<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 http://oval.mitre.org/language/download/schema/version5.8/ovaldefinition/complete/oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 http://oval.mitre.org/language/download/schema/version5.8/ovaldefinition/complete/oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows http://oval.mitre.org/language/download/schema/version5.8/ovaldefinition/complete/windows-definitions-schema.xsd">
  <generator>
    <oval:product_name>repotool</oval:product_name>
    <oval:schema_version>5.8</oval:schema_version>
    <oval:timestamp>2017-01-11T10:37:26</oval:timestamp>
  </generator>
  <definitions>
    <definition id="oval:mil.disa.fso.windows:def:3887" version="4" class="compliance">
      <metadata>
        <title>Unnecessary Features Installed - TFTP Client</title>
        <affected family="windows">
          <platform>Microsoft Windows 7</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="16006" ref_url="http://iase.disa.mil/stigs/srr/index.html" />
        <description>TFTP Client feature is not installed</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:388700" comment="Verifes TFTP Client feature is not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3889" version="4" class="compliance">
      <metadata>
        <title>Unnecessary Features Installed - Telnet Client</title>
        <affected family="windows">
          <platform>Microsoft Windows 7</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="16006" ref_url="http://iase.disa.mil/stigs/srr/index.html" />
        <description>Telnet Client feature is not installed</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:388900" comment="Verifes Telnet Client feature is not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3931" version="6" class="compliance">
      <metadata>
        <title>Lockout Duration</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1099" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Lockout duration must meet minimum requirements.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393100" comment="Verifies 'Account lockout duration' is set to '0'" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393201" comment="Verifies 'Account lockout threshold' is not set to '0'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3932" version="4" class="compliance">
      <metadata>
        <title>Bad Logon Attempts</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1097" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The number of allowed bad logon attempts must meet minimum requirements.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393200" comment="Verifies 'Account lockout threshold' is set to '3' or less" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393201" comment="Verifies 'Account lockout threshold' is not set to '0'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3933" version="5" class="compliance">
      <metadata>
        <title>Bad Logon Counter Reset</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1098" ref_url="http://iase.disa.mil/stigs/srr/index.html" />
        <description>The time before the bad-logon counter is reset must meet minimum requirements.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393300" comment="Verifies 'Reset account lockout counter after' is set to at least the required value" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393201" comment="Verifies 'Account lockout threshold' is not set to '0'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3934" version="4" class="compliance">
      <metadata>
        <title>Password Uniqueness</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Password uniqueness must meet minimum requirements.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393400" comment="Verifies 'Enforce password history' is set to '24' passwords or more" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3935" version="4" class="compliance">
      <metadata>
        <title>Maximum Password Age</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1104" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Maximum password age must meet minimum requirements.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393500" comment="Verifies 'Maximum Password Age' is set to '60' days or less" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393501" comment="Verifies 'Maximum Password Age' is not set to '0'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3936" version="4" class="compliance">
      <metadata>
        <title>Minimum Password Age</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The minimum password age must meet requirements.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393600" comment="Verifies 'Minimum Password Age' is set to at least '1' day" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3937" version="3" class="compliance">
      <metadata>
        <title>Minimum Password Length</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Passwords must, at a minimum, be 14 characters.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393700" comment="Verifies 'Minimum password length' is set to at least '14' characters" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3938" version="3" class="compliance">
      <metadata>
        <title>Microsoft Strong Password Filtering</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1150" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The built-in Microsoft password complexity filter must be enabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393800" comment="Verifies 'Password must meet complexity requirements' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3939" version="4" class="compliance">
      <metadata>
        <title>Reversible Password Encryption</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Reversible password encryption must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:393900" comment="Verifies 'Store password using reversible encryption' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3940" version="4" class="compliance">
      <metadata>
        <title>Audit - Credential Validation - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Account Logon - Credential Validation failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Credential Validation - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394000" comment="Audit - Credential Validation - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394101" comment="Audit - Credential Validation - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3941" version="4" class="compliance">
      <metadata>
        <title>Audit - Credential Validation - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Account Logon - Credential Validation successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Credential Validation - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394100" comment="Audit - Credential Validation - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394101" comment="Audit - Credential Validation - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3942" version="4" class="compliance">
      <metadata>
        <title>Audit - Other Account Management Events - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26534" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The system must be configured to audit Account Management - Other Account Management Events failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Other Account Management Events - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394200" comment="Audit - Other Account Management Events - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394301" comment="Audit - Other Account Management Events - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3943" version="4" class="compliance">
      <metadata>
        <title>Audit - Other Account Management - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Account Management - Other Account Management Events successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Other Account Management - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394300" comment="Audit - Other Account Management - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394301" comment="Audit - Other Account Management - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3944" version="4" class="compliance">
      <metadata>
        <title>Audit - Security Group Management - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Account Management - Security Group Management failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Security Group Management - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394400" comment="Audit - Security Group Management - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394501" comment="Audit - Security Group Management - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3945" version="4" class="compliance">
      <metadata>
        <title>Audit - Security Group Management - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Account Management - Security Group Management successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Security Group Management - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394500" comment="Audit - Security Group Management - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394501" comment="Audit - Security Group Management - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3946" version="4" class="compliance">
      <metadata>
        <title>Audit - User Account Management - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Account Management - User Account Management failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - User Account Management - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394600" comment="Audit - User Account Management - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394701" comment="Audit - User Account Management - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3947" version="4" class="compliance">
      <metadata>
        <title>Audit - User Account Management - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Account Management - User Account Management successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - User Account Management - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394700" comment="Audit - User Account Management - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394701" comment="Audit - User Account Management - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3948" version="3" class="compliance">
      <metadata>
        <title>Audit - Process Creation - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Detailed Tracking - Process Creation successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Process Creation - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394800" comment="Audit - Process Creation - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394801" comment="Audit - Process Creation - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3949" version="4" class="compliance">
      <metadata>
        <title>Audit - Logoff - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Logon/Logoff - Logoff successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Logoff - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394900" comment="Audit - Logoff - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:394901" comment="Audit - Logoff - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3950" version="4" class="compliance">
      <metadata>
        <title>Audit - Logon - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Logon/Logoff - Logon failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Logon - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395000" comment="Audit - Logon - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395101" comment="Audit - Logon - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3951" version="4" class="compliance">
      <metadata>
        <title>Audit - Logon - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Logon/Logoff - Logon successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Logon - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395100" comment="Audit - Logon - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395101" comment="Audit - Logon - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3952" version="4" class="compliance">
      <metadata>
        <title>Audit - Special Logon - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Logon/Logoff - Special Logon successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Special Logon - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395200" comment="Audit - Special Logon - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395201" comment="Audit - Special Logon - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3957" version="3" class="compliance">
      <metadata>
        <title>Audit - Audit Policy Change - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Policy Change - Audit Policy Change failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Audit Policy Change - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395700" comment="Audit - Audit Policy Change - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395801" comment="Audit - Audit Policy Change - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3958" version="4" class="compliance">
      <metadata>
        <title>Audit - Audit Policy Change - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Policy Change - Audit Policy Change successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Audit Policy Change - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395800" comment="Audit - Audit Policy Change - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395801" comment="Audit - Audit Policy Change - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3959" version="4" class="compliance">
      <metadata>
        <title>Audit - Authentication Policy Change - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Policy Change - Authentication Policy Change successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Authentication Policy Change - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395900" comment="Audit - Authentication Policy Change - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:395901" comment="Audit - Authentication Policy Change - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3960" version="4" class="compliance">
      <metadata>
        <title>Audit - Sensitive Privilege Use - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Sensitive Privilege Use - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396000" comment="Audit - Sensitive Privilege Use - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396101" comment="Audit - Sensitive Privilege Use - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3961" version="4" class="compliance">
      <metadata>
        <title>Audit - Sensitive Privilege Use - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Sensitive Privilege Use - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396100" comment="Audit - Sensitive Privilege Use - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396101" comment="Audit - Sensitive Privilege Use - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3962" version="4" class="compliance">
      <metadata>
        <title>Audit - IPSec Driver - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit System - IPsec Driver failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - IPSec Driver - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396200" comment="Audit - IPSec Driver - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396301" comment="Audit - IPSec Driver - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3963" version="4" class="compliance">
      <metadata>
        <title>Audit - IPSec Driver - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26551" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The system must be configured to audit System - IPsec Driver successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - IPSec Driver - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396300" comment="Audit - IPSec Driver - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396301" comment="Audit - IPSec Driver - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3965" version="4" class="compliance">
      <metadata>
        <title>Audit - Security State Change - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit System - Security State Change successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Security State Change - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396500" comment="Audit - Security State Change - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396501" comment="Audit - Security State Change - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3966" version="4" class="compliance">
      <metadata>
        <title>Audit - Security System Extension - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit System - Security System Extension failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Security System Extension - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396600" comment="Audit - Security System Extension - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396701" comment="Audit - Security System Extension - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3967" version="4" class="compliance">
      <metadata>
        <title>Audit - Security System Extension - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit System - Security System Extension successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Security System Extension - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396700" comment="Audit - Security System Extension - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396701" comment="Audit - Security System Extension - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3968" version="4" class="compliance">
      <metadata>
        <title>Audit - System Integrity - Failure</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit System - System Integrity failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - System Integrity - Failure">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396800" comment="Audit - System Integrity - Failure only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396901" comment="Audit - System Integrity - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3969" version="4" class="compliance">
      <metadata>
        <title>Audit - System Integrity - Success</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit System - System Integrity successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - System Integrity - Success">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396900" comment="Audit - System Integrity - Success only" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:396901" comment="Audit - System Integrity - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:3985" version="3" class="compliance">
      <metadata>
        <title>WN08-CC-000015</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Connections to non-domain networks when connected to a domain authenticated network must be blocked.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:398500" comment="Verifies 'Prohibit connection to non-domain networks when connected to domain authenticated network' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4002" version="3" class="compliance">
      <metadata>
        <title>HTTP Printer Drivers</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14260" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Downloading print driver packages over HTTP must be prevented.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:400200" comment="Verifies 'Turn off downloading of print drivers over HTTP' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4007" version="3" class="compliance">
      <metadata>
        <title>Internet Download / Online Ordering</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14256" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Web publishing and online ordering wizards must be prevented from downloading a list of providers.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:400700" comment="Verifies 'Turn off Internet download for Web publishing and online ordering wizards' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4009" version="3" class="compliance">
      <metadata>
        <title>Printing Over HTTP</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14259" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Printing over HTTP must be prevented.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:400900" comment="Verifies 'Turn off printing over HTTP' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4023" version="3" class="compliance">
      <metadata>
        <title>WN08-CC-000053</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Signing in using a PIN must be turned off.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:402300" comment="Verifies 'Turn on PIN sign-in' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4024" version="3" class="compliance">
      <metadata>
        <title>Power Mgmt - Password Wake on Battery</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="15705" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Users must be prompted for a password on resume from sleep (on battery).</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:402400" comment="Verifies 'Require a password when a computer wakes (on battery)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4025" version="3" class="compliance">
      <metadata>
        <title>Power Mgmt - Password Wake When Plugged In</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The user must be prompted for a password on resume from sleep (plugged in).</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:402500" comment="Verifies 'Require a password when a computer wakes (plugged in)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4034" version="3" class="compliance">
      <metadata>
        <title>RPC - Unauthenticated RPC Clients</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14253" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthenticated RPC clients must be restricted from connecting to the RPC server.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:403400" comment="Verifies 'Restrict Unauthenticated RPC clients' is set to 'Enabled' and 'Authenticated'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4041" version="4" class="compliance">
      <metadata>
        <title>Application Compatibility Program Inventory</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:404100" comment="Verifies 'Turn off Inventory Collector' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4042" version="4" class="compliance">
      <metadata>
        <title>Autoplay for non-volume devices</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Autoplay must be turned off for non-volume devices.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:404200" comment="Verifies 'Disallow Autoplay for non-volume devices' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4043" version="3" class="compliance">
      <metadata>
        <title>Default Autorun Behavior</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The default autorun behavior must be configured to prevent autorun commands.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:404300" comment="Verifies 'Default behavior for AutoRun' is set to 'Enabled:Do not execute any autorun commands'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4044" version="3" class="compliance">
      <metadata>
        <title>Disable Media Autoplay</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Autoplay must be disabled for all drives.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:404400" comment="Verifies 'Turn off AutoPlay' is set to 'Enabled:All Drives'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4047" version="3" class="compliance">
      <metadata>
        <title>Enumerate Administrator Accounts on Elevation</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14243" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The system must require username and password to elevate a running application.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:404700" comment="Verifies 'Enumerate administrator accounts on elevation' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4048" version="4" class="compliance">
      <metadata>
        <title>The Enhanced Mitigation Experience Toolkit (EMET) system-wide Address Space Layout Randomization (ASLR) must be enabled and configured to Application Opt In.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) system-wide Address Space Layout Randomization (ASLR) must be enabled and configured to Application Opt In.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:404800" comment="Verifies 'System ASLR' is set to 'Enabled' with 'Application Opt In' selected" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4052" version="4" class="compliance">
      <metadata>
        <title>WINCC-000082</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) system-wide Data Execution Prevention (DEP) must be enabled and configured to at least Application Opt Out.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:405200" comment="Verifies 'System DEP' is set to 'Enabled' with 'Application Opt Out' selected" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:405201" comment="Verifies 'System DEP' is set to 'Enabled' with 'Always On' selected" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4053" version="6" class="compliance">
      <metadata>
        <title>WINCC-000083</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) system-wide Structured Exception Handler Overwrite Protection (SEHOP) must be configured to Application Opt Out.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:405300" comment="Verifies 'System SEHOP' is set to 'Enabled' with 'Application Opt Out' selected" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4054" version="3" class="compliance">
      <metadata>
        <title>Maximum Log Size - Application</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Application event log must be configured to a minimum size requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:405400" comment="Verifies 'Specify the maximum log size (KB)' is set at a minimum to 'Enabled:32768'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4055" version="5" class="compliance">
      <metadata>
        <title>Maximum Log Size - Security</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Security event log must be configured to a minimum size requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:405500" comment="Verifies 'Specify the maximum log size (KB)' is set at a minimum to 'Enabled:196608'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4057" version="3" class="compliance">
      <metadata>
        <title>Maximum Log Size - System</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The System event log must be configured to a minimum size requirement.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:405700" comment="Verifies 'Specify the maximum log size (KB)' is set at a minimum to 'Enabled:32768'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4060" version="4" class="compliance">
      <metadata>
        <title>Windows Explorer - Heap Termination</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Turning off File Explorer heap termination on corruption must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:406000" comment="Verifies 'Turn off heap termination on corruption' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4066" version="3" class="compliance">
      <metadata>
        <title>TS/RDS - Prevent Password Saving</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14247" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Passwords must not be saved in the Remote Desktop Client.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:406600" comment="Verifies 'Do not allow passwords to be saved' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4068" version="4" class="compliance">
      <metadata>
        <title>TS/RDS - Drive Redirection</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14249" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Local drives must be prevented from sharing with Remote Desktop Session Hosts.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:406800" comment="Verifies 'Do not allow drive redirection' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4069" version="3" class="compliance">
      <metadata>
        <title>TS/RDS - Password Prompting</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Remote Desktop Services must always prompt a client for passwords upon connection.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:406900" comment="Verifies 'Always prompt for password upon connection' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4070" version="3" class="compliance">
      <metadata>
        <title>TS/RDS - Set Encryption Level</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Remote Desktop Services must be configured with the client connection encryption set to the required level.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:407000" comment="Verifies 'Set client connection encryption level' is set to 'Enabled' and 'High Level'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4075" version="4" class="compliance">
      <metadata>
        <title>RSS Attachment Downloads</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="15682" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Attachments must be prevented from being downloaded from RSS feeds.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:407500" comment="Verifies 'Prevent downloading of enclosures' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4077" version="4" class="compliance">
      <metadata>
        <title>Search - Encrypted Files Indexing</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Indexing of encrypted files must be turned off.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:407700" comment="Verifies 'Allow indexing of encrypted files' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4084" version="3" class="compliance">
      <metadata>
        <title>Windows Installer - User Control</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="15685" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Users must be prevented from changing installation options.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:408400" comment="Verifies 'Enable user control over installs' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4085" version="4" class="compliance">
      <metadata>
        <title>Always Install with Elevated Privileges Disabled</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>The Windows Installer Always install with elevated privileges must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:408500" comment="Verifies 'Always install with elevated privileges' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4092" version="4" class="compliance">
      <metadata>
        <title>WINCC-000123</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>The Windows Remote Management (WinRM) client must not use Basic authentication.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:409200" comment="Verifies 'Allow Basic authentication' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4093" version="3" class="compliance">
      <metadata>
        <title>WINCC-000124</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Windows Remote Management (WinRM) client must not allow unencrypted traffic.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:409300" comment="Verifies 'Allow unencrypted traffic' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4094" version="3" class="compliance">
      <metadata>
        <title>WINCC-000125</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Windows Remote Management (WinRM) client must not use Digest authentication.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:409400" comment="Verifies 'Disallow Digest authentication' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4095" version="4" class="compliance">
      <metadata>
        <title>WINCC-000126</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="36718" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Windows Remote Management (WinRM) service must not use Basic authentication.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:409500" comment="Verifies 'Allow Basic authentication' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4096" version="4" class="compliance">
      <metadata>
        <title>WINCC-000127</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Windows Remote Management (WinRM) service must not allow unencrypted traffic.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:409600" comment="Verifies 'Allow unencrypted traffic' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4097" version="3" class="compliance">
      <metadata>
        <title>WINCC-000128</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Windows Remote Management (WinRM) service must not store RunAs credentials.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:409700" comment="Verifies 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4099" version="3" class="compliance">
      <metadata>
        <title>TS/RDS - Secure RPC Connection</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Remote Desktop Session Host must require secure RPC communications.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:409900" comment="Verifies 'Require secure RPC communication' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4143" version="3" class="compliance">
      <metadata>
        <title>Limit Blank Passwords</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Local accounts with blank passwords must be restricted to prevent access from the network.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:414300" comment="Verifies 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4148" version="3" class="compliance">
      <metadata>
        <title>Audit Policy Subcategory Setting</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14230" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Audit policy using subcategories must be enabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:414800" comment="Verifies 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4151" version="3" class="compliance">
      <metadata>
        <title>Encrypting and Signing of Secure Channel Traffic</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Outgoing secure channel traffic must be encrypted or signed.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415100" comment="Verifies 'Domain member: Digitally encrypt or sign secure channel data (always)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4152" version="4" class="compliance">
      <metadata>
        <title>Encryption of Secure Channel Traffic</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1163" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Outgoing secure channel traffic must be encrypted when possible.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415200" comment="Verifies 'Domain member: Digitally encrypt secure channel data (when possible)' is set to 'Enabled'" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415101" comment="Verifies 'Domain member: Digitally encrypt or sign secure channel data (always)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4153" version="4" class="compliance">
      <metadata>
        <title>Signing of Secure Channel Traffic</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1164" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Outgoing secure channel traffic must be signed when possible.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415300" comment="Verifies 'Domain member: Digitally sign secure channel data (when possible)' is set to 'Enabled'" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415101" comment="Verifies 'Domain member: Digitally encrypt or sign secure channel data (always)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4154" version="3" class="compliance">
      <metadata>
        <title>Computer Account Password Reset</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1165" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The computer account password must not be prevented from being reset.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415400" comment="Verifies 'Domain member: Disable machine account password changes' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4155" version="3" class="compliance">
      <metadata>
        <title>Maximum Machine Account Password Age</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The maximum age for machine account passwords must be set to requirements.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415500" comment="Verifies 'Domain member: Maximum machine account password age' is set to '30' days or less" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415501" comment="Verifies 'Domain member: Maximum machine account password age' is not set to '0'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4156" version="3" class="compliance">
      <metadata>
        <title>Strong Session Key</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to require a strong session key.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:415600" comment="Verifies 'Domain member: Require strong (Windows 2000 or later) session key' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4166" version="3" class="compliance">
      <metadata>
        <title>Smart Card Removal Option</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1157" ref_url="http://iase.disa.mil/stigs/srr/index.html" />
        <description>The Smart Card removal option must be configured to Force Logoff or Lock Workstation.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:416600" comment="Verifies 'Interactive logon: Smart card removal behavior' is set to 'Lock Workstation'" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:416601" comment="Verifies 'Interactive logon: Smart card removal behavior' is set to 'Force Logoff'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4167" version="3" class="compliance">
      <metadata>
        <title>SMB Client Packet Signing (Always)</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Windows SMB client must be configured to always perform SMB packet signing.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:416700" comment="Verifies 'Microsoft Network Client: Digitally sign communications (always)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4168" version="3" class="compliance">
      <metadata>
        <title>SMB Client Packet Signing (if server agrees)</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1166" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Windows SMB client must be enabled to perform SMB packet signing when possible.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:416800" comment="Verifies 'Microsoft network client: Digitally sign communications (if server agrees)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4169" version="4" class="compliance">
      <metadata>
        <title>Unencrypted Password is Sent to SMB Server</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1141" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unencrypted passwords must not be sent to a third-party SMB Server.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:416900" comment="Verifies 'Microsoft Network Client: Send unencrypted password to connect to third-party SMB servers' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4170" version="3" class="compliance">
      <metadata>
        <title>Idle Time Before Suspending a Session.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1174" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The amount of idle time required before suspending a session must be properly set.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:417000" comment="Verifies 'Microsoft network server: Amount of idle time required before suspending session' is set to '15' minutes or less" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4171" version="4" class="compliance">
      <metadata>
        <title>SMB Server Packet Signing (Always)</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Windows SMB server must be configured to always perform SMB packet signing.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:417100" comment="Verifies 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4172" version="3" class="compliance">
      <metadata>
        <title>SMB Server Packet Signing (if client agrees)</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1162" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Windows SMB server must perform SMB packet signing when possible.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:417200" comment="Verifies 'Microsoft network server: Digitally sign communications (if client agrees)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4176" version="4" class="compliance">
      <metadata>
        <title>IPv6 Source Routing</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>IPv6 source routing must be configured to the highest protection level.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:417600" comment="Verifies 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' is set to 'Highest protection, source routing is completely disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4177" version="3" class="compliance">
      <metadata>
        <title>Disable IP Source Routing</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to prevent IP source routing.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:417700" comment="Verifies 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set to 'Highest protection, source routing is completely disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4178" version="3" class="compliance">
      <metadata>
        <title>Disable ICMP Redirect</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to prevent ICMP redirects from overriding OSPF generated routes.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:417800" comment="Verifies 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4182" version="3" class="compliance">
      <metadata>
        <title>Name-Release Attacks</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to ignore NetBIOS name release requests except from WINS servers.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:418200" comment="Verifies 'MSS: (NoNameReleaseOnDemand) Allow computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4190" version="3" class="compliance">
      <metadata>
        <title>Restrict Anonymous SAM Enumeration</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Anonymous enumeration of SAM accounts must not be allowed.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:419000" comment="Verifies 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4191" version="4" class="compliance">
      <metadata>
        <title>Restrict Anonymous Network Shares</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Anonymous enumeration of shares must be restricted.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:419100" comment="Verifies 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4192" version="3" class="compliance">
      <metadata>
        <title>Storage of Passwords and Credentials</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to prevent the storage of passwords and credentials.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:419200" comment="Verifies 'Network access: Do not allow storage of credentials or .NET Passports for network authentication' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4193" version="3" class="compliance">
      <metadata>
