Docs for schema windows-system-characteristics-schema.xsd in Open Vulnerability and Assessment Language (OVAL®)

This document outlines the Windows specific items of the System Characteristics XML schema. Each item is an extention of a basic System Characteristics item defined in the default System Characteristics XML schema. The OVAL Schema is maintained by The Mitre Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org.

<xsd:schema targetNamespace="http://oval.mitre.org/XMLSchema/system_characteristics#windows" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:system_characteristics="http://oval.mitre.org/XMLSchema/system_characteristics" xmlns:windows="http://oval.mitre.org/XMLSchema/system_characteristics#windows" elementFormDefault="qualified" version="4.2"> <xsd:import namespace="http://oval.mitre.org/XMLSchema/system_characteristics" schemaLocation="system-characteristics-schema.xsd"/> <xsd:annotation> <xsd:documentation>This document outlines the Windows specific items of the System Characteristics XML schema. Each item is an extention of a basic System Characteristics item defined in the default System Characteristics XML schema.</xsd:documentation> <xsd:documentation>The OVAL Schema is maintained by The Mitre Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org.</xsd:documentation> <xsd:appinfo> <schema>Windows System Characteristics</schema> <version>4.2</version> <date>2 December 2005</date> </xsd:appinfo> </xsd:annotation>    <xsd:element name="accountprivileges_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many accountprivileges_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Account Privileges Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:accountprivileges_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="accountprivileges_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>The account privileges item holds information about the individual privileges and rights associated with a specific account. Each privilege and right in the data section accepts a boolean value signifying whether the privilege is granted or not. This item also holds information about the domain and sid of the account.</xsd:documentation> <xsd:appinfo> <item_name>Account Privileges Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="account_name" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The name of the account to check the privileges and rights of.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="account_domain" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The domain the specified account belongs to.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="account_sid" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The SID of the specified account.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seassignprimarytokenprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a parent process to replace the access token that is associated with a child process.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seauditprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a process to generate audit records in the security log. The security log can be used to trace unauthorized system access.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sebackupprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to circumvent file and directory permissions to back up the system. The privilege is selected only when an application attempts access by using the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sechangenotifyprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to pass through folders to which the user otherwise has no access while navigating an object path in the NTFS file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="secreateglobalprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to create named file mapping objects in the global namespace during Terminal Services sessions.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="secreatepagefileprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to create and change the size of a pagefile.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="secreatepermanentprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a process to create a directory object in the object manager. It is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode have this privilege inherently.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="secreatetokenprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a process to create an access token by calling NtCreateToken() or other token-creating APIs.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sedebugprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to attach a debugger to any process. It provides access to sensitive and critical operating system components.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seenabledelegationprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to change the Trusted for Delegation setting on a user or computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seimpersonateprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to impersonate a client after authentication. It is not supported on Windows XP, Windows 2000 SP3 and earlier, or Windows NT.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seincreasebasepriorityprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to increase the base priority class of a process.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seincreasequotaprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a process that has access to a second process to increase the processor quota assigned to the second process.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seloaddriverprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to install and remove drivers for Plug and Play devices.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="selockmemoryprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="semachineaccountprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to add a computer to a specific domain.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="semanagevolumeprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a non-administrative or remote user to manage volumes or disks.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seprofilesingleprocessprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to sample the performance of an application process.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seremoteshutdownprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to shut down a computer from a remote location on the network. </xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="serestoreprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sesecurityprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. A user who has this privilege can also view and clear the security log from Event Viewer.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seshutdownprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to shut down the local computer.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sesyncagentprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a process to read all objects and properties in the directory, regardless of the protection on the objects and properties. It is required in order to use Lightweight Directory Access Protocol (LDAP) directory synchronization (Dirsync) services.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sesystemenvironmentprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows modification of system environment variables either by a process through an API or by a user through System Properties.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sesystemprofileprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to sample the performance of system processes.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sesystemtimeprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to adjust the time on the computer's internal clock. It is not required to change the time zone or other display characteristics of the system time.