The following is a description of the elements, types, and attributes that compose the Windows specific tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and should provide the information necessary to understand what each element and attribute represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between the different tests and their relationship to the Core Definition Schema is not outlined here.
The OVAL Schema is maintained by The MITRE Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org.
The accesstoken_test is used to check the properties of a Windows access token as well as individual privileges and rights associated with it. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an accesstoken_object and the optional state element specifies the data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The accesstoken_object element is used by an access token test to define the object to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An accesstoken_object consists of a single security principal that identifies user, group, or computer account that is associated with the token.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:AccesstokenBehaviors 0 1 security_principle oval-def:EntityObjectStringType 1 1
The accesstoken_state element defines the different information that can be used to evaluate the specified access tokens. This includes the multitude of user rights and permissions that can be granted. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs security_principle oval-def:EntityStateStringType 0 1 seassignprimarytokenprivilege oval-def:EntityStateBoolType 0 1 seauditprivilege oval-def:EntityStateBoolType 0 1 sebackupprivilege oval-def:EntityStateBoolType 0 1 sechangenotifyprivilege oval-def:EntityStateBoolType 0 1 secreateglobalprivilege oval-def:EntityStateBoolType 0 1 secreatepagefileprivilege oval-def:EntityStateBoolType 0 1 secreatepermanentprivilege oval-def:EntityStateBoolType 0 1 secreatesymboliclinkprivilege oval-def:EntityStateBoolType 0 1 secreatetokenprivilege oval-def:EntityStateBoolType 0 1 sedebugprivilege oval-def:EntityStateBoolType 0 1 seenabledelegationprivilege oval-def:EntityStateBoolType 0 1 seimpersonateprivilege oval-def:EntityStateBoolType 0 1 seincreasebasepriorityprivilege oval-def:EntityStateBoolType 0 1 seincreasequotaprivilege oval-def:EntityStateBoolType 0 1 seincreaseworkingsetprivilege oval-def:EntityStateBoolType 0 1 seloaddriverprivilege oval-def:EntityStateBoolType 0 1 selockmemoryprivilege oval-def:EntityStateBoolType 0 1 semachineaccountprivilege oval-def:EntityStateBoolType 0 1 semanagevolumeprivilege oval-def:EntityStateBoolType 0 1 seprofilesingleprocessprivilege oval-def:EntityStateBoolType 0 1 serelabelprivilege oval-def:EntityStateBoolType 0 1 seremoteshutdownprivilege oval-def:EntityStateBoolType 0 1 serestoreprivilege oval-def:EntityStateBoolType 0 1 sesecurityprivilege oval-def:EntityStateBoolType 0 1 seshutdownprivilege oval-def:EntityStateBoolType 0 1 sesyncagentprivilege oval-def:EntityStateBoolType 0 1 sesystemenvironmentprivilege oval-def:EntityStateBoolType 0 1 sesystemprofileprivilege oval-def:EntityStateBoolType 0 1 sesystemtimeprivilege oval-def:EntityStateBoolType 0 1 setakeownershipprivilege oval-def:EntityStateBoolType 0 1 setcbprivilege oval-def:EntityStateBoolType 0 1 setimezoneprivilege oval-def:EntityStateBoolType 0 1 seundockprivilege oval-def:EntityStateBoolType 0 1 seunsolicitedinputprivilege oval-def:EntityStateBoolType 0 1 sebatchlogonright oval-def:EntityStateBoolType 0 1 seinteractivelogonright oval-def:EntityStateBoolType 0 1 senetworklogonright oval-def:EntityStateBoolType 0 1 seremoteinteractivelogonright oval-def:EntityStateBoolType 0 1 seservicelogonright oval-def:EntityStateBoolType 0 1 sedenybatchLogonright oval-def:EntityStateBoolType 0 1 sedenyinteractivelogonright oval-def:EntityStateBoolType 0 1 sedenynetworklogonright oval-def:EntityStateBoolType 0 1 sedenyremoteInteractivelogonright oval-def:EntityStateBoolType 0 1 sedenyservicelogonright oval-def:EntityStateBoolType 0 1
The AccesstokenBehaviors complex type defines a number of behaviors that allow a more detailed definition of the accesstoken_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
| Deprecated As Of Version: 5.7 Reason: Replaced by the activedirectory57_test. This test allows for single fields to be selected from active directory. A new test was created to allow more than one field to be selected in one statement. See the activedirectory57_test. Comment: This object has been deprecated and may be removed in a future version of the language. |
The active directory test is used to check information about specific entries in active directory. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an activedirectory_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
| Deprecated As Of Version: 5.7 Reason: Replaced by the activedirectory57_object. This object allows for single fields to be selected from active directory. A new object was created to allow more than one field to be selected in one statement. See the activedirectory57_object. Comment: This object has been deprecated and may be removed in a future version of the language. |
The activedirectory_object element is used by an active directory test to define those objects to evaluated based on a specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An active directory object consists of three pieces of information, a naming context, a relative distinguished name, and an attribute. Each piece helps identify a specific active directory entry.
