each represents. The security_principle element identifies a specific access token. Security principals include users or groups with either local or domain accounts, and computer accounts created when a computer running Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family joins a domain. - datatype attribute for the security_principle entity of an accesstoken_state should be 'string' - operation attribute for the security_principle entity of an accesstoken_state should be 'equals', 'not equal', or 'pattern match' If the seassignprimarytokenprivilege privilege is enabled, it allows a parent process to replace the access token that is associated with a child process. - datatype attribute for the seassignprimarytokenprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seassignprimarytokenprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seauditprivilege privilege is enabled, it allows a process to generate audit records in the security log. The security log can be used to trace unauthorized system access. - datatype attribute for the seauditprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seauditprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sebackupprivilege privilege is enabled, it allows the user to circumvent file and directory permissions to back up the system. The privilege is selected only when an application attempts access by using the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply. - datatype attribute for the sebackupprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sebackupprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sechangenotifyprivilege privilege is enabled, it allows the user to pass through folders to which the user otherwise has no access while navigating an object path in the NTFS file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories. - datatype attribute for the sechangenotifyprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sechangenotifyprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreateglobalprivilege privilege is enabled, it allows the user to create named file mapping objects in the global namespace during Terminal Services sessions. - datatype attribute for the secreateglobalprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreateglobalprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatepagefileprivilege privilege is enabled, it allows the user to create and change the size of a pagefile. - datatype attribute for the secreatepagefileprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreatepagefileprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatepermanentprivilege privilege is enabled, it allows a process to create a directory object in the object manager. It is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode have this privilege inherently. - datatype attribute for the secreatepermanentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for thesecreatepermanentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the secreatetokenprivilege privilege is enabled, it allows a process to create an access token by calling NtCreateToken() or other token-creating APIs. - datatype attribute for the secreatetokenprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the secreatetokenprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sedebugprivilege privilege is enabled, it allows the user to attach a debugger to any process. It provides access to sensitive and critical operating system components. - datatype attribute for the sedebugprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sedebugprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seenabledelegationprivilege privilege is enabled, it allows the user to change the Trusted for Delegation setting on a user or computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object. - datatype attribute for the seenabledelegationprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seenabledelegationprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seimpersonateprivilege privilege is enabled, it allows the user to impersonate a client after authentication. It is not supported on Windows XP, Windows 2000 SP3 and earlier, or Windows NT. - datatype attribute for the seimpersonateprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seimpersonateprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seincreasebasepriorityprivilege privilege is enabled, it allows a user to increase the base priority class of a process. - datatype attribute for the seincreasebasepriorityprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seincreasebasepriorityprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seincreasequotaprivilege privilege is enabled, it allows a process that has access to a second process to increase the processor quota assigned to the second process. - datatype attribute for the seincreasequotaprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seincreasequotaprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seloaddriverprivilege privilege is enabled, it allows a user to install and remove drivers for Plug and Play devices. - datatype attribute for the seloaddriverprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seloaddriverprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the selockmemoryprivilege privilege is enabled, it allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. - datatype attribute for the selockmemoryprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the selockmemoryprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the semachineaccountprivilege privilege is enabled, it allows the user to add a computer to a specific domain. - datatype attribute for the semachineaccountprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the semachineaccountprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the semanagevolumeprivilege privilege is enabled, it allows a non-administrative or remote user to manage volumes or disks. - datatype attribute for the semanagevolumeprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the semanagevolumeprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seprofilesingleprocessprivilege privilege is enabled, it allows a user to sample the performance of an application process. - datatype attribute for the seprofilesingleprocessprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seprofilesingleprocessprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seremoteshutdownprivilege privilege is enabled, it allows