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="setakeownershipprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a user to take ownership of any securable object in the system, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="setcbprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seundockprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seunsolicitedinputprivilege" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If this privilege is enabled, it allows the user to read unsolicited data from a terminal device.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sebatchlogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it can log on using the batch logon type.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seinteractivelogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it can log on using the interactive logon type.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="senetworklogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it can log on using the network logon type.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seremoteinteractivelogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it can log on to the computer by using a Remote Desktop connection.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="seservicelogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it can log on using the service logon type.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sedenybatchLogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on using the batch logon type.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sedenyinteractivelogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on using the interactive logon type.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sedenynetworklogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on using the network logon type.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sedenyremoteInteractivelogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on through Terminal Services.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="sedenyservicelogonright" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on using the service logon type.</xsd:documentation> <xsd:appinfo> <parent_item>accountprivileges_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="activedirectory_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many activedirectory_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Active Directory Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:activedirectory_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="activedirectory_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <item_name>Active Directory Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="naming_context" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema.</xsd:documentation> <xsd:appinfo> <parent_item>activedirectory_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:simpleContent> <xsd:restriction base="system_characteristics:objectStringType"> <xsd:enumeration value="domain"/> <xsd:enumeration value="configuration"/> <xsd:enumeration value="schema"/> <xsd:enumeration value=""/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> </xsd:element> <xsd:element name="relative_dn" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the objects distinguished name except those outlined by the naming context.</xsd:documentation> <xsd:appinfo> <parent_item>activedirectory_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="attribute" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies a named value contained by the object.</xsd:documentation> <xsd:appinfo> <parent_item>activedirectory_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="object_class" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The name of the class of which the object is an instance.</xsd:documentation> <xsd:appinfo> <parent_item>activedirectory_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="adstype" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies the type of information that the specified attribute represents.</xsd:documentation> <xsd:appinfo> <parent_item>activedirectory_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:simpleContent> <xsd:restriction base="system_characteristics:dataStringType"> <xsd:enumeration value="ADSTYPE_INVALID"/> <xsd:enumeration value="ADSTYPE_DN_STRING"/> <xsd:enumeration value="ADSTYPE_CASE_EXACT_STRING"/> <xsd:enumeration value="ADSTYPE_CASE_IGNORE_STRING"/> <xsd:enumeration value="ADSTYPE_PRINTABLE_STRING"/> <xsd:enumeration value="ADSTYPE_NUMERIC_STRING"/> <xsd:enumeration value="ADSTYPE_BOOLEAN"/> <xsd:enumeration value="ADSTYPE_INTEGER"/> <xsd:enumeration value="ADSTYPE_OCTET_STRING"/> <xsd:enumeration value="ADSTYPE_UTC_TIME"/> <xsd:enumeration value="ADSTYPE_LARGE_INTEGER"/> <xsd:enumeration value="ADSTYPE_PROV_SPECIFIC"/> <xsd:enumeration value="ADSTYPE_OBJECT_CLASS"/> <xsd:enumeration value="ADSTYPE_CASEIGNORE_LIST"/> <xsd:enumeration value="ADSTYPE_OCTET_LIST"/> <xsd:enumeration value="ADSTYPE_PATH"/> <xsd:enumeration value="ADSTYPE_POSTALADDRESS"/> <xsd:enumeration value="ADSTYPE_TIMESTAMP"/> <xsd:enumeration value="ADSTYPE_BACKLINK"/> <xsd:enumeration value="ADSTYPE_TYPEDNAME"/> <xsd:enumeration value="ADSTYPE_HOLD"/> <xsd:enumeration value="ADSTYPE_NETADDRESS"/> <xsd:enumeration value="ADSTYPE_REPLICAPOINTER"/> <xsd:enumeration value="ADSTYPE_FAXNUMBER"/> <xsd:enumeration value="ADSTYPE_EMAIL"/> <xsd:enumeration value="ADSTYPE_NT_SECURITY_DESCRIPTOR"/> <xsd:enumeration value="ADSTYPE_UNKNOWN"/> <xsd:enumeration value="ADSTYPE_DN_WITH_BINARY"/> <xsd:enumeration value="ADSTYPE_DN_WITH_STRING"/> <xsd:enumeration value=""/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> </xsd:element> <xsd:element name="value" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The actual value of the specified active directory attribute.</xsd:documentation> <xsd:appinfo> <parent_item>activedirectory_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>binary, boolean, float, int, string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="auditeventpolicy_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many auditeventpolicy_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Audit Event Policy Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:auditeventpolicy_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="auditeventpolicy_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>The auditeventpolicy item enumerates the different types of events the system should audit. The defined values are found in window's POLICY_AUDIT_EVENT_TYPE enumeration and accessed through the LsaQueryInformationPolicy when the InformationClass parameters are set to PolicyAuditEventsInformation.</xsd:documentation> <xsd:appinfo> <item_name>Audit Event Policy Item</item_name> <extends>itemType</extends> <valid_sections>message, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="account_logon" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection.</xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="account_management" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit attempts to create, delete, or change user or group accounts. Also, audit password changes.</xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="detailed_tracking" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit specific events, such as program activation, some forms of handle duplication, indirect access to an object, and process exit. </xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="directory_service_access" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit attempts to access the directory service.</xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="logon" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection.</xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="object_access" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit attempts to access securable objects, such as files.</xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="policy_change" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit attempts to change Policy object rules. </xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="privilege_use" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit attempts to use privileges.</xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="system" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Audit attempts to shut down or restart the computer. Also, audit events that affect system security or the security log.