Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Tree: 7a8d27031b
Fetching contributors…

Cannot retrieve contributors at this time

4292 lines (4289 sloc) 369.041 kB
<?xml version="1.0" encoding="utf-8"?>
<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:oval-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:win-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns:sch="http://purl.oclc.org/dsdl/schematron" targetNamespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" elementFormDefault="qualified" version="5.10.1">
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" schemaLocation="oval-system-characteristics-schema.xsd"/>
<xsd:annotation>
<xsd:documentation>The following is a description of the elements, types, and attributes that compose the Windows specific system characteristic items found in Open Vulnerability and Assessment Language (OVAL). Each item is an extension of the standard item element defined in the Core System Characteristic Schema. Through extension, each item inherits a set of elements and attributes that are shared amongst all OVAL Items. Each item is described in detail and should provide the information necessary to understand what each element and attribute represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between the different tests and their relationship to the Core System Characteristic Schema is not outlined here.</xsd:documentation>
<xsd:documentation>The OVAL Schema is maintained by The MITRE Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org.</xsd:documentation>
<xsd:appinfo>
<schema>Windows System Characteristics</schema>
<version>5.10.1</version>
<date>1/27/2012 1:22:32 PM</date>
<terms_of_use>Copyright (c) 2002-2012, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the OVAL License located at http://oval.mitre.org/oval/about/termsofuse.html. See the OVAL License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the OVAL Schema, this license header must be included.</terms_of_use>
<sch:ns prefix="oval-sc" uri="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5"/>
<sch:ns prefix="win-sc" uri="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows"/>
<sch:ns prefix="xsi" uri="http://www.w3.org/2001/XMLSchema-instance"/>
</xsd:appinfo>
</xsd:annotation>
<!-- =============================================================================== -->
<!-- ============================= ACCESS TOKEN ITEM ============================= -->
<!-- =============================================================================== -->
<xsd:element name="accesstoken_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The access token item holds information about the individual privileges and rights associated with a specific access token. It is important to note that these privileges are specific to certain versions of Windows. As a result, the documentation for that version of Windows should be consulted for more information. Each privilege and right in the data section accepts a boolean value signifying whether the privilege is granted or not. It extends the standard ItemType as defined in the oval-system-characteristics schema and one should refer to the ItemType description for more information.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="security_principle" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Security principles include users or groups with either local or domain accounts, and computer accounts created when a computer joins a domain. In Windows, security principles are case-insensitive. As a result, it is recommended that the case-insensitive operations are used for this entity. User rights and permissions to access objects such as Active Directory objects, files, and registry settings are assigned to security principles. In a domain environment, security principles should be identified in the form: "domain\trustee name". For local security principles use: "computer name\trustee name". For built-in accounts on the system, use the trustee name without a domain.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seassignprimarytokenprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a parent process to replace the access token that is associated with a child process.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seauditprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a process to generate audit records in the security log. The security log can be used to trace unauthorized system access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sebackupprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to circumvent file and directory permissions to back up the system. The privilege is selected only when an application attempts access by using the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sechangenotifyprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to pass through folders to which the user otherwise has no access while navigating an object path in the NTFS file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="secreateglobalprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to create named file mapping objects in the global namespace during Terminal Services sessions.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="secreatepagefileprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to create and change the size of a pagefile.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="secreatepermanentprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a process to create a directory object in the object manager. It is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode have this privilege inherently.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="secreatesymboliclinkprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user create a symbolic link.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="secreatetokenprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a process to create an access token by calling NtCreateToken() or other token-creating APIs.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sedebugprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to attach a debugger to any process. It provides access to sensitive and critical operating system components.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seenabledelegationprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to change the Trusted for Delegation setting on a user or computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seimpersonateprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to impersonate a client after authentication.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seincreasebasepriorityprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to increase the base priority class of a process.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seincreasequotaprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a process that has access to a second process to increase the processor quota assigned to the second process.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seincreaseworkingsetprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to increase a process working set.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seloaddriverprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to install and remove drivers for Plug and Play devices.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="selockmemoryprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="semachineaccountprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to add a computer to a specific domain.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="semanagevolumeprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a non-administrative or remote user to manage volumes or disks.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seprofilesingleprocessprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to sample the performance of an application process.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="serelabelprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to modify an object label.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seremoteshutdownprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to shut down a computer from a remote location on the network.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="serestoreprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principle as the owner of an object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sesecurityprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. A user who has this privilege can also view and clear the security log from Event Viewer.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seshutdownprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to shut down the local computer.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sesyncagentprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a process to read all objects and properties in the directory, regardless of the protection on the objects and properties. It is required in order to use Lightweight Directory Access Protocol (LDAP) directory synchronization (Dirsync) services.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sesystemenvironmentprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows modification of system environment variables either by a process through an API or by a user through System Properties.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sesystemprofileprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to sample the performance of system processes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sesystemtimeprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to adjust the time on the computer's internal clock. It is not required to change the time zone or other display characteristics of the system time.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="setakeownershipprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to take ownership of any securable object in the system, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="setcbprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="setimezoneprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows a user to change the time zone.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seundockprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seunsolicitedinputprivilege" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If this privilege is enabled, it allows the user to read unsolicited data from a terminal device.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sebatchlogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it can log on using the batch logon type.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seinteractivelogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it can log on using the interactive logon type.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="senetworklogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it can log on using the network logon type.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seremoteinteractivelogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it can log on to the computer by using a Remote Desktop connection.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="seservicelogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it can log on using the service logon type.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sedenybatchLogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on using the batch logon type.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sedenyinteractivelogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on using the interactive logon type.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sedenynetworklogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on using the network logon type.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sedenyremoteInteractivelogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on through Terminal Services.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sedenyservicelogonright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it is explicitly denied the ability to log on using the service logon type.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="setrustedcredmanaccessnameright" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>If an account is assigned this right, it can access the Credential Manager as a trusted caller.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ======================== ACTIVE DIRECTORY ITEM ============================== -->
<!-- =============================================================================== -->