a user to shut down a computer from a remote location on the network. - datatype attribute for the seremoteshutdownprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seremoteshutdownprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the serestoreprivilege privilege is enabled, it allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object. - datatype attribute for the serestoreprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the serestoreprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesecurityprivilege privilege is enabled, it allows a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. A user who has this privilege can also view and clear the security log from Event Viewer. - datatype attribute for the sesecurityprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesecurityprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seshutdownprivilege privilege is enabled, it allows a user to shut down the local computer. - datatype attribute for the seshutdownprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seshutdownprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesyncagentprivilege privilege is enabled, it allows a process to read all objects and properties in the directory, regardless of the protection on the objects and properties. It is required in order to use Lightweight Directory Access Protocol (LDAP) directory synchronization (Dirsync) services. - datatype attribute for the sesyncagentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesyncagentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemenvironmentprivilege privilege is enabled, it allows modification of system environment variables either by a process through an API or by a user through System Properties. - datatype attribute for the sesystemenvironmentprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemenvironmentprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemprofileprivilege privilege is enabled, it allows a user to sample the performance of system processes. - datatype attribute for the sesystemprofileprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemprofileprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the sesystemtimeprivilege privilege is enabled, it allows the user to adjust the time on the computer's internal clock. It is not required to change the time zone or other display characteristics of the system time. - datatype attribute for the sesystemtimeprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the sesystemtimeprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the setakeownershipprivilege privilege is enabled, it allows a user to take ownership of any securable object in the system, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads. - datatype attribute for the setakeownershipprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the setakeownershipprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the setcbprivilege privilege is enabled, it allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access. - datatype attribute for the setcbprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the setcbprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seundockprivilege privilege is enabled, it allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu. - datatype attribute for the seundockprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seundockprivilege entity of an accesstoken_state should be 'equals', or 'not equal If the seunsolicitedinputprivilege privilege is enabled, it allows the user to read unsolicited data from a terminal device. - datatype attribute for the seunsolicitedinputprivilege entity of an accesstoken_state should be 'boolean' - operation attribute for the seunsolicitedinputprivilege entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sebatchlogonright right, it can log on using the batch logon type. - datatype attribute for the sebatchlogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sebatchlogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seinteractivelogonright right, it can log on using the interactive logon type. - datatype attribute for the seinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the senetworklogonright right, it can log on using the network logon type. - datatype attribute for the senetworklogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the senetworklogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seremoteinteractivelogonright right, it can log on to the computer by using a Remote Desktop connection. - datatype attribute for the seremoteinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seremoteinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the seservicelogonright right, it can log on using the service logon type. - datatype attribute for the seservicelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the seservicelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenybatchLogonright right, it is explicitly denied the ability to log on using the batch logon type. - datatype attribute for the sedenybatchLogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenybatchLogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyinteractivelogonright right, it is explicitly denied the ability to log on using the interactive logon type. - datatype attribute for the sedenyinteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyinteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenynetworklogonright right, it is explicitly denied the ability to log on using the network logon type. - datatype attribute for the sedenynetworklogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenynetworklogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyremoteInteractivelogonright right, it is explicitly denied the ability to log on through Terminal Services. - datatype attribute for the sedenyremoteInteractivelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyremoteInteractivelogonright entity of an accesstoken_state should be 'equals', or 'not equal If an account is assigned the sedenyservicelogonright right, it is explicitly denied the ability to log on using the service logon type. - datatype attribute for the sedenyservicelogonright entity of an accesstoken_state should be 'boolean' - operation attribute for the sedenyservicelogonright entity of an accesstoken_state should be 'equals', or 'not equal The active directory test is used to check information about specific entries in active directory. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an activedirectory_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an activedirectory_test must reference an activedirectory_object - the state child element of an activedirectory_test must reference an activedirectory_state The activedirectory_object element is used by an active directory test to define those objects to evaluated based on a specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. An active directory object consists of three pieces of information, a naming context, a relative distinguished name, and an attribute. Each piece helps identify a specific active directory entry. Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema. - datatype attribute for the naming_context entity of an activedirectory_object should be 'string' - operation attribute for the naming_context entity of an activedirectory_object should be 'equals', or 'not equal The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the object's distinguished name except those outlined by the naming context. If the nillable attribute is set to true, then the object being specified is the higher level naming context. In this case, the relative_dn element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every relative dn under a given naming context. Note that when nil is used for the relative dn element, the attribute element should also be nilled. - datatype attribute for the relative_dn entity of an activedirectory_object should be 'string' - operation attribute for the relative_dn entity of an activedirectory_object should be 'equals', 'not equal', or 'pattern match' - attribute entity must be nil when relative_dn is nil Specifies a named value contained by the object. If the nillable attribute is set to true, then the object being specified is the higher level relative_dn. In this case, the attribute element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every attribute under a given relative dn. - datatype attribute for the attribute entity of an activedirectory_object should be 'string' - operation attribute for the attribute entity of an activedirectory_object should be 'equals', 'not equal', or 'pattern match' The activedirectory_state element defines the different information that can be used to evaluate the specified entries in active directory. An active directory test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents. Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema. - datatype attribute for the naming_context entity of an activedirectory_state should be 'string' - operation attribute for the naming_context entity of an activedirectory_state should be 'equals', or 'not equal The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the objects distinguished name except those outlined by the naming context. - datatype attribute for the relative_dn entity of an activedirectory_state should be 'string' - operation attribute for the relative_dn entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' Specifies a named value contained by the object. - datatype attribute for the attribute entity of an activedirectory_state should be 'string' - operation attribute for the attribute entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' The name of the class of which the object is an instance. - datatype attribute for the object_class entity of an activedirectory_state should be 'string' - operation attribute for the object_class entity of an activedirectory_state should be 'equals', 'not equal', or 'pattern match' Specifies the type of information that the specified attribute represents. - datatype attribute for the adstype entity of an activedirectory_state should be 'string' - operation attribute for the adstype entity of an activedirectory_state should be 'equals', or 'not equal The actual value of the specified active directory attribute. - the supplied operation attribute for the value entity of an activedirectory_state is not valid given a datatype of '' The audit event policy test is used to check different types of events the system should audit. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of an auditeventpolicy_test must reference an auditeventpolicy_object - the state child element of an auditeventpolicy_test must reference an auditeventpolicy_state The auditeventpolicy_object element is used by an audit event policy test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy will reference the same auditeventpolicy_object which is basically an empty object element. The auditeventpolicy_state element specifies the different system activities that can be audited. An audit event policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. The defined values are found in window's POLICY_AUDIT_EVENT_TYPE enumeration and accessed through the LsaQueryInformationPolicy when the InformationClass parameters are set to PolicyAuditEventsInformation. Please refer to the individual elements in the schema for more details about what each represents. Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection. - datatype attribute for the account_logon entity of an auditeventpolicy_state should be 'string' - operation attribute for the account_logon entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to create, delete, or change user or group accounts. Also, audit password changes. > - datatype attribute for the account_management entity of an auditeventpolicy_state should be 'string' - operation attribute for the account_management entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit specific events, such as program activation, some forms of handle duplication, indirect access to an object, and process exit. - datatype attribute for the detailed_tracking entity of an auditeventpolicy_state should be 'string' - operation attribute for the detailed_tracking entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to access the directory service. - datatype attribute for the directory_service_access entity of an auditeventpolicy_state should be 'string' - operation attribute for the directory_service_access entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection. - datatype attribute for the logon entity of an auditeventpolicy_state should be 'string' - operation attribute for the logon entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to access securable objects, such as files. > - datatype attribute for the object_access entity of an auditeventpolicy_state should be 'string' - operation attribute for the