Skip to content

Updated ntuser documentation based on implementation docs and clarified when an item should be created and added new behavior per #307 and #308 #310

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vanderpol wants to merge 5 commits into
base: 5.12.3_develop
Choose a base branch
from
Open

Updated ntuser documentation based on implementation docs and clarified when an item should be created and added new behavior per #307 and #308 #310

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5293a52
Resolved #307 Resolved #308 - Updated documentation based on implemen…
vanderpol May 8, 2026
078c27b
Updated #307 and #308, removed mandate for item creation, added new b…
vanderpol May 13, 2026
734c23e
Removed accidental commit related to issue #306
vanderpol May 13, 2026
63fce36
Added MS documentation on HKEY_USERS
vanderpol May 13, 2026
84f08b1
Added note on other API usage, to ensure the suggestion of HKEY_USERS…
vanderpol May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion oval-schemas/windows-definitions-schema.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3931,6 +3931,8 @@
<xsd:documentation>The ntuser test is used to check metadata associated with Windows ntuser.dat files. It extends the standard TestType as defined in the oval-definitions-schema and
one should refer to the TestType description for more information. The required object element references a ntuser_object and the optional state element specifies the ntuser
data to check.</xsd:documentation>

<xsd:documentation>To ensure consistent results across OVAL interpreters, application developers should refer to documentation in the ntuser_item when implenting this test.</xsd:documentation>
<xsd:appinfo>
<oval:element_mapping>
<oval:test>ntuser_test</oval:test>
Expand Down Expand Up @@ -4062,16 +4064,21 @@
<xsd:element name="logged_on" type="oval-def:EntityStateBoolType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>The logged_on element describes if the user account is currently logged on to the computer.</xsd:documentation>
<xsd:documentation>This can be determined by comparing the SIDs collected from the ProfileList against those populated in HKEY_USERS\&lt;SID&gt;</xsd:documentation>
<xsd:documentation>HKEY_USERS: Contains all the actively loaded user profiles on the computer. https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users</xsd:documentation>
<xsd:documentation>This data can also be obtained by other various Windows API's such as a combination of win32_logonsession and win32_loggedonuser, but the specifics are beyond the scope of OVAL documentation.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="days_since_last_logon" type="oval-def:EntityStateIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The last_logon data, converted to days and then rounded down to the nearest integer (floor function). If the account is determined to be currently logged in, this date should be reported as 0.</xsd:documentation>
<xsd:documentation>The last_logon data which can be obtained from the LocalProfileLoadTimeHigh and LocalProfileLoadTimeLow registry values from HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\&lt;SID&gt;, converted to days and then rounded down to the nearest integer (floor function). If the account is determined to be currently logged in, this date should be reported as 0.</xsd:documentation>
<xsd:documentation>For more information, refer to https://learn.microsoft.com/en-us/troubleshoot/windows-server/support-tools/scripts-to-retrieve-profile-age</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="enabled" type="oval-def:EntityStateBoolType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>The enabled element describes if the user account is enabled or disabled.</xsd:documentation>
<xsd:documentation>Note: For domain users, if a domain controller is not available, this will not return data, and should be reported with a status of 'not collected'. If using this data for a filter to include enabled accounts, it’s recommended to exclude accounts that are have been determined to be disabled, vs including ones that are enabled, as the later may filter out accounts for which the domain controller could not return data.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="date_modified" type="oval-def:EntityStateIntType" minOccurs="0">
Expand Down Expand Up @@ -4184,6 +4191,20 @@
</xsd:restriction>
</xsd:simpleType>
</xsd:attribute>
<xsd:attribute name="item_creation" use="optional" default="key_and_name_exist">
<xsd:annotation>
<xsd:documentation>For 'key_and_name_exist', items are only created when an ntuser.dat file includes the key and name provided in the ntuser object.</xsd:documentation>
<xsd:documentation>For 'every_ntuser', items are created for each relavent ntuser.dat found on the system. This option will prevent false negatives in instances where each ntuser.dat file must contain the required key/name/value in order to pass, but the file is lacking the key/name required to normally satisfy the creation of an ntuser item.</xsd:documentation>
<xsd:documentation></xsd:documentation>
</xsd:annotation>
<xsd:simpleType>
<xsd:restriction base="xsd:string">
<xsd:enumeration value="key_and_name_exist"/>
<xsd:enumeration value="every_ntuser"/>
</xsd:restriction>
</xsd:simpleType>
</xsd:attribute>