<xsd:element name="activedirectory_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The active directory item holds information about specific entries in the Windows Active Directory. It extends the standard ItemType as defined in the oval-system-characteristics schema and one should refer to the ItemType description for more information.</xsd:documentation>
<xsd:documentation>Note that this ite supports only simple (string based) value collection. For more complex values see the activedirectory57_item.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="naming_context" type="win-sc:EntityItemNamingContextType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="relative_dn" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the objects distinguished name except those outlined by the naming context. If the xsi:nil attribute is set to true, then the item being represented is the higher level naming context.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="attribute" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>Specifies a named value contained by the object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="object_class" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The name of the class of which the object is an instance.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="adstype" type="win-sc:EntityItemAdstypeType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the type of information that the specified attribute represents.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="value" type="oval-sc:EntityItemAnySimpleType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>The actual value of the specified active directory attribute.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ======================== ACTIVE DIRECTORY ITEM (57) ========================= -->
<!-- =============================================================================== -->
<xsd:element name="activedirectory57_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The activedirectory57_item holds information about specific entries in the Windows Active Directory. It extends the standard ItemType as defined in the oval-system-characteristics schema and one should refer to the ItemType description for more information.</xsd:documentation>
<xsd:documentation>Note that this item supports complex values that are in the form of a record. For simple (string based) value collection see the activedirectory_item.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="naming_context" type="win-sc:EntityItemNamingContextType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Each object in active directory exists under a certain naming context (also known as a partition). A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. There are three default naming contexts in Active Directory: domain, configuration, and schema.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="relative_dn" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>The relative_dn field is used to uniquely identify an object inside the specified naming context. It contains all the parts of the objects distinguished name except those outlined by the naming context. If the xsi:nil attribute is set to true, then the item being represented is the higher level naming context.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="attribute" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>Specifies a named value contained by the object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="object_class" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The name of the class of which the object is an instance.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="adstype" type="win-sc:EntityItemAdstypeType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the type of information that the specified attribute represents.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="value" type="oval-sc:EntityItemRecordType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>The actual value of the specified Active Directory attribute. Note that while an Active Directory attribute can contain structured data where it is necessary to collect multiple related fields that can be described by the 'record' datatype, it is not always the case. It also is possible that an Active Directory attribute can contain only a single value or an array of values. In these cases, there is not a name to uniquely identify the corresponding field(s) which is a requirement for fields in the 'record' datatype. As a result, the name of the Active Directory attribute will be used to uniquely identify the field(s) and satisfy this requirement. If the Active Directory attribute contains a single value, the 'record' will have a single field identified by the name of the Active Directory attribute. If the Active Directory attribute contains an array of values, the 'record' will have multiple fields all identified by the name of the Active Directory attribute</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="win-sc_activedirectory57_itemvalue">
<sch:rule context="win-sc:activedirectory57_item/win-sc:value">
<sch:assert test="@datatype='record'"><sch:value-of select="../@id"/> - datatype attribute for the value entity of a activedirectory57_item must be 'record'</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ======================= AUDIT EVENT POLICY ITEM ============================= -->
<!-- =============================================================================== -->
<xsd:element name="auditeventpolicy_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The auditeventpolicy item enumerates the different types of events the system should audit. The defined values are found in window's POLICY_AUDIT_EVENT_TYPE enumeration and accessed through the LsaQueryInformationPolicy when the InformationClass parameters are set to PolicyAuditEventsInformation. It extends the standard ItemType as defined in the oval-system-characteristics schema and one should refer to the ItemType description for more information.</xsd:documentation>
<xsd:documentation>Note that when audinting is disabled each of the entities listed below should be set to 'AUDIT_NONE'.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="account_logon" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="account_management" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit attempts to create, delete, or change user or group accounts. Also, audit password changes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="detailed_tracking" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit specific events, such as program activation, some forms of handle duplication, indirect access to an object, and process exit. </xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="directory_service_access" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit attempts to access the directory service.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="logon" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit attempts to log on to or log off of the system. Also, audit attempts to make a network connection.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="object_access" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit attempts to access securable objects, such as files.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="policy_change" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit attempts to change Policy object rules. </xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="privilege_use" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit attempts to use privileges.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="system" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit attempts to shut down or restart the computer. Also, audit events that affect system security or the security log.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- =================== AUDIT EVENT POLICY SUBCATEGORIES ITEM =================== -->
<!-- =============================================================================== -->
<xsd:element name="auditeventpolicysubcategories_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The auditeventpolicysubcategories_item is used to hold information about the audit event policy settings on a Windows system. These settings are used to specify which system and network events are monitored. For example, if the credential_validation element has a value of AUDIT_FAILURE, it means that the system is configured to log all unsuccessful attempts to validate a user account on a system. It is important to note that these audit event policy settings are specific to certain versions of Windows. As a result, the documentation for that version of Windows should be consulted for more information on each setting. It extends the standard ItemType as defined in the oval-system-characteristics schema and one should refer to the ItemType description for more information.</xsd:documentation>
<xsd:documentation>Note that when audinting is disabled each of the entities listed below should be set to 'AUDIT_NONE'.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<!-- Account Logon Audit Policy Subcategories -->
<xsd:element name="credential_validation" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced during the validation of a user's logon credentials.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="kerberos_authentication_service" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by Kerberos authentication ticket-granting requests.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="kerberos_service_ticket_operations" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by Kerberos service ticket requests.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="kerberos_ticket_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced during the validation of Kerberos tickets provided for a user account logon request.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="other_account_logon_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to user accounts that are not covered by other events in the Account Logon category.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<!-- Account Management Audit Policy Subcategories -->
<xsd:element name="application_group_management" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to application groups.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="computer_account_management" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to computer accounts.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="distribution_group_management" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to distribution groups.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="other_account_management_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by other user account changes that are not covered by other events in the Account Management category.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="security_group_management" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to security groups.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="user_account_management" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to user accounts.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<!-- Detailed Tracking Audit Policy Subcategories -->
<xsd:element name="dpapi_activity" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced when requests are made to the Data Protection application interface.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="process_creation" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced when a process is created or starts.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="process_termination" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced when a process ends.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="rpc_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by inbound remote procedure call connections.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<!-- DS Access Audit Policy Subcategories -->
<xsd:element name="directory_service_access" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced when a Active Directory Domain Services object is accessed.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="directory_service_changes" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced when changes are made to Active Directory Domain Services objects.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="directory_service_replication" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced when two Active Directory Domain Services domain controllers are replicated.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="detailed_directory_service_replication" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by detailed Active Directory Domain Services replication between domain controllers.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<!-- Logon/Logoff Audit Policy Subcategories -->