</xsd:documentation> <xsd:appinfo> <parent_item>auditeventpolicy_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="environmentvariable_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many environmentvariable_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Environment Variable Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:environmentvariable_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="environmentvariable_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This element stores environment variables and their values</xsd:documentation> <xsd:appinfo> <item_name>Environment Variable Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="name" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element describes the name of an environment variable.</xsd:documentation> <xsd:appinfo> <parent_item>environmentvariable_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="value" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The actual value of the specified environment variable.</xsd:documentation> <xsd:appinfo> <parent_item>environmentvariable_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>binary, boolean, float, int, string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="file_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many file_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>File Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:file_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="file_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This element stores file metadata. The time information can be retrieved by the _stst function.</xsd:documentation> <xsd:appinfo> <item_name>File Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example> <file_item id="2"> <object> <path>C:\WINDOWS\system32\mshtml.dll</path> </object> <data> <owner datatype="string" status="exists">Administrators</owner> <size datatype="string" status="exists">3004928</size> <a_time datatype="string" status="exists">1103205891</a_time> <c_time datatype="string" status="exists">1089236248</c_time> <m_time datatype="string" status="exists">1096480024</m_time> <ms_checksum datatype="int" status="exists">3058159</ms_checksum> <md5 datatype="string" status="exists">8dad986b8288c58937e1c8d8a117b389</md5> <version datatype="int" status="exists"> <major>6</major> <minor>0</minor> <build>2900</build> <private>2523</private> </version> <type datatype="string" status="exists">FILE_TYPE_DISK</type> <development_class datatype="string" status="exists">xpsp_sp2_gdr</development_class> </data> </file_item> </example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="path" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies the absolute path to a file on the machine.</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>none</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="owner" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>A string that contains the name of the owner.</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="size" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Size of the file in bytes.</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="a_time" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Time of last access of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="c_time" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Time of creation of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="m_time" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Time of last modification of file. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="ms_checksum" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>the md5 checksum of the file.</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="md5" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The md5 hash of the file</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="version" type="windows:dataFileVersionType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The version of the file.</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>none</content> <valid_datatypes>version</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="type" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The type child element marks wether the file item describes a directory, named pipe, standard file, etc. These types are the return values for GetFileType, with the exception of FILE_ATTRIBUTE_DIRECTORY which is obtained by looking at GetFileAttributesEx.</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:simpleContent> <xsd:restriction base="system_characteristics:dataStringType"> <xsd:enumeration value="FILE_ATTRIBUTE_DIRECTORY"/> <xsd:enumeration value="FILE_TYPE_CHAR"/> <xsd:enumeration value="FILE_TYPE_DISK"/> <xsd:enumeration value="FILE_TYPE_PIPE"/> <xsd:enumeration value="FILE_TYPE_REMOTE"/> <xsd:enumeration value="FILE_TYPE_UNKNOWN"/> <xsd:enumeration value=""/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> </xsd:element> <xsd:element name="development_class" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The development_class element allows the distinction to be made between the GDR development environment and the QFE development environment. This field holds the text found in front of the mmmmmm-nnnn version, for example srv03_gdr.</xsd:documentation> <xsd:appinfo> <parent_item>file_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="fileauditedpermissions_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many fileauditedpermissions_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>File Audited Permissions Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:fileauditedpermissions_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="fileauditedpermissions_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This item stores the audited access rights of a file that a system access control list (SACL) structure grants to a specified trustee. The trustee's audited access rights are determined checking all access control entries (ACEs) in the SACL. For help with this test see the GetAuditedPermissionsFromAcl() api.</xsd:documentation> <xsd:appinfo> <item_name>File Audited Permissions Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="path" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the absolute path to a file on the machine from which the DACL was retrieved.</xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>none</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="trustee_name" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the trustee name associated with this particular SACL. A trustee can be a user, group, or program (such as a Windows service)</xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="trustee_domain" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The domain of the specified trustee name.</xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="trustee_sid" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The security identifier (SID) of the specified trustee name.</xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_delete" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_read_control" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_write_dac" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_write_owner" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_synchronize" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="access_system_security" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_read" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_write" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_execute" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_all" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_read_data" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_write_data" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_append_data" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_read_ea" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_write_ea" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_execute" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_delete_child" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_read_attributes" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_write_attributes" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="fileeffectiverights_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many fileeffectiverights_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>File Effective Rights Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:fileeffectiverights_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="fileeffectiverights_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This item stores the effective rights of a file that a discretionary access control list (DACL) structure grants to a specified trustee. The trustee's effective rights are determined checking all access-allowed and access-denied access control entries (ACEs) in the DACL. For help with this test see the GetEffectiveRightsFromAcl() api.