        <title>Everyone Anonymous Rights</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must not be configured to give anonymous users Everyone rights.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:419300" comment="Verifies 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4197" version="3" class="compliance">
      <metadata>
        <title>Anonymous Access to Named Pipes and Shares</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="6834" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Anonymous access to Named Pipes and Shares must be restricted.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:419700" comment="Verifies 'Network access: Restrict anonymous access to Named Pipes and Shares' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4200" version="3" class="compliance">
      <metadata>
        <title>Computer Identity Authentication for NTLM</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Services using Local System that use negotiate when reverting to NTLM authentication must use the computer identity vs. authenticating anonymously.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420000" comment="Verifies 'Network Security: Allow Local System to use computer identity for NTLM' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4201" version="3" class="compliance">
      <metadata>
        <title>NTLM NULL Session Fallback</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>NTLM must be prevented from falling back to a Null session.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420100" comment="Verifies 'Network security: Allow LocalSystem NULL session fallback' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4202" version="3" class="compliance">
      <metadata>
        <title>PKU2U Online Identities Authentication</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>PKU2U authentication using online identities must be prevented.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420200" comment="Verifies 'Network Security: Allow PKU2U authentication requests to this computer to use online identities' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4203" version="3" class="compliance">
      <metadata>
        <title>Kerberos Encryption Types</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420300" comment="Verifies 'Network Security: Configure encryption types allowed for Kerberos' is set to 'Enabled' with 'AES128_HMAC_SHA1', 'AES256_HMAC_SHA1', 'Future encryption types'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4204" version="4" class="compliance">
      <metadata>
        <title>LAN Manager Hash Value Stored</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="3379" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The system must be configured to prevent the storage of the LAN Manager hash of passwords.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420400" comment="Verifies 'Network security: Do not store LAN Manager hash value on next password change' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4205" version="3" class="compliance">
      <metadata>
        <title>Force Logoff When Logon Hours Expire</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to force users to log off when their allowed logon hours expire.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420500" comment="Verifies 'Network security: Force logoff when logon hours expire' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4206" version="3" class="compliance">
      <metadata>
        <title>LanMan Authentication Level</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1153" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420600" comment="Verifies 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM &amp; NTLM' (Level 5)" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4207" version="3" class="compliance">
      <metadata>
        <title>LDAP Client Signing</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Network Security: LDAP client signing requirements</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420700" comment="Verifies 'Network security: LDAP client signing requirements' is set to at a minimum 'Negotiate signing'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4208" version="3" class="compliance">
      <metadata>
        <title>Session Security for NTLM SSP Based Clients</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420800" comment="Verifies 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require NTLMv2 session security'" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420801" comment="Verifies 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require 128-bit encryption'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4209" version="3" class="compliance">
      <metadata>
        <title>Session Security for NTLM SSP Based Servers</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420900" comment="Verifies 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require NTLMv2 session security'" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:420901" comment="Verifies 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require 128-bit encryption'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4213" version="3" class="compliance">
      <metadata>
        <title>FIPS Compliant Algorithms</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:421300" comment="Verifies 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4214" version="3" class="compliance">
      <metadata>
        <title>Case Insensitivity for Non-Windows</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to require case insensitivity for non-Windows subsystems.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:421400" comment="Verifies 'System objects: Require case insensitivity for non-Windows subsystems' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4215" version="3" class="compliance">
      <metadata>
        <title>Global System Objects Permission Strength</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="1173" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The default permissions of global system objects must be increased.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:421500" comment="Verifies 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4216" version="4" class="compliance">
      <metadata>
        <title>UAC - Admin Approval Mode</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14234" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>User Account Control approval mode for the built-in Administrator must be enabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:421600" comment="Verifies 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4217" version="4" class="compliance">
      <metadata>
        <title>UAC - Admin Elevation Prompt</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14235" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>User Account Control must, at minimum, prompt administrators for consent on the secure desktop.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:421700" comment="Verifies 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop'" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:421701" comment="Verifies 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for credentials on the secure desktop'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4219" version="3" class="compliance">
      <metadata>
        <title>UAC - Application Installations</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14237" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>User Account Control must be configured to detect application installations and prompt for elevation.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:421900" comment="Verifies 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4221" version="3" class="compliance">
      <metadata>
        <title>UAC - UIAccess Application Elevation</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14239" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>User Account Control must only elevate UIAccess applications that are installed in secure locations.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:422100" comment="Verifies 'User Account Control: Only elevate UIAccess applications that are installed in secure locations' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4222" version="3" class="compliance">
      <metadata>
        <title>UAC - All Admin Approval Mode</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14240" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>User Account Control must run all administrators in Admin Approval Mode, enabling UAC.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:422200" comment="Verifies 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4224" version="3" class="compliance">
      <metadata>
        <title>UAC - Non UAC Compliant Application Virtualization</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="14242" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>User Account Control must virtualize file and registry write failures to per-user locations.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:422400" comment="Verifies 'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4240" version="4" class="compliance">
      <metadata>
        <title>UR: Act as part of the operating system</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Act as part of the operating system user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:424000" comment="Act as part of the operating system - None" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4249" version="4" class="compliance">
      <metadata>
        <title>UR: Create a token object</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26479" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Create a token object user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:424900" comment="Create a token object - None" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4251" version="4" class="compliance">
      <metadata>
        <title>UR: Create permanent shared objects</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26481" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Create permanent shared objects user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:425100" comment="Create permanent shared objects - None" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4253" version="5" class="compliance">
      <metadata>
        <title>UR: Debug Programs</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Debug programs user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:425300" comment="Debug Programs - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4259" version="5" class="compliance">
      <metadata>
        <title>UR: Enable computer and user accounts to be trusted for delegation</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26487" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Enable computer and user accounts to be trusted for delegation user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:425900" comment="Enable computer and user accounts to be trusted for delegation - None" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4266" version="3" class="compliance">
      <metadata>
        <title>UR: Lock pages in memory</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26494" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Lock pages in memory user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:426600" comment="Lock pages in memory - None" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4372" version="4" class="compliance">
      <metadata>
        <title>UR: Deny log on as a service</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Deny log on as a service user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems.  No other groups or accounts must be assigned this right.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4373" comment="Deny log on as a service - Non-Domain Systems" />
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4374" comment="Deny log on as a service - Domain Joined Systems" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4373" version="4" class="compliance">
      <metadata>
        <title>UR: Deny log on as a service - Non-Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26484" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny log on as a service user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems.  No other groups or accounts must be assigned this right.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4982" comment="System is not a member of a domain" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:437300" comment="Deny log on as a service - None" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4374" version="4" class="compliance">
      <metadata>
        <title>UR: Deny log on as a service - Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26484" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny log on as a service user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems.  No other groups or accounts must be assigned this right.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="System is not a member of a domain" definition_ref="oval:mil.disa.fso.windows:def:4982" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:437400" comment="Deny log on as a service - Domain Admins" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:437401" comment="Deny log on as a service - Enterprise Admins" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4375" version="4" class="compliance">
      <metadata>
        <title>UR: Deny log on locally</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4376" comment="Deny log on locally - Non-Domain Systems" />
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4377" comment="Deny log on locally - Domain Joined Systems" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4376" version="3" class="compliance">
      <metadata>
        <title>UR: Deny log on locally - Non-Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26485" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4982" comment="System is not a member of a domain" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:437600" comment="Deny log on locally - Guests" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4377" version="4" class="compliance">
      <metadata>
        <title>UR: Deny log on locally - Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26485" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="System is not a member of a domain" definition_ref="oval:mil.disa.fso.windows:def:4982" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:437600" comment="Deny log on locally - Guests" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:437700" comment="Deny log on locally - Domain Admins" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:437701" comment="Deny log on locally - Enterprise Admins" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4730" version="2" class="compliance">
      <metadata>
        <title>WINSO-000021</title>
        <affected family="windows">
          <platform>Microsoft Windows Server 2012</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:473000" comment="Verifies 'Interactive logon: Machine inactivity limit' is set to '900' seconds or less" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4740" version="2" class="compliance">
      <metadata>
        <title>UR: Access Credential Manager as a trusted caller</title>
        <affected family="windows">
          <platform>Microsoft Windows Server 2012</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Access Credential Manager as a trusted caller user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:474000" comment="Access Credential Manager as a trusted caller - None" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4775" version="3" class="compliance">
      <metadata>
        <title>UR: Deny access to this computer from the network</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local administrator accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4776" comment="Deny access to this computer from the network - Non-Domain Systems" />
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4777" comment="Deny access to this computer from the network - Domain Joined Systems" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4776" version="2" class="compliance">
      <metadata>
        <title>UR: Deny access to this computer from the network - Non-Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="1155" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local administrator accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4982" comment="System is not a member of a domain" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477500" comment="Deny access to this computer from the network - Guests" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4777" version="4" class="compliance">
      <metadata>
        <title>UR: Deny access to this computer from the network - Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="1155" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local administrator accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="System is not a member of a domain" definition_ref="oval:mil.disa.fso.windows:def:4982" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477500" comment="Deny access to this computer from the network - Guests" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477501" comment="Deny access to this computer from the network - Domain Admins" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477502" comment="Deny access to this computer from the network - Enterprise Admins" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477508" comment="Deny access to this computer from the network - Local account" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4778" version="5" class="compliance">
      <metadata>
        <title>UR: Deny log on through Remote Desktop Services</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Deny log on through Remote Desktop Services user right on workstations must be configured to prevent access from highly privileged domain accounts and local administrator accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4779" comment="Deny log on through Remote Desktop Services - Non-Domain Systems" />
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4780" comment="Deny log on through Remote Desktop Services - Domain Joined Systems" />
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:5142" comment="Deny log on through Remote Desktop Services - Everyone" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4779" version="2" class="compliance">
      <metadata>
        <title>UR: Deny log on through Remote Desktop Services - Non-Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26486" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny log on through Remote Desktop Services user right on workstations must be configured to prevent access from highly privileged domain accounts and local administrator accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4982" comment="System is not a member of a domain" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477800" comment="Deny log on through Remote Desktop Services - Guests" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4780" version="4" class="compliance">
      <metadata>
        <title>UR: Deny log on through Remote Desktop Services - Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26486" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny log on through Remote Desktop Services user right on workstations must be configured to prevent access from highly privileged domain accounts and local administrator accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="System is not a member of a domain" definition_ref="oval:mil.disa.fso.windows:def:4982" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477800" comment="Deny log on through Remote Desktop Services - Guests" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477801" comment="Deny log on through Remote Desktop Services - Domain Admins" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477802" comment="Deny log on through Remote Desktop Services - Enterprise Admins" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:477808" comment="Deny log on through Remote Desktop Services - Local Account" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4847" version="3" class="compliance">
      <metadata>
        <title>Legal Notice Display</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The required legal notice must be configured to display before console logon.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:484700" comment="Legal Notice is configured with the required text." />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:484701" comment="Legal Notice is configured with the required text." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4848" version="2" class="compliance">
      <metadata>
        <title>Legal Banner Dialog Box Title</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Windows dialog box title for the legal banner must be configured.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:484800" comment="Legal Notice Caption - DoD Notice and Consent Banner" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:484801" comment="Legal Notice Caption - US Department of Defense Warning Statement" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4849" version="2" class="compliance">
      <metadata>
        <title>UR: Access this computer from the network</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26470" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Access this computer from the network user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:484900" comment="Access this computer from the network - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4851" version="2" class="compliance">
      <metadata>
        <title>UR: Allow log on locally</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Allow log on locally user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:485100" comment="Allow log on locally - Administrators, Users" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4852" version="2" class="compliance">
      <metadata>
        <title>UR: Back up files and directories</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Back up files and directories user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:485200" comment="Back up files and directories - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4854" version="3" class="compliance">
      <metadata>
        <title>UR: Change the system time</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Change the system time user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:485400" comment="Change the system time - Administrators, Local Service" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4856" version="2" class="compliance">
      <metadata>
        <title>UR: Create a pagefile</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="DISA" ref_id="26478" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Create a pagefile user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:485600" comment="Create a pagefile - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4857" version="3" class="compliance">
      <metadata>
        <title>UR: Create global objects</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26480" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Create global objects user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:485700" comment="Create global objects - Administrators, Service, Local Service, Network Service" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4858" version="3" class="compliance">
      <metadata>
        <title>UR: Create symbolic links</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26482" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Create symbolic links user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:485800" comment="Create symbolic links - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4859" version="3" class="compliance">
      <metadata>
        <title>UR: Force shutdown from a remote system</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26488" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Force shutdown from a remote system user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:485900" comment="Force shutdown from a remote system - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4860" version="3" class="compliance">
      <metadata>
        <title>UR: Generate security audits</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26489" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Generate security audits user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:486000" comment="Generate security audits - Local Service, Network Service" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4861" version="3" class="compliance">
      <metadata>
        <title>UR: Impersonate a client after authentication</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26490" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Impersonate a client after authentication user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:486100" comment="Impersonate a client after authentication - Administrators, Service, Local Service, Network Service" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4863" version="2" class="compliance">
      <metadata>
        <title>UR: Increase scheduling priority</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26492" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Increase scheduling priority user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:486300" comment="Increase scheduling priority - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4864" version="2" class="compliance">
      <metadata>
        <title>UR: Load and unload device drivers</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26493" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Unauthorized accounts must not have the Load and unload device drivers user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:486400" comment="Load and unload device drivers - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4865" version="3" class="compliance">
      <metadata>
        <title>UR: Manage auditing and security log</title>
        <affected family="windows">
          <platform>Microsoft Windows 7</platform>
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Manage auditing and security log user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:486500" comment="Manage auditing and security log - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4866" version="2" class="compliance">
      <metadata>
        <title>UR: Modify firmware environment values</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Modify firmware environment values user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:486600" comment="Modify firmware environment values - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4867" version="2" class="compliance">
      <metadata>
        <title>UR: Perform volume maintenance tasks</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Perform volume maintenance tasks user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:486700" comment="Perform volume maintenance tasks - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4868" version="2" class="compliance">
      <metadata>
        <title>UR: Profile single process</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Profile single process user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:486800" comment="Profile single process - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4871" version="2" class="compliance">
      <metadata>
        <title>UR: Restore files and directories</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Restore files and directories user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:487100" comment="Restore files and directories - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4873" version="2" class="compliance">
      <metadata>
        <title>UR: Take ownership of files or other objects</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Unauthorized accounts must not have the Take ownership of files or other objects user right.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:487300" comment="Take ownership of files or other objects - Administrators" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4874" version="4" class="compliance">
      <metadata>
        <title>WINPK-000001 DoD Root Certificate</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>The DoD Root Certificate must be installed into the Trusted Root Store.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487400" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -8C" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487401" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -8C" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487402" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -8C" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487403" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -8C" />
        </criteria>
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487404" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -D7" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487405" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -D7" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487406" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -D7" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487407" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -D7" />
        </criteria>
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487408" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -B8" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487409" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -B8" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487410" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -B8" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487411" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -B8" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4875" version="4" class="compliance">
      <metadata>
        <title>WINPK-000002 External CA Root Certificate</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>The External CA Root Certificate must be installed into the Trusted Root Store.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487500" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -C3" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487501" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -C3" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487502" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -C3" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487503" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -C3" />
        </criteria>
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487504" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -73" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487505" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -73" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487506" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -73" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487507" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -73" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4876" version="5" class="compliance">
      <metadata>
        <title>WINPK-000003 DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate must be installed into the Untrusted Certificates Store.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487600" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -22" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487601" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -22" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487602" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -22" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487603" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -22" />
        </criteria>
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487604" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FF" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487605" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FF" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487606" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FF" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487607" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FF" />
        </criteria>
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487608" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FC" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487609" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FC" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487610" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FC" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487611" comment="Verifies the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FC" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4877" version="336" class="compliance">
      <metadata>
        <title>WINPK-000004</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>The US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate must be installed into the Untrusted Certificates Store.</description>
      </metadata>
      <criteria operator="AND">
        <criteria operator="OR">
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487704" comment="Verifies the US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate is installed into the Untrusted Certificates Store -DA" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487705" comment="Verifies the US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate is installed into the Untrusted Certificates Store -DA" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487706" comment="Verifies the US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate is installed into the Untrusted Certificates Store -DA" />
          <criterion test_ref="oval:mil.disa.fso.windows:tst:487707" comment="Verifies the US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate is installed into the Untrusted Certificates Store -DA" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4982" version="1" class="compliance">
      <metadata>
        <title>Standalone Workstation/Server System</title>
        <affected family="windows">
          <platform>Microsoft Windows Server 2008 R2</platform>
        </affected>
        <description>The system is not a member of a domain.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.windows:tst:498200" comment="System is not a member of a domain" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:4985" version="2" class="compliance">
      <metadata>
        <title>Windows Update must not obtain updates from other PCs on the Internet</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Prevents getting updates from other systems on the Internet</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:498500" comment="'DownloadMode' is set to 'Enabled' with 'None, LAN or Group' selected." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.fso.windows:def:5142" version="1" class="compliance">
      <metadata>
        <title>Deny log on through Remote Desktop Services - Everyone</title>
        <affected family="windows">
          <platform>Microsoft Windows 7</platform>
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Deny everyone log on through Remote Desktop Services</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.windows:tst:514200" comment="Deny log on through Remote Desktop Services - Everyone" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:11" version="3" class="compliance">
      <metadata>
        <title>The Enhanced Mitigation Experience Toolkit v5.5 or later must be installed on the system.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit v5.5 or later must be installed on the system.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.windows:tst:439601" comment="Verifies EMET is installed" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:1100" comment="Verifies EMET 5.5 or higher is installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:15" version="3" class="compliance">
      <metadata>
        <title>Domain-joined systems must use Windows 10 Enterprise Edition.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Domain-joined systems must use Windows 10 Enterprise Edition.</description>
      </metadata>
      <criteria operator="OR" comment="Standalone or Enterprise Edition">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:83" comment="Enterprise Edition" />
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:82" comment="Standalone System" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:17" version="3" class="compliance">
      <metadata>
        <title>Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:82" comment="System is not a member of a domain" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:413900" comment="Verifies local admin accounts filtered token policy is enabled on domain systems" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:19" version="2" class="compliance">
      <metadata>
        <title>Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares.</description>
      </metadata>
      <criteria operator="OR" comment="non-domain system or has correct UNC path hardening">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:82" comment="non-domain system" />
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:1900" comment="Mutual Authentication and Integrity for \\*\SYSVOL" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:1901" comment="Mutual Authentication and Integrity for \\*\NETLOGON" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:21" version="1" class="compliance">
      <metadata>
        <title>Systems must at least attempt device authentication using certificates.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Systems must at least attempt device authentication using certificates.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:82" comment="System is standalone" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:2100" comment="DevicePKInitEnabled (reg_dword) is 1 or does not exist" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:22" version="1" class="compliance">
      <metadata>
        <title>The system must be configured to block untrusted fonts from loading.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to block untrusted fonts from loading.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:2200" comment="Untrusted fonts are blocked" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:23" version="1" class="compliance">
      <metadata>
        <title>Wi-Fi Sense must be disabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Wi-Fi Sense must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:2300" comment="Verifies 'Disable Wi-Fi Sense' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:24" version="3" class="compliance">
      <metadata>
        <title>Windows Telemetry must be configured to the lowest level of data sent to Microsoft.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Windows Telemetry must be configured to the lowest level of data sent to Microsoft.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:2400" comment="AllowTelemetry = 0 or 1" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:25" version="2" class="compliance">
      <metadata>
        <title>The password manager function in the Edge browser must be disabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The password manager function in the Edge browser must be disabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:2500" comment="Verifies 'Allows you to configure password manager' is set to 'Disabled'" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:2501" comment="Windows 10 Enterprise LTSB is installed, thus Microsoft Edge is not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:27" version="1" class="compliance">
      <metadata>
        <title>The minimum pin length for Microsoft Passport for Work must be 6 characters or greater.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The minimum pin length for Microsoft Passport for Work must be 6 characters or greater.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:2700" comment="Verifies 'Minimum PIN length' is set to '6' or greater." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:30" version="1" class="compliance">
      <metadata>
        <title>Local volumes must be formatted using NTFS.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Local volumes must be formatted using NTFS.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.stig.windows:tst:3000" comment="Local volumes use NTFS" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:35" version="1" class="compliance">
      <metadata>
        <title>Internet Information System (IIS) or its subcomponents must not be installed on a workstation.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Internet Information System (IIS) or its subcomponents must not be installed on a workstation.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:3500" comment="No IIS components are installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:38" version="3" class="compliance">
      <metadata>
        <title>The HBSS McAfee Agent must be installed.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The HBSS McAfee Agent must be installed.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND" comment="Test to see if McAfee Framework Service version 4 or greater is installed and running">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:3800" comment="McAfee Framework Service is running" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:3801" comment="FrameworkService.exe is version 4 or greater" />
        </criteria>
        <criteria operator="AND" comment="Test to see if McAfee Agent Service version 5 or greater is installed and running">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:3802" comment="McAfee Agent Service is running" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:3803" comment="masvc.exe is version 5 or greater" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:51" version="4" class="compliance">
      <metadata>
        <title>Permissions for the Application event log must prevent access by non-privileged accounts.</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5101" comment="The Applicaion event log must have at least default permissions. Strict Path" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5102" negate="true" comment="The Application event log registry specified location must have the %SystemRoot% environment variable." />
        </criteria>
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5100" comment="The Applicaion event log must have at least default permissions. Built Path" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5102" comment="The Application event log registry specified location must have the %SystemRoot% environment variable." />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:52" version="4" class="compliance">
      <metadata>
        <title>Permissions for the Security event log must prevent access by non-privileged accounts.</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5201" comment="The Security event log must have at least default permissions. Strict Path" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5202" negate="true" comment="The Security event log registry specified location must have the %SystemRoot% environment variable." />
        </criteria>
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5200" comment="The Security event log must have at least default permissions. Built Path" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5202" comment="The Security event log registry specified location must have the %SystemRoot% environment variable." />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:53" version="2" class="compliance">