<xsd:element name="account_lockout" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by a failed attempt to log onto a locked out account.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="ipsec_extended_mode" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by Internet Key Exchange and Authenticated Internet protocol during Extended Mode negotiations.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="ipsec_main_mode" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by Internet Key Exchange and Authenticated Internet protocol during Main Mode negotiations.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="ipsec_quick_mode" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by Internet Key Exchange and Authenticated Internet protocol during Quick Mode negotiations.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="logoff" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by closing a logon session.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="logon" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by attempts to log onto a user account.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="network_policy_server" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by RADIUS and Network Access Protection user access requests.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="other_logon_logoff_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by other logon/logoff based events that are not covered in the Logon/Logoff category.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="special_logon" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by special logons.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<!-- Object Access Audit Policy Subcategories -->
<xsd:element name="application_generated" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by applications that use the Windows Auditing API.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="certification_services" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by operations on Active Directory Certificate Services.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="detailed_file_share" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by attempts to access files and folders on a shared folder.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_share" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by attempts to access a shared folder.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_system" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced user attempts to access file system objects.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="filtering_platform_connection" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by connections that are allowed or blocked by Windows Filtering Platform.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="filtering_platform_packet_drop" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by packets that are dropped by Windows Filtering Platform.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="handle_manipulation" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced when a handle is opened or closed.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="kernel_object" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by attempts to access the system kernel.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="other_object_access_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by the management of Task Scheduler jobs or COM+ objects.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="registry" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by attempts to access registry objects.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sam" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by attempts to access Security Accounts Manager objects.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<!-- Policy Change Audit Policy Subcategories -->
<xsd:element name="audit_policy_change" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes in security audit policy settings.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="authentication_policy_change" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to the authentication policy.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="authorization_policy_change" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to the authorization policy.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="filtering_platform_policy_change" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to the Windows Filtering Platform.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="mpssvc_rule_level_policy_change" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes to policy rules used by the Windows Firewall.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="other_policy_change_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by other security policy changes that are not covered other events in the Policy Change category.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<!-- Privilege Use Audit Policy Subcategories -->
<xsd:element name="non_sensitive_privilege_use" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by the use of non-sensitive privileges.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="other_privilege_use_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This is currently not used and has been reserved by Microsoft for use in the future.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="sensitive_privilege_use" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by the use of sensitive privileges.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<!-- System Audit Policy Subcategories -->
<xsd:element name="ipsec_driver" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by the IPsec filter driver.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="other_system_events" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by the startup and shutdown, security policy processing, and cryptography key file and migration operations of the Windows Firewall.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="security_state_change" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by changes in the security state.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="security_system_extension" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events produced by the security system extensions or services.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="system_integrity" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Audit the events that indicate that the integrity security subsystem has been violated.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- =============================== CMDLET ITEM ================================ -->
<!-- =============================================================================== -->
<xsd:element name="cmdlet_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The cmdlet_item represents a PowerShell cmdlet, the parameters supplied to it, and the value it returned.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="module_name" type="oval-sc:EntityItemStringType" nillable="true" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The name of the module that contains the cmdlet.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="module_id" type="win-sc:EntityItemGUIDType" nillable="true" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The globally unique identifier for the module.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="module_version" type="oval-sc:EntityItemVersionType" nillable="true" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The version of the module that contains the cmdlet in the form of MAJOR.MINOR.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="verb" type="win-sc:EntityItemCmdletVerbType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The cmdlet verb.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="noun" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The cmdlet noun.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="parameters" type="oval-sc:EntityItemRecordType" nillable="true" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>A list of properties (name and value pairs) as input to invoke the cmdlet.</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="win-sc_cmdletitemparameters">
<sch:rule context="win-sc:cmdlet_item/win-sc:parameters">
<sch:assert test="@datatype='record'"><sch:value-of select="../@id"/> - datatype attribute for the parameters entity of a cmdlet_item must be 'record'</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="select" type="oval-sc:EntityItemRecordType" nillable="true" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>A list of fields (name and value pairs) used as input to the Select-Object cmdlet to select specific output properties.</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="win-sc_cmdletitemselect">
<sch:rule context="win-sc:cmdlet_item/win-sc:select">
<sch:assert test="@datatype='record'"><sch:value-of select="../@id"/> - datatype attribute for the select entity of a cmdlet_item must be 'record'</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="value" type="oval-sc:EntityItemRecordType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>The expected value represented as a set of fields (name and value pairs).</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="win-sc_cmdletitemvalue">
<sch:rule context="win-sc:cmdlet_item/win-sc:value">
<sch:assert test="@datatype='record'"><sch:value-of select="../@id"/> - datatype attribute for the value entity of a cmdlet_item must be 'record'</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================= DNS CACHE ITEM ================================ -->
<!-- =============================================================================== -->
<xsd:element name="dnscache_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The dnscache_item stores information retrieved from the DNS cache about a domain name, its time to live, and its corresponding IP addresses.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="domain_name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The domain_name element contains a string that represents a domain name that was collected from the DNS cache on the local system.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="ttl" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The ttl element contains an integer that represents the time to live in seconds of the DNS cache entry.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="ip_address" type="oval-sc:EntityItemIPAddressStringType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>The ip_address element contains a string that represents an IP address associated with the specified domain name. Note that the IP address can be IPv4 or IPv6.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================== FILE ITEM ==================================== -->
<!-- =============================================================================== -->