</xsd:documentation> <xsd:appinfo> <item_name>File Effective Rights Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example> <fileeffectiverights_item id="2"> <object> <path>C:\WINDOWS\system32\mshtml.dll</path> <trustee_name datatype="string" status="exists">SYSTEM</trustee_name> </object> <data> <trustee_domain datatype="string" status="exists">NT AUTHORITY</trustee_domain> <trustee_sid datatype="string" status="exists">S-1-5-18</trustee_sid> <standard_delete datatype="boolean" status="exists">0</standard_delete> <standard_read_control datatype="boolean" status="exists">0</standard_read_control> <standard_write_dac datatype="boolean" status="exists">0</standard_write_dac> <standard_write_owner datatype="boolean" status="exists">0</standard_write_owner> <standard_synchronize datatype="boolean" status="exists">0</standard_synchronize> <access_system_security datatype="boolean" status="exists">1</access_system_security> <generic_read datatype="boolean" status="exists">1</generic_read> <generic_write datatype="boolean" status="exists">1</generic_write> <generic_execute datatype="boolean" status="exists">1</generic_execute> <generic_all datatype="boolean" status="exists">1</generic_all> <file_read_data datatype="boolean" status="exists">0</file_read_data> <file_write_data datatype="boolean" status="exists">0</file_write_data> <file_append_data datatype="boolean" status="exists">0</file_append_data> <file_read_ea datatype="boolean" status="exists">0</file_read_ea> <file_write_ea datatype="boolean" status="exists">0</file_write_ea> <file_execute datatype="boolean" status="exists">0</file_execute> <file_delete_child datatype="boolean" status="exists">0</file_delete_child> <file_read_attributes datatype="boolean" status="exists">0</file_read_attributes> <file_write_attributes datatype="boolean" status="exists">0</file_write_attributes> </data> </fileeffectiverights_item> </example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="path" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the absolute path to a file on the machine from which the DACL was retrieved.</xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>none</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="trustee_name" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the trustee name associated with this particular DACL. A trustee can be a user, group, or program (such as a Windows service)</xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="trustee_domain" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The domain of the specified trustee name.</xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="trustee_sid" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The security identifier (SID) of the specified trustee name.</xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_delete" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_read_control" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_write_dac" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_write_owner" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_synchronize" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="access_system_security" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_read" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_write" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_execute" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_all" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_read_data" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_write_data" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_append_data" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_read_ea" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_write_ea" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_execute" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_delete_child" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_read_attributes" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_write_attributes" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>File Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="group_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many group_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Group Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:group_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="group_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>The windows group item allows the different users that belong to specific groups be collected. Note that the user element can appear an unlimited number of times. If no user is found in the specified group, or if there is an error determining the users of a group, then a single user element should be included that reports this error.</xsd:documentation> <xsd:appinfo> <item_name>Group Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="group" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>A string the represents the name of a particular group.</xsd:documentation> <xsd:appinfo> <parent_item>group_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="enabled" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>A boolean that represents whether the particular group is enabled or not.</xsd:documentation> <xsd:appinfo> <parent_item>group_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="user" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="unbounded"> <xsd:annotation> <xsd:documentation>A string that represents the name of a particular user.</xsd:documentation> <xsd:appinfo> <parent_item>group_item</parent_item> <cardinality>1-n</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="interface_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many interface_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Interface Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:interface_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="interface_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>Enumerate various attributes about the interfaces on a system.</xsd:documentation> <xsd:appinfo> <item_name>Interface Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="name" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the name of an interface.</xsd:documentation> <xsd:appinfo> <parent_item>Interface Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="index" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies index that identifies the interface.</xsd:documentation> <xsd:appinfo> <parent_item>Interface Item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="type" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the type of interface which is limited to certain set of values.</xsd:documentation> <xsd:appinfo> <parent_item>Interface Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:simpleContent> <xsd:restriction base="system_characteristics:dataStringType"> <xsd:enumeration value="MIB_IF_TYPE_ETHERNET"/> <xsd:enumeration value="MIB_IF_TYPE_FDDI"/> <xsd:enumeration value="MIB_IF_TYPE_LOOPBACK"/> <xsd:enumeration value="MIB_IF_TYPE_OTHER"/> <xsd:enumeration value="MIB_IF_TYPE_PPP"/> <xsd:enumeration value="MIB_IF_TYPE_SLIP"/> <xsd:enumeration value="MIB_IF_TYPE_TOKENRING"/> <xsd:enumeration value=""/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> </xsd:element> <xsd:element name="hardware_addr" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the the physical address of the adapter for this interface.</xsd:documentation> <xsd:appinfo> <parent_item>Interface Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="inet_addr" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the IP address.</xsd:documentation> <xsd:appinfo> <parent_item>Interface Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="broadcast_addr" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the broadcast address. A broadcast address is typically the IP address with the host portion set to either all zeros or all ones.