      <metadata>
        <title>Permissions for the System event log must prevent access by non-privileged accounts.</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
          <platform>Microsoft Windows 8</platform>
        </affected>
        <description>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5301" comment="The System event log must have at least default permissions. Strict Path" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5302" negate="true" comment="The System event log registry specified location must have the %SystemRoot% environment variable." />
        </criteria>
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5300" comment="The System event log must have at least default permissions. Built Path" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:5302" comment="The System event log registry specified location must have the %SystemRoot% environment variable." />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:54" version="1" class="compliance">
      <metadata>
        <title>Users must not be allowed to run virtual machines in Hyper-V on the system.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Users must not be allowed to run virtual machines in Hyper-V on the system.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:5400" comment="Hyper-V Administrators group has no members" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:55" version="1" class="compliance">
      <metadata>
        <title>Unnecessary Features Installed - SNMP</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>SNMP feature is not installed</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:5500" comment="Verifes SNMP feature is not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:56" version="1" class="compliance">
      <metadata>
        <title>Simple TCP/IP Services must not be installed on the system.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Simple TCP/IP Services must not be installed on the system.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:5600" comment="simptcp service not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:65" version="1" class="compliance">
      <metadata>
        <title>Automatically signing in the last interactive user after a system-initiated restart must be disabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Automatically signing in the last interactive user after a system-initiated restart must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:6500" comment="Verifies 'Sign-in last interactive user automatically after a system-initiated restart' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:66" version="1" class="compliance">
      <metadata>
        <title>The network selection user interface (UI) must not be displayed on the logon screen.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The network selection user interface (UI) must not be displayed on the logon screen.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:6600" comment="Verifies 'Do not display network selection UI' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:67" version="1" class="compliance">
      <metadata>
        <title>The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:6700" comment="Verifies 'Allow Microsoft accounts to be optional' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:68" version="1" class="compliance">
      <metadata>
        <title>The use of OneDrive for storage must be disabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The use of OneDrive for storage must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:6800" comment="Verifies 'Prevent the usage of OneDrive for file storage' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:69" version="1" class="compliance">
      <metadata>
        <title>The display of slide shows on the lock screen must be disabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The display of slide shows on the lock screen must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:6900" comment="Verifies 'Prevent enabling lock screen slide show' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:77" version="1" class="compliance">
      <metadata>
        <title>Accounts must be configured to require password expiration.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Accounts must be configured to require password expiration.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:7700" comment="No active, local accounts have non-expiring passwords." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:82" version="2" class="compliance">
      <metadata>
        <title>The system is standalone (not domain joined or a domain controller).</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Returns "true" if the system is standalone, that is, not a member of a domain or a domain controller.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8200" comment="DomainRole is 0 or 2" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:83" version="2" class="compliance">
      <metadata>
        <title>Windows Enterprise Edition</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The installed operating system is an Enterprise Edition.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8300" comment="EditionID is Enterprise or EnterpriseS" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:85" version="1" class="compliance">
      <metadata>
        <title>Insecure logons to an SMB server must be disabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Insecure logons to an SMB server must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8500" comment="'Enable insecure guest logons' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:86" version="1" class="compliance">
      <metadata>
        <title>Enhanced anti-spoofing when available must be enabled for facial recognition.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Enhanced anti-spoofing when available must be enabled for facial recognition.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8600" comment="'Use enhanced anti-spoofing when available' is 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:87" version="2" class="compliance">
      <metadata>
        <title>Users must not be allowed to ignore SmartScreen filter warnings for malicious websites in Microsoft Edge.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Users must not be allowed to ignore SmartScreen filter warnings for malicious websites in Microsoft Edge.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8700" comment="'Don't allow SmartScreen Filter warning overrides' is 'Enabled'" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8701" comment="Windows 10 Enterprise LTSB is installed, thus Microsoft Edge is not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:88" version="2" class="compliance">
      <metadata>
        <title>Users must not be allowed to ignore SmartScreen filter warnings for unverified files in Microsoft Edge.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Users must not be allowed to ignore SmartScreen filter warnings for unverified files in Microsoft Edge.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8800" comment="'Don't allow SmartScreen Filter warning overrides for unverified files' is 'Enabled'" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8801" comment="Windows 10 Enterprise LTSB is installed, thus Microsoft Edge is not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:89" version="2" class="compliance">
      <metadata>
        <title>InPrivate browsing in Microsoft Edge must be disabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>InPrivate browsing in Microsoft Edge must be disabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8900" comment="'Turn off InPrivate browsing' is 'Disabled'" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:8901" comment="Windows 10 Enterprise LTSB is installed, thus Microsoft Edge is not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:90" version="2" class="compliance">
      <metadata>
        <title>The SmartScreen filter for Microsoft Edge must be enabled.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The SmartScreen filter for Microsoft Edge must be enabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:9000" comment="'Turn off the SmartScreen Filter' set to 'Enabled' (setting worded incorrectly)" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:9001" comment="Windows 10 Enterprise LTSB is installed, thus Microsoft Edge is not installed" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:91" version="3" class="compliance">
      <metadata>
        <title>The Enhanced Mitigation Experience Toolkit (EMET) Default Actions and Mitigations Settings must enable Deep Hooks.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) Default Actions and Mitigations Settings must enable Deep Hooks.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:9100" comment="'Default Actions and Mitigations' is 'Enabled'" />
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Make sure that EMET is installed" />
        </criteria>
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="If EMET is uninstalled and DEP, SEHOP are correctly configured, check is NA" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:92" version="3" class="compliance">
      <metadata>
        <title>The Enhanced Mitigation Experience Toolkit (EMET) Default Actions and Mitigations Settings must enable Anti Detours.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-42218-8" />
        <description>The Enhanced Mitigation Experience Toolkit (EMET) Default Actions and Mitigations Settings must enable Anti Detours.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:9200" comment="'Default Actions and Mitigations Settings, Anti Detours' is 'Enabled'" />
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Check to see if EMET 5.5 is installed" />
        </criteria>
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="If EMET is uninstalled and DEP, SEHOP are correctly configured, check is NA" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:93" version="3" class="compliance">
      <metadata>
        <title>The Enhanced Mitigation Experience Toolkit (EMET) Default Actions and Mitigations Settings must enable Banned Functions.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-42218-8" />
        <description>The Enhanced Mitigation Experience Toolkit (EMET) Default Actions and Mitigations Settings must enable Banned Functions.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:9300" comment="'Default Actions and Mitigations Settings, Banned Functions' is 'Enabled'" />
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Check to see if EMET 5.5 is installed." />
        </criteria>
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="If EMET uninstalled and DEP, SEHOP are correctly configured, check is NA" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:95" version="1" class="compliance">
      <metadata>
        <title>WN10-CC-000055</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Simultaneous connections to the Internet or a Windows domain must be limited.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:9500" comment="Verifies 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:97" version="2" class="compliance">
      <metadata>
        <title>Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:9700" comment="'Boot-Start Driver Initialization Policy' is not set to All, ~7~." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:98" version="2" class="compliance">
      <metadata>
        <title>Group Policy objects must be reprocessed even if they have not changed.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:9800" comment="NoGPOistChanges is set to 0." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:99" version="3" class="compliance">
      <metadata>
        <title>The Windows SmartScreen must be configured to require approval from an administrator before running downloaded unknown software.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Windows SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Requiring administrator approval before running unknown software will prevent users from executing potentially malicious programs.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:9900" comment="EnableSmartScreen has value of 1." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:100" version="2" class="compliance">
      <metadata>
        <title>Basic authentication for RSS feeds over HTTP must not be used.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Basic authentication uses plain text passwords that could be used to compromise a system.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:10000" comment="AllowBasicAuthInClear reg value set to not 1" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:101" version="1" class="compliance">
      <metadata>
        <title>File Explorer shell protocol must run in protected mode.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The shell protocol will limit the set of folders applications can open when run in protected mode. Restricting files an application can open, to a limited set of folders, increases the security of Windows.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:10100" comment="'Turn off shell protocol protected mode' is set to 'Disabled' or 'Not Configured'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:104" version="1" class="compliance">
      <metadata>
        <title>Explorer Data Execution Prevention</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Explorer Data Execution Prevention must be enabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:10400" comment="Verifies 'Turn off Data Execution Prevention for Explorer' is set to 'Disabled' or 'Not Configured'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:105" version="5" class="compliance">
      <metadata>
        <title>WN10-EM-000015</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) Default Protections for Popular Software must be enabled.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="Verifies EMET is not installed, but DEP and SEHOP are properly configured per V-68845 and V-68849" />
        <criteria operator="AND">
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Verifies currently accepted EMET version is installed." />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10500" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\7-Zip\7z.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10501" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\7-Zip\7zFM.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10502" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\7-Zip\7zG.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10503" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Adobe\Adobe Photoshop CS*\Photoshop.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10504" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Foxit Reader\Foxit Reader'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10505" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Google\Chrome\Application\chrome.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10506" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Google\Google Talk\googletalk.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10507" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\iTunes\iTunes.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10508" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Microsoft Lync\communicator.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10509" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\mIRC\mirc.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10510" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Mozilla Firefox\firefox.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10511" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Mozilla Firefox\plugin-container.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10512" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Mozilla Thunderbird\plugin-container.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10513" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Mozilla Thunderbird\thunderbird.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10514" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Opera\*\opera.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10515" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Opera\opera.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10516" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Pidgin\pidgin.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10517" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\QuickTime\QuickTimePlayer.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10518" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Real\RealPlayer\realconverter.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10519" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Real\RealPlayer\realplay.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10520" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Safari\Safari.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10521" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\SkyDrive\SkyDrive.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10522" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Skype\Phone\Skype.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10523" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\VideoLAN\VLC\vlc.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10524" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Winamp\winamp.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10525" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Windows Live\Mail\wlmail.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10526" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Windows Live\Photo Gallery\WLXPhotoGallery.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10527" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Windows Live\Writer\WindowsLiveWriter.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10528" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Windows Media Player\wmplayer.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10529" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinRAR\rar.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10530" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinRAR\unrar.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10531" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinRAR\winrar.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10532" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinZip\winzip32.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10533" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinZip\winzip64.exe'" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:106" version="4" class="compliance">
      <metadata>
        <title>WN10-EM-000020</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) Default Protections for Recommended Software must be enabled.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="Verifies EMET is not installed, but DEP and SEHOP are properly configured per V-68845 and V-68849" />
        <criteria operator="AND">
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Verifies currently accepted EMET version is installed" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10600" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Adobe\*\Reader\AcroRd32.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10601" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Adobe\Acrobat*\Acrobat\Acrobat.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10602" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\java.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10603" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\javaw.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10604" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\javaws.exe'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10605" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\EXCEL.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10606" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\INFOPATH.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10607" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\LYNC.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10608" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\MSACCESS.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10609" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\MSPUB.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10610" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\OIS.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10611" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\OUTLOOK.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10612" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\POWERPNT.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10613" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\PPTVIEW.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10614" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\VISIO.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10615" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\VPREVIEW.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10616" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\WINWORD.EXE'" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10617" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WindowsNT\Accessories\wordpad.exe'" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:108" version="1" class="compliance">
      <metadata>
        <title>WN10-CC-000130</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Local users on domain-joined computers must not be enumerated.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:82" comment="non-domain system" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:402100" comment="Verifies 'Enumerate local users on domain-joined computers' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:109" version="2" class="compliance">
      <metadata>
        <title>Unsupported Service Packs</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Systems must be maintained at a supported service pack level.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10900" comment="Verifies the OS Version is equal to or greater than 6.3" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10901" comment="Verifies the OS Build is equal to or greater than 10586" />
        </criteria>
        <criteria operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10902" comment="Verify the OS is Windows 10 Enterprise LTSB" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:10903" comment="Verifies the OS Build is equal to or greater than 10240 for Windows 10 Enterprise LTSB" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:113" version="1" class="compliance">
      <metadata>
        <title>Users must be notified if a web-based program attempts to install software.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Web-based programs may attempt to install malicious software on a system. Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11300" comment="'SafeForScripting' is set to 'Disabled' or 'Not Configured'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:114" version="1" class="compliance">
      <metadata>
        <title>Caching of logon credentials must be limited.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:82" comment="Pass if Standalone system" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11400" comment="'Interactive logon: Number of previous logons to cache' is set to 10 or less" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:115" version="1" class="compliance">
      <metadata>
        <title>User Account Control must automatically deny elevation requests for standard users.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. Denying elevation requests from standard user accounts requires tasks that need elevation to be initiated by accounts with administrative privileges. This ensures correct accounts are used on the system for privileged tasks to help mitigate credential theft.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11500" comment="'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatially deny elevation requests', 0" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:116" version="3" class="compliance">
      <metadata>
        <title>WN10-EM-000010</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) Default Protections for Internet Explorer must be enabled.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="Verifies EMET is not installed, but DEP and SEHOP are properly configured per V-68845 and V-68849" />
        <criteria operator="AND">
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Verify a currently allowed version of EMET is installed." />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:11600" comment="Verifies 'Default Protections for Internet Explorer' is set to 'Enabled'" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:117" version="1" class="compliance">
      <metadata>
        <title>WN10-AU-000135</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit System - Other System Events failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Process Creation - Success">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11700" comment="Audit - Other System Events - Failure only" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11701" comment="Audit - Other System Events - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:118" version="2" class="compliance">
      <metadata>
        <title>WN10-AU-000130</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit System - Other System Events successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Other System Events - Success">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11800" comment="Audit - Other System Events - Success only" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11801" comment="Audit - Other System Events - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:119" version="1" class="compliance">
      <metadata>
        <title>WN10-AU-000055</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Logon/Logoff - Account Lockout successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Special Logon - Success">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11900" comment="Audit - Account Lockout - Success only" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11901" comment="Audit - Account Lockout - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:120" version="1" class="compliance">
      <metadata>
        <title>Data Execution Prevention (DEP) must be configured to at least OptOut.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Data Execution Prevention (DEP) must be configured to at least OptOut.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:12000" comment="Verifies DEP is set to 'OptOut'" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:12001" comment="Verifies DEP is set to 'AlwaysOn'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:121" version="1" class="compliance">
      <metadata>
        <title>Data Execution Prevention (DEP) must be configured to at least Opt Out.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Data Execution Prevention (DEP) must be configured to at least Opt Out.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Verifies EMET 5.5 or higher is installed" />
          <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4052" comment="Verifies 'System DEP' is set to 'Enabled' with 'Application Opt Out' or 'Always On' selected" />
        </criteria>
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:120" comment="Verify DEP is set to 'OptOut' or 'AlwaysOn' using BCDEdit method" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:122" version="1" class="compliance">
      <metadata>
        <title>Structured Exception Handling Overwrite Protection (SEHOP) must be turned on in the registry.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Structured Exception Handling Overwrite Protection (SEHOP) must be turned on in the registry.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:12200" comment="Verifies SEHOP is on and configured correctly" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:123" version="1" class="compliance">
      <metadata>
        <title>Structured Exception Handling Overwrite Protection (SEHOP) must be turned on.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Structured Exception Handling Overwrite Protection (SEHOP) must be turned on.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:122" comment="Verifies SEHOP is on and configured correctly" />
        <criteria operator="AND">
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Verifies EMET 5.5 or higher is installed" />
          <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4053" comment="Verifies 'System SEHOP' is set to 'Enabled' with 'Application Opt Out' selected" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:124" version="1" class="compliance">
      <metadata>
        <title>EMET is not installed but DEP and SEHOP are enabled and configured correctly.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>EMET is not installed but DEP and SEHOP are enabled and configured correctly.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:120" comment="Verifies DEP is enabled and set to 'OptOut' or 'AlwaysOn'" />
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:122" comment="Verifies SEHOP is on and configured correctly" />
        <criterion test_ref="oval:mil.disa.fso.windows:tst:439601" comment="Verifies EMET is installed" negate="true" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:125" version="1" class="compliance">
      <metadata>
        <title>The Enhanced Mitigation Experience Toolkit (EMET) v5.5 or later must be installed on the system.</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) v5.5 or later must be installed on the system.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Verifies EMET v5.5 is installed" />
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="Verifies EMET is not installed, but DEP and SEHOP are properly configured per V-68845 and V-68849" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:126" version="1" class="compliance">
      <metadata>
        <title>WN10-EM-000025</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Enhanced Mitigation Experience Toolkit (EMET) system-wide Address Space Layout Randomization (ASLR) must be enabled and configured to Application Opt In.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="Verifies EMET is not installed, but DEP and SEHOP are properly configured per V-68845 and V-68849" />
        <criteria operator="AND">
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Verify a currently allowed version of EMET is installed." />
          <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4048" comment="Verifies 'System ASLR' is set to 'Enabled' with 'Application Opt In' selected" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:127" version="2" class="compliance">
      <metadata>
        <title>The Enhanced Mitigation Experience ToolkitEMET system-wide Structured Exception Handler Overwrite Protection (SEHOP) must be configured to Application Opt Out.</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-42187-5" />
        <description>The Enhanced Mitigation Experience Toolkit (EMET) system-wide Structured Exception Handler Overwrite Protection (SEHOP) must be configured to Application Opt Out.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4053" comment="The Enhanced Mitigation Experience Toolkit (EMET) system-wide Structured Exception Handler Overwrite Protection (SEHOP) must be configured to Application Opt Out." />
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Check to see if EMET 5.5 is installed." />
        </criteria>
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="If EMET is uninstalled and DEP, SEHOP are correctly configured, check is NA" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:128" version="1" class="compliance">
      <metadata>
        <title>The Enhanced Mitigation Experience Toolkit (EMET) system-wide Data Execution Prevention (DEP) must be enabled and configured to at least Application Opt Out</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="http://cce.mitre.org" ref_id="CCE-42073-7" />
        <description>Multiple error reports of the same error type are useful in diagnosing potential system configuration issues, as well as intrusion activity. This setting controls whether error reporting collects additional, second-level report data even if a CAB file containing data about the event types has already been collected.</description>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition definition_ref="oval:mil.disa.stig.windows:def:11" comment="Check to see if EMET 5.5 is installed." />
          <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4052" comment="Check to see if EMET 5.5 is installed." />
        </criteria>
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:124" comment="The Enhanced Mitigation Experience Toolkit (EMET) system-wide Data Execution Prevention (DEP) must be enabled and configured to at least Application Opt Out." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:129" version="1" class="compliance">
      <metadata>
        <title>Built-in Admin Account Status</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The built-in administrator account must be disabled.</description>
        <reference source="http://cce.mitre.org" ref_id="CCE-43470-4" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:12900" comment="Verifies 'Accounts: Administrator account status' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:130" version="1" class="compliance">
      <metadata>
        <title>Built-in Guest Account Status</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The built-in guest account must be disabled.</description>
        <reference source="http://cce.mitre.org" ref_id="CCE-41528-1" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:13000" comment="Verifies 'Accounts: Guest account status' is set to 'Disabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:131" version="2" class="compliance">
      <metadata>
        <title>Rename Built-in Administrator Account</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The built-in administrator account must be renamed.</description>
        <reference source="http://cce.mitre.org" ref_id="CCE-42970-4" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:13100" comment="Verifies 'Accounts: Rename administrator account' is not set to 'Administrator'" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:13101" comment="Verifies 'Accounts: Rename administrator account' is not set to 'localdomain\Administrator'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:132" version="2" class="compliance">
      <metadata>
        <title>Rename Built-in Guest Account</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The built-in guest account must be renamed.</description>
        <reference source="http://cce.mitre.org" ref_id="CCE-43078-5" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:13200" comment="Verifies 'Accounts: Rename guest account' is not set to 'Guest'" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:13201" comment="Verifies 'Accounts: Rename guest account' is not set to 'localdomain\Guest'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:133" version="1" class="compliance">
      <metadata>
        <title>The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store.</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate must be installed into the Untrusted Certificates Store.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4877" comment="US DoD CCEB Interoperability Root cross-certs must be installed." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:134" version="1" class="compliance">
      <metadata>
        <title>WINPK-000003 DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate. Windows 10</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate must be installed into the Untrusted Certificates Store.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4876" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate must be installed into the Untrusted Certificates Store." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:135" version="1" class="compliance">
      <metadata>
        <title>WINPK-000002 External CA Root Certificate - Win10</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The External CA Root Certificate must be installed into the Trusted Root Store.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4875" comment="The External CA Root Certificate must be installed into the Trusted Root Store." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:136" version="1" class="compliance">
      <metadata>
        <title>WINPK-000001 DoD Root Certificate - Win10</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The DoD Root Certificate must be installed into the Trusted Root Store.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4874" comment="The External CA Root Certificate must be installed into the Trusted Root Store." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:137" version="1" class="compliance">
      <metadata>
        <title>WN10-CC-000326</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>PowerShell Script block logging must be enabled.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:13700" comment="Verifies PowerShell Script Block Logging is endabled" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:139" version="1" class="compliance">
      <metadata>
        <title>WN10-CC-000066</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Command line data must be included in process creation events.</description>
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:13900" comment="Verifies command line data is included in process creation events is endabled" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:140" version="1" class="compliance">
      <metadata>
        <title>WN10-00-000155</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Windows PowerShell 2.0 feature must be disabled on the system.</description>
      </metadata>
      <criteria>
        <criteria comment="Determine if Windows PowerShell 2.0 feature is disabled" operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:14000" comment="Check the WMI Objects to see if the Windows PowerShell 2.0 Win32_OptionalFeature is at InstallState 2" />
          <criterion test_ref="oval:mil.disa.stig.windows:tst:14001" comment="Check the WMI Objects to see if the Windows PowerShell 2.0 Engine Win32_OptionalFeature is at InstallState 2" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:141" version="1" class="compliance">
      <metadata>
        <title>WN10-00-000160</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Server Message Block (SMB) v1 protocol must be disabled on the system.</description>
      </metadata>
      <criteria>
        <criteria comment="Determine if SMB v1 protocol is disabled" operator="AND">
          <criterion test_ref="oval:mil.disa.stig.windows:tst:14100" comment="Check the WMI Objects to see if the SMB1Protocol Win32_OptionalFeature is at InstallState 2" />
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:147" version="1" class="compliance">
      <metadata>
        <title>WN10-AU-000054</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Logon/Logoff - Account Lockout failures.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Special Logon - Success">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:14700" comment="Audit - Account Lockout - Failure only" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:11901" comment="Audit - Account Lockout - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:148" version="1" class="compliance">
      <metadata>
        <title>WN10-CC-000038</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>WDigest Authentication must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:14800" comment="Verifies the WDigest Authentication is disabled." />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:150" version="1" class="compliance">
      <metadata>
        <title>The system must be configured to audit Policy Change - Authorization Policy Change successes.</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The system must be configured to audit Policy Change - Audit Policy Change successes.</description>
      </metadata>
      <criteria operator="OR" comment="Audit - Audit Policy Change - Success">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15000" comment="Audit - Audit Policy Change - Success only" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15001" comment="Audit - Audit Policy Change - Success and Failure" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:151" version="1" class="compliance">
      <metadata>
        <title>Prohibit Internet Connection Sharing</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="71765" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Internet connection sharing must be disabled.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15100" comment="Verifies 'Prohibit use of Internet Connection Sharing on your DNS domain network' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:152" version="1" class="compliance">
      <metadata>
        <title>Security Account Manager (SAM) RPC</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="71771" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15200" comment="Allow Administrators group to make remote calls to SAM" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:153" version="1" class="compliance">
      <metadata>
        <title>Microsoft Consumer Experience</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="71771" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Microsoft consumer experiences must be turned off.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15300" comment="Verifies 'Turn off Microsoft consumer experiences' is set to 'Enabled'" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:154" version="1" class="compliance">
      <metadata>
        <title>Run as different user</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="72329" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>Run as different user must be removed from context menus.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15400" comment="Verifies 'Remove 'Run as Different User' from context menus' is set to 'Enabled' (batfile)" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15401" comment="Verifies 'Remove 'Run as Different User' from context menus' is set to 'Enabled' (cmdfile)" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15402" comment="Verifies 'Remove 'Run as Different User' from context menus' is set to 'Enabled' (exefile)" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15403" comment="Verifies 'Remove 'Run as Different User' from context menus' is set to 'Enabled' (mscfile)" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:155" version="1" class="compliance">
      <metadata>
        <title>UR: Deny log on as a batch job</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>The Deny log on as a batch job user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="OR">
        <extend_definition definition_ref="oval:mil.disa.fso.windows:def:4982" comment="System is not a member of a domain" />
        <extend_definition definition_ref="oval:mil.disa.stig.windows:def:156" comment="Deny log on as a batch job - Domain Joined Systems" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:156" version="1" class="compliance">
      <metadata>
        <title>UR: Deny log on as a batch job - Domain Systems</title>
        <affected family="windows">
          <platform>Microsoft Windows 10</platform>
        </affected>
        <reference source="DISA" ref_id="26483" ref_url="http://iase.disa.mil/stigs/SRR/index.html" />