<xsd:element name="file_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>This element describes file metadata. The time information can be retrieved by the _stst function. Development_class and other version information (company, internal name, language, original_filename, product_name, product_version) can be retrieved using the VerQueryValue function.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="filepath" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The filepath element specifies the absolute path for a file on the machine. A directory cannot be specified as a filepath.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="path" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the directory component of the absolute path to a file on the machine.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="filename" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>The name of the file. If the xsi:nil attribute is set to true, then the item being represented is the higher directory represented by the path entity. The other items associated with this item would then reflect the values associated with the directory.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="owner" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>A string that contains the name of the owner. The name should be specified in the DOMAIN\username format.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Size of the file in bytes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="a_time" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Time of last access of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="c_time" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Time of creation of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="m_time" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Time of last modification of file. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="ms_checksum" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The checksum of the file as supplied by Microsoft's MapFileAndCheckSum function.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="version" type="oval-sc:EntityItemVersionType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The version of the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="type" type="win-sc:EntityItemFileTypeType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The type child element marks wether the file item describes a directory, named pipe, standard file, etc. These types are the return values for GetFileType, with the exception of FILE_ATTRIBUTE_DIRECTORY which is obtained by looking at GetFileAttributesEx.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="development_class" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The development_class element allows the distinction to be made between the GDR development environment and the QFE development environment. This field holds the text found in front of the mmmmmm-nnnn version, for example srv03_gdr.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="company" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This entity defines the company name held within the version-information structure.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="internal_name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This entity defines the internal name held within the version-information structure.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="language" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This entity defines the language held within the version-information structure.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="original_filename" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This entity defines the original filename held within the version-information structure.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="product_name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This entity defines the product name held within the version-information structure.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="product_version" type="oval-sc:EntityItemVersionType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This entity defines the product version held within the version-information structure.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="windows_view" type="win-sc:EntityItemWindowsViewType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>The windows view value from which this OVAL Item was collected. This is used to indicate from which view (32-bit or 64-bit), the associated Item was collected. A value of '32_bit' indicates the Item was collected from the 32-bit view. A value of '64-bit' indicates the Item was collected from the 64-bit view. Omitting this entity removes any assertion about which view the Item was collected from, and therefore it is strongly suggested that this entity be set.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ======================= FILE AUDITED PERMISSIONS ITEM ======================= -->
<!-- =============================================================================== -->
<xsd:element name="fileauditedpermissions_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>This item stores the audited access rights of a file that a system access control list (SACL) structure grants to a specified trustee. The trustee's audited access rights are determined checking all access control entries (ACEs) in the SACL. For help with this test see the GetAuditedPermissionsFromAcl() api.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="filepath" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the absolute path to a file on the machine from which the DACL was retrieved. A directory cannot be specified as a filepath.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="path" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the directory component of the absolute path to a file on the machine from which the DACL was retrieved.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="filename" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>The name of the file. If the xsi:nil attribute is set to true, then the item being represented is the higher directory represented by the path entity. The other items associated with this item would then reflect the values associated with the directory.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="trustee_sid" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The trustee_sid entity specifies the SID that associated a user, group, system, or program (such as a Windows service).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="trustee_name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the trustee name associated with this particular SACL. A trustee can be a user, group, or program (such as a Windows service). In Windows, trustee names are case-insensitive. As a result, it is recommended that the case-insensitive operations are used for this entity. In a domain environment, trustee names should be identified in the form: "domain\trustee name". For local trustee names use: "computer name\trustee name". For built-in accounts on the system, use the trustee name without a domain.</xsd:documentation>
<xsd:appinfo>
<oval:deprecated_info>
<oval:version>5.3</oval:version>
<oval:reason>Replaced by the trustee_sid entity. This entity uses trustee names for identifying trustees. Trustee names are not unique, and a new entity was created to use trustee SIDs, which are unique. See the trustee_sid.</oval:reason>
<oval:comment>This entity has been deprecated and will be removed in version 6.0 of the language.</oval:comment>
</oval:deprecated_info>
<sch:pattern id="win-sc_fileaudititemtrustee_name">
<sch:rule context="win-sc:fileauditedpermissions_item/win-sc:trustee_name">
<sch:report test="true()">DEPRECATED ELEMENT: <sch:value-of select="name()"/> ID: <sch:value-of select="@id"/></sch:report>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_delete" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to delete the object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_read_control" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to read the information in the object's security descriptor, not including the information in the SACL.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_write_dac" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to modify the DACL in the object's security descriptor.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_write_owner" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to change the owner in the object's security descriptor.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_synchronize" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="access_system_security" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Indicates access to a system access control list (SACL).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_read" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Read access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_write" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Write access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_execute" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Execute access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_all" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Read, write, and execute access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_read_data" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to read data from the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_write_data" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to write data to the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_append_data" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to append data to the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_read_ea" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to read extended attributes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_write_ea" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to write extended attributes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_execute" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to execute a file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_delete_child" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Right to delete a directory and all the files it contains (its children), even if the files are read-only.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_read_attributes" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to read file attributes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_write_attributes" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to change file attributes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="windows_view" type="win-sc:EntityItemWindowsViewType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>The windows view value from which this OVAL Item was collected. This is used to indicate from which view (32-bit or 64-bit), the associated Item was collected. A value of '32_bit' indicates the Item was collected from the 32-bit view. A value of '64-bit' indicates the Item was collected from the 64-bit view. Omitting this entity removes any assertion about which view the Item was collected from, and therefore it is strongly suggested that this entity be set.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ======================== FILE EFFECTIVE RIGHTS ITEM ========================= -->
<!-- =============================================================================== -->
<xsd:element name="fileeffectiverights_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>This item stores the effective rights of a file that a discretionary access control list (DACL) structure grants to a specified trustee. The trustee's effective rights are determined checking all access-allowed and access-denied access control entries (ACEs) in the DACL. For help with this test see the GetEffectiveRightsFromAcl() api.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="filepath" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the absolute path to a file on the machine from which the DACL was retrieved. A directory cannot be specified as a filepath.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="path" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the absolute path to a file on the machine from which the DACL was retrieved.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="filename" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>The name of the file. If the xsi:nil attribute is set to true, then the item being represented is the higher directory represented by the path entity. The other items associated with this item would then reflect the values associated with the directory.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="trustee_sid" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The trustee_sid entity specifies the SID that associated a user, group, system, or program (such as a Windows service).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="trustee_name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the trustee name associated with this particular DACL. A trustee can be a user, group, or program (such as a Windows service). In Windows, trustee names are case-insensitive. As a result, it is recommended that the case-insensitive operations are used for this entity. In a domain environment, trustee names should be identified in the form: "domain\trustee name". For local trustee names use: "computer name\trustee name". For built-in accounts on the system, use the trustee name without a domain.</xsd:documentation>
<xsd:appinfo>
<oval:deprecated_info>
<oval:version>5.3</oval:version>
<oval:reason>Replaced by the trustee_sid entity. This entity uses trustee names for identifying trustees. Trustee names are not unique, and a new entity was created to use trustee SIDs, which are unique. See the trustee_sid.</oval:reason>
<oval:comment>This entity has been deprecated and will be removed in version 6.0 of the language.</oval:comment>
</oval:deprecated_info>
<sch:pattern id="win-sc_feritemtrustee_name">
<sch:rule context="win-sc:fileeffectiverights_item/win-sc:trustee_name">