</xsd:documentation> <xsd:appinfo> <parent_item>Interface Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="netmask" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the subnet mask for the IP address.</xsd:documentation> <xsd:appinfo> <parent_item>Interface Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="addr_type" minOccurs="1" maxOccurs="unbounded"> <xsd:annotation> <xsd:documentation>This element specifies the address type or state of a specific interface. Each interface can be associated with more than one value meaning the addr_type element can occur multiple times.</xsd:documentation> <xsd:appinfo> <parent_item>Interface Item</parent_item> <cardinality>1-n</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:simpleContent> <xsd:restriction base="system_characteristics:dataStringType"> <xsd:enumeration value="MIB_IPADDR_DELETED"/> <xsd:enumeration value="MIB_IPADDR_DISCONNECTED"/> <xsd:enumeration value="MIB_IPADDR_DYNAMIC"/> <xsd:enumeration value="MIB_IPADDR_PRIMARY"/> <xsd:enumeration value="MIB_IPADDR_TRANSIENT"/> <xsd:enumeration value=""/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="lockoutpolicy_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many lockoutpolicy_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Lockout Policy Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:lockoutpolicy_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="lockoutpolicy_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>The lockoutpolicy item enumerates various attributes associated with lockout information for users and global groups in the security database.</xsd:documentation> <xsd:appinfo> <item_name>Lockout Policy Item</item_name> <extends>itemType</extends> <valid_sections>message, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="data" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="force_logoff" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>lockoutpolicy_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="lockout_duration" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>lockoutpolicy_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="lockout_observation_window" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>lockoutpolicy_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="lockout_threshold" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>lockoutpolicy_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="metabase_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many metabase_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Metabase Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:metabase_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="metabase_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This item gathers information from the specified metabase keys.</xsd:documentation> <xsd:appinfo> <item_name>Metabase Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="key" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element describes a metabase key to be gathered.</xsd:documentation> <xsd:appinfo> <parent_item>metabase_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="id" type="system_characteristics:objectIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>metabase_item</parent_item> <cardinality>1</cardinality> <content>integer</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="name" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element describes the name of the specified metabase object.</xsd:documentation> <xsd:appinfo> <parent_item>metabase_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="user_type" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>metabase_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="data_type" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>metabase_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="data" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The actual data of the named item under the specified metabase key</xsd:documentation> <xsd:appinfo> <parent_item>metabase_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>sbinary, boolean, float, int, string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="passwordpolicy_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many passwordpolicy_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Password Policy Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:passwordpolicy_item" minOccurs="1" maxOccurs="1"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="passwordpolicy_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>Specific policy items associated with passwords. Information is stored in the SAM or Active Directory but is encrypted or hidden so the registry_item and activedirectory_item are of no use. If this can be figured out, then the password_policy item is not needed.</xsd:documentation> <xsd:appinfo> <item_name>Password Policy Item</item_name> <extends>itemType</extends> <valid_sections>message, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="max_passwd_age" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies, in seconds, the maximum allowable password age. A value of TIMEQ_FOREVER (-1) indicates that the password never expires. The minimum valid value for this element is ONE_DAY (86400).</xsd:documentation> <xsd:appinfo> <parent_item>passwordpolicy_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="min_passwd_age" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies the minimum number of seconds that can elapse between the time a password changes and when it can be changed again. A value of zero indicates that no delay is required between password updates.</xsd:documentation> <xsd:appinfo> <parent_item>passwordpolicy_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="min_passwd_len" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies the minimum allowable password length. Valid values for this element are zero through PWLEN.</xsd:documentation> <xsd:appinfo> <parent_item>passwordpolicy_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="password_hist_len" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies the length of password history maintained. A new password cannot match any of the previous usrmod0_password_hist_len passwords. Valid values for this element are zero through DEF_MAX_PWHIST.</xsd:documentation> <xsd:appinfo> <parent_item>passwordpolicy_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="password_complexity" type="system_characteristics:dataBoolType" minOccurs="0" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>passwordpolicy_item</parent_item> <cardinality>0-1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="reversible_encryption" type="system_characteristics:dataBoolType" minOccurs="0" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>passwordpolicy_item</parent_item> <cardinality>0-1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="port_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many port_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Port Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:port_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="port_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>Information about open listening ports.</xsd:documentation> <xsd:appinfo> <item_name>Port Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="local_address" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the local IP address the listening port is bound to.</xsd:documentation> <xsd:appinfo> <parent_item>Port Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="local_port" type="system_characteristics:objectIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the number assigned to the local listening port.</xsd:documentation> <xsd:appinfo> <parent_item>Port Item</parent_item> <cardinality>1</cardinality> <content>integer</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="protocol" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the type of listening port. It is restricted to either TCP or UDP.</xsd:documentation> <xsd:appinfo> <parent_item>Port Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:simpleContent> <xsd:restriction base="system_characteristics:objectStringType"> <xsd:enumeration value="TCP"/> <xsd:enumeration value="UDP"/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="pid" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The id given to the process that is associated with the specified listening port.