Child Elements Type MinOccurs MaxOccurs naming_context win-def:EntityObjectNamingContextType 1 1 relative_dn oval-def:EntityObjectStringType 1 1 attribute oval-def:EntityObjectStringType 1 1
| Deprecated As Of Version: 5.7 Reason: Replaced by the activedirectory57_state. This state allows for single fields to be selected from active directory. A new state was created to allow more than one field to be selected in one statement. See the activedirectory57_state. Comment: This object has been deprecated and may be removed in a future version of the language. |
The activedirectory_state element defines the different information that can be used to evaluate the specified entries in active directory. An active directory test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs naming_context win-def:EntityStateNamingContextType 0 1 relative_dn oval-def:EntityStateStringType 0 1 attribute oval-def:EntityStateStringType 0 1 object_class oval-def:EntityStateStringType 0 1 adstype win-def:EntityStateAdstypeType 0 1 value oval-def:EntityStateAnySimpleType 0 1
The active directory test is used to check information about specific entries in active directory. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an activedirectory57_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The activedirectory57_object element is used by an active directory test to define those objects to evaluated based on a specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An active directory object consists of three pieces of information, a naming context, a relative distinguished name, and an attribute. Each piece helps identify a specific active directory entry.
Child Elements Type MinOccurs MaxOccurs naming_context win-def:EntityObjectNamingContextType 1 1 relative_dn oval-def:EntityObjectStringType 1 1 attribute oval-def:EntityObjectStringType 1 1
The activedirectory57_state element defines the different information that can be used to evaluate the specified entries in active directory. An active directory test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs naming_context win-def:EntityStateNamingContextType 0 1 relative_dn oval-def:EntityStateStringType 0 1 attribute oval-def:EntityStateStringType 0 1 object_class oval-def:EntityStateStringType 0 1 adstype win-def:EntityStateAdstypeType 0 1 value oval-def:EntityStateRecordType 0 1
The auditeventpolicy_test is used to check different types of events the system should audit. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The auditeventpolicy_object element is used by an audit event policy test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy will reference the same auditeventpolicy_object which is basically an empty object element.
The auditeventpolicy_state element specifies the different system activities that can be audited. An audit event policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. The defined values are found in window's POLICY_AUDIT_EVENT_TYPE enumeration and accessed through the LsaQueryInformationPolicy when the InformationClass parameters are set to PolicyAuditEventsInformation. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs account_logon win-def:EntityStateAuditType 0 1 account_management win-def:EntityStateAuditType 0 1 detailed_tracking win-def:EntityStateAuditType 0 1 directory_service_access win-def:EntityStateAuditType 0 1 logon win-def:EntityStateAuditType 0 1 object_access win-def:EntityStateAuditType 0 1 policy_change win-def:EntityStateAuditType 0 1 privilege_use win-def:EntityStateAuditType 0 1 system win-def:EntityStateAuditType 0 1
The auditeventpolicysubcategories_test is used to check the audit event policy settings on a Windows system. These settings are used to specify which system and network events are monitored. For example, if the credential_validation element has a value of AUDIT_FAILURE, it means that the system is configured to log all unsuccessful attempts to validate a user account on a system. It is important to note that these audit event policy settings are specific to certain versions of Windows. As a result, the documentation for that version of Windows should be consulted for more information on each setting. The test extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The auditeventpolicysubcategories_object element is used by an audit event policy subcategories test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy subcategories and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy subcategories will reference the same auditeventpolicysubcategories_object which is basically an empty object element.
The auditeventpolicysubcategories_state element specifies the different system activities that can be audited. An audit event policy subcategories test will reference a specific instance of this state that defines the exact subcategories that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs credential_validation win-def:EntityStateAuditType 0 1 kerberos_authentication_service win-def:EntityStateAuditType 0 1 kerberos_service_ticket_operations win-def:EntityStateAuditType 0 1 kerberos_ticket_events win-def:EntityStateAuditType 0 1 other_account_logon_events win-def:EntityStateAuditType 0 1 application_group_management win-def:EntityStateAuditType 0 1 computer_account_management win-def:EntityStateAuditType 0 1 distribution_group_management win-def:EntityStateAuditType 0 1 other_account_management_events win-def:EntityStateAuditType 0 1 security_group_management win-def:EntityStateAuditType 0 1 user_account_management win-def:EntityStateAuditType 0 1 dpapi_activity win-def:EntityStateAuditType 0 1 process_creation win-def:EntityStateAuditType 0 1 process_termination win-def:EntityStateAuditType 0 1 rpc_events win-def:EntityStateAuditType 0 1 directory_service_access win-def:EntityStateAuditType 0 1 directory_service_changes win-def:EntityStateAuditType 0 1 directory_service_replication win-def:EntityStateAuditType 0 1 detailed_directory_service_replication win-def:EntityStateAuditType 0 1 account_lockout win-def:EntityStateAuditType 0 1 ipsec_extended_mode win-def:EntityStateAuditType 0 1 ipsec_main_mode win-def:EntityStateAuditType 0 1 ipsec_quick_mode win-def:EntityStateAuditType 0 1 logoff win-def:EntityStateAuditType 0 1 logon win-def:EntityStateAuditType 0 1 network_policy_server win-def:EntityStateAuditType 0 1 other_logon_logoff_events win-def:EntityStateAuditType 0 1 special_logon win-def:EntityStateAuditType 0 1 application_generated win-def:EntityStateAuditType 0 1 certification_services win-def:EntityStateAuditType 0 1 detailed_file_share win-def:EntityStateAuditType 0 1 file_share win-def:EntityStateAuditType 0 1 file_system win-def:EntityStateAuditType 0 1 filtering_platform_connection win-def:EntityStateAuditType 0 1 filtering_platform_packet_drop win-def:EntityStateAuditType 0 1 handle_manipulation win-def:EntityStateAuditType 0 1 kernel_object win-def:EntityStateAuditType 0 1 other_object_access_events win-def:EntityStateAuditType 0 1 registry win-def:EntityStateAuditType 0 1 sam win-def:EntityStateAuditType 0 1 audit_policy_change win-def:EntityStateAuditType 0 1 authentication_policy_change win-def:EntityStateAuditType 0 1 authorization_policy_change win-def:EntityStateAuditType 0 1 filtering_platform_policy_change win-def:EntityStateAuditType 0 1 mpssvc_rule_level_policy_change win-def:EntityStateAuditType 0 1 other_policy_change_events win-def:EntityStateAuditType 0 1 non_sensitive_privilege_use win-def:EntityStateAuditType 0 1 other_privilege_use_events win-def:EntityStateAuditType 0 1 sensitive_privilege_use win-def:EntityStateAuditType 0 1 ipsec_driver win-def:EntityStateAuditType 0 1 other_system_events win-def:EntityStateAuditType 0 1 security_state_change win-def:EntityStateAuditType 0 1 security_system_extension win-def:EntityStateAuditType 0 1 system_integrity win-def:EntityStateAuditType 0 1
The dnscache_test is used to check the time to live and IP addresses associated with a domain name. The time to live and IP addresses for a particular domain name are retrieved from the DNS cache on the local system. The entries in the DNS cache can be collected using Microsoft's DnsGetCacheDataTable() and DnsQuery() API calls. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a dnscache_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The dnscache_object is used by the dnscache_test to specify the domain name(s) that should be collected from the DNS cache on the local system. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs domain_name oval-def:EntityObjectStringType 1 1
The dnscache_state contains three entities that are used to check the domain name, time to live, and IP addresses associated with the DNS cache entry.