<sch:report test="true()">DEPRECATED ELEMENT: <sch:value-of select="name()"/> ID: <sch:value-of select="@id"/></sch:report>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_delete" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to delete the object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_read_control" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to read the information in the object's security descriptor, not including the information in the SACL.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_write_dac" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to modify the DACL in the object's security descriptor.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_write_owner" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to change the owner in the object's security descriptor.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_synchronize" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="access_system_security" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Indicates access to a system access control list (SACL).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_read" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Read access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_write" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Write access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_execute" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Execute access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_all" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Read, write, and execute access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_read_data" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to read data from the file</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_write_data" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to write data to the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_append_data" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to append data to the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_read_ea" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to read extended attributes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_write_ea" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to write extended attributes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_execute" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to execute a file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_delete_child" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Right to delete a directory and all the files it contains (its children), even if the files are read-only.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_read_attributes" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to read file attributes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_write_attributes" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Grants the right to change file attributes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="windows_view" type="win-sc:EntityItemWindowsViewType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>The windows view value from which this OVAL Item was collected. This is used to indicate from which view (32-bit or 64-bit), the associated Item was collected. A value of '32_bit' indicates the Item was collected from the 32-bit view. A value of '64-bit' indicates the Item was collected from the 64-bit view. Omitting this entity removes any assertion about which view the Item was collected from, and therefore it is strongly suggested that this entity be set.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================== GROUP ITEM ================================== -->
<!-- =============================================================================== -->
<xsd:element name="group_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The Windows group_item allows the different users and subgroups, that directly belong to specific groups (identified by name), to be collected. The collected subgroups will not be resolved to find indirect user or subgroup members. If the subgroups need to be resolved, it should be done using the sid_object. Note that the user and subgroup elements can appear an unlimited number of times. If a user is not found in the specified group, a single user element should exist with a status of 'does not exist'. If there is an error determining the users of a group, a single user element should exist with a status of 'error'. If a subgroup is not found in the specified group, a single subgroup element should exist with a status of 'does not exist'. If there is an error determining the subgroups of a group, a single subgroup element should exist with a status of 'error'.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="group" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>A string the represents the name of a particular group. In Windows, group names are case-insensitive. As a result, it is recommended that the case-insensitive operations are used for this entity. In a domain environment, groups should be identified in the form: "domain\group name". For local groups use: "computer name\group name". For built-in accounts on the system, use the group name without a domain.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="user" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>A string that represents the name of a particular user. In Windows, user names are case-insensitive. As a result, it is recommended that the case-insensitive operations are used for this entity. In a domain environment, users should be identified in the form: "domain\user name". For local users use: "computer name\user name". For built-in accounts on the system, use the user name without a domain.</xsd:documentation>
<xsd:documentation>If the specified group has more than one user as a member, then multiple user elements should exist. If the specified group does not contain a single user, then a single user element should exist with a status of 'does not exist'. If there is an error determining the users that are members of the group, then a single user element should be included with a status of 'error'.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="subgroup" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>A string that represents the name of a particular subgroup in the specified group. In Windows, group names are case-insensitive. As a result, it is recommended that the case-insensitive operations are used for this entity. In a domain environment, the subgroups should be identified in the form: "domain\group name". In a local environment, the subgroups should be identified in the form: "computer name\group name". If the subgroups are built-in groups, the subgroups should be identified in the form: "group name" without a domain component.</xsd:documentation>
<xsd:documentation>If the specified group has more than one subgroup as a member, then multiple subgroup elements should exist. If the specified group does not contain a single subgroup, then a single subgroup element should exist with a status of 'does not exist'. If there is an error determining the subgroups that are members of the group, then a single subgroup element should be included with a status of 'error'.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================ GROUP SID ITEM ================================ -->
<!-- =============================================================================== -->
<xsd:element name="group_sid_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The Windows group_sid_item allows the different users and subgroups, that directly belong to specific groups (identified by SID), to be collected. The collected subgroups will not be resolved to find indirect user or subgroup members. If the subgroups need to be resolved, it should be done using the sid_sid_object. Note that the user and subgroup elements can appear an unlimited number of times. If a user is not found in the specified group, a single user element should exist with a status of 'does not exist'. If there is an error determining the users of a group, a single user element should exist with a status of 'error'. If a subgroup is not found in the specified group, a single subgroup element should exist with a status of 'does not exist'. If there is an error determining the subgroups of a group, a single subgroup element should exist with a status of 'error'.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="group_sid" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>A string the represents the SID of a particular group.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="user_sid" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>A string that represents the SID of a particular user. If the specified group has more than one user as a member, then multiple user_sid entities should exist. If the specified group does not contain a single user, then a single user_sid entity should exist with a status of 'does not exist'. If there is an error determining the userss that are members of the group, then a single user_sid entity should be included with a status of 'error'.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="subgroup_sid" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>A string that represents the SID of a particular subgroup. If the specified group has more than one subgroup as a member, then multiple subgroup_sid entities should exist. If the specified group does not contain a single subgroup, a single subgroup_sid entity should exist with a status of 'does not exist'. If there is an error determining the subgroups that are members of the group, then a single subgroup_sid entity should be included with a status of 'error'.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================ INTERFACE ITEM ================================= -->
<!-- =============================================================================== -->
<xsd:element name="interface_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>Enumerate various attributes about the interfaces on a system.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the name of an interface.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="index" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies index that identifies the interface.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="type" type="win-sc:EntityItemInterfaceTypeType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the type of interface which is limited to certain set of values.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="hardware_addr" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the hardware or MAC address of the physical network card. MAC addresses should be formatted according to the IEEE 802-2001 standard which states that a MAC address is a sequence of six octet values, separated by hyphens, where each octet is represented by two hexadecimal digits. Uppercase letters should also be used to represent the hexadecimal digits A through F.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="inet_addr" type="oval-sc:EntityItemIPAddressStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the IP address of the specific interface. Note that the IP address can be IPv4 or IPv6. If the IP address is an IPv6 address, this entity should be expressed as an IPv6 address prefix using CIDR notation and the netmask entity should not be collected.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="broadcast_addr" type="oval-sc:EntityItemIPAddressStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the broadcast address. A broadcast address is typically the IP address with the host portion set to either all zeros or all ones. Note that the IP address can be IPv4 or IPv6.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="netmask" type="oval-sc:EntityItemIPAddressStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the subnet mask for the IP address. Note that if the inet_addr entity contains an IPv6 address prefix, this entity should not be collected.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="addr_type" type="win-sc:EntityItemAddrTypeType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>This element specifies the address type or state of a specific interface. Each interface can be associated with more than one value meaning the addr_type element can occur multiple times.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ========================= LOCKOUT POLICY ITEM =============================== -->
<!-- =============================================================================== -->