</xsd:documentation> <xsd:appinfo> <parent_item>Port Item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="process_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many process_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Process Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:process_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="process_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>Information about running processes.</xsd:documentation> <xsd:appinfo> <item_name>Process Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="command_line" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>process_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="pid" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The id given to the process that is created for a specified command line.</xsd:documentation> <xsd:appinfo> <parent_item>process_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="ppid" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The id given to the parent of the process that is created for the specified command line</xsd:documentation> <xsd:appinfo> <parent_item>process_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="priority" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>process_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="image_path" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>process_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="current_dir" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>process_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="registry_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many registry_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Registry Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:registry_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="registry_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>The windows registry item specifies a particular registry key (or keys) to collect.</xsd:documentation> <xsd:appinfo> <item_name>Registry Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example> <registry_item id="1"> <object> <hive>HKEY_LOCAL_MACHINE</hive> <key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key> <name>CurrentVersion</name> </object> <data> <type datatype="string" status="exists">reg_sz</type> <value datatype="string" status="exists">5.1</value> </data> </registry_item> </example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="hive" type="windows:objectHiveType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The hive that the registry key belongs to.</xsd:documentation> <xsd:appinfo> <parent_item>registry_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element describes a registry key to be gathered. Note that the hive portion of the string should not be inclueded, as this data can be found under the hive element.</xsd:documentation> <xsd:appinfo> <parent_item>registry_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="name" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element describes the name of a registry key.</xsd:documentation> <xsd:appinfo> <parent_item>registry_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="type" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies the type of data stored by the registry key.</xsd:documentation> <xsd:appinfo> <parent_item>registry_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:simpleContent> <xsd:restriction base="system_characteristics:dataStringType"> <xsd:enumeration value="reg_binary"/> <xsd:enumeration value="reg_dword"/> <xsd:enumeration value="reg_expand_sz"/> <xsd:enumeration value="reg_multi_sz"/> <xsd:enumeration value="reg_qword"/> <xsd:enumeration value="reg_sz"/> <xsd:enumeration value=""/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> </xsd:element> <xsd:element name="value" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The actual value of the specified registry key.</xsd:documentation> <xsd:appinfo> <parent_item>registry_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>binary, boolean, float, int, string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="regkeyauditedpermissions_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of one or more regkeyauditedpermissions_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Regkey Audited Permissions Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:regkeyauditedpermissions_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="regkeyauditedpermissions_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This item stores the audited access rights of a registry key that a system access control list (SACL) structure grants to a specified trustee. The trustee's audited access rights are determined checking all access control entries (ACEs) in the SACL. For help with this test see the GetAuditedPermissionsFromAcl() api.</xsd:documentation> <xsd:appinfo> <item_name>Regkey Audited Permissions Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="hive" type="windows:objectHiveType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the hive of a registry key on the machine from which the SACL was retrieved.</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies a registry key on the machine from which the SACL was retrieved. Note that the hive portion of the string should not be inclueded, as this data should be found under the hive element.</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="trustee_name" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the trustee name associated with this particular SACL. A trustee can be a user, group, or program (such as a Windows service)</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="trustee_domain" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The domain of the specified trustee name.</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="trustee_sid" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The security identifier (SID) of the specified trustee name.</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_delete" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_read_control" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_write_dac" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_write_owner" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_synchronize" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="access_system_security" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_read" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_write" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_execute" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_all" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_query_value" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_set_value" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_create_sub_key" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_enumerate_sub_keys" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_notify" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_create_link" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_wow64_64key" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_wow64_32key" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_wow64_res" type="windows:dataAuditType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Audited Permissions Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="regkeyeffectiverights_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of one or more regkeyeffectiverights_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Regkey Effective Rights Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:regkeyeffectiverights_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="regkeyeffectiverights_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This item stores the effective rights of a registry key that a discretionary access control list (DACL) structure grants to a specified trustee. The trustee's effective rights are determined checking all access-allowed and access-denied access control entries (ACEs) in the DACL. For help with this test see the GetEffectiveRightsFromAcl() api.