</xsd:complexType>
<!-- =============================================================================== -->
<!-- =========================== PASSWORD POLICY TEST ============================ -->
Expand Down
30 changes: 25 additions & 5 deletions oval-schemas/windows-system-characteristics-schema.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1629,6 +1629,20 @@
<xsd:element name="ntuser_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The windows ntuser_item specifies information that can be collected from a particular ntuser.dat file.</xsd:documentation>
<xsd:documentation>To ensure consistent results across OVAL interpreters, the following implementation methods are recommended. Note that there may be other technical ways to obtain the data, which vendors may choose to implement.</xsd:documentation>
<xsd:documentation>1. Finding Human User Profiles </xsd:documentation>
<xsd:documentation> a. Obtain a list of User Profiles from the following registry key, where each subkey is a profile that may be included in scope for this test</xsd:documentation>
<xsd:documentation> i. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList</xsd:documentation>
<xsd:documentation> b. Determine which user profiles are from ‘human’ users</xsd:documentation>
<xsd:documentation> i. Exclude profiles for LocalService, Network service etc.. by excluding subkeys in the format of S-1-5-&lt;number*gt;</xsd:documentation>
<xsd:documentation> ii. Exclude profiles for Per-Service SIDs by excluding subkeys in the format of S-1-5-80-&lt;number*gt;-&lt;number*gt;-&lt;number*gt;-&lt;number*gt;-&lt;number*gt;</xsd:documentation>
<xsd:documentation> iii. Include Local and Domain User SIDs by including subkeys match the format of S-1-5-21-&lt;number*gt;-&lt;number*gt;-&lt;number*gt;-&lt;number*gt;</xsd:documentation>
<xsd:documentation> c. Obtain ntuser filepath from the ProfileImagePath value of 'human' profiles</xsd:documentation>
<xsd:documentation>2. Gathering per user registry key data</xsd:documentation>
<xsd:documentation> a. If a user is logged in, their ntuser.dat file will be locked and the OVAL interpreter will not be able to read it, the OVAL interpreter will need to obtain that data from HKEY_USERS\&lt;sid_of_logged_in_user&gt;</xsd:documentation>
<xsd:documentation> b. If a user is not logged in, the OVAL interpreter will need to obtain the data directly from the users ntuser.dat file.</xsd:documentation>
<xsd:documentation> Note: There are many different methods depenending on programming language to parse ntuser.dat files, and each OVAL interpreter may choose their own methods.</xsd:documentation>
<xsd:documentation> If no other programming language native methods are available, it is advised not to load the ntuser.dat file directly from its original location, as it will lock the file and prevent that user from logging into Windows.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
Expand Down Expand Up @@ -1666,16 +1680,21 @@
<xsd:element name="logged_on" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The logged_on element describes if the user account is currently logged on to the computer.</xsd:documentation>
</xsd:annotation>
<xsd:documentation>This can be determined by comparing the SIDs collected from the ProfileList against those populated in HKEY_USERS\&lt;SID&gt;</xsd:documentation>
<xsd:documentation>HKEY_USERS: Contains all the actively loaded user profiles on the computer. https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users</xsd:documentation>
<xsd:documentation>This data can also be obtained by other various Windows API's such as a combination of win32_logonsession and win32_loggedonuser, but the specifics are beyond the scope of OVAL documentation.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="days_since_last_logon" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The last_logon data, converted to days and then rounded down to the nearest integer (floor function). If the account is determined to be currently logged in, this date should be reported as 0.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:annotation>
<xsd:documentation>The last_logon data which can be obtained from the LocalProfileLoadTimeHigh and LocalProfileLoadTimeLow registry values from HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\&lt;SID&gt;, converted to days and then rounded down to the nearest integer (floor function). If the account is determined to be currently logged in, this date should be reported as 0.</xsd:documentation>
<xsd:documentation>For more information, refer to https://learn.microsoft.com/en-us/troubleshoot/windows-server/support-tools/scripts-to-retrieve-profile-age</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="enabled" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The enabled element describes if the user account is enabled or disabled.</xsd:documentation>
<xsd:documentation>Note: For domain users, if a domain controller is not available, this will not return data, and should be reported with a status of 'not collected'. If using this data for a filter to include enabled accounts, it’s recommended to exclude accounts that are have been determined to be disabled, vs including ones that are enabled, as the later may filter out accounts for which the domain controller could not return data.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="date_modified" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
Expand All @@ -1692,6 +1711,7 @@
<xsd:element name="filepath" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element describes the filepath of the ntuser.dat file.</xsd:documentation>
<xsd:documentation>The existance of each ntuser.dat file determines the overall ntuser_item existence.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="last_write_time" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
Expand Down