<xsd:element name="lockoutpolicy_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The lockoutpolicy item enumerates various attributes associated with lockout information for users and global groups in the security database.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="force_logoff" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies, in seconds, the amount of time between the end of the valid logon time and the time when the user is forced to log off the network. A value of TIMEQ_FOREVER indicates that the user is never forced to log off. A value of zero indicates that the user will be forced to log off immediately when the valid logon time expires. See the USER_MODALS_INFO_0 structure returned by a call to NetUserModalsGet().</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="lockout_duration" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies, in seconds, how long a locked account remains locked before it is automatically unlocked. See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet().</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="lockout_observation_window" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the maximum time, in seconds, that can elapse between any two failed logon attempts before lockout occurs. See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet().</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="lockout_threshold" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the number of invalid password authentications that can occur before an account is marked "locked out." See the USER_MODALS_INFO_3 structure returned by a call to NetUserModalsGet().</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================ METABASE ITEM ================================== -->
<!-- =============================================================================== -->
<xsd:element name="metabase_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>This item gathers information from the specified metabase keys.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="key" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element describes a metabase key to be gathered.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="id" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>The id element specifies a particular object under the metabase key. If the xsi:nil attribute is set to true, then the item being represented is the higher level metabase key. Using xsi:nil here will result in a status of 'does not exist' for the other entities associated with this item since these entities are not associated with a key by itself.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element describes the name of the specified metabase object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="user_type" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The user_type element is a DWORD that specifies the user type of the data. See the METADATA_RECORD structure.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="data_type" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The data_type element identifies the type of data in the metabase entry. See the METADATA_RECORD structure.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="data" type="oval-sc:EntityItemAnySimpleType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>The actual data of the named item under the specified metabase key. If the specified metabase key is of type multi string, then multiple value elements should exist to describe the array of strings.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ======================== PASSWORD POLICY ITEM =============================== -->
<!-- =============================================================================== -->
<xsd:element name="passwordpolicy_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>Specific policy items associated with passwords. It is important to note that these policies are specific to certain versions of Windows. As a result, the documentation for that version of Windows should be consulted for more information. Information is stored in the SAM or Active Directory but is encrypted or hidden so the registry_item and activedirectory_item are of no use. If this can be figured out, then the password_policy item is not needed.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="max_passwd_age" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies, in seconds, the maximum allowable password age. A value of TIMEQ_FOREVER (-1) indicates that the password never expires. The minimum valid value for this element is ONE_DAY (86400).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="min_passwd_age" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the minimum number of seconds that can elapse between the time a password changes and when it can be changed again. A value of zero indicates that no delay is required between password updates.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="min_passwd_len" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the minimum allowable password length. Valid values for this element are zero through PWLEN.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="password_hist_len" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the length of password history maintained. A new password cannot match any of the previous usrmod0_password_hist_len passwords. Valid values for this element are zero through DEF_MAX_PWHIST.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="password_complexity" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>A boolean value that signifies whether passwords must meet the complexity requirements put forth by the operating system.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="reversible_encryption" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Determines whether or not passwords are stored using reversible encryption.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- =========================== PE HEADER ITEM ================================== -->
<!-- =============================================================================== -->
<xsd:element name="peheader_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The peheader_item describes the metadata associated with a PE file header. For more information, please see the documentation for the IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER structures.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="header_signature" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The header_signature entity is the signature of the header.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="target_machine_type" type="win-sc:EntityItemPeTargetMachineType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The target_machine_type entity is a WORD that specifies the target architecture that the file is intended for.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="number_of_sections" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The number_of_sections entity is a WORD that specifies the number of sections in the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="time_date_stamp" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The time_date_stamp entity is a DWORD that specifies the time that the linker produced the file. The value is represented as the number of seconds since January 1, 1970, 00:00:00.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="pointer_to_symbol_table" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The pointer_to_symbol_table entity is a DWORD that specifies the file offset of the COFF symbol table.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="number_of_symbols" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The number_of_symbols entity is a DWORD that specifies the number of symbols in the COFF symbol table.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_optional_header" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The size_of_optional_header entity is a DWORD that specifies the size of an optional header in bytes.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_relocs_stripped" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_relocs_stripped entity is a boolean value that specifies if the relocation information is stripped from the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_executable_image" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_executable_image entity is a boolean value that specifies if the file is executable.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_line_nums_stripped" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_line_nums_stripped entity is a boolean value that specifies if the line numbers are stripped from the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_local_syms_stripped" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_local_syms_stripped entity is a boolean value that specifies if the local symbols are stripped from the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_aggresive_ws_trim" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_aggressive_ws_trim entity is a boolean value that specifies that the working set should be aggressively trimmed.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_large_address_aware" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_large_address_aware entity is a boolean value that specifies that the application can handle addresses larger than 2GB.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_16bit_machine" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_16bit_machine entity is a boolean value that specifies that the computer supports 16-bit words.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_bytes_reversed_lo" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_bytes_reversed_lo entity is a boolean value that specifies that the bytes of the word are reversed.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_32bit_machine" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_32bit_machine entity is a boolean value that specifies that the computer supports 32-bit words.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_debug_stripped" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_debug_stripped entity is a boolean value that specifies that the debugging information is stored separately in a .dbg file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_removable_run_from_swap" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_removable_run_from_swap entity is a boolean value that specifies that the image is on removable media, copy and run from the swap file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_system" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_system entity is a boolean value that specifies that the image is a system file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_dll" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_dll entity is a boolean value that specifies that the image is a DLL.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_up_system_only" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_up_system_only entity is a boolean value that specifies that the file should only be run on a uniprocessor computer.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_file_bytes_reveresed_hi" type="oval-sc:EntityItemBoolType" default="false" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_file_bytes_reversed_hi entity is a boolean value that specifies that the bytes of the word are reversed.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="magic_number" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The magic_number entity is a WORD that specifies the state of the image file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="major_linker_version" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The major_linker_version entity is a BYTE that specifies the major version of the linker that produced the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="minor_linker_version" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The minor_linker_version entity is a BYTE that specifies the minor version of the linker that produced the file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_code" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The size_of_code entity is a DWORD that specifies the total size of all of the code sections.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_initialized_data" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The size_of_initialized_data entity is a DWORD that specifies the total size of all of the sections that are composed of initialized data.