</xsd:documentation> <xsd:appinfo> <item_name>Regkey Effective Rights Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="hive" type="windows:objectHiveType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The hive that the registry key belongs to.</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element describes a registry key to be gathered. Note that the hive portion of the string should not be inclueded, as this data can be found under the hive element.</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="trustee_name" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>This element specifies the trustee name associated with this particular DACL. A trustee can be a user, group, or program (such as a Windows service)</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="trustee_domain" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The domain of the specified trustee name.</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="trustee_sid" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The security identifier (SID) of the specified trustee name.</xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_delete" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_read_control" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_write_dac" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_write_owner" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="standard_synchronize" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="access_system_security" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_read" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_write" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_execute" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="generic_all" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_query_value" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_set_value" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_create_sub_key" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_enumerate_sub_keys" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_notify" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_create_link" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_wow64_64key" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_wow64_32key" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="key_wow64_res" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>Regkey Effective Rights Item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="textfilecontent_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element has been deprecated in version 4.1 of the windows-system-characterics-schema and will be removed completely in version 5. It is recommended that all future OVAL Content use the textfilecontent_items found in the independent-system-characterics-schema.</xsd:documentation> <xsd:documentation>This element is a container of many textfilecontent_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Text File Content Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:textfilecontent_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="textfilecontent_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This item has been deprecated in version 4.1 of the windows-system-characterics-schema and will be removed completely in version 5. It is recommended that all future OVAL Content use the textfilecontent_item found in the independent-system-characterics-schema.</xsd:documentation> <xsd:documentation>The textfilecontent item looks at the contents of a text file (aka a configuration file) by looking at individual lines.</xsd:documentation> <xsd:appinfo> <item_name>Text File Content Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="path" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies the absolute path to a file on the machine.</xsd:documentation> <xsd:appinfo> <parent_item>textfilecontent_item</parent_item> <cardinality>1</cardinality> <content>none</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="line" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1" nillable="true"> <xsd:annotation> <xsd:documentation>The line element represents a line in the file and is represented using a regular expression.</xsd:documentation> <xsd:appinfo> <parent_item>textfilecontent_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="subexpression" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="unbounded"> <xsd:annotation> <xsd:documentation>Each subexpression in the regular expression of the line element is then tested against the value specified in the subexpression element.</xsd:documentation> <xsd:appinfo> <parent_item>textfilecontent_item</parent_item> <cardinality>1-n</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="user_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many user_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>User Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:user_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="user_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>The windows user item allows the different groups that a user belongs to be collected. Note that the group element can appear an unlimited number of times. If the specified group is not a member of a single group, or if there is an error determining the groups that the user belongs to, then a single group element should be included that reports this error.</xsd:documentation> <xsd:appinfo> <item_name>User Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="user" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>A string the represents the name of a particular user.</xsd:documentation> <xsd:appinfo> <parent_item>group_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="enabled" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>A boolean that represents whether the particular user is enabled or not.</xsd:documentation> <xsd:appinfo> <parent_item>user_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="group" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="unbounded"> <xsd:annotation> <xsd:documentation>A string that represents the name of a particular group.</xsd:documentation> <xsd:appinfo> <parent_item>group_item</parent_item> <cardinality>1-n</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="volume_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many volume_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>Volume Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:volume_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="volume_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>The volume item enumerates various attributes about a particular volume mounted to a machine. This includes the various system flags returned by GetVolumeInformation().</xsd:documentation> <xsd:appinfo> <item_name>Volume Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="rootpath" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="file_system" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="name" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="serial_number" type="system_characteristics:dataIntType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>integer</content> <valid_datatypes>integer</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_named_streams" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_read_only_volume" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_supports_object_ids" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_supports_reparse_points" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_supports_sparse_files" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="file_volume_quotas" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="fs_case_is_preserved" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="fs_case_sensitive" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="fs_file_compression" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="fs_file_encryption" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="fs_persistent_acls" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="fs_unicode_stored_on_disk" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="fs_vol_is_compressed" type="system_characteristics:dataBoolType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation></xsd:documentation> <xsd:appinfo> <parent_item>volume_item</parent_item> <cardinality>1</cardinality> <content>boolean</content> <valid_datatypes>boolean</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="xmlfilecontent_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element has been deprecated in version 4.1 of the windows-system-characterics-schema and will be removed completely in version 5. It is recommended that all future OVAL Content use the xmlfilecontent_items found in the independent-system-characterics-schema.