Child Elements Type MinOccurs MaxOccurs domain_name oval-def:EntityStateStringType 0 1 ttl oval-def:EntityStateIntType 0 1 ip_address oval-def:EntityStateStringType 0 1
The file test is used to check metadata associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a file_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The file_object element is used by a file test to define the specific file(s) to be evaluated. The file_object will collect directories and all Windows file types (FILE_TYPE_CHAR, FILE_TYPE_DISK, FILE_TYPE_PIPE, FILE_TYPE_REMOTE, and FILE_TYPE_UNKNOWN). Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A file object defines the path and filename or complete filepath of the file(s). In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileBehaviors complex type for more information about specific behaviors.
The set of files to be evaluated may be identified with either a complete filepath or a path and filename. Only one of these options may be selected.
It is important to note that the 'max_depth' and 'recurse_direction' attributes of the 'behaviors' element do not apply to the 'filepath' element, only to the 'path' and 'filename' elements. This is because the 'filepath' element represents an absolute path to a particular file and it is not possible to recurse over a file.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileBehaviors 0 1 filepath oval-def:EntityObjectStringType 1 1 path oval-def:EntityObjectStringType 1 1 filename oval-def:EntityObjectStringType 1 1
The file_state element defines the different metadata associate with a Windows file. This includes the path, filename, owner, size, last modified time, version, etc. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs filepath oval-def:EntityStateStringType 0 1 path oval-def:EntityStateStringType 0 1 filename oval-def:EntityStateStringType 0 1 owner oval-def:EntityStateStringType 0 1 size oval-def:EntityStateIntType 0 1 a_time oval-def:EntityStateIntType 0 1 c_time oval-def:EntityStateIntType 0 1 m_time oval-def:EntityStateIntType 0 1 ms_checksum oval-def:EntityStateStringType 0 1 version oval-def:EntityStateStringType 0 1 type win-def:EntityStateFileTypeType 0 1 development_class oval-def:EntityStateStringType 0 1 company oval-def:EntityStateStringType 0 1 internal_name oval-def:EntityStateStringType 0 1 language oval-def:EntityStateStringType 0 1 original_filename oval-def:EntityStateStringType 0 1 product_name oval-def:EntityStateStringType 0 1 product_version oval-def:EntityStateStringType 0 1
The FileBehaviors complex type defines a number of behaviors that allow a more detailed definition of the file_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
It is important to note that the 'max_depth' and 'recurse_direction' attributes of the 'behaviors' element do not apply to the 'filepath' element, only to the 'path' and 'filename' elements. This is because the 'filepath' element represents an absolute path to a particular file and it is not possible to recurse over a file.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - recurse_file_system n/a (optional -- default='all')
The file audit permissions test is used to check the audit permissions associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The fileauditedpermissions53_object element is used by a file audited permissions test to define the objects used to evalutate against the specified state. The fileauditedpermissions53_object will collect directories and all Windows file types (FILE_TYPE_CHAR, FILE_TYPE_DISK, FILE_TYPE_PIPE, FILE_TYPE_REMOTE, and FILE_TYPE_UNKNOWN). Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A fileauditedpermissions53_object is defined as a combination of a Windows file and trustee sid. The file represents the file to be evaluated while the trustee sid represents the account (sid) to check audited permissions of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileAuditPermissions53Behaviors complex type for more information about specific behaviors.
The set of files to be evaluated may be identified with either a complete filepath or a path and filename. Only one of these options may be selected.
It is important to note that the 'max_depth' and 'recurse_direction' attributes of the 'behaviors' element do not apply to the 'filepath' element, only to the 'path' and 'filename' elements. This is because the 'filepath' element represents an absolute path to a particular file and it is not possible to recurse over a file.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileAuditPermissions53Behaviors 0 1 filepath oval-def:EntityObjectStringType 1 1 path oval-def:EntityObjectStringType 1 1 filename oval-def:EntityObjectStringType 1 1 trustee_sid oval-def:EntityObjectStringType 1 1
The fileauditedpermissions53_state element defines the different audit permissions that can be associated with a given fileauditedpermissions53_object. Please refer to the individual elements in the schema for more details about what each represents.