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_uninitialized_data" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The size_of_uninitialized_data entity is a DWORD that specifies the total size of all of the sections that are composed of uninitialized data.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="address_of_entry_point" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The address_of_entry_point entity is a DWORD that specifies the address where the loader will begin execution.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="base_of_code" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The base_of_code entity is a DWORD that specifies the relative virtual address where the file's code section begins.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="base_of_data" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The base_of_data entity is a DWORD that specifies the relative virtual address where the file's data section begins.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_base_address" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_base_address entity is a DWORD that specifies the preferred address fo the first byte of the image when it is loaded into memory.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="section_alignment" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The section_alignment entity is a DWORD that specifies the alignment of the sections loaded into memory.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="file_alignment" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The file_alignment entity is a DWORD that specifies the alignment of the raw data of sections in the image file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="major_operating_system_version" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The major_operating_system_version entity is a WORD that specifies the major version of the operating system required to use this executable.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="minor_operating_system_version" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The minor_operating_system_version entity is a WORD that specifies the minor version of the operating system required to use this executable.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="major_image_version" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The major_image_version entity is a WORD that specifies the major version number of the image.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="minor_image_version" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The minor_image_version entity is a DWORD that specifies the minor version number of the image.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="major_subsystem_version" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The major_subsystem_version entity is a WORD that specifies the major version of the subsystem required to run the executable.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="minor_susbsystem_version" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The minor_subsystem_version entity is a WORD that specifies the minor version of the subsystem required to run the executable.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_image" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The size_of_image entity is a DWORD that specifies the total size of the image including all of the headers.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_headers" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The size_of_headers entity is a DWORD that specifies the total combined size of the MS-DOS stub, PE header, and the section headers.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="checksum" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The checksum entity is a DWORD that specifies the checksum of the image file.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="subsystem" type="win-sc:EntityItemPeSubsystemType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The subsystem entity is a DWORD that specifies the type of subsystem that the executable uses for its user interface.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="dll_characteristics" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>The dll_characteristics entity is a DWORD that specifies the set of flags indicating the circumstances under which a DLL's initialization function will be called..</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_stack_reserve" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The time_date_stamp entity is a DWORD that specifies the number of bytes to reserve for the stack.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_stack_commit" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The time_date_stamp entity is a DWORD that specifies the number of bytes to commit for the stack.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_heap_reserve" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The time_date_stamp entity is a DWORD that specifies the number of bytes to reserve for the local heap.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="size_of_heap_commit" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The time_date_stamp entity is a DWORD that specifies the number of bytes to commit for the local heap.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="loader_flags" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The loader_flags entity is a DWORD that specifies the loader flags of the header.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="number_of_rva_and_sizes" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The number_of_rva_and_sizes entity is a DWORD that specifies the number of directory entries in the remainder of the optional header.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="real_number_of_directory_entries" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The real_number_of_directory_entries entity is the real number of data directory entries in the remainder of the optional header calculated by enumerating the directory entries.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================== PORT ITEM ==================================== -->
<!-- =============================================================================== -->
<xsd:element name="port_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>Information about open listening ports.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="local_address" type="oval-sc:EntityItemIPAddressStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the local IP address the listening port is bound to. Note that the IP address can be IPv4 or IPv6.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="local_port" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the number assigned to the local listening port.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="protocol" type="win-sc:EntityItemProtocolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the type of listening port. It is restricted to either TCP or UDP.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="pid" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The id given to the process that is associated with the specified listening port.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="foreign_address" type="oval-sc:EntityItemIPAddressStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This is the IP address with which the program is communicating, or with which it will communicate, in the case of a listening server. Note that the IP address can be IPv4 or IPv6.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="foreign_port" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This is the TCP or UDP port to which the program communicates.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ======================= PRINTER EFFECTIVE RIGHTS ITEM ======================= -->
<!-- =============================================================================== -->
<xsd:element name="printereffectiverights_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>This item stores the effective rights of a printer that a discretionary access control list (DACL) structure grants to a specified trustee. The trustee's effective rights are determined checking all access-allowed and access-denied access control entries (ACEs) in the DACL. For help with this test see the GetEffectiveRightsFromAcl() api.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="printer_name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The printer_name enitity specifies the name of the printer.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="trustee_sid" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The trustee_sid entity specifies the SID that associated a user, group, system, or program (such as a Windows service).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_delete" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to delete the object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_read_control" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to read the information in the object's security descriptor, not including the information in the SACL.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_write_dac" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to modify the DACL in the object's security descriptor.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_write_owner" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to change the owner in the object's security descriptor.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_synchronize" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="access_system_security" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Indicates access to a system access control list (SACL).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_read" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Read access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_write" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Write access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_execute" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Execute access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_all" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Read, write, and execute access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="printer_access_administer" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="printer_access_use" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="job_access_administer" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="job_access_read" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================ PROCESS ITEM =================================== -->
<!-- =============================================================================== -->
<xsd:element name="process_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>Information about running processes.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="command_line" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The command_line entity is the string used to start the process. This includes any parameters that are part of the command line.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="pid" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The id given to the process that is created for a specified command line.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="ppid" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The id given to the parent of the process that is created for the specified command line</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="priority" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The base priority of the process.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="image_path" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The image_path entity represents the name of the executable file for the process.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="current_dir" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The current_dir entity represents the current path to the executable file for the process.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="creation_time" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The creation_time entity represents the creation time of the process. The value of this entity represents the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). See the GetProcessTimes function lpCreationTime.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="dep_enabled" type="oval-sc:EntityItemBoolType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The dep_enabled entity represents whether or not data execution prevention (DEP) is enabled. See the GetProcessDEPPolicy function lpFlags.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="primary_window_text" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The primary_window_text entity represents the title of the primary window of the process. See the GetWindowText function.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ============================ REGISTRY ITEM ================================== -->