object_access entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to change Policy object rules. - datatype attribute for the policy_change entity of an auditeventpolicy_state should be 'string' - operation attribute for the policy_change entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to use privileges. - datatype attribute for the privilege_use entity of an auditeventpolicy_state should be 'string' - operation attribute for the privilege_use entity of an auditeventpolicy_state should be 'equals', or 'not equal Audit attempts to shut down or restart the computer. Also, audit events that affect system security or the security log. - datatype attribute for the system entity of an auditeventpolicy_state should be 'string' - operation attribute for the system entity of an auditeventpolicy_state should be 'equals', or 'not equal The file test is used to check metadata associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a file_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a file_test must reference a file_object - the state child element of a file_test must reference a file_state The file_object element is used by a file test to define the specific file(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema. A file object defines the path and filename of the file(s). In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileBehaviors complex type for more information about specific behaviors. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a file_object should be 'string' - operation attribute for the path entity of a file_object should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. If the nillable attribute is set to true, then the object being specified is the higher level path. In this case, the filename element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a file_object should be 'string' - operation attribute for the filename entity of a file_object should be 'equals', 'not equal', or 'pattern match' The file_state element defines the different metadata associate with a Windows file. This includes the path, filename, owner, size, last modified time, version, etc. Please refer to the individual elements in the schema for more details about what each represents. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a file_state should be 'string' - operation attribute for the path entity of a file_state should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. - datatype attribute for the filename entity of a file_state should be 'string' - operation attribute for the filename entity of a file_state should be 'equals', 'not equal', or 'pattern match' The owner element is a string that contains the name of the owner. - datatype attribute for the owner entity of a file_state should be 'string' - operation attribute for the owner entity of a file_state should be 'equals', 'not equal', or 'pattern match' The size element is the size of the file in bytes. integer equals, not equal, greater than, less than, greater than or equal, less than or equal - datatype attribute for the size entity of a file_state should be 'int' - operation attribute for the size entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' Time of last access of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the a_time entity of a file_state should be 'string' - operation attribute for the a_time entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', 'less than or equal', or 'pattern match' Time of creation of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the c_time entity of a file_state should be 'string' - operation attribute for the c_time entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', 'less than or equal', or 'pattern match' Time of last modification of file. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). - datatype attribute for the m_time entity of a file_state should be 'string' - operation attribute for the m_time entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', 'less than or equal', or 'pattern match' The ms_checksum element is the md5 checksum of the file as supplied by Microsoft. - datatype attribute for the ms_checksum entity of a file_state should be 'string' - operation attribute for the ms_checksum entity of a file_state should be 'equals', 'not equal', or 'pattern match' The version element is the delimited version string of the file. - datatype attribute for the version entity of a file_state should be 'version' - operation attribute for the version entity of a file_state should be 'equals', 'not equal', 'greater than', 'greater than or equal', 'less than', or 'less than or equal' The type element marks whether the file is a directory, named pipe, standard file, etc. These types are the return values for GetFileType, with the exception of FILE_ATTRIBUTE_DIRECTORY which is obtained by looking at GetFileAttributesEx. NOTE: Should this entity be split into two in future versions of the language as there are other values associated with GetFileAttributesEx that are not represented here? - datatype attribute for the type entity of a file_state should be 'string' - operation attribute for the type entity of a file_state should be 'equals', or 'not equal' The development_class element allows the distinction to be made between the GDR development environment and the QFE development environment. This field holds the text found in front of the mmmmmm-nnnn version, for example srv03_gdr. - datatype attribute for the development_class entity of a file_state should be 'string' - operation attribute for the development_class entity of a file_state should be 'equals', 'not equal', or 'pattern match' The FileBehaviors complex type defines a number of behaviors that allow a more detailed definition of the file objects being specified. 'max_depth' defines how many directories to recurse when a recurse direction is specified. The default value is '-1' meaning no limitation. A value of '0' is equivalent to no recursion, '1' means to step only one directory level up/down, and so on. 'recurse_direction' defines the direction to recurse, either 'up' to parent directories, or 'down' into child directories. The default value is 'none' for no recursion. The file audit permissions test is used to check the audit permissions associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType. - the object child element of a fileauditedpermissions_test must reference a fileauditedpermissions_object - the state child element of a fileauditedpermissions_test must reference a fileauditedpermissions_state The fileauditedpermissions_object element is used by a file audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. A fileauditedpermissions_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileAuditPermissionsBehaviors complex type for more information about specific behaviors. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a fileauditedpermissions_object should be 'string' - operation attribute for the path entity of a fileauditedpermissions_object should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. If the nillable attribute is set to true, then the object being specified is the higher level path. In this case, the filename element should not be collected or used in analysis. Setting nil equal to true is different than using a .* pattern match, which says to collect every file under a given path. - datatype attribute for the filename entity of a fileauditedpermissions_object should be 'string' - operation attribute for the filename entity of a fileauditedpermissions_object should be 'equals', 'not equal', or 'pattern match' The trustee_name element is the unique name that associated a particular SID. A SID can be associated with a user, group, or program (such as a Windows service) - datatype attribute for the trustee_name entity of a fileauditedpermissions_object should be 'string' - operation attribute for the trustee_name entity of a fileauditedpermissions_object should be 'equals', 'not equal', or 'pattern match' The fileauditedpermissions_state element defines the different audit permissions that can be associated with a given fileauditedpermissions_object. Please refer to the individual elements in the schema for more details about what each represents. The path element specifies the absolute path to a file on the machine. - datatype attribute for the path entity of a fileauditedpermissions_state should be 'string' - operation attribute for the path entity of a fileauditedpermissions_state should be 'equals', 'not equal', or 'pattern match' The filename element specifies the name of the file. - datatype attribute for the filename entity of a fileauditedpermissions_state should be 'string' - operation attribute for the filename entity of a fileauditedpermissions_state should be 'equals', 'not equal', or 'pattern match' The trustee_name is the unique name associated with a particular security identifier (SID). - datatype attribute for the trustee_name entity of a fileauditedpermissions_state should be 'string' - operation attribute for the trustee_name entity of a fileauditedpermissions_state should be 'equals', 'not equal', or 'pattern match' The right to delete the object. - datatype attribute for the standard_delete entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_delete entity of a fileauditedpermissions_state should be 'equals', or 'not equal' The right to read the information in the object's security descriptor, not including the information in the SACL. - datatype attribute for the standard_read_control entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_read_control entity of a fileauditedpermissions_state should be 'equals', or 'not equal' The right to modify the DACL in the object's security descriptor. - datatype attribute for the standard_write_dac entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_write_dac entity of a fileauditedpermissions_state should be 'equals', or 'not equal' The right to change the owner in the object's security descriptor. - datatype attribute for the standard_write_owner entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_write_owner entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Windows NT/2000: The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. - datatype attribute for the standard_synchronize entity of a fileauditedpermissions_state should be 'string' - operation attribute for the standard_synchronize entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Indicates access to a system access control list (SACL). - datatype attribute for the access_system_security entity of a fileauditedpermissions_state should be 'string' - operation attribute for the access_system_security entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Read access. - datatype attribute for the generic_read entity of a fileauditedpermissions_state should be 'string' - operation attribute for the generic_read entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Write access. - datatype attribute for the generic_write entity of a fileauditedpermissions_state should be 'string' - operation attribute for the generic_write entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Execute access. - datatype attribute for the generic_execute entity of a fileauditedpermissions_state should be 'string' - operation attribute for the generic_execute entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Read, write, and execute access. - datatype attribute for the generic_all entity of a fileauditedpermissions_state should be 'string' - operation attribute for the generic_all entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to read data from the file - datatype attribute for the file_read_data entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_read_data entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to write data to the file. - datatype attribute for the file_write_data entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_write_data entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to append data to the file. - datatype attribute for the file_append_data entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_append_data entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to read extended attributes. - datatype attribute for the file_read_ea entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_read_ea entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to write extended attributes. - datatype attribute for the file_write_ea entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_write_ea entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Grants the right to execute a file. - datatype attribute for the file_execute entity of a fileauditedpermissions_state should be 'string' - operation attribute for the file_execute entity of a fileauditedpermissions_state should be 'equals', or 'not equal' Right to delete a directory and all the files it contains (its children), even if the files are read-only.