The FileAuditPermissions53Behaviors complex type defines a number of behaviors that allow a more detailed definition of the fileauditpermissions53_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
It is important to note that the 'max_depth' and 'recurse_direction' attributes of the 'behaviors' element do not apply to the 'filepath' element, only to the 'path' and 'filename' elements. This is because the 'filepath' element represents an absolute path to a particular file and it is not possible to recurse over a file.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - recurse_file_system n/a (optional -- default='all') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
| Deprecated As Of Version: 5.3 Reason: Replaced by the fileauditedpermissions53_test. This test uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. See the fileauditedpermissions53_test. Comment: This test has been deprecated and will be removed in version 6.0 of the language. |
The file audited permissions test is used to check the audit permissions associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileauditedpermissions_object, and the optional state element references a fileauditedpermissions_state that specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
| Deprecated As Of Version: 5.3 Reason: Replaced by the fileauditedpermissions53_object. This object uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new object was created to use trustee SIDs, which are unique. See the fileauditedpermissions53_object. Comment: This object has been deprecated and will be removed in version 6.0 of the language. |
The fileauditedpermissions_object element is used by a file audited permissions test to define the objects used to evalutate against the specified state. The fileauditedpermissions_object will collect directories and all Windows file types (FILE_TYPE_CHAR, FILE_TYPE_DISK, FILE_TYPE_PIPE, FILE_TYPE_REMOTE, and FILE_TYPE_UNKNOWN). Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A fileauditedpermissions_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileAuditPermissionsBehaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileAuditPermissionsBehaviors 0 1 path oval-def:EntityObjectStringType 1 1 filename oval-def:EntityObjectStringType 1 1 trustee_name oval-def:EntityObjectStringType 1 1
| Deprecated As Of Version: 5.3 Reason: Replaced by the fileauditedpermissions53_state. This state uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new state was created to use trustee SIDs, which are unique. See the fileauditedpermissions53_state. Comment: This state has been deprecated and will be removed in version 6.0 of the language. |
The fileauditedpermissions_state element defines the different audit permissions that can be associated with a given fileauditedpermissions_object. Please refer to the individual elements in the schema for more details about what each represents.
| Deprecated As Of Version: 5.3 Reason: Replaced by the FileAuditPermissionsBehaviors53. The FileAuditPermissionsBehaviors complex type is used by the fileauditedpermissions_test which uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. This new test utilizes the FileAuditPermissionsBehaviors53 complex type, and as a result, the FileAuditPermissionsBehaviors complex type is no longer needed. Comment: This complex type has been deprecated and will be removed in version 6.0 of the language. |
The FileAuditPermissionsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the fileauditpermissions_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The file effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The fileeffectiverights53_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileeffectiverights53_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The fileeffectiverights53_object element is used by a file effective rights test to define the objects used to evalutate against the specified state. The fileeffectiverights53_object will collect directories and all Windows file types (FILE_TYPE_CHAR, FILE_TYPE_DISK, FILE_TYPE_PIPE, FILE_TYPE_REMOTE, and FILE_TYPE_UNKNOWN). Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A fileeffectiverights53_object is defined as a combination of a Windows file and trustee sid. The file represents the file to be evaluated while the trustee sid represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileEffectiveRights53Behaviors complex type for more information about specific behaviors.
The set of files to be evaluated may be identified with either a complete filepath or a path and filename. Only one of these options may be selected.
It is important to note that the 'max_depth' and 'recurse_direction' attributes of the 'behaviors' element do not apply to the 'filepath' element, only to the 'path' and 'filename' elements. This is because the 'filepath' element represents an absolute path to a particular file and it is not possible to recurse over a file.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileEffectiveRights53Behaviors 0 1 filepath oval-def:EntityObjectStringType 1 1 path oval-def:EntityObjectStringType 1 1 filename oval-def:EntityObjectStringType 1 1 trustee_sid oval-def:EntityObjectStringType 1 1
The fileeffectiverights53_state element defines the different rights that can be associated with a given fileeffectiverights53_object. Please refer to the individual elements in the schema for more details about what each represents.
The FileEffectiveRights53Behaviors complex type defines a number of behaviors that allow a more detailed definition of the fileeffectiverights53_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
It is important to note that the 'max_depth' and 'recurse_direction' attributes of the 'behaviors' element do not apply to the 'filepath' element, only to the 'path' and 'filename' elements. This is because the 'filepath' element represents an absolute path to a particular file and it is not possible to recurse over a file.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - recurse_file_system n/a (optional -- default='all') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
| Deprecated As Of Version: 5.3 Reason: Replaced by the fileeffectiverights53_test. This test uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. See the fileeffectiverights53_test. Comment: This test has been deprecated and will be removed in version 6.0 of the language. |
The file effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The fileeffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileeffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
| Deprecated As Of Version: 5.3 Reason: Replaced by the fileeffectiverights_object. This object uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new object was created to use trustee SIDs, which are unique. See the fileeffectiverights53_object. Comment: This object has been deprecated and will be removed in version 6.0 of the language. |
The fileeffectiverights_object element is used by a file effective rights test to define the objects used to evalutate against the specified state. The fileeffectiverights_object will collect directories and all Windows file types (FILE_TYPE_CHAR, FILE_TYPE_DISK, FILE_TYPE_PIPE, FILE_TYPE_REMOTE, and FILE_TYPE_UNKNOWN). Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A fileeffectiverights_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileEffectiveRightsBehaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileEffectiveRightsBehaviors 0 1 path oval-def:EntityObjectStringType 1 1 filename oval-def:EntityObjectStringType 1 1 trustee_name oval-def:EntityObjectStringType 1 1
| Deprecated As Of Version: 5.3 Reason: Replaced by the fileeffectiverights53_state. This state uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new state was created to use trustee SIDs, which are unique. See the fileeffectiverights53_state. Comment: This state has been deprecated and will be removed in version 6.0 of the language. |
The fileeffectiverights_state element defines the different rights that can be associated with a given fileeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents.