<!-- =============================================================================== -->
<xsd:element name="registry_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>The windows registry item specifies information that can be collected about a particular registry key.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="hive" type="win-sc:EntityItemRegistryHiveType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The hive that the registry key belongs to.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="key" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>This element describes a registry key to be gathered. Note that the hive portion of the string should not be inclueded, as this data can be found under the hive element. If the xsi:nil attribute is set to true, then the item being represented is the higher level hive. Using xsi:nil here will result in a status of 'does not exist' for the type, and value entities since these entities are not associated with a hive by itself. Note that when xsi:nil is used for the key element, the name element should also be nilled.</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="win-sc_regitemkey">
<sch:rule context="win-sc:registry_item/win-sc:key[@xsi:nil='true' or @xsi:nil='1']">
<sch:assert test="../win-sc:name/@xsi:nil='true' or ../win-sc:name/@xsi:nil='1'"><sch:value-of select="../@id"/> - name entity must be nil when key is nil</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>This element describes the name of a registry key. If the xsi:nil attribute is set to true, then the item being represented is the higher level key. Using xsi:nil here will result in a status of 'does not exist' for the type, and value entities since these entities are not associated with a key by itself.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="last_write_time" type="oval-sc:EntityItemIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The last time that the key or any of its value entries was modified. The value of this entity represents the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). Last write time can be queried on a hive, key, or name. When collecting only information about a registry hive the last write time will be the time the hive or any of its entiries was written to. When collecting only information about a registry hive and key the last write time will be the time the key or any of its entiries was written to. When collecting only information about a registry name the last write time will be the time the name was written to. See the RegQueryInfoKey function lpftLastWriteTime.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="type" type="win-sc:EntityItemRegistryTypeType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the type of data stored by the registry key. Please refer to the EntityItemRegistryTypeType for more information about the different possible types.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="value" type="oval-sc:EntityItemAnySimpleType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>The value entity holds the actual value of the specified registry key. The representation of the value as well as the associated datatype attribute depends on type of data stored in the registry key. If the specified registry key is of type REG_BINARY, then the datatype attribute should be set to 'binary' and the data represented by the value entity should follow the xsd:hexBinary form. (each binary octet is encoded as two hex digits) If the registry key is of type REG_DWORD or REG_QWORD, then the datatype attribute should be set to 'int' and the value entity should represent the data as an integer. If the specified registry key is of type REG_EXPAND_SZ, then the datatype attribute should be set to 'string' and the pre-expanded string should be represented by the value entity. If the specified registry key is of type REG_MULTI_SZ, then multiple value entities should exist to describe the array of strings, with each value element holds a single string. In the end, there should be the same number of value entities as there are strings in the reg_multi_sz array. If the specified registry key is of type REG_SZ, then the datatype should be 'string' and the value entity should be a copy of the string.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="windows_view" type="win-sc:EntityItemWindowsViewType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>The windows view value from which this OVAL Item was collected. This is used to indicate from which view (32-bit or 64-bit), the associated Item was collected. A value of '32_bit' indicates the Item was collected from the 32-bit view. A value of '64-bit' indicates the Item was collected from the 64-bit view. Omitting this entity removes any assertion about which view the Item was collected from, and therefore it is strongly suggested that this entity be set.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- =================== REGISTRY KEY AUDITED PERMISSIONS ITEM =================== -->
<!-- =============================================================================== -->
<xsd:element name="regkeyauditedpermissions_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>This item stores the audited access rights of a registry key that a system access control list (SACL) structure grants to a specified trustee. The trustee's audited access rights are determined checking all access control entries (ACEs) in the SACL. For help with this test see the GetAuditedPermissionsFromAcl() api.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="hive" type="win-sc:EntityItemRegistryHiveType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the hive of a registry key on the machine from which the SACL was retrieved.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="key" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true">
<xsd:annotation>
<xsd:documentation>This element specifies a registry key on the machine from which the SACL was retrieved. Note that the hive portion of the string should not be inclueded, as this data should be found under the hive element.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="trustee_sid" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The security identifier (SID) of the specified trustee name.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="trustee_name" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>This element specifies the trustee name associated with this particular DACL. A trustee can be a user, group, or program (such as a Windows service). In Windows, trustee names are case-insensitive. As a result, it is recommended that the case-insensitive operations are used for this entity. In a domain environment, trustee names should be identified in the form: "domain\trustee name". For local trustee names use: "computer name\trustee name". For built-in accounts on the system, use the trustee name without a domain.</xsd:documentation>
<xsd:appinfo>
<oval:deprecated_info>
<oval:version>5.3</oval:version>
<oval:reason>Replaced by the trustee_sid entity. This entity uses trustee names for identifying trustees. Trustee names are not unique, and a new entity was created to use trustee SIDs, which are unique. See the trustee_sid.</oval:reason>
<oval:comment>This entity has been deprecated and will be removed in version 6.0 of the language.</oval:comment>
</oval:deprecated_info>
<sch:pattern id="win-sc_rapitemtrustee_name">
<sch:rule context="win-sc:regkeyauditedpermissions_item/win-sc:trustee_name">
<sch:report test="true()">DEPRECATED ELEMENT: <sch:value-of select="name()"/> ID: <sch:value-of select="@id"/></sch:report>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_delete" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to delete the object.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_read_control" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to read the information in the object's security descriptor, not including the information in the SACL.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_write_dac" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to modify the DACL in the object's security descriptor.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_write_owner" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to change the owner in the object's security descriptor.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="standard_synchronize" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.</xsd:documentation>
<xsd:appinfo>
<oval:deprecated_info>
<oval:version>5.6</oval:version>
<oval:reason>This entity has been deprecated because registry keys do not support the SYNCHRONIZE standard access right.</oval:reason>
</oval:deprecated_info>
<sch:pattern id="win-sc_rapitemstandard_synchronize">
<sch:rule context="win-sc:regkeyauditedpermissions_item/win-sc:standard_synchronize">
<sch:report test="true()">DEPRECATED ELEMENT: <sch:value-of select="name()"/> ID: <sch:value-of select="@id"/></sch:report>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="access_system_security" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Indicates access to a system access control list (SACL).</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_read" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Read access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_write" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Write access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_execute" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Execute access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="generic_all" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Read, write, and execute access.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_query_value" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_set_value" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_create_sub_key" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_enumerate_sub_keys" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_notify" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_create_link" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_wow64_64key" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_wow64_32key" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="key_wow64_res" type="win-sc:EntityItemAuditType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation/>
</xsd:annotation>
</xsd:element>
<xsd:element name="windows_view" type="win-sc:EntityItemWindowsViewType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>The windows view value from which this OVAL Item was collected. This is used to indicate from which view (32-bit or 64-bit), the associated Item was collected. A value of '32_bit' indicates the Item was collected from the 32-bit view. A value of '64-bit' indicates the Item was collected from the 64-bit view. Omitting this entity removes any assertion about which view the Item was collected from, and therefore it is strongly suggested that this entity be set.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<!-- =============================================================================== -->
<!-- ==================== REGISTRY KEY EFFECTIVE RIGHTS ITEM ===================== -->
<!-- =============================================================================== -->
<xsd:element name="regkeyeffectiverights_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>This item stores the effective rights of a registry key that a discretionary access control list (DACL) structure grants to a specified trustee. The trustee's effective rights are determined checking all access-allowed and access-denied access control entries (ACEs) in the DACL. For help with this test see the GetEffectiveRightsFromAcl() api.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="hive" type="win-sc:EntityItemRegistryHiveType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The hive that the registry key belongs to.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="key" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1" nillable="true" >
<xsd:annotation>
<xsd:documentation>This element describes a registry key to be gathered. Note that the hive portion of the string should not be inclueded, as this data can be found under the hive element. If the xsi:nil attribute is set to true, then the item being represented is the higher level hive.</xsd:documentat