        <description>The Deny log on as a batch job user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="System is not a member of a domain" definition_ref="oval:mil.disa.fso.windows:def:4982" negate="true" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15600" comment="Deny log on as a batch job - Domain Admins" />
        <criterion test_ref="oval:mil.disa.stig.windows:tst:15601" comment="Deny log on as a batch job - Enterprise Admins" />
      </criteria>
    </definition>
    <definition id="oval:mil.disa.stig.windows:def:4029" version="3" class="compliance">
      <metadata>
        <title>Remote Assistance - Solicit Remote Assistance</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
          <platform>Microsoft Windows 10</platform>
        </affected>
        <description>Solicited Remote Assistance must not be allowed.</description>
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.stig.windows:tst:402900" comment="Verifies 'Configure Solicited Remote Assistance' is set to 'Disabled'" />
      </criteria>
    </definition>
  </definitions>
  <tests>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:388700" version="2" comment="TFTP Client feature is not installed" check_existence="none_exist" check="at least one">
      <object object_ref="oval:mil.disa.fso.windows:obj:388700" />
    </file_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:388900" version="2" comment="Telnet Client feature is not installed" check_existence="none_exist" check="at least one">
      <object object_ref="oval:mil.disa.fso.windows:obj:388900" />
    </file_test>
    <lockoutpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393100" version="5" comment="'Account lockout duration' is set to '0'" check_existence="at_least_one_exists" state_operator="OR" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393101" />
    </lockoutpolicy_test>
    <lockoutpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393200" version="2" comment="'Account lockout threshold' is set to '3' or less" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393200" />
    </lockoutpolicy_test>
    <lockoutpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393201" version="5" comment="'Account lockout threshold' is not set to '0'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393201" />
    </lockoutpolicy_test>
    <lockoutpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393300" version="3" comment="'Reset account lockout counter after' is set to at least the required value" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393300" />
    </lockoutpolicy_test>
    <passwordpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393400" version="2" comment="'Enforce password history' is set to '24' passwords or more" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393400" />
    </passwordpolicy_test>
    <passwordpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393500" version="2" comment="'Maximum Password Age' is set to '60' days or less" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393500" />
    </passwordpolicy_test>
    <passwordpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393501" version="2" comment="'Maximum Password Age' is not set to '0'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393501" />
    </passwordpolicy_test>
    <passwordpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393600" version="2" comment="'Minimum Password Age' is set to at least '1' day" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393600" />
    </passwordpolicy_test>
    <passwordpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393700" version="2" comment="'Minimum password length' is set to at least '14' characters" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393700" />
    </passwordpolicy_test>
    <passwordpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393800" version="2" comment="'Password must meet complexity requirements' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393800" />
    </passwordpolicy_test>
    <passwordpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:393900" version="2" comment="'Store password using reversible encryption' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:393900" />
    </passwordpolicy_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394000" version="2" comment="'Audit Credential Validation' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394000" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394100" version="2" comment="'Audit Credential Validation' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394100" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394101" version="2" comment="'Audit Credential Validation' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394101" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394200" version="2" comment="'Audit Other Account Management Events' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394200" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394300" version="2" comment="'Audit Other Account Management Events' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394300" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394301" version="2" comment="'Audit Other Account Management Events' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394301" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394400" version="2" comment="'Audit Security Group Management' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394400" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394500" version="2" comment="'Audit Security Group Management' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394500" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394501" version="2" comment="'Audit Security Group Management' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394501" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394600" version="2" comment="'Audit User Account Management' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394600" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394700" version="2" comment="'Audit User Account Management' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394700" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394701" version="2" comment="'Audit User Account Management' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394701" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394800" version="2" comment="'Audit Process Creation' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394800" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394801" version="2" comment="'Audit Process Creation' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394801" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394900" version="2" comment="'Audit Logoff' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394900" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:394901" version="2" comment="'Audit Logoff' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:394901" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395000" version="2" comment="'Audit Logon' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395000" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395100" version="2" comment="'Audit Logon' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395100" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395101" version="2" comment="'Audit Logon' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395101" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395200" version="2" comment="'Audit Special Logon' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395200" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395201" version="2" comment="'Audit Special Logon' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395201" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395700" version="2" comment="'Audit Audit Policy Change' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395700" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395800" version="2" comment="'Audit Audit Policy Change' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395800" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395801" version="2" comment="'Audit Audit Policy Change' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395801" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395900" version="2" comment="'Audit Authentication Policy Change' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395900" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:395901" version="2" comment="'Audit Authentication Policy Change' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:395901" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396000" version="2" comment="'Audit Sensitive Privilege Use' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396000" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396100" version="2" comment="'Audit Sensitive Privilege Use' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396100" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396101" version="2" comment="'Audit Sensitive Privilege Use' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396101" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396200" version="2" comment="'Audit IPSec Driver' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396200" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396300" version="2" comment="'Audit IPSec Driver' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396300" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396301" version="2" comment="'Audit IPSec Driver' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396301" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396500" version="2" comment="'Audit Security State Change' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396500" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396501" version="2" comment="'Audit Security State Change' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396501" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396600" version="2" comment="'Audit Security System Extension' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396600" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396700" version="2" comment="'Audit Security System Extension' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396700" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396701" version="2" comment="'Audit Security System Extension' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396701" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396800" version="2" comment="'Audit System Integrity' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396800" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396900" version="2" comment="'Audit System Integrity' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396900" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:396901" version="2" comment="'Audit System Integrity' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:396901" />
    </auditeventpolicysubcategories_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:398500" version="2" comment="'Prohibit connection to non-domain networks when connected to domain authenticated network' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:398500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:400200" version="2" comment="'Turn off downloading of print drivers over HTTP' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:400200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:400200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:400700" version="2" comment="'Turn off Internet download for Web publishing and online ordering wizards' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:400700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:400700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:400900" version="2" comment="'Turn off printing over HTTP' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:400900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:400900" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:402100" version="2" comment="'Enumerate local users on domain-joined computers' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:402100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:402300" version="2" comment="'Turn on PIN sign-in' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:402300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:402400" version="2" comment="'Require a password when a computer wakes (on battery)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:402400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:402400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:402500" version="2" comment="'Require a password when a computer wakes (plugged in)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:402500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:402500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:403400" version="2" comment="'Restrict Unauthenticated RPC clients' is set to 'Enabled' and 'Authenticated'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:403400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:403400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:404100" version="3" comment="'Turn off Inventory Collector' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:404100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:404100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:404200" version="2" comment="'Disallow Autoplay for non-volume devices' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:404200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:404200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:404300" version="2" comment="'Default behavior for AutoRun' is set to 'Enabled:Do not execute any autorun commands'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:404300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:404300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:404400" version="2" comment="'Turn off AutoPlay' is set to 'Enabled:All Drives'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:404400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:404400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:404700" version="2" comment="'Enumerate administrator accounts on elevation' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:404700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:404700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:404800" version="2" comment="'System ASLR' is set to 'Enabled' with 'Application Opt In' selected" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:404800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:404800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:405200" version="2" comment="'System DEP' is set to 'Enabled' with 'Application Opt Out' selected" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:405200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:405201" version="1" comment="'System DEP' is set to 'Enabled' with 'Always On' selected" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:405200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:405300" version="3" comment="'System SEHOP' is set to 'Enabled' with 'Application Opt Out' selected" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:405300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:405400" version="2" comment="'Specify the maximum log size (KB)' is set at a minimum to 'Enabled:32768'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:405400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:405400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:405500" version="3" comment="'Specify the maximum log size (KB)' is set at a minimum to 'Enabled:196608'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:405500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:405500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:405700" version="2" comment="'Specify the maximum log size (KB)' is set at a minimum to 'Enabled:32768'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:405700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:405700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:406000" version="3" comment="'Turn off heap termination on corruption' is set to 'Disabled'" check_existence="any_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:406000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:406000" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:406600" version="2" comment="'Do not allow passwords to be saved' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:406600" />
      <state state_ref="oval:mil.disa.fso.windows:ste:406600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:406800" version="2" comment="'Do not allow drive redirection' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:406800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:406800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:406900" version="2" comment="'Always prompt for password upon connection' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:406900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:406900" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:407000" version="2" comment="'Set client connection encryption level' is set to 'Enabled' and 'High Level'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:407000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:407000" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:407500" version="2" comment="'Prevent downloading of enclosures' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:407500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:407700" version="2" comment="'Allow indexing of encrypted files' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:407700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:407700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:408400" version="2" comment="'Enable user control over installs' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:408400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:408500" version="2" comment="'Always install with elevated privileges' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:408500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:409200" version="2" comment="'Allow Basic authentication' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:409200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:409300" version="2" comment="'Allow unencrypted traffic' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:409300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:409400" version="2" comment="'Disallow Digest authentication' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:409400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:409500" version="2" comment="'Allow Basic authentication' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:409500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:409600" version="2" comment="'Allow unencrypted traffic' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:409600" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:409700" version="2" comment="'Disallow WinRM from storing RunAs credentials' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:409700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:409900" version="2" comment="'Require secure RPC communication' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:409900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:413900" version="2" comment="Local admin accounts filtered token policy is enabled on domain systems" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:413900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:397100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:414300" version="3" comment="'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:414300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:414300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:414800" version="2" comment="'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:414800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:414800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:415100" version="2" comment="'Domain member: Digitally encrypt or sign secure channel data (always)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:415100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:415100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:415101" version="1" comment="'Domain member: Digitally encrypt or sign secure channel data (always)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:415100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:415200" version="3" comment="'Domain member: Digitally encrypt secure channel data (when possible)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:415200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:415200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:415300" version="3" comment="'Domain member: Digitally sign secure channel data (when possible)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:415300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:415300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:415400" version="2" comment="'Domain member: Disable machine account password changes' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:415400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:415400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:415500" version="2" comment="'Domain member: Maximum machine account password age' is set to '30' days or less" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:415500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:415500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:415501" version="2" comment="'Domain member: Maximum machine account password age' is not set to '0'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:415500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:407101" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:415600" version="2" comment="'Domain member: Require strong (Windows 2000 or later) session key' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:415600" />
      <state state_ref="oval:mil.disa.fso.windows:ste:415600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:416600" version="2" comment="'Interactive logon: Smart card removal behavior' is set to 'Lock Workstation'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:416600" />
      <state state_ref="oval:mil.disa.fso.windows:ste:416600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:416601" version="2" comment="'Interactive logon: Smart card removal behavior' is set to 'Force Logoff'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:416600" />
      <state state_ref="oval:mil.disa.fso.windows:ste:416601" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:416700" version="2" comment="'Microsoft Network Client: Digitally sign communications (always)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:416700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:416700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:416800" version="2" comment="'Microsoft network client: Digitally sign communications (if server agrees)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:416800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:416800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:416900" version="2" comment="'Microsoft Network Client: Send unencrypted password to connect to third-party SMB servers' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:416900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:416900" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:417000" version="2" comment="'Microsoft network server: Amount of idle time required before suspending session' is set to '15' minutes or less" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:417000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:417000" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:417100" version="2" comment="'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:417100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:417100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:417200" version="2" comment="'Microsoft network server: Digitally sign communications (if client agrees)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:417200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:417200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:417600" version="2" comment="'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' is set to 'Highest protection, source routing is completely disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:417600" />
      <state state_ref="oval:mil.disa.fso.windows:ste:417600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:417700" version="2" comment="'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set to 'Highest protection, source routing is completely disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:417700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:417700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:417800" version="2" comment="'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:417800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:417800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:418200" version="2" comment="'MSS: (NoNameReleaseOnDemand) Allow computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:418200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:418200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:419000" version="2" comment="'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:419000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:419000" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:419100" version="2" comment="'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:419100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:419100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:419200" version="2" comment="'Network access: Do not allow storage of credentials or .NET Passports for network authentication' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:419200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:419200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:419300" version="2" comment="'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:419300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:419300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:419700" version="2" comment="'Network access: Restrict anonymous access to Named Pipes and Shares' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:419700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:419700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420000" version="2" comment="'Network Security: Allow Local System to use computer identity for NTLM' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420000" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420100" version="2" comment="'Network security: Allow LocalSystem NULL session fallback' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420200" version="2" comment="'Network Security: Allow PKU2U authentication requests to this computer to use online identities' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420300" version="2" comment="'Network Security: Configure encryption types allowed for Kerberos' is set to 'Enabled' with 'RC4_HMAC_MD5', 'AES128_HMAC_SHA1', 'AES256_HMAC_SHA1', 'Future encryption types'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420400" version="2" comment="'Network security: Do not store LAN Manager hash value on next password change' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420400" />
    </registry_test>
    <lockoutpolicy_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420500" version="2" comment="'Network security: Force logoff when logon hours expire' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:393200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420500" />
    </lockoutpolicy_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420600" version="2" comment="'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM &amp; NTLM' (Level 5)" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420600" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420700" version="2" comment="'Network security: LDAP client signing requirements' is set to at a minimum 'Negotiate signing'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420800" version="2" comment="'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require NTLMv2 session security'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420801" version="2" comment="'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require 128-bit encryption'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420801" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420900" version="2" comment="'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require NTLMv2 session security'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:420901" version="2" comment="'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require 128-bit encryption'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:420900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:420801" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:421300" version="2" comment="'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:421300" />
      <state state_ref="oval:mil.disa.fso.windows:ste:421300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:421400" version="2" comment="'System objects: Require case insensitivity for non-Windows subsystems' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:421400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:421400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:421500" version="2" comment="'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:421500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:421500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:421600" version="2" comment="'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:421600" />
      <state state_ref="oval:mil.disa.fso.windows:ste:421600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:421700" version="2" comment="'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:421700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:421700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:421701" version="1" comment="'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for credentials on the secure desktop'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:421700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:421900" version="2" comment="'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:421900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:421900" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:422100" version="2" comment="'User Account Control: Only elevate UIAccess applications that are installed in secure locations' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:422100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:422100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:422200" version="2" comment="'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:422200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:422200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:422400" version="2" comment="'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:422400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:422400" />
    </registry_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:424000" version="2" comment="Act as part of the operating system - None" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:424000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:424000" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:424900" version="2" comment="Create a token object - None" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:424000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:424900" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:425100" version="2" comment="Create permanent shared objects - None" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:424000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:425100" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:425300" version="3" comment="Debug Programs - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:425300" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:425900" version="2" comment="Enable computer and user accounts to be trusted for delegation - None" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:424000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:425900" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:426600" version="2" comment="Lock pages in memory - None" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:424000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:426600" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:437300" version="3" comment="Deny log on as a service - None" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:424000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:437201" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:437400" version="2" comment="Deny log on as a service - Domain Admins" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:437200" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:437401" version="2" comment="Deny log on as a service - Enterprise Admins" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437101" />
      <state state_ref="oval:mil.disa.fso.windows:ste:437200" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:437600" version="2" comment="Deny log on locally - Guests" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437001" />
      <state state_ref="oval:mil.disa.fso.windows:ste:437500" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:437700" version="2" comment="Deny log on locally - Domain Admins" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:437500" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:437701" version="2" comment="Deny log on as a locally - Enterprise Admins" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437101" />
      <state state_ref="oval:mil.disa.fso.windows:ste:437500" />
    </accesstoken_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:439601" version="2" comment="EMET is installed" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:439601" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:473000" version="1" comment="'Interactive logon: Machine inactivity limit' is set to '900' seconds or less" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:473000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:473000" />
    </registry_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:474000" version="1" check="all" comment="Access Credential Manager as a trusted caller - None">
      <object object_ref="oval:mil.disa.fso.windows:obj:461700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:474000" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:477500" version="3" comment="Deny access to this computer from the network - Guests" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437001" />
      <state state_ref="oval:mil.disa.fso.windows:ste:477500" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:477501" version="1" comment="Deny access to this computer from the network - Domain Admins" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:477500" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:477502" version="1" comment="Deny access to this computer from the network - Enterprise Admins" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437101" />
      <state state_ref="oval:mil.disa.fso.windows:ste:477500" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:477508" version="2" comment="Deny access to this computer from the network - Local account" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:477509" />
      <state state_ref="oval:mil.disa.fso.windows:ste:477500" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:477800" version="1" comment="Deny log on through Remote Desktop Services - Guests" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437001" />
      <state state_ref="oval:mil.disa.fso.windows:ste:477800" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:477801" version="1" comment="Deny log on through Remote Desktop Services - Domain Admins" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:477800" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:477802" version="1" comment="Deny log on through Remote Desktop Services - Enterprise Admins" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:437101" />
      <state state_ref="oval:mil.disa.fso.windows:ste:477800" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:477808" version="2" comment="Deny log on through Remote Desktop Services - Local account" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:477509" />
      <state state_ref="oval:mil.disa.fso.windows:ste:477800" />
    </accesstoken_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:484700" version="1" comment="Legal Notice is configured with the required text." check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:484700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:484700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:484701" version="1" comment="Legal Notice is configured with the required text." check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:484700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:484701" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:484800" version="1" comment="Legal Notice Caption - DoD Notice and Consent Banner" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:484800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:484800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:484801" version="1" comment="Legal Notice Caption - US Department of Defense Warning Statement" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:484800" />
      <state state_ref="oval:mil.disa.fso.windows:ste:484801" />
    </registry_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:484900" version="1" comment="Access this computer from the network - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:484900" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:485100" version="1" comment="Allow log on locally - Administrators, Users" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:485100" />
      <state state_ref="oval:mil.disa.fso.windows:ste:485100" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:485200" version="1" comment="Back up files and directories - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:485200" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:485400" version="1" comment="Change the system time - Administrators, Local Service" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:485400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:485400" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:485600" version="1" comment="Create a pagefile - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:485600" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:485700" version="1" comment="Create global objects - Administrators, Service, Local Service, Network Service" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:485700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:485700" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:485800" version="1" comment="Create symbolic links - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:485800" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:485900" version="1" comment="Force shutdown from a remote system - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:485900" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:486000" version="1" comment="Generate security audits - Local Service, Network Service" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:486000" />
      <state state_ref="oval:mil.disa.fso.windows:ste:486000" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:486100" version="1" comment="Impersonate a client after authentication - Administrators, Service, Local Service, Network Service" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:485700" />
      <state state_ref="oval:mil.disa.fso.windows:ste:486100" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:486300" version="1" comment="Increase scheduling priority - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:486300" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:486400" version="1" comment="Load and unload device drivers - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:486400" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:486500" version="2" check="all" check_existence="any_exist" comment="Manage auditing and security log - Administrators">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:486500" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:486600" version="1" comment="Modify firmware environment values - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:486600" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:486700" version="1" comment="Perform volume maintenance tasks - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:486700" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:486800" version="1" comment="Profile single process - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:486800" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487100" version="1" comment="Restore files and directories - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:487100" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487300" version="1" comment="Take ownership of files or other objects - Administrators" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:425301" />
      <state state_ref="oval:mil.disa.fso.windows:ste:487300" />