| Deprecated As Of Version: 5.3 Reason: Replaced by the FileEffectiveRightsBehaviors53. The FileEffectiveRightsBehaviors complex type is used by the fileeffectiverights_test which uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. This new test utilizes the FileEffectiveRightsBehaviors53 complex type, and as a result, the FileEffectiveRightsBehaviors complex type is no longer needed. Comment: This complex type has been deprecated and will be removed in version 6.0 of the language. |
The FileEffectiveRightsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the fileeffectiverights_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The group_test allows the different users and subgroups, that directly belong to specific groups (identified by name), to be tested. When the group_test collects the groups on the system, it should only include the local and built-in group accounts and not domain group accounts. However, it is important to note that domain group accounts can still be looked up. Also, note that the subgroups of the group will not be resolved to find indirect user and group members. If the subgroups need to be resolved, it should be done using the sid_object. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a group_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The group_object element is used by a group test to define the specific group(s) (identified by name) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs group oval-def:EntityObjectStringType 1 1
The group_state element enumerates the different users and subgroups directly associated with a Windows group. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs group oval-def:EntityStateStringType 0 1 user oval-def:EntityStateStringType 0 1 subgroup oval-def:EntityStateStringType 0 1
The group_sid_test allows the different users and subgroups, that directly belong to specific groups (identified by SID), to be tested. When the group_sid_test collects the group SIDs on the system, it should only include the local and built-in group SIDs and not domain group SIDs. However, it is important to note that domain group SIDs can still be looked up. Also, note that the subgroups of the group will not be resolved to find indirect user and group members. If the subgroups need to be resolved, it should be done using the sid_sid_object. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a group_sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The group_sid_object element is used by a group_test to define the specific group(s) (identified by SID) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs group_sid oval-def:EntityObjectStringType 1 1
The group_state element enumerates the different users and subgroups directly associated with a Windows group. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs group_sid oval-def:EntityStateStringType 0 1 user_sid oval-def:EntityStateStringType 0 1 subgroup_sid oval-def:EntityStateStringType 0 1
The interface test enumerate various attributes about the interfaces on a system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an interface_object and the optional state element specifies the interface information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The interface_object element is used by an interface test to define the specific interfaces(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An interface object consists of a single name entity that identifies which interface is being specified. For help understanding this object, see the MIB_IFROW and MIB_IPADDRROW structures.
Child Elements Type MinOccurs MaxOccurs name oval-def:EntityObjectStringType 1 1
The interface_state element enumerates the different properties associate with a Windows interface. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs name oval-def:EntityStateStringType 0 1 index oval-def:EntityStateIntType 0 1 type win-def:EntityStateInterfaceTypeType 0 1 hardware_addr oval-def:EntityStateStringType 0 1 inet_addr oval-def:EntityStateStringType 0 1 broadcast_addr oval-def:EntityStateStringType 0 1 netmask oval-def:EntityStateStringType 0 1 addr_type win-def:EntityStateAddrTypeType 0 1
The lockout policy test enumerates various attributes associated with lockout information for users and global groups in the security database. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a lockoutpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The lockoutpolicy_object element is used by a lockout policy test to define those objects to evaluated based on a specified state. There is actually only one object relating to lockout policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check lockout policy will reference the same lockoutpolicy_object which is basically an empty object element.
The lockoutpolicy_state element specifies the various attributes associated with lockout information for users and global groups in the security database. A lockout policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs force_logoff oval-def:EntityStateIntType 0 1 lockout_duration oval-def:EntityStateIntType 0 1 lockout_observation_window oval-def:EntityStateIntType 0 1 lockout_threshold oval-def:EntityStateIntType 0 1
The metabase test is used to check information found in the Windows metabase. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a metabase_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The metabase_object element is used by a metabase test to define the specific metabase item(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A metabase object defines the key and id of the item(s).
Child Elements Type MinOccurs MaxOccurs key oval-def:EntityObjectStringType 1 1 id oval-def:EntityObjectIntType 1 1
The metabase_state element defines the different metadata associate with a metabase item. This includes the name, user type, data type, and the actual data. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs key oval-def:EntityStateStringType 0 1 id oval-def:EntityStateIntType 0 1 name oval-def:EntityStateStringType 0 1 user_type oval-def:EntityStateStringType 0 1 data_type oval-def:EntityStateStringType 0 1 data oval-def:EntityStateAnySimpleType 0 1
The password policy test is used to check specific policy associated with passwords. It is important to note that these policies are specific to certain versions of Windows. As a result, the documentation for that version of Windows should be consulted for more information. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a passwordpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
NOTE: This information is stored in the SAM or Active Directory but is encrypted or hidden so the registry_test and activedirectory57_test are of no use. If this can be figured out, then the password_policy test is not needed.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The passwordpolicy_object element is used by a password policy test to define those objects to evaluated based on a specified state. There is actually only one object relating to password policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check password policy will reference the same passwordpolicy_object which is basically an empty object element.