</xsd:documentation> <xsd:documentation>This element is a container of many xmlfilecontent_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>XML File Content Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:xmlfilecontent_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="xmlfilecontent_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>This item has been deprecated in version 4.1 of the windows-system-characterics-schema and will be removed completely in version 5. It is recommended that all future OVAL Content use the xmlfilecontent_items found in the independent-system-characterics-schema.</xsd:documentation> <xsd:documentation>The xmlfilecontent item uses Xpath to explore the contents of an xml file. The value_of element checks the value of the nodes found.</xsd:documentation> <xsd:appinfo> <item_name>XML File Content Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="path" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>Specifies the absolute path to a file on the machine.</xsd:documentation> <xsd:appinfo> <parent_item>xmlfilecontent_item</parent_item> <cardinality>1</cardinality> <content>none</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="xpath" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1" nillable="true"> <xsd:annotation> <xsd:documentation>Specifies an Xpath expression describing the nodes to look at.</xsd:documentation> <xsd:appinfo> <parent_item>xmlfilecontent_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="value_of" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The value element checks the value of the nodes found.</xsd:documentation> <xsd:appinfo> <parent_item>xmlfilecontent_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:element name="wmi_items" substitutionGroup="system_characteristics:item_container"> <xsd:annotation> <xsd:documentation>This element is a container of many wmi_item elements.</xsd:documentation> <xsd:appinfo> <extends>item_container</extends> <valid_items>WMI Item</valid_items> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:sequence> <xsd:element ref="windows:wmi_item" minOccurs="1" maxOccurs="unbounded"/> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="wmi_item" substitutionGroup="system_characteristics:item"> <xsd:annotation> <xsd:documentation>The wmi_item outlines information to be checked through Microsoft's WMI interface.</xsd:documentation> <xsd:appinfo> <item_name>WMI Item</item_name> <extends>itemType</extends> <valid_sections>message, object, data</valid_sections> <example></example> </xsd:appinfo> </xsd:annotation> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:itemType"> <xsd:sequence> <xsd:element name="object" minOccurs="1" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:objectType"> <xsd:sequence> <xsd:element name="namespace" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The WMI namespaces of the specific object.</xsd:documentation> <xsd:appinfo> <parent_item>wmi_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> <xsd:element name="wql" type="system_characteristics:objectStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>A WQL query used to identify the object(s) specified. Any valid WQL query is allowed with one exception, at most one field is allowed in the SELECT portion of the query. For example SELECT name FROM ... is valid, as is SELECT 'true' FROM ..., but SELECT name, number FROM ... is not valid. This is because the result element in the data section is only designed to work against a single field.</xsd:documentation> <xsd:appinfo> <parent_item>wmi_item</parent_item> <cardinality>1</cardinality> <content>string</content> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> <xsd:element name="data" minOccurs="0" maxOccurs="1"> <xsd:complexType> <xsd:complexContent> <xsd:extension base="system_characteristics:dataType"> <xsd:sequence> <xsd:element name="result" type="system_characteristics:dataStringType" minOccurs="1" maxOccurs="1"> <xsd:annotation> <xsd:documentation>The result element specifies how to test objects in the result set of the specified WQL statement. Only one comparable field is allowed. So if the WQL statement look like 'SELECT name FROM ...', then a result element with a value of 'Fred' would test that value against the names returned by the WQL statement.</xsd:documentation> <xsd:appinfo> <parent_item>wmi_item</parent_item> <cardinality>1</cardinality> <content>string</content> <valid_datatypes>binary, boolean, float, int, string</valid_datatypes> </xsd:appinfo> </xsd:annotation> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element> </xsd:sequence> </xsd:extension> </xsd:complexContent> </xsd:complexType> </xsd:element>    <xsd:complexType name="dataAuditType"> <xsd:annotation> <xsd:documentation>The dataAuditType restricts a string value to a specific set of values: AUDIT_NONE, AUDIT_SUCCESS, AUDIT_FAILURE, and AUDIT_SUCCESS_FAILURE. These values describe which audit records should be generated.</xsd:documentation> <xsd:appinfo> <extends>system_characteristics:dataStringType</extends> <attributes>(includes system_characteristics:dataAttributes)</attributes> <content>string</content> <child_elements>none</child_elements> </xsd:appinfo> </xsd:annotation> <xsd:simpleContent> <xsd:restriction base="system_characteristics:dataStringType"> <xsd:enumeration value="AUDIT_FAILURE"/> <xsd:enumeration value="AUDIT_NONE"/> <xsd:enumeration value="AUDIT_SUCCESS"/> <xsd:enumeration value="AUDIT_SUCCESS_FAILURE"/> <xsd:enumeration value=""/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> <xsd:complexType name="dataFileVersionType"> <xsd:annotation> <xsd:documentation>The dataFileVersionType allows the different portions of a windows file version to be represented. A windows file version is made up of for distinct parts: a major version, a minor version, a build number, and a private number. Each part is an integer</xsd:documentation> <xsd:appinfo> <extends>system_characteristics:dataBaseType</extends> <attributes>(includes system_characteristics:dataAttributes)</attributes> <content>none</content> <child_elements>major, minor, build, private</child_elements> </xsd:appinfo> </xsd:annotation> <xsd:complexContent> <xsd:extension base="system_characteristics:dataBaseType"> <xsd:all> <xsd:element name="major" type="xsd:integer"/> <xsd:element name="minor" type="xsd:integer"/> <xsd:element name="build" type="xsd:integer"/> <xsd:element name="private" type="xsd:integer"/> </xsd:all> </xsd:extension> </xsd:complexContent> </xsd:complexType> <xsd:complexType name="objectHiveType"> <xsd:annotation> <xsd:documentation>The objectHiveType restricts a string value to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. These values describe the possible hives in the registry.</xsd:documentation> <xsd:appinfo> <extends>system_characteristics:objectStringType</extends> <attributes>(includes system_characteristics:objectAttributes)</attributes> <content>string</content> <child_elements>none</child_elements> </xsd:appinfo> </xsd:annotation> <xsd:simpleContent> <xsd:restriction base="system_characteristics:objectStringType"> <xsd:enumeration value="HKEY_CLASSES_ROOT"/> <xsd:enumeration value="HKEY_CURRENT_CONFIG"/> <xsd:enumeration value="HKEY_CURRENT_USER"/> <xsd:enumeration value="HKEY_LOCAL_MACHINE"/> <xsd:enumeration value="HKEY_USERS"/> </xsd:restriction> </xsd:simpleContent> </xsd:complexType> </xsd:schema>

Schema Name:	windows-system-characteristics-schema.xsd
Target Namespace:	http://oval.mitre.org/XMLSchema/system_characteristics#windows
Documentation:	This document outlines the Windows specific items of the System Characteristics XML schema. Each item is an extention of a basic System Characteristics item defined in the default System Characteristics XML schema. The OVAL Schema is maintained by The Mitre Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org.

ComplexTypes:
	dataAuditType dataFileVersionType objectHiveType