    </accesstoken_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487400" version="3" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -8C" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487401" version="3" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -8C" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487401" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487402" version="3" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -8C" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487402" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487403" version="3" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -8C" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487403" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487404" version="1" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -D7" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487404" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487405" version="1" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -D7" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487405" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487406" version="1" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -D7" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487406" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487407" version="1" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -D7" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487407" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487408" version="1" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -B8" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487408" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487409" version="1" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -B8" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487409" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487410" version="1" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -B8" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487410" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487411" version="1" comment="Verifies the DoD Root Certificate is installed into the Trusted Root Store. -B8" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487411" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487500" version="3" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -C3" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487501" version="3" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -C3" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487502" version="3" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -C3" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487502" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487503" version="3" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -C3" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487503" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487504" version="1" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -73" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487504" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487505" version="1" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -73" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487505" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487506" version="1" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -73" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487506" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487507" version="1" comment="Verifies the External CA Root Certificate is installed into the Trusted Root Store. -73" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487507" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487600" version="4" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -22" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487601" version="4" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -22" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487601" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487602" version="4" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -22" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487602" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487603" version="4" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -22" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487604" version="2" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FF" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487604" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487605" version="2" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FF" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487605" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487606" version="2" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FF" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487606" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487607" version="2" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FF" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487607" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487608" version="2" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FC" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487608" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487609" version="2" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FC" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487609" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487610" version="2" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FC" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487610" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487611" version="2" comment="The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate is installed into the Untrusted Certificates Store -FC" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487611" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487704" version="2" comment="The US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate is installed into the Untrusted Certificates Store -DA" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487704" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487705" version="2" comment="The US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate is installed into the Untrusted Certificates Store -DA" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487705" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487706" version="2" comment="The US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate is installed into the Untrusted Certificates Store -DA" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487706" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:487707" version="2" comment="The US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate is installed into the Untrusted Certificates Store -DA" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:487707" />
    </registry_test>
    <wmi_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:498200" state_operator="OR" version="1" comment="System is not a member of a domain" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:498200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:498200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:498203" />
    </wmi_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:498500" version="2" comment="'DownloadMode' is set to 'Enabled' with 'None, LAN or Group' selected." state_operator="OR" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:498500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:498500" />
      <state state_ref="oval:mil.disa.fso.windows:ste:498501" />
      <state state_ref="oval:mil.disa.fso.windows:ste:498502" />
    </registry_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:tst:514200" version="1" comment="Deny log on through Remote Desktop Services - Everyone" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:514200" />
      <state state_ref="oval:mil.disa.fso.windows:ste:514200" />
    </accesstoken_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:1100" version="2" comment="EMET 5.5 or higher is installed" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:439606" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:1900" version="1" comment="Mutual Authentication and Integrity for \\*\SYSVOL" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:1900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1901" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1902" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1903" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:1901" version="1" comment="Mutual Authentication and Integrity for \\*\NETLOGON" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:1901" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1901" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1902" />
      <state state_ref="oval:mil.disa.stig.windows:ste:1903" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:2100" version="1" comment="DevicePKInitEnabled (reg_dword) is 1 or does not exist" check_existence="any_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:2100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:2100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:2200" version="1" comment="Untrusted fonts are blocked" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:2200" />
      <state state_ref="oval:mil.disa.stig.windows:ste:2200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:2300" version="1" comment="Verifies 'Disable Wi-Fi Sense' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:2300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:2300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:2400" version="2" comment="AllowTelemetry = 0 or 1" check_existence="at_least_one_exists" check="all" state_operator="OR">
      <object object_ref="oval:mil.disa.stig.windows:obj:2400" />
      <state state_ref="oval:mil.disa.stig.windows:ste:2400" />
      <state state_ref="oval:mil.disa.stig.windows:ste:2401" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:2500" version="1" comment="Verifies 'Allows you to configure password manager' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:2500" />
      <state state_ref="oval:mil.disa.stig.windows:ste:2500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:2501" version="1" comment="If Windows 10 LTSB is installed, EditionID is 'EnterpriseS'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8301" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:2700" version="1" comment="Verifies 'Minimum PIN length' is set to '6' or greater." check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:2700" />
      <state state_ref="oval:mil.disa.stig.windows:ste:2700" />
    </registry_test>
    <wmi_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:3000" version="1" check="all" check_existence="none_exist" comment="Local volumes use NTFS">
      <object object_ref="oval:mil.disa.stig.windows:obj:3000" />
    </wmi_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:3500" version="1" comment="No IIS components are installed" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:3500" />
    </registry_test>
    <wmi57_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:3800" version="5" comment="McAfee Framework Service is running" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:3800" />
      <state state_ref="oval:mil.disa.stig.windows:ste:3800" />
    </wmi57_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:3801" version="1" comment="FrameworkService.exe is version 4 or greater" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:3801" />
      <state state_ref="oval:mil.disa.stig.windows:ste:3801" />
    </file_test>
    <wmi57_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:3802" version="1" comment="McAfee Agent Service is running" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:3803" />
      <state state_ref="oval:mil.disa.stig.windows:ste:3800" />
    </wmi57_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:3803" version="1" comment="masvc.exe is version 5 or greater" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:3804" />
      <state state_ref="oval:mil.disa.stig.windows:ste:3802" />
    </file_test>
    <fileeffectiverights53_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5100" version="2" comment="The Applicaion event log must have at least default permissions. Built Path" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5100" />
    </fileeffectiverights53_test>
    <fileeffectiverights53_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5101" version="2" comment="The Applicaion event log must have at least default permissions. Strict Path" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5103" />
    </fileeffectiverights53_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5102" version="3" comment="The Application event log registry specified location must have the %SystemRoot% environment variable." check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5102" />
      <state state_ref="oval:mil.disa.stig.windows:ste:5104" />
    </registry_test>
    <fileeffectiverights53_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5200" version="2" comment="The Security event log must have at least default permissions. Built Path" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5200" />
    </fileeffectiverights53_test>
    <fileeffectiverights53_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5201" version="2" comment="The Security event log must have at least default permissions. Strict Path" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5203" />
    </fileeffectiverights53_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5202" version="3" comment="The Security event log registry specified location must have the %SystemRoot% environment variable." check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5202" />
      <state state_ref="oval:mil.disa.stig.windows:ste:5104" />
    </registry_test>
    <fileeffectiverights53_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5300" version="1" comment="The System event log must have at least default permissions. Built Path" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5300" />
    </fileeffectiverights53_test>
    <fileeffectiverights53_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5301" version="1" comment="The System event log must have at least default permissions. Strict Path" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5303" />
    </fileeffectiverights53_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5302" version="2" comment="The System event log registry specified location must have the %SystemRoot% environment variable." check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5302" />
      <state state_ref="oval:mil.disa.stig.windows:ste:5104" />
    </registry_test>
    <group_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5400" version="6" comment="Hyper-V Administrators group has no members or does not exist" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5403" />
    </group_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5500" version="1" comment="SNMP feature is not installed" check_existence="none_exist" check="at least one">
      <object object_ref="oval:mil.disa.stig.windows:obj:5500" />
    </file_test>
    <wmi_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:5600" version="1" comment="simptcp service not installed" check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:5600" />
    </wmi_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:6500" version="1" comment="Verifies 'Sign-in last interactive user automatically after a system-initiated restart' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:6500" />
      <state state_ref="oval:mil.disa.stig.windows:ste:6500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:6600" version="1" comment="Verifies 'Do not display network selection UI' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:6600" />
      <state state_ref="oval:mil.disa.stig.windows:ste:6600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:6700" version="1" comment="Verifies 'Allow Microsoft accounts to be optional' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:6700" />
      <state state_ref="oval:mil.disa.stig.windows:ste:6700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:6800" version="1" comment="Verifies 'Prevent the usage of OneDrive for file storage' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:6800" />
      <state state_ref="oval:mil.disa.stig.windows:ste:6800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:6900" version="1" comment="Verifies 'Prevent enabling lock screen slide show' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:6900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:6900" />
    </registry_test>
    <wmi_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:7700" version="1" comment="No active, local accounts have non-expiring passwords." check_existence="none_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:7700" />
    </wmi_test>
    <wmi_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8200" version="2" comment="DomainRole is 0 or 2" check_existence="at_least_one_exists" check="all" state_operator="OR">
      <object object_ref="oval:mil.disa.stig.windows:obj:8200" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8200" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8201" />
    </wmi_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8300" version="2" comment="EditionID is Enterprise or EnterpriseS" check_existence="at_least_one_exists" check="all" state_operator="OR">
      <object object_ref="oval:mil.disa.stig.windows:obj:8300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8301" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8500" version="1" comment="'Enable insecure guest logons' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8500" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8600" version="1" comment="'Use enhanced anti-spoofing when available' is 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8600" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8700" version="1" comment="'Don't allow SmartScreen Filter warning overrides' is 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8700" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8701" version="1" comment="If Windows 10 LTSB is installed, EditionID is 'EnterpriseS'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8301" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8800" version="1" comment="'Don't allow SmartScreen Filter warning overrides for unverified files' is 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8800" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8801" version="1" comment="If Windows 10 LTSB is installed, EditionID is 'EnterpriseS'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8301" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8900" version="1" comment="'Turn off InPrivate browsing' is 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8900" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:8901" version="1" comment="If Windows 10 LTSB is installed, EditionID is 'EnterpriseS'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8301" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9000" version="1" comment="'Turn off the SmartScreen Filter' set to 'Enabled' (setting worded incorrectly)" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:9000" />
      <state state_ref="oval:mil.disa.stig.windows:ste:9000" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9001" version="1" comment="If Windows 10 LTSB is installed, EditionID is 'EnterpriseS'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8301" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9100" version="1" comment="'Default Actions and Mitigations' is 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:9100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:9100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9200" version="1" comment="'Default Actions and Mitigations Settings, Anti Detours' is 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:9200" />
      <state state_ref="oval:mil.disa.stig.windows:ste:9200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9300" version="1" comment="'Default Actions and Mitigations Settings, Banned Functions' is 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:9300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:9300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9500" version="1" comment="'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled'" check_existence="any_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:398400" />
      <state state_ref="oval:mil.disa.fso.windows:ste:398400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9700" version="1" comment="'Boot-Start Driver Initialization Policy' is not set to All, ~7~." check_existence="any_exist" check="none satisfy">
      <object object_ref="oval:mil.disa.fso.windows:obj:399700" />
      <state state_ref="oval:mil.disa.stig.windows:ste:9700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9800" version="1" comment="NoGPOistChanges is set to 0." check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:399802" />
      <state state_ref="oval:mil.disa.stig.windows:ste:9800" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:9900" version="2" comment="EnableSmartScreen has value of 1." check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:405800" />
      <state state_ref="oval:mil.disa.stig.windows:ste:9900" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10000" version="1" comment="AllowBasicAuthInClear reg value set to not 1" check_existence="any_exist" check="none satisfy">
      <object object_ref="oval:mil.disa.fso.windows:obj:478900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10000" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10100" version="1" comment="'Turn off shell protocol protected mode' is set to 'Disabled' or 'Not Configured'" check_existence="any_exist" check="none satisfy">
      <object object_ref="oval:mil.disa.fso.windows:obj:406100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10400" version="1" comment="'Turn off Data Execution Prevention for Explorer' is set to 'Disabled' or 'Not Configured'" check_existence="any_exist" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:405900" />
      <state state_ref="oval:mil.disa.fso.windows:ste:405900" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10500" version="3" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\7-Zip\7z.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10500" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10501" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\7-Zip\7zFM.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10501" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10502" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\7-Zip\7zG.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10502" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10503" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Adobe\Adobe Photoshop CS*\Photoshop.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10503" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10504" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Foxit Reader\Foxit Reader.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10504" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10505" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Google\Chrome\Application\chrome.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10505" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10502" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10506" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Google\Google Talk\googletalk.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10506" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10503" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10507" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\iTunes\iTunes.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10507" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10508" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Microsoft Lync\communicator.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10508" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10509" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\mIRC\mirc.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10509" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10510" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Mozilla Firefox\firefox.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10510" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10504" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10511" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Mozilla Firefox\plugin-container.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10511" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10512" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Mozilla Thunderbird\plugin-container.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10512" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10513" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Mozilla Thunderbird\thunderbird.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10513" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10514" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Opera\*\opera.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10514" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10515" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Opera\opera.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10515" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10516" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Pidgin\pidgin.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10516" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10517" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\QuickTime\QuickTimePlayer.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10517" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10518" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Real\RealPlayer\realconverter.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10518" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10519" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Real\RealPlayer\realplay.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10519" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10520" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Safari\Safari.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10520" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10521" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\SkyDrive\SkyDrive.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10521" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10522" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Skype\Phone\Skype.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10522" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10523" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\VideoLAN\VLC\vlc.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10523" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10524" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Winamp\winamp.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10524" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10525" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Windows Live\Mail\wlmail.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10525" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10526" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Windows Live\Photo Gallery\WLXPhotoGallery.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10526" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10527" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Windows Live\Writer\WindowsLiveWriter.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10527" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10528" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Windows Media Player\wmplayer.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10528" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10505" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10529" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinRAR\rar.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10529" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10530" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinRAR\unrar.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10530" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10531" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinRAR\winrar.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10531" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10532" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinZip\winzip32.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10532" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10533" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WinZip\winzip64.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10533" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10501" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10600" version="3" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Adobe\*\Reader\AcroRd32.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10600" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10601" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Adobe\Acrobat*\Acrobat\Acrobat.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10601" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10600" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10602" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\java.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10602" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10601" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10603" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\javaw.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10603" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10601" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10604" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\javaws.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10604" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10601" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10605" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\EXCEL.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10605" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10602" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10606" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\INFOPATH.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10606" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10607" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\LYNC.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10607" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10608" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\MSACCESS.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10608" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10609" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\MSPUB.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10609" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10610" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\OIS.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10610" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10611" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\OUTLOOK.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10611" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10612" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\POWERPNT.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10612" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10602" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10613" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\PPTVIEW.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10613" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10614" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\VISIO.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10614" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10615" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\VPREVIEW.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10615" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10616" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\WINWORD.EXE'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10616" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10602" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10617" version="2" comment="Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WindowsNT\Accessories\wordpad.exe'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10617" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10603" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10900" version="1" comment="The OS Version is equal to or greater than 6.3" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10900" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10901" version="1" comment="The OS Build is equal to or greater than 10586" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10901" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10901" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10902" version="1" comment="The OS is Windows 10 Enterprise LTSB" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:8300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:8301" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:10903" version="1" comment="The OS Build is equal to or greater than 10240" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:10901" />
      <state state_ref="oval:mil.disa.stig.windows:ste:10902" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11300" version="1" comment="'SafeForScripting' is set to 'Disabled' or 'Not Configured'" check_existence="any_exist" check="none satisfy">
      <object object_ref="oval:mil.disa.fso.windows:obj:408600" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11400" version="1" comment="'Interactive logon: Number of previous logons to cache' is set to 10 or less" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:478500" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11500" version="1" comment="'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests', 0" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:421800" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11500" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11600" version="1" comment="'Default Protections for Internet Explorer' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:11600" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11600" />
    </registry_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11700" version="1" comment="'Audit Other System Events' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11700" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11701" version="1" comment="'Audit Other System Events' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11701" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11800" version="1" comment="'Audit Other System Events' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11800" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11801" version="1" comment="'Audit Other System Events' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11801" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11900" version="1" comment="'Audit Account Lockout' is set to 'Success'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11900" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:11901" version="1" comment="'Audit Account Lockout' is set to 'Success' and 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:11901" />
    </auditeventpolicysubcategories_test>
    <wmi57_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:12000" version="1" comment="DEP is set to 'OptOut'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:12000" />
      <state state_ref="oval:mil.disa.stig.windows:ste:12000" />
    </wmi57_test>
    <wmi57_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:12001" version="1" comment="DEP is set to 'AlwaysOn'" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:12000" />
      <state state_ref="oval:mil.disa.stig.windows:ste:12001" />
    </wmi57_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:12200" version="1" comment="SEHOP is turned on and properly configured" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:12200" />
      <state state_ref="oval:mil.disa.stig.windows:ste:12200" />
    </registry_test>
    <user_sid55_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:12900" version="1" comment="'Accounts: Administrator account status' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:12900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:12900" />
    </user_sid55_test>
    <user_sid55_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:13000" version="1" comment="'Accounts: Guest account status' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:13000" />
      <state state_ref="oval:mil.disa.stig.windows:ste:13000" />
    </user_sid55_test>
    <sid_sid_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:13100" version="2" comment="'Accounts: Rename administrator account' is not set to 'Administrator'" check_existence="any_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:13100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:13100" />
    </sid_sid_test>
    <sid_sid_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:13101" version="1" comment="'Accounts: Rename administrator account' is not set to 'localdomain\Administrator'" check_existence="any_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:13100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:13101" />
    </sid_sid_test>
    <sid_sid_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:13200" version="2" comment="'Accounts: Rename guest account' is not set to 'Guest'" check_existence="any_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:13200" />
      <state state_ref="oval:mil.disa.stig.windows:ste:13200" />
    </sid_sid_test>
    <sid_sid_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:13201" version="1" comment="'Accounts: Rename guest account' is not set to 'localdomain\Guest'" check_existence="any_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:13200" />
      <state state_ref="oval:mil.disa.stig.windows:ste:13201" />
    </sid_sid_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:13700" version="1" comment="Check if PowerShell Script Block Logging is set to enabled in the registry" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:13700" />
      <state state_ref="oval:mil.disa.stig.windows:ste:13700" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:13900" version="1" comment="Check the registry if command line is included in process creation events" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:13900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:13900" />
    </registry_test>
    <wmi57_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:14000" version="1" comment="Windows PowerShell 2.0 optional feature is disabled" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:14000" />
      <state state_ref="oval:mil.disa.stig.windows:ste:14000" />
    </wmi57_test>
    <wmi57_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:14001" version="1" comment="Windows PowerShell 2.0 Engine optional feature is disabled" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:14001" />
      <state state_ref="oval:mil.disa.stig.windows:ste:14000" />
    </wmi57_test>
    <wmi57_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:14100" version="1" comment="SMB v1 Protocol is disabled" check_existence="all_exist" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:14100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:14100" />
    </wmi57_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:14700" version="1" comment="'Audit Account Lockout' is set to 'Failure'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:14700" />
    </auditeventpolicysubcategories_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:14800" version="1" comment="WDigest Authentication is disabled" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:14800" />
      <state state_ref="oval:mil.disa.stig.windows:ste:14800" />
    </registry_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15000" version="1" check="all" comment="Audit - Audit Policy Change - Success only" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15000" />
    </auditeventpolicysubcategories_test>
    <auditeventpolicysubcategories_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15001" version="2" check="all" comment="Audit - Audit Policy Change - Success and Failure" check_existence="at_least_one_exists">
      <object object_ref="oval:mil.disa.fso.windows:obj:394100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15001" />
    </auditeventpolicysubcategories_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15100" version="1" comment="'Prohibit use of Internet Connection Sharing on your DNS domain network' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15100" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15100" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15200" version="1" comment="Allow Administrators group to make remote calls to SAM" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15200" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15200" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15300" version="1" comment="'Turn off Microsoft consumer experiences' is set to 'Enabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15300" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15300" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15400" version="1" comment="'Remove 'Run as Different User' from context menus' is set to 'Enabled' (batfile)" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15400" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15401" version="1" comment="'Remove 'Run as Different User' from context menus' is set to 'Enabled' (cmdfile)" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15401" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15402" version="1" comment="'Remove 'Run as Different User' from context menus' is set to 'Enabled' (exefile)" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15402" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15400" />
    </registry_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15403" version="1" comment="'Remove 'Run as Different User' from context menus' is set to 'Enabled' (mscfile)" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15403" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15400" />
    </registry_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15600" version="1" comment="Deny log on as a batch job - Domain Admins" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15600" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15500" />
    </accesstoken_test>
    <accesstoken_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:15601" version="1" comment="Deny log on as a batch job - Enterprise Admins" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:15601" />
      <state state_ref="oval:mil.disa.stig.windows:ste:15500" />
    </accesstoken_test>
    <registry_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:tst:402900" version="2" comment="'Configure Solicited Remote Assistance' is set to 'Disabled'" check_existence="at_least_one_exists" check="all">
      <object object_ref="oval:mil.disa.stig.windows:obj:402900" />
      <state state_ref="oval:mil.disa.stig.windows:ste:402900" />
    </registry_test>
  </tests>
  <objects>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:388601" version="2" comment="System Root Directory Registry Object">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name datatype="string">SystemRoot</name>
    </registry_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:388700" version="2" comment="%windir%\system32\tftp.exe">
      <path var_ref="oval:mil.disa.fso.windows:var:388700" var_check="all" datatype="string" />
      <filename datatype="string" operation="case insensitive equals">tftp.exe</filename>
    </file_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:388900" version="1" comment="%windir%\system32\telnet.exe">
      <path var_ref="oval:mil.disa.fso.windows:var:388700" var_check="all" datatype="string" />
      <filename datatype="string">telnet.exe</filename>
    </file_object>
    <lockoutpolicy_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:393200" version="5" comment="Lockout policy" />
    <passwordpolicy_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:393500" version="1" comment="Password policy" />
    <auditeventpolicysubcategories_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:394100" version="1" comment="Audit event subcategories policy" />
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:398400" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy\</key>
      <name datatype="string" operation="equals">fMinimizeConnections</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:398500" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy\</key>
      <name datatype="string" operation="equals">fBlockNonDomain</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:399700" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">System\CurrentControlSet\Policies\EarlyLaunch</key>
      <name datatype="string" operation="equals">DriverLoadPolicy</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:399802" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}</key>
      <name datatype="string">NoGPOListChanges</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:400200" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows NT\Printers</key>
      <name datatype="string">DisableWebPnPDownload</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:400700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer</key>
      <name datatype="string">NoWebServices</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:400900" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows NT\Printers</key>
      <name datatype="string">DisableHTTPPrinting</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:402100" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\System</key>