The passwordpolicy_state element specifies the various policies associated with passwords. A password policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated.
Child Elements Type MinOccurs MaxOccurs max_passwd_age oval-def:EntityStateIntType 0 1 min_passwd_age oval-def:EntityStateIntType 0 1 min_passwd_len oval-def:EntityStateIntType 0 1 password_hist_len oval-def:EntityStateIntType 0 1 password_complexity oval-def:EntityStateBoolType 0 1 reversible_encryption oval-def:EntityStateBoolType 0 1
The port test is used to check information about the available ports on a Windows system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a port_object and the optional state element specifies the port information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The port_object element is used by a port test to define the specific port(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A port object defines the local address, port number, and protocol of the port(s).
Child Elements Type MinOccurs MaxOccurs local_address oval-def:EntityObjectStringType 1 1 local_port oval-def:EntityObjectIntType 1 1 protocol win-def:EntityObjectProtocolType 1 1
The port_state element defines the different metadata associate with a Windows port. This includes the local address, port number, protocol, and pid. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs local_address oval-def:EntityStateStringType 0 1 local_port oval-def:EntityStateIntType 0 1 protocol win-def:EntityStateProtocolType 0 1 pid oval-def:EntityStateIntType 0 1
The printer effective rights test is used to check the effective rights associated with Windows printers. The printereffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a printereffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
Child Elements Type MinOccurs MaxOccurs behaviors win-def:PrinterEffectiveRightsBehaviors 0 1 printer_name oval-def:EntityObjectStringType 1 1 trustee_sid oval-def:EntityObjectStringType 1 1
The printereffectiverights_state element defines the different rights that can be associated with a given printereffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs printer_name oval-def:EntityStateStringType 0 1 trustee_sid oval-def:EntityStateStringType 0 1 standard_delete oval-def:EntityStateBoolType 0 1 standard_read_control oval-def:EntityStateBoolType 0 1 standard_write_dac oval-def:EntityStateBoolType 0 1 standard_write_owner oval-def:EntityStateBoolType 0 1 standard_synchronize oval-def:EntityStateBoolType 0 1 access_system_security oval-def:EntityStateBoolType 0 1 generic_read oval-def:EntityStateBoolType 0 1 generic_write oval-def:EntityStateBoolType 0 1 generic_execute oval-def:EntityStateBoolType 0 1 generic_all oval-def:EntityStateBoolType 0 1 printer_access_administer oval-def:EntityStateBoolType 0 1 printer_access_use oval-def:EntityStateBoolType 0 1 job_access_administer oval-def:EntityStateBoolType 0 1 job_access_read oval-def:EntityStateBoolType 0 1
The PrinterEffectiveRightsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the pritnereffectiverights_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The process test is used to check information found in the Windows processes. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a process_object and the optional state element specifies the process information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The process_object element is used by a process test to define the specific process(es) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A process object defines the command line used to start the process(s).
Child Elements Type MinOccurs MaxOccurs command_line oval-def:EntityObjectStringType 1 1
The process_state element defines the different metadata associate with a Windows process. This includes the command line, pid, ppid, image path, and current directory. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs command_line oval-def:EntityStateStringType 0 1 pid oval-def:EntityStateIntType 0 1 ppid oval-def:EntityStateIntType 0 1 priority oval-def:EntityStateStringType 0 1 image_path oval-def:EntityStateStringType 0 1 current_dir oval-def:EntityStateStringType 0 1
The registry test is used to check metadata associated with Windows registry key. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a registry_object and the optional state element specifies the registry data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegistryBehaviors 0 1 hive win-def:EntityObjectRegistryHiveType 1 1 key oval-def:EntityObjectStringType 1 1 name oval-def:EntityObjectStringType 1 1
The registry_state element defines the different metadata associate with a Windows registry key. This includes the hive, key, name, type, and value. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs hive win-def:EntityStateRegistryHiveType 0 1 key oval-def:EntityStateStringType 0 1 name oval-def:EntityStateStringType 0 1 type win-def:EntityStateRegistryTypeType 0 1 value oval-def:EntityStateAnySimpleType 0 1
The RegistryBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registry_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none')
The registry key audited permissions test is used to check the audit permissions associated with Windows registry keys. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyauditedpermissions53_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The regkeyauditedpermissions53_object element is used by a registry key audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A regkeyauditedpermissions53_object is defined as a combination of a Windows registry key and trustee name. The hive and key elements represents the registry key to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple keys or sids are matched by either reference, then each possible combination of registry key and sid is a matching registry key audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the RegkeyAuditPermissions53Behaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegkeyAuditPermissions53Behaviors 0 1 hive win-def:EntityObjectRegistryHiveType 1 1 key oval-def:EntityObjectStringType 1 1 trustee_sid oval-def:EntityObjectStringType 1 1
The regkeyauditedpermissions53_state element defines the different audit permissions that can be associated with a given regkeyauditedpermissions53_object. Please refer to the individual elements in the schema for more details about what each represents.