      <name datatype="string" operation="equals">EnumerateLocalUsers</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:402300" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\System</key>
      <name datatype="string" operation="equals">AllowDomainPINLogon</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:402400" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51</key>
      <name datatype="string">DCSettingIndex</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:402500" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51</key>
      <name datatype="string">ACSettingIndex</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:403400" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows NT\Rpc</key>
      <name datatype="string">RestrictRemoteClients</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:404100" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Windows\AppCompat</key>
      <name datatype="string">DisableInventory</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:404200" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Windows\Explorer</key>
      <name datatype="string">NoAutoplayfornonVolume</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:404300" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</key>
      <name datatype="string">NoAutorun</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:404400" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer</key>
      <name datatype="string">NoDriveTypeAutoRun</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:404700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI</key>
      <name datatype="string">EnumerateAdministrators</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:404800" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\SysSettings</key>
      <name datatype="string" operation="equals">ASLR</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:405200" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\SysSettings</key>
      <name datatype="string" operation="equals">DEP</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:405300" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\SysSettings</key>
      <name datatype="string" operation="equals">SEHOP</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:405400" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\EventLog\Application</key>
      <name datatype="string">MaxSize</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:405500" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\EventLog\Security</key>
      <name datatype="string">MaxSize</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:405700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\EventLog\System</key>
      <name datatype="string">MaxSize</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:405800" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\System</key>
      <name datatype="string" operation="equals">EnableSmartScreen</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:405900" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Windows\Explorer</key>
      <name datatype="string">NoDataExecutionPrevention</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:406000" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Windows\Explorer</key>
      <name datatype="string">NoHeapTerminationOnCorruption</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:406100" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</key>
      <name datatype="string">PreXPSP2ShellProtocolBehavior</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:406600" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services</key>
      <name datatype="string">DisablePasswordSaving</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:406800" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Windows NT\Terminal Services</key>
      <name datatype="string">fDisableCdm</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:406900" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Windows NT\Terminal Services</key>
      <name datatype="string">fPromptForPassword</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:407000" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Policies\Microsoft\Windows NT\Terminal Services</key>
      <name datatype="string">MinEncryptionLevel</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:407500" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Internet Explorer\Feeds</key>
      <name datatype="string" operation="equals">DisableEnclosureDownload</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:407700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\Windows Search</key>
      <name datatype="string">AllowIndexingEncryptedStoresOrItems</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:408400" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\Installer</key>
      <name datatype="string" operation="equals">EnableUserControl</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:408500" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\Installer</key>
      <name datatype="string" operation="equals">AlwaysInstallElevated</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:408600" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\Installer</key>
      <name datatype="string" operation="equals">SafeForScripting</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:409200" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\WinRM\Client</key>
      <name datatype="string" operation="equals">AllowBasic</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:409300" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\WinRM\Client</key>
      <name datatype="string" operation="equals">AllowUnencryptedTraffic</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:409400" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\WinRM\Client</key>
      <name datatype="string" operation="equals">AllowDigest</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:409500" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\WinRM\Service</key>
      <name datatype="string" operation="equals">AllowBasic</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:409600" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\WinRM\Service</key>
      <name datatype="string" operation="equals">AllowUnencryptedTraffic</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:409700" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\WinRM\Service</key>
      <name datatype="string" operation="equals">DisableRunAs</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:409900" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows NT\Terminal Services</key>
      <name datatype="string" operation="equals">fEncryptRPCTraffic</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:413900" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string" operation="equals">LocalAccountTokenFilterPolicy</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:414300" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\Currentcontrolset\Control\Lsa</key>
      <name datatype="string">Limitblankpassworduse</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:414800" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\Currentcontrolset\Control\Lsa</key>
      <name datatype="string">scenoapplylegacyauditpolicy</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:415100" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Netlogon\Parameters</key>
      <name datatype="string">RequireSignOrSeal</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:415200" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Netlogon\Parameters</key>
      <name datatype="string">SealSecureChannel</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:415300" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Netlogon\Parameters</key>
      <name datatype="string">SignSecureChannel</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:415400" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Netlogon\Parameters</key>
      <name datatype="string">DisablePasswordChange</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:415500" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Netlogon\Parameters</key>
      <name datatype="string">MaximumPasswordAge</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:415600" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Netlogon\Parameters</key>
      <name datatype="string">RequireStrongKey</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:416600" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows NT\CurrentVersion\Winlogon</key>
      <name datatype="string">scremoveoption</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:416700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\LanmanWorkstation\Parameters</key>
      <name datatype="string">RequireSecuritySignature</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:416800" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\LanmanWorkstation\Parameters</key>
      <name datatype="string">EnableSecuritySignature</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:416900" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\LanmanWorkstation\Parameters</key>
      <name datatype="string">EnablePlainTextPassword</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:417000" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\LanmanServer\Parameters</key>
      <name datatype="string">AutoDisconnect</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:417100" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\LanmanServer\Parameters</key>
      <name datatype="string">RequireSecuritySignature</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:417200" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\LanmanServer\Parameters</key>
      <name datatype="string">EnableSecuritySignature</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:417600" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Tcpip6\Parameters</key>
      <name datatype="string">DisableIPSourceRouting</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:417700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Tcpip\Parameters</key>
      <name datatype="string">DisableIPSourceRouting</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:417800" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Tcpip\Parameters</key>
      <name datatype="string">EnableICMPRedirect</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:418200" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\Netbt\Parameters</key>
      <name datatype="string">NoNameReleaseOnDemand</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:419000" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa</key>
      <name datatype="string">RestrictAnonymousSAM</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:419100" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa</key>
      <name datatype="string">RestrictAnonymous</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:419200" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa</key>
      <name datatype="string">DisableDomainCreds</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:419300" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa</key>
      <name datatype="string">EveryoneIncludesAnonymous</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:419700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Services\LanManServer\Parameters</key>
      <name datatype="string">restrictnullsessaccess</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420000" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa</key>
      <name datatype="string">UseMachineId</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420100" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa\MSV1_0</key>
      <name datatype="string">allownullsessionfallback</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420200" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa\pku2u</key>
      <name datatype="string">AllowOnlineID</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420300" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters</key>
      <name datatype="string">SupportedEncryptionTypes</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420400" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa</key>
      <name datatype="string">NoLMHash</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420600" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Control\Lsa</key>
      <name datatype="string">LmCompatibilityLevel</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Services\LDAP</key>
      <name datatype="string">LDAPClientIntegrity</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420800" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0</key>
      <name datatype="string">NTLMMinClientSec</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:420900" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0</key>
      <name datatype="string">NTLMMinServerSec</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:421300" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy</key>
      <name datatype="string">Enabled</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:421400" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Control\Session Manager\Kernel</key>
      <name datatype="string">ObCaseInsensitive</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:421500" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Control\Session Manager</key>
      <name datatype="string">ProtectionMode</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:421600" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">FilterAdministratorToken</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:421700" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">ConsentPromptBehaviorAdmin</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:421800" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">ConsentPromptBehaviorUser</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:421900" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">EnableInstallerDetection</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:422100" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">EnableSecureUIAPaths</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:422200" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">EnableLUA</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:422400" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">EnableVirtualization</name>
    </registry_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:424000" version="2" comment="All security principles">
      <security_principle operation="pattern match" datatype="string">.*</security_principle>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:425301" version="3" comment="Administrators only">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.windows:obj:424000</object_reference>
        <filter>oval:mil.disa.fso.windows:ste:425301</filter>
      </set>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:437001" version="3" comment="Guests">
      <security_principle datatype="string" operation="equals">Guests</security_principle>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:437100" version="3" comment="Domain Admins">
      <security_principle datatype="string" operation="pattern match">^.*\\Domain Admins$|^Domain Admins$</security_principle>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:437101" version="4" comment="Enterprise Admins">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.windows:obj:437102</object_reference>
        <object_reference>oval:mil.disa.fso.windows:obj:437103</object_reference>
      </set>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:437102" version="1" comment="Enterprise Admins equals check for OVALdi workaround">
      <security_principle datatype="string" operation="equals">Enterprise Admins</security_principle>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:437103" version="1" comment="Enterprise Admins pattern match">
      <security_principle datatype="string" operation="pattern match">^.*\\Enterprise Admins$</security_principle>
    </accesstoken_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:439601" version="3" comment="EMET Install Entries">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="COMPLEMENT">
        <object_reference>oval:mil.disa.fso.windows:obj:439602</object_reference>
        <object_reference>oval:mil.disa.fso.windows:obj:439603</object_reference>
      </set>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:439602" version="4" comment="Find the comments for the installed products including the installed EMET version">
      <behaviors max_depth="2" recurse_direction="down" />
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products</key>
      <name datatype="string" operation="equals">Comments</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:439603" version="3" comment="Non-EMET Install Entries">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.fso.windows:obj:439602</object_reference>
        <filter>oval:mil.disa.fso.windows:ste:439600</filter>
      </set>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:439606" version="2" comment="EMET Version">
      <behaviors max_depth="2" recurse_direction="down" />
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals" var_check="at least one" var_ref="oval:mil.disa.fso.windows:var:439600" />
      <name datatype="string" operation="equals">DisplayVersion</name>
    </registry_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:461700" version="2" comment="All security principles">
      <security_principle datatype="string" operation="pattern match">.*</security_principle>
    </accesstoken_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:473000" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">InactivityTimeoutSecs</name>
    </registry_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:477509" version="2" comment="Local account">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.windows:obj:477512</object_reference>
        <object_reference>oval:mil.disa.fso.windows:obj:477513</object_reference>
      </set>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:477512" version="1" comment="Local account equals check">
      <security_principle datatype="string" operation="equals">Local account</security_principle>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:477513" version="1" comment="Local account pattern match">
      <security_principle datatype="string" operation="equals">NT AUTHORITY\Local account</security_principle>
    </accesstoken_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:478500" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">Software\Microsoft\Windows NT\CurrentVersion\Winlogon</key>
      <name datatype="string">CachedLogonsCount</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:478900" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds</key>
      <name datatype="string">AllowBasicAuthInClear</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:484700" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">LegalNoticeText</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:484800" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">LegalNoticeCaption</name>
    </registry_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:485100" version="1" comment="Administrators, Users only">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.windows:obj:424000</object_reference>
        <filter>oval:mil.disa.fso.windows:ste:425301</filter>
        <filter>oval:mil.disa.fso.windows:ste:485101</filter>
      </set>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:485400" version="1" comment="Administrators, Local Service only">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.windows:obj:424000</object_reference>
        <filter>oval:mil.disa.fso.windows:ste:425301</filter>
        <filter>oval:mil.disa.fso.windows:ste:485001</filter>
      </set>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:485700" version="1" comment="Administrators, Service, Local Service, Network Service only">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.windows:obj:424000</object_reference>
        <filter>oval:mil.disa.fso.windows:ste:425301</filter>
        <filter>oval:mil.disa.fso.windows:ste:485701</filter>
        <filter>oval:mil.disa.fso.windows:ste:485001</filter>
        <filter>oval:mil.disa.fso.windows:ste:485002</filter>
      </set>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:486000" version="1" comment="Local Service, Network Service only">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.fso.windows:obj:424000</object_reference>
        <filter>oval:mil.disa.fso.windows:ste:485001</filter>
        <filter>oval:mil.disa.fso.windows:ste:485002</filter>
      </set>
    </accesstoken_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487400" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487401" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487402" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487403" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Root\Certificates\8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487404" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\D73CA91102A2204A36459ED32213B467D7CE97FB</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487405" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\D73CA91102A2204A36459ED32213B467D7CE97FB</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487406" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\D73CA91102A2204A36459ED32213B467D7CE97FB</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487407" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Root\Certificates\D73CA91102A2204A36459ED32213B467D7CE97FB</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487408" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\B8269F25DBD937ECAFD4C35A9838571723F2D026</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487409" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\B8269F25DBD937ECAFD4C35A9838571723F2D026</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487410" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\B8269F25DBD937ECAFD4C35A9838571723F2D026</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487411" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Root\Certificates\B8269F25DBD937ECAFD4C35A9838571723F2D026</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487500" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\C313F919A6ED4E0E8451AFA930FB419A20F181E4</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487501" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\C313F919A6ED4E0E8451AFA930FB419A20F181E4</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487502" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\C313F919A6ED4E0E8451AFA930FB419A20F181E4</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487503" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Root\Certificates\C313F919A6ED4E0E8451AFA930FB419A20F181E4</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487504" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487505" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487506" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487507" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Root\Certificates\73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487600" version="3">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\22BBE981F0694D246CC1472ED2B021DC8540A22F</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487601" version="3">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates\22BBE981F0694D246CC1472ED2B021DC8540A22F</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487602" version="3">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates\22BBE981F0694D246CC1472ED2B021DC8540A22F</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487603" version="3">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Disallowed\Certificates\22BBE981F0694D246CC1472ED2B021DC8540A22F</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487604" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FFAD03329B9E527A43EEC66A56F9CBB5393E6E13</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487605" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates\FFAD03329B9E527A43EEC66A56F9CBB5393E6E13</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487606" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates\FFAD03329B9E527A43EEC66A56F9CBB5393E6E13</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487607" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Disallowed\Certificates\FFAD03329B9E527A43EEC66A56F9CBB5393E6E13</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487608" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487609" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates\FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487610" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates\FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487611" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Disallowed\Certificates\FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487704" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487705" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates\DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487706" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates\DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:487707" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\EnterpriseCertificates\Disallowed\Certificates\DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3</key>
      <name datatype="string" operation="pattern match">^.+$</name>
    </registry_object>
    <wmi_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:498200" version="1" comment="DomainRole property">
      <namespace datatype="string">root\cimv2</namespace>
      <wql datatype="string" operation="equals">SELECT DomainRole FROM win32_computersystem</wql>
    </wmi_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:498500" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\Windows\DeliveryOptimization</key>
      <name datatype="string" operation="equals">DODownloadMode</name>
    </registry_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:obj:514200" version="1" comment="Everyone Group">
      <security_principle datatype="string" operation="pattern match">^.*\\Everyone$|^Everyone$</security_principle>
    </accesstoken_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:1900" version="1" comment="Hardened Path Config for \\*\SYSVOL">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths</key>
      <name datatype="string">\\*\SYSVOL</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:1901" version="1" comment="Hardened Path Config for \\*\NETLOGON">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths</key>
      <name datatype="string">\\*\NETLOGON</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:2100" version="1" comment="DevicePKInitEnabled">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters</key>
      <name datatype="string">DevicePKInitEnabled</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:2200" version="1" comment="MitigationOptions_FontBocking">
      <!-- Note:  acutal registry value name is misspelled "Bocking"; this is not a content error -->
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions</key>
      <name datatype="string">MitigationOptions_FontBocking</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:2300" version="1" comment="AutoConnectAllowedOEM">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config</key>
      <name datatype="string">AutoConnectAllowedOEM</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:2400" version="2" comment="AllowTelemetry">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\DataCollection</key>
      <name datatype="string">AllowTelemetry</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:2500" version="1" comment="FormSuggest Passwords">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main</key>
      <name datatype="string">FormSuggest Passwords</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:2700" version="1" comment="MinimumPINLength">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity</key>
      <name datatype="string">MinimumPINLength</name>
    </registry_object>
    <wmi_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:3000" version="1" comment="All 'Local Disk' File systems not using NTFS">
      <namespace datatype="string">root\cimv2</namespace>
      <wql datatype="string">SELECT deviceid FROM win32_logicaldisk WHERE drivetype=3 AND filesystem!="NTFS"</wql>
    </wmi_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:3500" version="1" comment="IIS components">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\InetStp\Components</key>
      <name datatype="string" operation="pattern match">.+</name>
    </registry_object>
    <wmi57_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:3800" version="6" comment="McAfeeFramework State">
      <namespace>root\cimv2</namespace>
      <wql>SELECT state FROM Win32_Service WHERE Name="McAfeeFramework"</wql>
    </wmi57_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:3801" version="2" comment="Determine the path FrameworkService.exe is installed">
      <filepath var_ref="oval:mil.disa.stig.windows:var:3800" />
    </file_object>
    <wmi_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:3802" version="1" comment="McAfeeFramework PathName">
      <namespace>root\cimv2</namespace>
      <wql>SELECT pathname FROM Win32_Service WHERE Name="McAfeeFramework"</wql>
    </wmi_object>
    <wmi57_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:3803" version="1" comment="McAfee Agent Service (masvc) State">
      <namespace>root\cimv2</namespace>
      <wql>SELECT state FROM Win32_Service WHERE Name="masvc"</wql>
    </wmi57_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:3804" version="1" comment="Determine the path masvc.exe is installed">
      <filepath var_ref="oval:mil.disa.stig.windows:var:3801" />
    </file_object>
    <wmi_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:3805" version="1" comment="McAfee Agent Service (masvc) PathName">
      <namespace>root\cimv2</namespace>
      <wql>SELECT pathname FROM Win32_Service WHERE Name="masvc"</wql>
    </wmi_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5100" version="4" comment="Permissions of Application event log, minus those allowed. Built filepath.">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.stig.windows:obj:5101</object_reference>
        <filter>oval:mil.disa.stig.windows:ste:5100</filter>
        <filter>oval:mil.disa.stig.windows:ste:5101</filter>
        <filter>oval:mil.disa.stig.windows:ste:5102</filter>
        <filter>oval:mil.disa.stig.windows:ste:5103</filter>
      </set>
    </fileeffectiverights53_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5101" version="2" comment="The Application event log. Built filepath.">
      <filepath var_ref="oval:mil.disa.stig.windows:var:5101" var_check="at least one" datatype="string" />
      <trustee_sid operation="pattern match" datatype="string">.*</trustee_sid>
    </fileeffectiverights53_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5102" version="1" comment="path Application.evtx">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Services\EventLog\Application</key>
      <name datatype="string">file</name>
    </registry_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5103" version="4" comment="Permissions of Application event log, minus those allowed. Strict filepath, as listed.">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.stig.windows:obj:5104</object_reference>
        <filter>oval:mil.disa.stig.windows:ste:5100</filter>
        <filter>oval:mil.disa.stig.windows:ste:5101</filter>
        <filter>oval:mil.disa.stig.windows:ste:5102</filter>
        <filter>oval:mil.disa.stig.windows:ste:5103</filter>
      </set>
    </fileeffectiverights53_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5104" version="2" comment="The Application event log. Strict filepath, as listed.">
      <filepath var_ref="oval:mil.disa.stig.windows:var:5102" var_check="at least one" datatype="string" />
      <trustee_sid operation="pattern match" datatype="string">.*</trustee_sid>
    </fileeffectiverights53_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5200" version="4" comment="Permissions of Security event log, minus allowed accounts. Built filepath.">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.stig.windows:obj:5201</object_reference>
        <filter>oval:mil.disa.stig.windows:ste:5100</filter>
        <filter>oval:mil.disa.stig.windows:ste:5101</filter>
        <filter>oval:mil.disa.stig.windows:ste:5102</filter>
        <filter>oval:mil.disa.stig.windows:ste:5103</filter>
      </set>
    </fileeffectiverights53_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5201" version="2" comment="The Security event log. Built filepath.">
      <filepath var_ref="oval:mil.disa.stig.windows:var:5201" var_check="at least one" datatype="string" />
      <trustee_sid operation="pattern match" datatype="string">.*</trustee_sid>
    </fileeffectiverights53_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5202" version="1" comment="path Security.evtx">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Services\EventLog\Security</key>
      <name datatype="string">file</name>
    </registry_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5203" version="4" comment="Permissions of Security event log, minus allowed accounts. Strict filepath, as listed.">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.stig.windows:obj:5204</object_reference>
        <filter>oval:mil.disa.stig.windows:ste:5100</filter>
        <filter>oval:mil.disa.stig.windows:ste:5101</filter>
        <filter>oval:mil.disa.stig.windows:ste:5102</filter>
        <filter>oval:mil.disa.stig.windows:ste:5103</filter>
      </set>
    </fileeffectiverights53_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5204" version="2" comment="The Security event log. Strict filepath, as listed.">
      <filepath var_ref="oval:mil.disa.stig.windows:var:5202" var_check="at least one" datatype="string" />
      <trustee_sid operation="pattern match" datatype="string">.*</trustee_sid>
    </fileeffectiverights53_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5300" version="2" comment="Permissions of System event log, excluding allowed accounts. Built filepath.">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.stig.windows:obj:5301</object_reference>
        <filter>oval:mil.disa.stig.windows:ste:5100</filter>
        <filter>oval:mil.disa.stig.windows:ste:5101</filter>
        <filter>oval:mil.disa.stig.windows:ste:5102</filter>
        <filter>oval:mil.disa.stig.windows:ste:5103</filter>
      </set>
    </fileeffectiverights53_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5301" version="1" comment="The System event log. Built filepath.">
      <filepath var_ref="oval:mil.disa.stig.windows:var:5301" var_check="at least one" datatype="string" />
      <trustee_sid operation="pattern match" datatype="string">.*</trustee_sid>
    </fileeffectiverights53_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5302" version="1" comment="path System.evtx">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Services\EventLog\System</key>
      <name datatype="string">file</name>
    </registry_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5303" version="2" comment="Permissions of System event log, excluding allowed accounts. Strict filepath, as listed.">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.stig.windows:obj:5304</object_reference>
        <filter>oval:mil.disa.stig.windows:ste:5100</filter>
        <filter>oval:mil.disa.stig.windows:ste:5101</filter>
        <filter>oval:mil.disa.stig.windows:ste:5102</filter>
        <filter>oval:mil.disa.stig.windows:ste:5103</filter>
      </set>
    </fileeffectiverights53_object>
    <fileeffectiverights53_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5304" version="1" comment="The System event log. Strict filepath, as listed.">
      <filepath var_ref="oval:mil.disa.stig.windows:var:5302" var_check="at least one" datatype="string" />
      <trustee_sid operation="pattern match" datatype="string">.*</trustee_sid>
    </fileeffectiverights53_object>
    <group_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5400" version="5" comment="Hyper-V Administrators group">
      <group datatype="string">Hyper-V Administrators</group>
    </group_object>
    <group_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5401" version="6" comment="Hyper-V Administrators group having users">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.stig.windows:obj:5400</object_reference>
        <filter action="include">oval:mil.disa.stig.windows:ste:5400</filter>
      </set>
    </group_object>
    <group_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5402" version="6" comment="Hyper-V Administrators group having subgroups">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <object_reference>oval:mil.disa.stig.windows:obj:5400</object_reference>
        <filter action="include">oval:mil.disa.stig.windows:ste:5401</filter>
      </set>
    </group_object>
    <group_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5403" version="1" comment="Hyper-V Administrators group having users or subgroups">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.stig.windows:obj:5401</object_reference>
        <object_reference>oval:mil.disa.stig.windows:obj:5402</object_reference>
      </set>
    </group_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5500" version="1" comment="%windir%\system32\snmp.exe">
      <path var_ref="oval:mil.disa.fso.windows:var:388700" var_check="all" datatype="string" />
      <filename datatype="string" operation="case insensitive equals">snmp.exe</filename>
    </file_object>
    <wmi_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:5600" version="1" comment="simptcp service">
      <namespace>root\cimv2</namespace>
      <wql>SELECT state FROM Win32_Service WHERE Name="simptcp"</wql>
    </wmi_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:6500" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">DisableAutomaticRestartSignOn</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:6600" version="1" comment="HKLM\SOFTWARE\Policies\Microsoft\Windows\System\DontDisplayNetworkSelectionUI">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\System</key>
      <name datatype="string">DontDisplayNetworkSelectionUI</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:6700" version="1" comment="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\MSAOptional">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</key>
      <name datatype="string">MSAOptional</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:6800" version="1" comment="HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive\DisableFileSyncNGSC">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\OneDrive</key>
      <name datatype="string">DisableFileSyncNGSC</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:6900" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\Personalization</key>
      <name datatype="string">NoLockScreenSlideshow</name>
    </registry_object>
    <wmi_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:7700" version="1" comment="active, local accounts with non-expiring passwords">
      <namespace>root\cimv2</namespace>
      <wql>SELECT name FROM Win32_UserAccount WHERE LocalAccount=TRUE AND Disabled=FALSE AND PasswordExpires=FALSE</wql>
    </wmi_object>
    <wmi_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:8200" version="1" comment="Win32_ComputerSystem/DomainRole">
      <namespace>root\cimv2</namespace>
      <wql>SELECT DomainRole FROM Win32_ComputerSystem</wql>
    </wmi_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:8300" version="1" comment="EditionID">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name datatype="string">EditionId</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:8500" version="1" comment="AllowInsecureGuestAuth">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation</key>
      <name datatype="string">AllowInsecureGuestAuth</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:8600" version="1" comment="EnhancedAntiSpoofing">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures</key>
      <name datatype="string">EnhancedAntiSpoofing</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:8700" version="1" comment="PreventOverride">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter</key>
      <name datatype="string">PreventOverride</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:8800" version="1" comment="PreventOverrideAppRepUnknown">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter</key>
      <name datatype="string">PreventOverrideAppRepUnknown</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:8900" version="1" comment="AllowInPrivate">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main</key>
      <name datatype="string">AllowInPrivate</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:9000" version="1" comment="EnabledV9">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter</key>
      <name datatype="string">EnabledV9</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:9100" version="1" comment="DeepHooks">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\EMET\SysSettings</key>
      <name datatype="string">DeepHooks</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:9200" version="1" comment="AntiDetours">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\EMET\SysSettings</key>
      <name datatype="string">AntiDetours</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:9300" version="1" comment="BannedFunctions">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\EMET\SysSettings</key>
      <name datatype="string">BannedFunctions</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10500" version="3">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\7-Zip\7z.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10501" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\7-Zip\7zFM.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10502" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\7-Zip\7zG.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10503" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Adobe\Adobe Photoshop CS*\Photoshop.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10504" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Foxit Reader\Foxit Reader.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10505" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Google\Chrome\Application\chrome.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10506" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Google\Google Talk\googletalk.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10507" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\iTunes\iTunes.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10508" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Microsoft Lync\communicator.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10509" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\mIRC\mirc.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10510" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Mozilla Firefox\firefox.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10511" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Mozilla Firefox\plugin-container.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10512" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Mozilla Thunderbird\plugin-container.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10513" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Mozilla Thunderbird\thunderbird.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10514" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Opera\*\opera.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10515" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Opera\opera.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10516" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Pidgin\pidgin.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10517" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\QuickTime\QuickTimePlayer.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10518" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Real\RealPlayer\realconverter.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10519" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Real\RealPlayer\realplay.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10520" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Safari\Safari.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10521" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\SkyDrive\SkyDrive.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10522" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Skype\Phone\Skype.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10523" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\VideoLAN\VLC\vlc.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10524" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Winamp\winamp.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10525" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Windows Live\Mail\wlmail.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10526" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Windows Live\Photo Gallery\WLXPhotoGallery.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10527" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Windows Live\Writer\WindowsLiveWriter.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10528" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Windows Media Player\wmplayer.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10529" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\WinRAR\rar.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10530" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\WinRAR\unrar.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10531" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\WinRAR\winrar.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10532" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\WinZip\winzip32.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10533" version="2">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\WinZip\winzip64.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10600" version="4" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\Adobe\*\Reader\AcroRd32.exe">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Adobe\*\Reader\AcroRd32.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10601" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\Adobe\Acrobat*\Acrobat\Acrobat.exe">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Adobe\Acrobat*\Acrobat\Acrobat.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10602" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\Java\jre*\bin\java.exe">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Java\jre*\bin\java.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10603" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\Java\jre*\bin\javaw.exe">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Java\jre*\bin\javaw.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10604" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\Java\jre*\bin\javaws.exe">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Java\jre*\bin\javaws.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10605" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\EXCEL.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\EXCEL.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10606" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\INFOPATH.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\INFOPATH.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10607" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\LYNC.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\LYNC.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10608" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\MSACCESS.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\MSACCESS.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10609" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\MSPUB.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\MSPUB.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10610" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\OIS.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\OIS.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10611" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\OUTLOOK.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\OUTLOOK.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10612" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\POWERPNT.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\POWERPNT.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10613" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\PPTVIEW.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\PPTVIEW.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10614" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\VISIO.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\VISIO.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10615" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\VPREVIEW.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\VPREVIEW.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10616" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\OFFICE1*\WINWORD.EXE">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\OFFICE1*\WINWORD.EXE</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10617" version="3" comment="Is there an entry for HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults\*\WindowsNT\Accessories\wordpad.exe">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Windows NT\Accessories\wordpad.exe</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10900" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Microsoft\Windows NT\CurrentVersion</key>
      <name datatype="string" operation="equals">CurrentVersion</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:10901" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Microsoft\Windows NT\CurrentVersion</key>
      <name datatype="string" operation="equals">CurrentBuildNumber</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:11600" version="1" comment="'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a name of '*\Internet Explorer\iexplore.exe'">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">Software\Policies\Microsoft\EMET\Defaults</key>
      <name datatype="string" operation="equals">*\Internet Explorer\iexplore.exe</name>
    </registry_object>
    <wmi57_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:12000" version="1" comment="Grab the wmi object for DataExecutionPrevention_SupportPolicy">
      <namespace datatype="string" operation="equals">root\cimv2</namespace>
      <wql datatype="string" operation="equals">SELECT dataexecutionprevention_supportpolicy FROM win32_operatingsystem</wql>
    </wmi57_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:12200" version="1" comment="Check the registry to verify SEHOP is truned on">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SYSTEM\CurrentControlSet\Control\Session Manager\kernel</key>
      <name datatype="string" operation="equals">DisableExceptionChainValidation</name>
    </registry_object>
    <user_sid55_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:12900" version="2" comment="Built-in Administrator account">
      <user_sid var_ref="oval:mil.disa.stig.windows:var:12901" datatype="string" />
    </user_sid55_object>
    <sid_sid_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:12901" version="1" comment="Built-in Administrator SID">
      <trustee_sid operation="pattern match">^S-1-5-[0-9-]+-500$</trustee_sid>
    </sid_sid_object>
    <user_sid55_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:13000" version="1" comment="Built-in Guest account">
      <user_sid var_ref="oval:mil.disa.stig.windows:var:13001" datatype="string" />
    </user_sid55_object>
    <sid_sid_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:13001" version="1" comment="Built-in Guest SID">
      <trustee_sid operation="pattern match">^S-1-5-[0-9-]+-501$</trustee_sid>
    </sid_sid_object>
    <sid_sid_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:13100" version="1" comment="Built-in Administrator SID">
      <trustee_sid operation="pattern match">^S-1-5-[0-9-]+-500$</trustee_sid>
    </sid_sid_object>
    <sid_sid_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:13200" version="1" comment="Built-in Guest SID">
      <trustee_sid operation="pattern match">^S-1-5-[0-9-]+-501$</trustee_sid>
    </sid_sid_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:13700" version="1">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging</key>
      <name datatype="string" operation="pattern match">EnableScriptBlockLogging</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:13900" version="1" comment="Get the value for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled">
      <hive datatype="string" operation="equals">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string" operation="equals">SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit</key>
      <name datatype="string" operation="pattern match">ProcessCreationIncludeCmdLine_Enabled</name>
    </registry_object>
    <wmi57_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:14000" version="1" comment="Windows PowerShell 2.0 Win32_OptionalFeature object">
      <namespace datatype="string">root\cimv2</namespace>
      <wql datatype="string" operation="equals">SELECT installstate FROM win32_optionalfeature WHERE name = 'MicrosoftWindowsPowerShellV2Root'</wql>
    </wmi57_object>
    <wmi57_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:14001" version="1" comment="Windows PowerShell 2.0 Engine Win32_OptionalFeature object">
      <namespace datatype="string">root\cimv2</namespace>
      <wql datatype="string" operation="equals">SELECT installstate FROM win32_optionalfeature WHERE name = 'MicrosoftWindowsPowerShellV2'</wql>
    </wmi57_object>
    <wmi57_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:14100" version="1" comment="SMB v1 Protocol Win32_OptionalFeature object">
      <namespace datatype="string">root\cimv2</namespace>
      <wql datatype="string" operation="equals">SELECT installstate FROM win32_optionalfeature WHERE name = 'SMB1Protocol'</wql>
    </wmi57_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:14800" version="1" comment="Check for registry object HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\UseLogonCredential">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest</key>
      <name datatype="string">UseLogonCredential</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15100" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\Network Connections</key>
      <name datatype="string">NC_ShowSharedAccessUI</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15200" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SYSTEM\CurrentControlSet\Control\Lsa</key>
      <name datatype="string">RestrictRemoteSAM</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15300" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows\CloudContent</key>
      <name datatype="string">DisableWindowsConsumerFeatures</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15400" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Classes\batfile\shell\runasuser</key>
      <name datatype="string">SuppressionPolicy</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15401" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Classes\cmdfile\shell\runasuser</key>
      <name datatype="string">SuppressionPolicy</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15402" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Classes\exefile\shell\runasuser</key>
      <name datatype="string">SuppressionPolicy</name>
    </registry_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15403" version="1">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Classes\mscfile\shell\runasuser</key>
      <name datatype="string">SuppressionPolicy</name>
    </registry_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15600" version="1" comment="Domain Admins">
      <security_principle datatype="string" operation="pattern match">^.*\\Domain Admins$|^Domain Admins$</security_principle>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15601" version="1" comment="Enterprise Admins">
      <set xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" set_operator="UNION">
        <object_reference>oval:mil.disa.stig.windows:obj:15602</object_reference>
        <object_reference>oval:mil.disa.stig.windows:obj:15603</object_reference>
      </set>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15602" version="1" comment="Enterprise Admins equals check for OVALdi workaround">
      <security_principle datatype="string" operation="equals">Enterprise Admins</security_principle>
    </accesstoken_object>
    <accesstoken_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:15603" version="1" comment="Enterprise Admins pattern match">
      <security_principle datatype="string" operation="pattern match">^.*\\Enterprise Admins$</security_principle>
    </accesstoken_object>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:obj:402900" version="2">
      <hive datatype="string">HKEY_LOCAL_MACHINE</hive>
      <key datatype="string">SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services</key>
      <name datatype="string">fAllowToGetHelp</name>
    </registry_object>
  </objects>
  <states>
    <lockoutpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393100" version="5" comment="Lockout Duration equals -1">
      <lockout_duration datatype="int" operation="less than or equal" entity_check="all">0</lockout_duration>
    </lockoutpolicy_state>
    <lockoutpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393101" version="2" comment="Lockout Duration equals 4294967295">
      <lockout_duration operation="equals" datatype="int">4294967295</lockout_duration>
    </lockoutpolicy_state>
    <lockoutpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393200" version="1" comment="Lockout Threshold is less than or equal to variable">
      <lockout_threshold operation="less than or equal" datatype="int" var_ref="oval:mil.disa.fso.windows:var:393200" />
    </lockoutpolicy_state>
    <lockoutpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393201" version="5" comment="Lockout Threshold is greater than 0">
      <lockout_threshold operation="greater than" datatype="int">0</lockout_threshold>
    </lockoutpolicy_state>
    <lockoutpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393300" version="1" comment="Lockout Observation Window is greater than or equal to variable">
      <lockout_observation_window operation="greater than or equal" datatype="int" var_ref="oval:mil.disa.fso.windows:var:393300" />
    </lockoutpolicy_state>
    <passwordpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393400" version="1" comment="Password History Length is greater than or equal to variable">
      <password_hist_len datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.windows:var:393400" />
    </passwordpolicy_state>
    <passwordpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393500" version="1" comment="Maximum Password Age is less than or equal to variable">
      <max_passwd_age datatype="int" operation="less than or equal" var_ref="oval:mil.disa.fso.windows:var:393500" />
    </passwordpolicy_state>
    <passwordpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393501" version="1" comment="Maximum Password Age is not equal to 0">
      <max_passwd_age datatype="int" operation="greater than">0</max_passwd_age>
    </passwordpolicy_state>
    <passwordpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393600" version="1" comment="Minimum Password Age is greater than or equal to variable">
      <min_passwd_age datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.windows:var:393600" />
    </passwordpolicy_state>
    <passwordpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393700" version="1" comment="Minimum Password Length is greater than or equal to variable">
      <min_passwd_len operation="greater than or equal" datatype="int" var_ref="oval:mil.disa.fso.windows:var:393700" />
    </passwordpolicy_state>
    <passwordpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393800" version="1" comment="Password Complexity equals variable">
      <password_complexity datatype="boolean" var_ref="oval:mil.disa.fso.windows:var:393800" />
    </passwordpolicy_state>
    <passwordpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:393900" version="1" comment="Reversible Encryption equals variable">
      <reversible_encryption datatype="boolean" var_ref="oval:mil.disa.fso.windows:var:393900" />
    </passwordpolicy_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394000" version="2" comment="'Credential Validation' is set to 'Failure'">
      <credential_validation datatype="string">AUDIT_FAILURE</credential_validation>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394100" version="2" comment="'Credential Validation' is set to 'Success'">
      <credential_validation datatype="string">AUDIT_SUCCESS</credential_validation>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394101" version="2" comment="'Credential Validation' is set to 'Success' and 'Failure'">
      <credential_validation datatype="string">AUDIT_SUCCESS_FAILURE</credential_validation>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394200" version="2" comment="'Other Account Management Events' is set to 'Failure'">
      <other_account_management_events datatype="string">AUDIT_FAILURE</other_account_management_events>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394300" version="2" comment="'Other Account Management Events' is set to 'Success'">
      <other_account_management_events datatype="string">AUDIT_SUCCESS</other_account_management_events>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394301" version="2" comment="'Other Account Management Events' is set to 'Success' and 'Failure'">
      <other_account_management_events datatype="string">AUDIT_SUCCESS_FAILURE</other_account_management_events>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394400" version="2" comment="'Security Group Management' is set to 'Failure'">
      <security_group_management datatype="string">AUDIT_FAILURE</security_group_management>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394500" version="2" comment="'Security Group Management' is set to 'Success'">
      <security_group_management datatype="string">AUDIT_SUCCESS</security_group_management>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394501" version="2" comment="'Security Group Management' is set to 'Success' and 'Failure'">
      <security_group_management datatype="string">AUDIT_SUCCESS_FAILURE</security_group_management>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394600" version="2" comment="'User Account Management' is set to 'Failure'">
      <user_account_management datatype="string">AUDIT_FAILURE</user_account_management>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394700" version="2" comment="'User Account Management' is set to 'Success'">
      <user_account_management datatype="string">AUDIT_SUCCESS</user_account_management>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394701" version="2" comment="'User Account Management' is set to 'Success' and 'Failure'">
      <user_account_management datatype="string">AUDIT_SUCCESS_FAILURE</user_account_management>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394800" version="2" comment="'Process Creation' is set to 'Success'">
      <process_creation datatype="string">AUDIT_SUCCESS</process_creation>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394801" version="2" comment="'Process Creation' is set to 'Success' and 'Failure'">
      <process_creation datatype="string">AUDIT_SUCCESS_FAILURE</process_creation>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394900" version="2" comment="'Log Off' is set to 'Success'">
      <logoff datatype="string">AUDIT_SUCCESS</logoff>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:394901" version="2" comment="'Log Off' is set to 'Success' and 'Failure'">
      <logoff datatype="string">AUDIT_SUCCESS_FAILURE</logoff>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395000" version="2" comment="'Log On' is set to 'Failure'">
      <logon datatype="string">AUDIT_FAILURE</logon>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395100" version="2" comment="'Log On' is set to 'Success'">
      <logon datatype="string">AUDIT_SUCCESS</logon>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395101" version="2" comment="'Log On' is set to 'Success' and 'Failure'">
      <logon datatype="string">AUDIT_SUCCESS_FAILURE</logon>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395200" version="2" comment="'Special Logon' is set to 'Success'">
      <special_logon datatype="string">AUDIT_SUCCESS</special_logon>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395201" version="2" comment="'Special Logon' is set to 'Success' and 'Failure'">
      <special_logon datatype="string">AUDIT_SUCCESS_FAILURE</special_logon>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395700" version="2" comment="'Audit Policy Change' is set to 'Failure'">
      <audit_policy_change datatype="string">AUDIT_FAILURE</audit_policy_change>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395800" version="2" comment="'Audit Policy Change' is set to 'Success'">
      <audit_policy_change datatype="string">AUDIT_SUCCESS</audit_policy_change>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395801" version="2" comment="'Audit Policy Change' is set to 'Success' and 'Failure'">
      <audit_policy_change datatype="string">AUDIT_SUCCESS_FAILURE</audit_policy_change>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395900" version="2" comment="'Authentication Policy Change' is set to 'Success'">
      <authentication_policy_change datatype="string">AUDIT_SUCCESS</authentication_policy_change>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:395901" version="2" comment="'Authentication Policy Change' is set to 'Success' and 'Failure'">
      <authentication_policy_change datatype="string">AUDIT_SUCCESS_FAILURE</authentication_policy_change>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396000" version="2" comment="'Sensitive Privilege Use' is set to 'Failure'">
      <sensitive_privilege_use datatype="string">AUDIT_FAILURE</sensitive_privilege_use>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396100" version="2" comment="'Sensitive Privilege Use' is set to 'Success'">
      <sensitive_privilege_use datatype="string">AUDIT_SUCCESS</sensitive_privilege_use>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396101" version="2" comment="'Sensitive Privilege Use' is set to 'Success' and 'Failure'">
      <sensitive_privilege_use datatype="string">AUDIT_SUCCESS_FAILURE</sensitive_privilege_use>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396200" version="2" comment="'IPSec Driver' is set to 'Failure'">
      <ipsec_driver datatype="string">AUDIT_FAILURE</ipsec_driver>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396300" version="2" comment="'IPSec Driver' is set to 'Success'">
      <ipsec_driver datatype="string">AUDIT_SUCCESS</ipsec_driver>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396301" version="2" comment="'IPSec Driver' is set to 'Success' and 'Failure'">
      <ipsec_driver datatype="string">AUDIT_SUCCESS_FAILURE</ipsec_driver>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396500" version="2" comment="'Security State Change' is set to 'Success'">
      <security_state_change datatype="string">AUDIT_SUCCESS</security_state_change>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396501" version="2" comment="'Security State Change' is set to 'Success' and 'Failure'">
      <security_state_change datatype="string">AUDIT_SUCCESS_FAILURE</security_state_change>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396600" version="2" comment="'Security System Extension' is set to 'Failure'">
      <security_system_extension datatype="string">AUDIT_FAILURE</security_system_extension>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396700" version="2" comment="'Security System Extension' is set to 'Success'">
      <security_system_extension datatype="string">AUDIT_SUCCESS</security_system_extension>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396701" version="2" comment="'Security System Extension' is set to 'Success' and 'Failure'">
      <security_system_extension datatype="string">AUDIT_SUCCESS_FAILURE</security_system_extension>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396800" version="2" comment="'System Integrity' is set to 'Failure'">
      <system_integrity datatype="string">AUDIT_FAILURE</system_integrity>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396900" version="2" comment="'System Integrity' is set to 'Success'">
      <system_integrity datatype="string">AUDIT_SUCCESS</system_integrity>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:396901" version="2" comment="'System Integrity' is set to 'Success' and 'Failure'">
      <system_integrity datatype="string">AUDIT_SUCCESS_FAILURE</system_integrity>
    </auditeventpolicysubcategories_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:397100" version="2" comment="Reg_Dword type and value equals 0">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:398400" version="3" comment="Reg_Dword type and value equals 1">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:398800" version="3" comment="Reg_Dword type and value equals 2">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">2</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:400200" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:400200" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:400700" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:400700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:400900" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:400900" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:402400" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:402400" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:402500" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:402500" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:403400" version="2" comment="Reg_Dword type and value is greater than or equal to variable">
      <type>reg_dword</type>
      <value datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.windows:var:403400" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:404100" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" operation="equals" var_ref="oval:mil.disa.fso.windows:var:404100" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:404200" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" operation="equals" var_ref="oval:mil.disa.fso.windows:var:404200" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:404300" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" operation="equals" var_ref="oval:mil.disa.fso.windows:var:404300" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:404400" version="2" comment="Reg_Dword type and value equals 255">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">255</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:404700" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:404700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:404800" version="3" comment="Reg_Dword type and value equals 3">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">3</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:405400" version="2" comment="Reg_Dword type and value equals or is greater than variable">
      <type>reg_dword</type>
      <value datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.windows:var:405400" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:405500" version="2" comment="Reg_Dword type and value equals or is greater than variable">
      <type>reg_dword</type>
      <value datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.windows:var:405500" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:405700" version="2" comment="Reg_Dword type and value equals or is greater than variable">
      <type>reg_dword</type>
      <value datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.windows:var:405700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:405900" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" operation="equals" var_ref="oval:mil.disa.fso.windows:var:405900" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:406000" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:406000" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:406600" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:406600" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:406800" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" operation="equals" var_ref="oval:mil.disa.fso.windows:var:406800" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:406900" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" operation="equals" var_ref="oval:mil.disa.fso.windows:var:406900" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:407000" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" operation="equals" var_ref="oval:mil.disa.fso.windows:var:407000" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:407101" version="2" comment="Reg_Dword type and value is greater than 0">
      <type>reg_dword</type>
      <value datatype="int" operation="greater than">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:407700" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:407700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:414300" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:414300" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:414800" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:414800" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:415100" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:415100" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:415200" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:415200" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:415300" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:415300" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:415400" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:415400" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:415500" version="2" comment="Reg_Dword type and value is less than or equal to variable">
      <type>reg_dword</type>
      <value datatype="int" operation="less than or equal" var_ref="oval:mil.disa.fso.windows:var:415500" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:415600" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:415600" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:416600" version="2" comment="Reg_Sz type and value equals 1">
      <type>reg_sz</type>
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:416601" version="2" comment="Reg_Sz type and value equals 2">
      <type>reg_sz</type>
      <value datatype="int" operation="equals">2</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:416700" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:416700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:416800" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:416800" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:416900" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:416900" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:417000" version="2" comment="Reg_Dword type and value is less than or equal to variable">
      <type>reg_dword</type>
      <value datatype="int" operation="less than or equal" var_ref="oval:mil.disa.fso.windows:var:417000" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:417100" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:417100" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:417200" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:417200" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:417600" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:417600" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:417700" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:417700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:417800" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:417800" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:418200" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" operation="equals" var_ref="oval:mil.disa.fso.windows:var:418200" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:419000" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:419000" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:419100" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:419100" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:419200" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:419200" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:419300" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:419300" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:419700" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:419700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420000" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:420000" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420100" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:420100" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420200" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:420200" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420300" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:420300" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420400" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:420400" />
    </registry_state>
    <lockoutpolicy_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420500" version="1" comment="Force Logoff equals variable">
      <force_logoff datatype="int" var_ref="oval:mil.disa.fso.windows:var:420500" />
    </lockoutpolicy_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420600" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:420600" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420700" version="2" comment="Reg_Dword type and value is greater than or equal to variable">
      <type>reg_dword</type>
      <value datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.windows:var:420700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420800" version="1" comment="Value bitwise and 524288">
      <type>reg_dword</type>
      <value datatype="int" operation="bitwise and">524288</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:420801" version="1" comment="Value bitwise and 536870912">
      <type>reg_dword</type>
      <value datatype="int" operation="bitwise and">536870912</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:421300" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:421300" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:421400" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:421400" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:421500" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:421500" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:421600" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:421600" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:421700" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:421700" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:421900" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:421900" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:422100" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:422100" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:422200" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:422200" />
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:422400" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.fso.windows:var:422400" />
    </registry_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:424000" version="3" comment="Act as part of the operating system">
      <setcbprivilege datatype="boolean" operation="equals">0</setcbprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:424900" version="3" comment="Create a token object">
      <secreatetokenprivilege datatype="boolean" operation="equals">0</secreatetokenprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:425100" version="3" comment="Create permanent shared objects">
      <secreatepermanentprivilege datatype="boolean" operation="equals">0</secreatepermanentprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:425300" version="3" comment="Debug programs">
      <sedebugprivilege datatype="boolean" operation="equals">0</sedebugprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:425301" version="3" comment="Administrators">
      <security_principle datatype="string" operation="equals">Administrators</security_principle>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:425900" version="3" comment="Enable computer and user accounts to be trusted for delegation">
      <seenabledelegationprivilege datatype="boolean" operation="equals">0</seenabledelegationprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:426600" version="3" comment="Lock pages in memory">
      <selockmemoryprivilege datatype="boolean" operation="equals">0</selockmemoryprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:437200" version="3" comment="Deny log on as a service">
      <sedenyservicelogonright datatype="boolean" operation="equals">1</sedenyservicelogonright>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:437201" version="1" comment="Deny log on as a service">
      <sedenyservicelogonright datatype="boolean" operation="equals">0</sedenyservicelogonright>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:437500" version="3" comment="Deny log on locally">
      <sedenyinteractivelogonright datatype="boolean" operation="equals">1</sedenyinteractivelogonright>
    </accesstoken_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:439600" version="3" comment="EMET">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">^Enhanced Mitigation Experience Toolkit .*</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:473000" version="1" comment="Reg_Dword type and value is less than or equals 900">
      <type>reg_dword</type>
      <value datatype="int" operation="less than or equal">900</value>
    </registry_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:474000" version="1" comment="Access Credential Manager as a trusted caller">
      <setrustedcredmanaccessnameright datatype="boolean" operation="equals">0</setrustedcredmanaccessnameright>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:477500" version="1" comment="Deny access to this computer from the network">
      <sedenynetworklogonright datatype="boolean" operation="equals">1</sedenynetworklogonright>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:477800" version="1" comment="Deny log on through Remote Desktop Services">
      <sedenyremoteInteractivelogonright datatype="boolean">1</sedenyremoteInteractivelogonright>
    </accesstoken_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:484700" version="1">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">^[[:space:]]*You[[:space:]]+are[[:space:]]+accessing[[:space:]]+a[[:space:]]+U\.S\.[[:space:]]+Government[[:space:]]+\(USG\)[[:space:]]+Information[[:space:]]+System[[:space:]]+\(IS\)[[:space:]]+that[[:space:]]+is[[:space:]]+provided[[:space:]]+for[[:space:]]+USG-authorized[[:space:]]+use[[:space:]]+only\.[[:space:]]+By[[:space:]]+using[[:space:]]+this[[:space:]]+IS[[:space:]]+\(which[[:space:]]+includes[[:space:]]+any[[:space:]]+device[[:space:]]+attached[[:space:]]+to[[:space:]]+this[[:space:]]+IS\),[[:space:]]+you[[:space:]]+consent[[:space:]]+to[[:space:]]+the[[:space:]]+following[[:space:]]+conditions:[[:space:]]+-The[[:space:]]+USG[[:space:]]+routinely[[:space:]]+intercepts[[:space:]]+and[[:space:]]+monitors[[:space:]]+communications[[:space:]]+on[[:space:]]+this[[:space:]]+IS[[:space:]]+for[[:space:]]+purposes[[:space:]]+including,[[:space:]]+but[[:space:]]+not[[:space:]]+limited[[:space:]]+to,[[:space:]]+penetration[[:space:]]+testing,[[:space:]]+COMSEC[[:space:]]+monitoring,[[:space:]]+network[[:space:]]+operations[[:space:]]+and[[:space:]]+defense,[[:space:]]+personnel[[:space:]]+misconduct[[:space:]]+\(PM\),[[:space:]]+law[[:space:]]+enforcement[[:space:]]+\(LE\),[[:space:]]+and[[:space:]]+counterintelligence[[:space:]]+\(CI\)[[:space:]]+investigations\.[[:space:]]+-At[[:space:]]+any[[:space:]]+time,[[:space:]]+the[[:space:]]+USG[[:space:]]+may[[:space:]]+inspect[[:space:]]+and[[:space:]]+seize[[:space:]]+data[[:space:]]+stored[[:space:]]+on[[:space:]]+this[[:space:]]+IS\.[[:space:]]+-Communications[[:space:]]+using,[[:space:]]+or[[:space:]]+data[[:space:]]+stored[[:space:]]+on,[[:space:]]+this[[:space:]]+IS[[:space:]]+are[[:space:]]+not[[:space:]]+private,[[:space:]]+are[[:space:]]+subject[[:space:]]+to[[:space:]]+routine[[:space:]]+monitoring,[[:space:]]+interception,[[:space:]]+and[[:space:]]+search,[[:space:]]+and[[:space:]]+may[[:space:]]+be[[:space:]]+disclosed[[:space:]]+or[[:space:]]+used[[:space:]]+for[[:space:]]+any[[:space:]]+USG-authorized[[:space:]]+purpose\.[[:space:]]+-This[[:space:]]+IS[[:space:]]+includes[[:space:]]+security[[:space:]]+measures[[:space:]]+\(e\.g\.,[[:space:]]+authentication[[:space:]]+and[[:space:]]+access[[:space:]]+controls\)[[:space:]]+to[[:space:]]+protect[[:space:]]+USG[[:space:]]+interests--not[[:space:]]+for[[:space:]]+your[[:space:]]+personal[[:space:]]+benefit[[:space:]]+or[[:space:]]+privacy\.[[:space:]]+-Notwithstanding[[:space:]]+the[[:space:]]+above,[[:space:]]+using[[:space:]]+this[[:space:]]+IS[[:space:]]+does[[:space:]]+not[[:space:]]+constitute[[:space:]]+consent[[:space:]]+to[[:space:]]+PM,[[:space:]]+LE[[:space:]]+or[[:space:]]+CI[[:space:]]+investigative[[:space:]]+searching[[:space:]]+or[[:space:]]+monitoring[[:space:]]+of[[:space:]]+the[[:space:]]+content[[:space:]]+of[[:space:]]+privileged[[:space:]]+communications,[[:space:]]+or work product,[[:space:]]+related[[:space:]]+to[[:space:]]+personal[[:space:]]+representation[[:space:]]+or[[:space:]]+services[[:space:]]+by[[:space:]]+attorneys,[[:space:]]+psychotherapists,[[:space:]]+or[[:space:]]+clergy,[[:space:]]+and[[:space:]]+their[[:space:]]+assistants\.[[:space:]]+Such[[:space:]]+communications[[:space:]]+and[[:space:]]+work[[:space:]]+product[[:space:]]+are[[:space:]]+private[[:space:]]+and[[:space:]]+confidential\.[[:space:]]+See[[:space:]]+User[[:space:]]+Agreement[[:space:]]+for[[:space:]]+details\.[[:space:]]*$</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:484701" version="1">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">^\s*You\s+are\s+accessing\s+a\s+U\.S\.\s+Government\s+\(USG\)\s+Information\s+System\s+\(IS\)\s+that\s+is\s+provided\s+for\s+USG-authorized\s+use\s+only\.\s+By\s+using\s+this\s+IS\s+\(which\s+includes\s+any\s+device\s+attached\s+to\s+this\s+IS\),\s+you\s+consent\s+to\s+the\s+following\s+conditions:\s+-The\s+USG\s+routinely\s+intercepts\s+and\s+monitors\s+communications\s+on\s+this\s+IS\s+for\s+purposes\s+including,\s+but\s+not\s+limited\s+to,\s+penetration\s+testing,\s+COMSEC\s+monitoring,\s+network\s+operations\s+and\s+defense,\s+personnel\s+misconduct\s+\(PM\),\s+law\s+enforcement\s+\(LE\),\s+and\s+counterintelligence\s+\(CI\)\s+investigations\.\s+-At\s+any\s+time,\s+the\s+USG\s+may\s+inspect\s+and\s+seize\s+data\s+stored\s+on\s+this\s+IS\.\s+-Communications\s+using,\s+or\s+data\s+stored\s+on,\s+this\s+IS\s+are\s+not\s+private,\s+are\s+subject\s+to\s+routine\s+monitoring,\s+interception,\s+and\s+search,\s+and\s+may\s+be\s+disclosed\s+or\s+used\s+for\s+any\s+USG-authorized\s+purpose\.\s+-This\s+IS\s+includes\s+security\s+measures\s+\(e\.g\.,\s+authentication\s+and\s+access\s+controls\)\s+to\s+protect\s+USG\s+interests--not\s+for\s+your\s+personal\s+benefit\s+or\s+privacy\.\s+-Notwithstanding\s+the\s+above,\s+using\s+this\s+IS\s+does\s+not\s+constitute\s+consent\s+to\s+PM,\s+LE\s+or\s+CI\s+investigative\s+searching\s+or\s+monitoring\s+of\s+the\s+content\s+of\s+privileged\s+communications,\s+or work product,\s+related\s+to\s+personal\s+representation\s+or\s+services\s+by\s+attorneys,\s+psychotherapists,\s+or\s+clergy,\s+and\s+their\s+assistants\.\s+Such\s+communications\s+and\s+work\s+product\s+are\s+private\s+and\s+confidential\.\s+See\s+User\s+Agreement\s+for\s+details\.\s*$</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:484800" version="1">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">^D(oD|OD) N(otice|OTICE) (and|AND) C(onsent|ONSENT) B(anner|ANNER)$</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:484801" version="1">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">^U\.?S\.? D(EPARTMENT|epartment) (OF|Of|of) D(EFENSE|efense) W(ARNING|arning) S(TATEMENT|tatement)$</value>