The RegkeyAuditPermissions53Behaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyauditedpermissions53_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
| Deprecated As Of Version: 5.3 Reason: Replaced by the regkeyauditedpermissions53_test. This test uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. See the regkeyauditedpermissions53_test. Comment: This test has been deprecated and will be removed in version 6.0 of the language. |
The registry key audited permissions test is used to check the audit permissions associated with Windows registry keys. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
| Deprecated As Of Version: 5.3 Reason: Replaced by the regkeyauditedpermissions53_object. This object uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new object was created to use trustee SIDs, which are unique. See the regkeyauditedpermissions53_object. Comment: This object has been deprecated and will be removed in version 6.0 of the language. |
The regkeyauditedpermissions_object element is used by a registry key audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A regkeyauditedpermissions_object is defined as a combination of a Windows registry key and trustee name. The hive and key elements represents the registry key to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple keys or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the RegkeyAuditPermissionsBehaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegkeyAuditPermissionsBehaviors 0 1 hive win-def:EntityObjectRegistryHiveType 1 1 key oval-def:EntityObjectStringType 1 1 trustee_name oval-def:EntityObjectStringType 1 1
| Deprecated As Of Version: 5.3 Reason: Replaced by the regkeyauditedpermissions53_state. This state uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new state was created to use trustee SIDs, which are unique. See the regkeyauditedpermissions53_state. Comment: This state has been deprecated and will be removed in version 6.0 of the language. |
The regkeyauditedpermissions_state element defines the different audit permissions that can be associated with a given regkeyauditedpermissions_object. Please refer to the individual elements in the schema for more details about what each represents.
| Deprecated As Of Version: 5.3 Reason: Replaced by the RegkeyAuditPermissionsBehaviors53. The RegkeyAuditPermissionsBehaviors complex type is used by the regkeyauditedpermissions_test which uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. This new test utilizes the RegkeyAuditPermissionsBehaviors53 complex type, and as a result, the RegkeyAuditPermissionsBehaviors complex type is no longer needed. Comment: This complex type has been deprecated and will be removed in version 6.0 of the language. |
The RegkeyAuditPermissionsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyauditedpermissions_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The registry key effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The regkeyeffectiverights53_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyeffectiverights53_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The regkeyeffectiverights53_object element is used by a registry key effective rights test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A regkeyeffectiverights53_object is defined as a combination of a Windows registry and trustee sid. The key entity represents the registry key to be evaluated while the trustee sid represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of registry key and sid is a matching registry key effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the RegkeyEffectiveRights53Behaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegkeyEffectiveRights53Behaviors 0 1 hive win-def:EntityObjectRegistryHiveType 1 1 key oval-def:EntityObjectStringType 1 1 trustee_sid oval-def:EntityObjectStringType 1 1
The regkeyeffectiverights53_state element defines the different rights that can be associated with a given regkeyeffectiverights53_object. Please refer to the individual elements in the schema for more details about what each represents.
The RegkeyEffectiveRights53Behaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyeffectiverights53_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
| Deprecated As Of Version: 5.3 Reason: Replaced by the regkeyeffectiverights53_test. This test uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. See the regkeyeffectiverights53_test. Comment: This test has been deprecated and will be removed in version 6.0 of the language. |
The registry key effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The regkeyeffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyeffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
| Deprecated As Of Version: 5.3 Reason: Replaced by the fileauditedpermissions53_object. This object uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new object was created to use trustee SIDs, which are unique. See the regkeyeffectiverights53_object. Comment: This object has been deprecated and will be removed in version 6.0 of the language. |
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegkeyEffectiveRightsBehaviors 0 1 hive win-def:EntityObjectRegistryHiveType 1 1 key oval-def:EntityObjectStringType 1 1 trustee_name oval-def:EntityObjectStringType 1 1
| Deprecated As Of Version: 5.3 Reason: Replaced by the regkeyeffectiverights53_state. This state uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new state was created to use trustee SIDs, which are unique. See the regkeyeffectiverights53_state. Comment: This state has been deprecated and will be removed in version 6.0 of the language. |
The regkeyeffectiverights_state element defines the different rights that can be associated with a given regkeyeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents.
| Deprecated As Of Version: 5.3 Reason: Replaced by the RegkeyEffectiveRightsBehaviors53. The RegkeyEffectiveRightsBehaviors complex type is used by the regkeyeffectiverights_test which uses a trustee_name element for identifying trustees. Trustee names are not unique, and a new test was created to use trustee SIDs, which are unique. This new test utilizes the RegkeyEffectiveRightsBehaviors53 complex type, and as a result, the RegkeyEffectiveRightsBehaviors complex type is no longer needed. Comment: This complex type has been deprecated and will be removed in version 6.0 of the language. |
The RegkeyEffectiveRightsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyeffectiverights_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The service effective rights test is used to check the effective rights associated with Windows services. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The serviceeffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a serviceeffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The serviceeffectiverights_object element is used by the serviceeffectiverights_test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A serviceeffectiverights_object is defined as a combination of a Windows service_name and trustee_sid. The service_name entity represents the service to be evaluated while the trustee_sid entity represents the account (sid) to check the effective rights of. If multiple services or sids are matched by either reference, then each possible combination of service and sid is a matching service effective rights object.
Child Elements Type MinOccurs MaxOccurs service_name oval-def:EntityObjectStringType 1 1 trustee_sid oval-def:EntityObjectStringType 1 1
The serviceeffectiverights_state element defines the different rights that can be associated with a given serviceeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents.
See http://support.microsoft.com/kb/914392 for more information.