    </registry_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:484900" version="1" comment="Access this computer from the network">
      <senetworklogonright datatype="boolean">0</senetworklogonright>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485001" version="1" comment="LOCAL SERVICE">
      <security_principle datatype="string" operation="equals">LOCAL SERVICE</security_principle>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485002" version="1" comment="NETWORK SERVICE">
      <security_principle datatype="string" operation="equals">NETWORK SERVICE</security_principle>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485100" version="1" comment="Allow log on locally">
      <seinteractivelogonright datatype="boolean">0</seinteractivelogonright>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485101" version="1" comment="Users">
      <security_principle datatype="string" operation="equals">Users</security_principle>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485200" version="1" comment="Back up files and directories">
      <sebackupprivilege datatype="boolean">0</sebackupprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485400" version="1" comment="Change the system time">
      <sesystemtimeprivilege datatype="boolean">0</sesystemtimeprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485600" version="1" comment="Create a pagefile">
      <secreatepagefileprivilege datatype="boolean">0</secreatepagefileprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485700" version="1" comment="Create global objects">
      <secreateglobalprivilege datatype="boolean">0</secreateglobalprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485701" version="1" comment="SERVICE">
      <security_principle datatype="string" operation="equals">SERVICE</security_principle>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485800" version="1" comment="Create symbolic links">
      <secreatesymboliclinkprivilege datatype="boolean">0</secreatesymboliclinkprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:485900" version="1" comment="Force shutdown from a remote system">
      <seremoteshutdownprivilege datatype="boolean">0</seremoteshutdownprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:486000" version="1" comment="Generate security audits">
      <seauditprivilege datatype="boolean">0</seauditprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:486100" version="1" comment="Impersonate a client after authentication">
      <seimpersonateprivilege datatype="boolean">0</seimpersonateprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:486300" version="1" comment="Increase scheduling priority">
      <seincreasebasepriorityprivilege datatype="boolean">0</seincreasebasepriorityprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:486400" version="1" comment="Load and unload device drivers">
      <seloaddriverprivilege datatype="boolean">0</seloaddriverprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:486500" version="1" comment="Manage auditing and security log">
      <sesecurityprivilege datatype="boolean" operation="equals">0</sesecurityprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:486600" version="1" comment="Modify firmware environment values">
      <sesystemenvironmentprivilege datatype="boolean">0</sesystemenvironmentprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:486700" version="1" comment="Perform volume maintenance tasks">
      <semanagevolumeprivilege datatype="boolean">0</semanagevolumeprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:486800" version="1" comment="Profile single process">
      <seprofilesingleprocessprivilege datatype="boolean">0</seprofilesingleprocessprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:487100" version="1" comment="Restore files and directories">
      <serestoreprivilege datatype="boolean">0</serestoreprivilege>
    </accesstoken_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:487300" version="1" comment="Take ownership of files or other objects">
      <setakeownershipprivilege datatype="boolean">0</setakeownershipprivilege>
    </accesstoken_state>
    <wmi_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:498200" version="1" comment="Standalone Workstation is 0">
      <result datatype="int" operation="equals">0</result>
    </wmi_state>
    <wmi_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:498203" version="1" comment="Standalone Server is 2">
      <result datatype="int" operation="equals">2</result>
    </wmi_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:498500" version="3" comment="Reg_Dword type and value equals 0">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:498501" version="3" comment="Reg_Dword type and value equals 1">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:498502" version="3" comment="Reg_Dword type and value equals 2">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">2</value>
    </registry_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.fso.windows:ste:514200" version="1" comment="Deny log on through Remote Desktop Services - Everyone">
      <sedenyremoteInteractivelogonright datatype="boolean">1</sedenyremoteInteractivelogonright>
    </accesstoken_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:1100" version="1" comment="EMET Version is greater than or equal to 5.5">
      <type>reg_sz</type>
      <value datatype="version" operation="greater than or equal">5.5</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:1900" version="2" comment="RequireMutualAuthentication=1">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">(^| *, *)RequireMutualAuthentication=1( *, *|$)</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:1901" version="2" comment="No RequireMutualAuthentication!=1">
      <type>reg_sz</type>
      <value datatype="string" entity_check="none satisfy" operation="pattern match">(^|[ *, *])RequireMutualAuthentication=(?!1( *, *|$))</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:1902" version="2" comment="RequireIntegrity=1">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">(^| *, *)RequireIntegrity=1( *, *|$)</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:1903" version="2" comment="No RequireIntegrity!=1">
      <type>reg_sz</type>
      <value datatype="string" entity_check="none satisfy" operation="pattern match">(^| *, *)RequireIntegrity=(?!1( *, *|$))</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:2100" version="1" comment="DevicePKInitEnabled = 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:2200" version="1" comment="MitigationOptions_FontBocking = 1000000000000 (reg_sz, 12 zeros)">
      <type>reg_sz</type>
      <value datatype="string">1000000000000</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:2300" version="1" comment="AutoConnectAllowedOEM = 0 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:2400" version="1" comment="AllowTelemetry = 0 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:2401" version="1" comment="AllowTelemetry = 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:2500" version="1" comment="FormSuggest Passwords = no (reg_sz)">
      <type>reg_sz</type>
      <value datatype="string">no</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:2700" version="1" comment="MinimumPINLength ge 6 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int" operation="greater than or equal">6</value>
    </registry_state>
    <wmi57_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:3800" version="5" comment="Is the McAfee Agent Service or McAfee Framework Service running">
      <result datatype="record" operation="equals">
        <field xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" name="state">Running</field>
      </result>
    </wmi57_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:3801" version="3" comment="McAfee Framework Service version">
      <version datatype="version" operation="greater than or equal">4</version>
    </file_state>
    <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:3802" version="1" comment="McAfee Agent Service version">
      <version datatype="version" operation="greater than or equal">5</version>
    </file_state>
    <fileeffectiverights53_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:5100" version="3" comment="Event Log process account. Deterministically built with respect to service name.">
      <trustee_sid datatype="string">S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122</trustee_sid>
    </fileeffectiverights53_state>
    <fileeffectiverights53_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:5101" version="2" comment="SYSTEM account.">
      <trustee_sid datatype="string">S-1-5-18</trustee_sid>
    </fileeffectiverights53_state>
    <fileeffectiverights53_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:5102" version="1" comment="Administrators account.">
      <trustee_sid datatype="string">S-1-5-32-544</trustee_sid>
    </fileeffectiverights53_state>
    <fileeffectiverights53_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:5103" version="2" comment="LOCAL SERVICE account, the owner.">
      <trustee_sid datatype="string">S-1-5-19</trustee_sid>
    </fileeffectiverights53_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:5104" version="2" comment="%SystemRoot% environment variable.">
      <value datatype="string" operation="pattern match">^%[Ss][Yy][Ss][Tt][Ee][Mm][Rr][Oo][Oo][Tt]%.*$</value>
    </registry_state>
    <group_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:5400" version="3" comment="Group has Users">
      <user operation="pattern match">.+</user>
    </group_state>
    <group_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:5401" version="2" comment="Group has Subgroups">
      <subgroup operation="pattern match">.+</subgroup>
    </group_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:6500" version="1" comment="DisableAutomaticRestartSignOn = 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:6600" version="1" comment="DontDisplayNetworkSelectionUI = 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:6700" version="1" comment="MSAOptional = 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:6800" version="1" comment="DisableFileSyncNGSC = 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:6900" version="1" comment="NoLockScreenSlideshow = 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <wmi_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8200" version="1" comment="DomainRole is 0 (Standalone Workstation)">
      <result datatype="int">0</result>
    </wmi_state>
    <wmi_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8201" version="1" comment="DomainRole is 2 (Standalone Server)">
      <result datatype="int">2</result>
    </wmi_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8300" version="1" comment="EditionID = Enterprise (reg_sz)">
      <type>reg_sz</type>
      <value datatype="string">Enterprise</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8301" version="1" comment="EditionID = EnterpriseS (reg_sz)">
      <type>reg_sz</type>
      <value datatype="string">EnterpriseS</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8500" version="1" comment="AllowInsecureGuestAuth == 0 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8600" version="1" comment="EnhancedAntiSpoofing == 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8700" version="1" comment="PreventOverride == 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8800" version="1" comment="PreventOverrideAppRepUnknown == 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:8900" version="1" comment="AllowInPrivate == 0 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:9000" version="1" comment="EnabledV9 == 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:9100" version="1" comment="DeepHooks == 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:9200" version="1" comment="AntiDetours == 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:9300" version="1" comment="BannedFunctions == 1 (reg_dword)">
      <type>reg_dword</type>
      <value datatype="int">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:9700" version="1" comment="Reg_Dword type and value equals 7">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">7</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:9800" version="1" comment="regdword value of zero.">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:9900" version="2" comment="REG_DWORD value of 1.">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10000" version="1" comment="Reg_Dword value equals 1">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10100" version="1" comment="Reg_Dword value of 1">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10500" version="2" comment="Reg_Sz type and value is -EAF">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">-EAF</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10501" version="2" comment="Reg_Sz type and value is blank">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">^$</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10502" version="2" comment="Reg_Sz type and value is +EAF+ eaf_modules:chrome_child.dll">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">+EAF+ eaf_modules:chrome_child.dll</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10503" version="2" comment="Reg_Sz type and value is -DEP">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">-DEP</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10504" version="2" comment="Reg_Sz type and value is +EAF+ eaf_modules:mozjs.dll;xul.dll">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">+EAF+ eaf_modules:mozjs.dll;xul.dll</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10505" version="2" comment="Reg_Sz type and value is -EAF -MandatoryASLR">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">-EAF -MandatoryASLR</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10600" version="2" comment="Reg_Sz type and value is '+EAF+ eaf_modules:AcroRd32.dll;Acrofx32.dll;AcroForm.api'">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">+EAF+ eaf_modules:AcroRd32.dll;Acrofx32.dll;AcroForm.api</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10601" version="2" comment="Reg_Sz type and value is '-HeapSpray'">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">-HeapSpray</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10602" version="2" comment="Reg_Sz type and value is '+ASR asr_modules:flash*.ocx'">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">+ASR asr_modules:flash*.ocx</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10603" version="2" comment="Reg_Sz type and value is an empty string">
      <type>reg_sz</type>
      <value datatype="string" operation="pattern match">^$</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10900" version="1" comment="Reg_Sz type and value is greater than or equal to 6.3">
      <type>reg_sz</type>
      <value datatype="version" operation="greater than or equal">6.3</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10901" version="1" comment="Reg_Sz type and value is greater than or equal to 10586">
      <type>reg_sz</type>
      <value datatype="version" operation="greater than or equal">10586</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:10902" version="1" comment="Reg_Sz type and value is greater than or equal to 10240">
      <type>reg_sz</type>
      <value datatype="version" operation="greater than or equal">10240</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11300" version="1" comment="Reg_Dword value of 1">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11400" version="1" comment="Reg_sz value of 10 or less">
      <type>reg_sz</type>
      <value datatype="int" operation="less than or equal">10</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11500" version="1" comment="Reg_dword of 0, 'Automatically deny elevation requests'">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11600" version="1" comment="Reg_Sz type and value equals +EAF+ eaf_modules:mshtml.dll;flash*.ocx;jscript*.dll;vbscript.dll;vgx.dll +ASR asr_modules:npjpi*.dll;jp2iexp.dll;vgx.dll;msxml4*.dll;wshom.ocx;scrrun.dll;vbscript.dll asr_zones:1;2">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">+EAF+ eaf_modules:mshtml.dll;flash*.ocx;jscript*.dll;vbscript.dll;vgx.dll +ASR asr_modules:npjpi*.dll;jp2iexp.dll;vgx.dll;msxml4*.dll;wshom.ocx;scrrun.dll;vbscript.dll asr_zones:1;2</value>
    </registry_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11700" version="1" comment="'Other System Events' is set to 'Failure'">
      <other_system_events datatype="string">AUDIT_FAILURE</other_system_events>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11701" version="1" comment="'Other System Events' is set to 'Success' and 'Failure'">
      <other_system_events datatype="string">AUDIT_SUCCESS_FAILURE</other_system_events>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11800" version="1" comment="'Other System Events' is set to 'Success'">
      <other_system_events datatype="string">AUDIT_SUCCESS</other_system_events>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11801" version="1" comment="'Other System Events' is set to 'Success' and 'Failure'">
      <other_system_events datatype="string">AUDIT_SUCCESS_FAILURE</other_system_events>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11900" version="1" comment="'Account Lockout' is set to 'Success'">
      <account_lockout datatype="string">AUDIT_SUCCESS</account_lockout>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:11901" version="1" comment="'Account Lockout' is set to 'Success' and 'Failure'">
      <account_lockout datatype="string">AUDIT_SUCCESS_FAILURE</account_lockout>
    </auditeventpolicysubcategories_state>
    <wmi57_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:12000" version="1" comment="Is DEP set to 'Opt Out'">
      <result datatype="record" operation="equals">
        <field xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" name="dataexecutionprevention_supportpolicy" entity_check="at least one" datatype="string">3</field>
      </result>
    </wmi57_state>
    <wmi57_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:12001" version="1" comment="Is DEP set to 'Always On'">
      <result datatype="record" operation="equals">
        <field xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" name="dataexecutionprevention_supportpolicy" entity_check="at least one" datatype="string">1</field>
      </result>
    </wmi57_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:12200" version="1" comment="Reg_Dword type and value equals 0">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">0</value>
    </registry_state>
    <user_sid55_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:12900" version="1" comment="Enabled equals variable">
      <enabled datatype="boolean" var_ref="oval:mil.disa.stig.windows:var:12900" />
    </user_sid55_state>
    <user_sid55_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:13000" version="1" comment="Enabled equals variable">
      <enabled datatype="boolean" var_ref="oval:mil.disa.stig.windows:var:13000" />
    </user_sid55_state>
    <sid_sid_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:13100" version="1" comment="Not Administrator">
      <trustee_name datatype="string" operation="case insensitive not equal">Administrator</trustee_name>
    </sid_sid_state>
    <sid_sid_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:13101" version="1" comment="Not localdomain\Administrator">
      <trustee_name datatype="string" operation="case insensitive not equal" var_ref="oval:mil.disa.stig.windows:var:13100" />
    </sid_sid_state>
    <sid_sid_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:13200" version="1" comment="Not Guest">
      <trustee_name datatype="string" operation="case insensitive not equal">Guest</trustee_name>
    </sid_sid_state>
    <sid_sid_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:13201" version="1" comment="Not localdomain\Guest">
      <trustee_name datatype="string" operation="case insensitive not equal" var_ref="oval:mil.disa.stig.windows:var:13200" />
    </sid_sid_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:13700" version="1">
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:13900" version="1" comment="Does the value equal 1">
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <wmi57_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:14000" version="1" comment="Check Windows PowerShell 2.0 Win32_OptionalFeature object InstallState is equal to 2">
      <result datatype="record" operation="equals">
        <field xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" name="installstate" entity_check="at least one" datatype="string">2</field>
      </result>
    </wmi57_state>
    <wmi57_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:14100" version="1" comment="Check SMB v1 Protocol Win32_OptionalFeature object InstallState is equal to 2">
      <result datatype="record" operation="equals">
        <field xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" name="installstate" entity_check="at least one" datatype="string">2</field>
      </result>
    </wmi57_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:14700" version="1" comment="'Account Lockout' is set to 'Failure'">
      <account_lockout datatype="string">AUDIT_FAILURE</account_lockout>
    </auditeventpolicysubcategories_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:14800" version="1" comment="DWORD type and value is equal to 0">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">0</value>
    </registry_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:15000" version="1" comment="Audit - Audit Policy Change - Success only">
      <authorization_policy_change datatype="string" operation="equals">AUDIT_SUCCESS</authorization_policy_change>
    </auditeventpolicysubcategories_state>
    <auditeventpolicysubcategories_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:15001" version="2" comment="Audit - Audit Policy Change - Success and Failure">
      <authorization_policy_change datatype="string" operation="equals">AUDIT_SUCCESS_FAILURE</authorization_policy_change>
    </auditeventpolicysubcategories_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:15100" version="2" comment="Reg_Dword type and value equals 0">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">0</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:15200" version="1" comment="Reg_Sz type and value equals O:BAG:BAD:(A;;RC;;;BA)">
      <type>reg_sz</type>
      <value datatype="string" operation="equals">O:BAG:BAD:(A;;RC;;;BA)</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:15300" version="1" comment="Reg_Dword type and value equals 1">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">1</value>
    </registry_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:15400" version="1" comment="Reg_Dword type and value equals 4096">
      <type>reg_dword</type>
      <value datatype="int" operation="equals">4096</value>
    </registry_state>
    <accesstoken_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:15500" version="1" comment="Deny log on as a batch job">
      <sedenybatchLogonright datatype="boolean" operation="equals">1</sedenybatchLogonright>
    </accesstoken_state>
    <registry_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:mil.disa.stig.windows:ste:402900" version="2" comment="Reg_Dword type and value equals variable">
      <type>reg_dword</type>
      <value datatype="int" var_ref="oval:mil.disa.stig.windows:var:402900" />
    </registry_state>
  </states>
  <variables>
    <local_variable id="oval:mil.disa.fso.windows:var:388700" version="1" comment="Windows system 32 directory" datatype="string">
      <concat>
        <object_component item_field="value" object_ref="oval:mil.disa.fso.windows:obj:388601" />
        <literal_component>\System32</literal_component>
      </concat>
    </local_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:393200" version="1" datatype="int" comment="Account Lockout Threshold">
      <possible_value hint="3_attempts">3</possible_value>
      <possible_value hint="5_attempts">5</possible_value>
      <possible_value hint="10_attempts">10</possible_value>
      <possible_value hint="50_attempts">50</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:393300" version="1" datatype="int" comment="Reset Account Lockout Counter After">
      <possible_value hint="900_seconds">900</possible_value>
      <possible_value hint="3600_seconds">3600</possible_value>
      <possible_value hint="86400_seconds">86400</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:393400" version="1" datatype="int" comment="Enforce Password History">
      <possible_value hint="5_passwords">5</possible_value>
      <possible_value hint="24_passwords">24</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:393500" version="1" datatype="int" comment="Maximum Password Age">
      <possible_value hint="5184000_seconds">5184000</possible_value>
      <possible_value hint="7776000_seconds">7776000</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:393600" version="1" datatype="int" comment="Minimum Password Age">
      <possible_value hint="86400_seconds">86400</possible_value>
      <possible_value hint="172800_seconds">172800</possible_value>
      <possible_value hint="432000_seconds">432000</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:393700" version="1" datatype="int" comment="Minimum Password Length">
      <possible_value hint="8_characters">8</possible_value>
      <possible_value hint="9_characters">9</possible_value>
      <possible_value hint="12_characters">12</possible_value>
      <possible_value hint="14_characters">14</possible_value>
      <possible_value hint="15_characters">15</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:393800" version="1" datatype="boolean" comment="Enforce Password Complexity">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:393900" version="1" datatype="boolean" comment="Enforce Reversible Encryption When Storing Passwords">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:400200" version="1" datatype="int" comment="Turn off downloading of print drivers over HTTP">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:400700" version="1" datatype="int" comment="Turn off Internet download for Web publishing and online ordering wizards">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:400900" version="1" datatype="int" comment="Turn off printing over HTTP">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:402400" version="1" datatype="int" comment="Require a Password when a Computer Wakes (On Battery)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:402500" version="1" datatype="int" comment="Require a Password when a Computer Wakes (Plugged)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:403400" version="1" datatype="int" comment="Restrictions for Unauthenticated RPC clients">
      <possible_value hint="enabled:none">0</possible_value>
      <possible_value hint="enabled:authenticated">1</possible_value>
      <possible_value hint="enabled:authenticated_with_exceptions">2</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:404100" version="1" datatype="int" comment="Turn off Program Inventory">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:404200" version="1" datatype="int" comment="Turn off Autoplay for non-volume devices">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:404300" version="1" datatype="int" comment="Default behavior for AutoRun">
      <possible_value hint="do_not_execute_autorun_commands">1</possible_value>
      <possible_value hint="automatically_execute_autorun_commands">2</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:404700" version="1" datatype="int" comment="Enumerate administrator accounts on elevation">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:405400" version="1" datatype="int" comment="Maximum Application Log Size">
      <possible_value hint="enabled:16384_kb">16384</possible_value>
      <possible_value hint="enabled:32768_kb">32768</possible_value>
      <possible_value hint="enabled:81920_kb">81920</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:405500" version="2" datatype="int" comment="Maximum Security Log Size">
      <possible_value hint="enabled:16384_kb">16384</possible_value>
      <possible_value hint="enabled:32768_kb">32768</possible_value>
      <possible_value hint="enabled:81920_kb">81920</possible_value>
      <possible_value hint="enabled:196608_kb">196608</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:405700" version="1" datatype="int" comment="Maximum System Log Size">
      <possible_value hint="enabled:16384_kb">16384</possible_value>
      <possible_value hint="enabled:32768_kb">32768</possible_value>
      <possible_value hint="enabled:81920_kb">81920</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:405900" version="1" datatype="int" comment="Turn off Data Execution Protection">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:406000" version="1" datatype="int" comment="Turn off Heap termination on corruption">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:406600" version="1" datatype="int" comment="Do not allow passwords to be saved">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:406800" version="1" datatype="int" comment="Do not allow drive redirection">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:406900" version="1" datatype="int" comment="Always prompt for password upon connection">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:407000" version="1" datatype="int" comment="Set client connection encryption level">
      <possible_value hint="low_level">1</possible_value>
      <possible_value hint="client_compatible">2</possible_value>
      <possible_value hint="high_level">3</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:407700" version="1" datatype="int" comment="Allow indexing of encrypted files">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:414300" version="1" datatype="int" comment="Accounts: Limit local account use to blank passwords to console logon only">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:414800" version="1" datatype="int" comment="Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:415100" version="1" datatype="int" comment="Domain member: Digitally encrypt or sign secure channel data (always)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:415200" version="1" datatype="int" comment="Domain member: Digitally encrypt secure channel data (when possible)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:415300" version="1" datatype="int" comment="Domain member: Digitally sign secure channel data (when possible)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:415400" version="1" datatype="int" comment="Domain member: Disable machine account password changes">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:415500" version="1" datatype="int" comment="Maximum Machine Account Password Age">
      <possible_value hint="7_days">7</possible_value>
      <possible_value hint="30_days">30</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:415600" version="1" datatype="int" comment="Require Strong Session Key">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:416700" version="1" datatype="int" comment="Client Digitally Sign Communications (Always)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:416800" version="1" datatype="int" comment="Microsoft network client: Digitally sign communications (if server agrees)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:416900" version="1" datatype="int" comment="Microsoft network client: Send unencrypted password to third-party SMB servers">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:417000" version="1" datatype="int" comment="Amount of Idle Time Required Before Suspending Session">
      <possible_value hint="15_minutes">15</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:417100" version="1" datatype="int" comment="Microsoft network server: Digitally sign communications (always)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:417200" version="1" datatype="int" comment="Microsoft network server: Digitally sign communications (if client agrees)">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:417600" version="1" datatype="int" comment="MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)">
      <possible_value hint="No_additional_protection">0</possible_value>
      <possible_value hint="Medium_protection">1</possible_value>
      <possible_value hint="Highest_protection">2</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:417700" version="1" datatype="int" comment="MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)">
      <possible_value hint="source_routing_packets_allowed">0</possible_value>
      <possible_value hint="source_routing_packets_ignored">1</possible_value>
      <possible_value hint="source_routing_packets_disabled">2</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:417800" version="1" datatype="int" comment="MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:418200" version="1" datatype="int" comment="MSS: (NoNameReleaseOnDemand) Allow computer to ignore NetBIOS name release requests except from WINS servers">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:419000" version="1" datatype="int" comment="Network access: Do not allow anonymous enumeration of SAM accounts">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:419100" version="1" datatype="int" comment="Network access: Do not allow anonymous enumeration of SAM accounts and shares">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:419200" version="1" datatype="int" comment="Network access: Do not allow storage of credentials or .NET Passports for network authentication">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:419300" version="1" datatype="int" comment="Network access: Let Everyone permissions apply to anonymous users">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:419700" version="1" datatype="int" comment="Network access: Restrict anonymous access to Named Pipes and Shares">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:420000" version="1" datatype="int" comment="Network security: Allow Local System to use computer identity for NTLM">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:420100" version="1" datatype="int" comment="Network security: Allow LocalSystem NULL session fallback">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:420200" version="1" datatype="int" comment="Network Security: Allow PKU2U authentication requests to this computer to use online identities">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:420300" version="2" datatype="int" comment="Network Security: Configure encryption types allowed for Kerberos">
      <possible_value hint="AES128_HMAC_SHA1__AES256_HMAC_SHA1__Future_Encryption_Types">2147483640</possible_value>
      <possible_value hint="RC4_HMAC_MD5__AES128_HMAC_SHA1__AES256_HMAC_SHA1__Future_Encryption_Types">2147483644</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:420400" version="1" datatype="int" comment="Network security: Do not store LAN Manager hash value on next password change">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:420500" version="1" datatype="int" comment="Network security: Force logoff when logon hours expire">
      <possible_value hint="enabled">0</possible_value>
      <possible_value hint="disabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:420600" version="1" datatype="int" comment="Network Security: LAN Manager Authentication Level">
      <possible_value hint="send_LM_and_NTLM_responses">0</possible_value>
      <possible_value hint="send_LM_and_NTLM_use_NTLMv2_session_security_if_negotiated">1</possible_value>
      <possible_value hint="send_NTLM_response_only">2</possible_value>
      <possible_value hint="send_NTLMv2_response_only">3</possible_value>
      <possible_value hint="send_NTLMv2_response_only_refuse_LM">4</possible_value>
      <possible_value hint="send_NTLMv2_response_only_refuse_LM_and_NTLM">5</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:420700" version="1" datatype="int" comment="Network Security: LDAP client signing requirements">
      <possible_value hint="none">0</possible_value>
      <possible_value hint="negotiate_signing">1</possible_value>
      <possible_value hint="require_signing">2</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:421300" version="1" datatype="int" comment="System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:421400" version="1" datatype="int" comment="System objects: Require case insensitivity for non-Windows subsystems">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:421500" version="1" datatype="int" comment="System objects: Strengthen default permissions of internal system objects">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:421600" version="1" datatype="int" comment="Admin Approval Mode for the Built-in Administrator account">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:421700" version="1" datatype="int" comment="Behavior of the elevation prompt for administrators in Admin Approval Mode">
      <possible_value hint="elevate_without_prompting">0</possible_value>
      <possible_value hint="prompt_for_credentials_on_the_secure_desktop">1</possible_value>
      <possible_value hint="prompt_for_consent_on_the_secure_desktop">2</possible_value>
      <possible_value hint="prompt_for_credentials">3</possible_value>
      <possible_value hint="prompt_for_consent">4</possible_value>
      <possible_value hint="prompt_for_consent_for_non_windows_binaries">5</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:421900" version="1" datatype="int" comment="Detect application installations and prompt for elevation">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:422100" version="1" datatype="int" comment="Only elevate UIAccess applications that are installed in secure locations">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:422200" version="1" datatype="int" comment="Run all administrators in Admin Approval Mode">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <external_variable id="oval:mil.disa.fso.windows:var:422400" version="1" datatype="int" comment="Virtualize file and registry write failures to per-user locations">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <local_variable id="oval:mil.disa.fso.windows:var:439600" version="3" datatype="string" comment="EMET Install Key">
      <object_component object_ref="oval:mil.disa.fso.windows:obj:439601" item_field="key" />
    </local_variable>
    <local_variable datatype="string" id="oval:mil.disa.stig.windows:var:3800" version="5" comment="FrameworkService.exe full path">
      <regex_capture pattern="&quot;?(.*FrameworkService.exe).*">
        <object_component object_ref="oval:mil.disa.stig.windows:obj:3802" item_field="result" />
      </regex_capture>
    </local_variable>
    <local_variable datatype="string" id="oval:mil.disa.stig.windows:var:3801" version="1" comment="masvc.exe full path">
      <regex_capture pattern="&quot;?(.*masvc.exe).*">
        <object_component object_ref="oval:mil.disa.stig.windows:obj:3805" item_field="result" />
      </regex_capture>
    </local_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:5101" version="2" datatype="string" comment="Path to Application.evtx">
      <concat>
        <object_component object_ref="oval:mil.disa.fso.windows:obj:388601" item_field="value" />
        <regex_capture pattern="^%.*%(.*)$">
          <object_component object_ref="oval:mil.disa.stig.windows:obj:5102" item_field="value" />
        </regex_capture>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:5102" version="3" datatype="string" comment="Path to Application.evtx, minus sysroot environment variable, stripping any trailing null characters.">
      <regex_capture pattern="^(.*)\0*$">
        <object_component object_ref="oval:mil.disa.stig.windows:obj:5102" item_field="value" />
      </regex_capture>
    </local_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:5201" version="2" datatype="string" comment="Path to Security.evtx">
      <concat>
        <object_component object_ref="oval:mil.disa.fso.windows:obj:388601" item_field="value" />
        <regex_capture pattern="^%.*%(.*)$">
          <object_component object_ref="oval:mil.disa.stig.windows:obj:5202" item_field="value" />
        </regex_capture>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:5202" version="2" datatype="string" comment="Path to Security.evtx, excluding trailing nulls, minus sysroot environment variable.">
      <regex_capture pattern="^(.*)\0*$">
        <object_component object_ref="oval:mil.disa.stig.windows:obj:5202" item_field="value" />
      </regex_capture>
    </local_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:5301" version="2" datatype="string" comment="Path to System.evtx">
      <concat>
        <object_component object_ref="oval:mil.disa.fso.windows:obj:388601" item_field="value" />
        <regex_capture pattern="^%.*%(.*)$">
          <object_component object_ref="oval:mil.disa.stig.windows:obj:5302" item_field="value" />
        </regex_capture>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:5302" version="2" datatype="string" comment="Path to System.evtx, excluding trailing nulls, and minus sysroot environment variable.">
      <regex_capture pattern="^(.*)\0*$">
        <object_component object_ref="oval:mil.disa.stig.windows:obj:5302" item_field="value" />
      </regex_capture>
    </local_variable>
    <external_variable id="oval:mil.disa.stig.windows:var:12900" version="3" datatype="boolean" comment="Status of Admin Account">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:12901" version="1" datatype="string" comment="Built-in Administrator">
      <object_component object_ref="oval:mil.disa.stig.windows:obj:12901" item_field="trustee_sid" />
    </local_variable>
    <external_variable id="oval:mil.disa.stig.windows:var:13000" version="1" datatype="boolean" comment="Status of Guest Account">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:13001" version="1" datatype="string" comment="Built-in Guest">
      <object_component object_ref="oval:mil.disa.stig.windows:obj:13001" item_field="trustee_sid" />
    </local_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:13100" datatype="string" version="2" comment="localdomain\Administrator">
      <concat>
        <object_component object_ref="oval:mil.disa.stig.windows:obj:13100" item_field="trustee_domain" />
        <literal_component>\Administrator</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.stig.windows:var:13200" datatype="string" version="2" comment="localdomain\Guest">
      <concat>
        <object_component object_ref="oval:mil.disa.stig.windows:obj:13200" item_field="trustee_domain" />
        <literal_component>\Guest</literal_component>
      </concat>
    </local_variable>
    <external_variable id="oval:mil.disa.stig.windows:var:402900" version="1" datatype="int" comment="Solicited Remote Assistance">
      <possible_value hint="disabled">0</possible_value>
      <possible_value hint="enabled">1</possible_value>
    </external_variable>
  </variables>
</oval_definitions>