Child Elements Type MinOccurs MaxOccurs service_name oval-def:EntityStateStringType 0 1 trustee_sid oval-def:EntityStateStringType 0 1 standard_delete oval-def:EntityStateBoolType 0 1 standard_read_control oval-def:EntityStateBoolType 0 1 standard_write_dac oval-def:EntityStateBoolType 0 1 standard_write_owner oval-def:EntityStateBoolType 0 1 generic_read oval-def:EntityStateBoolType 0 1 generic_write oval-def:EntityStateBoolType 0 1 generic_execute oval-def:EntityStateBoolType 0 1 service_query_conf oval-def:EntityStateBoolType 0 1 service_change_conf oval-def:EntityStateBoolType 0 1 service_query_stat oval-def:EntityStateBoolType 0 1 service_enum_dependents oval-def:EntityStateBoolType 0 1 service_start oval-def:EntityStateBoolType 0 1 service_stop oval-def:EntityStateBoolType 0 1 service_pause oval-def:EntityStateBoolType 0 1 service_interrogate oval-def:EntityStateBoolType 0 1 service_user_defined oval-def:EntityStateBoolType 0 1
The shared resource test is used to check properties associated with any shared resource on the system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The sharedresource_object element is used by a shared resource test to define the object, in this case a shared resource, to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An shared resource object consists of a single netname entity that identifies a specific shared resource.
Child Elements Type MinOccurs MaxOccurs netname oval-def:EntityObjectStringType 1 1
The sharedresource_state element defines the different metadata associate with a Windows shared resource. This includes the share type, permissions, and max uses. This state mirror the SHARE_INFO_2 structure. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs netname oval-def:EntityStateStringType 0 1 shared_type win-def:EntityStateSharedResourceTypeType 0 1 max_uses oval-def:EntityStateIntType 0 1 current_uses oval-def:EntityStateIntType 0 1 local_path oval-def:EntityStateStringType 0 1 access_read_permission oval-def:EntityStateBoolType 0 1 access_write_permission oval-def:EntityStateBoolType 0 1 access_create_permission oval-def:EntityStateBoolType 0 1 access_exec_permission oval-def:EntityStateBoolType 0 1 access_delete_permission oval-def:EntityStateBoolType 0 1 access_atrib_permission oval-def:EntityStateBoolType 0 1 access_perm_permission oval-def:EntityStateBoolType 0 1 access_all_permission oval-def:EntityStateBoolType 0 1
The sid test is used to check properties associated with the specified sid. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The sid_object element is used by a sid_test to define the object set, in this case a set of sids (identified by name), to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:SidBehaviors 0 1 trustee_name oval-def:EntityObjectStringType 1 1
The sid_state element defines the different metadata associate with a Windows trustee (identified by name). Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs trustee_name oval-def:EntityStateStringType 0 1 trustee_sid oval-def:EntityStateStringType 0 1 trustee_domain oval-def:EntityStateStringType 0 1
The SidBehaviors complex type defines a number of behaviors that allow a more detailed definition of the sid_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The sid_sid_test is used to check properties associated with the specified sid. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a sid_sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Note that this sid_sid test was added in version 5.4 as a temporary fix. There is a need within the community to identify things like users and groups by both the name and the sid. For version 6 of OVAL, work is underway for a better solution to the problem, but for now, a second test was added to satisfy the need.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The sid_sid_object element is used by a sid_sid_test to define the object set, in this case a set of sids, to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:SidSidBehaviors 0 1 trustee_sid oval-def:EntityObjectStringType 1 1
The sid_state element defines the different metadata associate with a Windows trustee (identified by SID). Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs trustee_sid oval-def:EntityStateStringType 0 1 trustee_name oval-def:EntityStateStringType 0 1 trustee_domain oval-def:EntityStateStringType 0 1
The SidSidBehaviors complex type defines a number of behaviors that allow a more detailed definition of the sid_sid_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The user access control test is used to check setting related to User Access Control within Windows. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a uaac_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The uac_object element is used by a user access control test to define those objects to evaluate based on a specified state. There is actually only one object relating to user access control and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check user access control settings will reference the same uac_object which is basically an empty object element.
The uac_state element specifies the different settings that are available under User Access Control. A user access control test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs admin_approval_mode oval-def:EntityStateBoolType 0 1 elevation_prompt_admin oval-def:EntityStateStringType 0 1 elevation_prompt_standard oval-def:EntityStateStringType 0 1 detect_installations oval-def:EntityStateBoolType 0 1 elevate_signed_executables oval-def:EntityStateBoolType 0 1 elevate_uiaccess oval-def:EntityStateBoolType 0 1 run_admins_aam oval-def:EntityStateBoolType 0 1 secure_desktop oval-def:EntityStateBoolType 0 1 virtualize_write_failures oval-def:EntityStateBoolType 0 1
The user_test is used to check information about Windows users. When the user_test collects the users on the system, it should only include the local and built-in user accounts and not domain user accounts. However, it is important to note that domain user accounts can still be looked up. Also, note that the collection of groups, for which a user is a member, is not recursive. The only groups that will be collected are those for which the user is a direct member. For example, if a user is a member of group A, and group A is a member of group B, the only group that will be collected is group A. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a user_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
Child Elements Type MinOccurs MaxOccurs user oval-def:EntityObjectStringType 1 1
The user_state element enumerates the different groups (identified by name) that a Windows user might belong to. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs user oval-def:EntityStateStringType 0 1 enabled oval-def:EntityStateBoolType 0 1 group oval-def:EntityStateStringType 0 1
The user_sid55_test is used to check information about Windows users. When the user_sid55_test collects the user SIDs on the system, it should only include the local and built-in user SIDs and not domain user SIDs. However, it is important to note that domain user SIDs can still be looked up. Also, note that the collection of groups, for which a user is a member, is not recursive. The only groups that will be collected are those for which the user is a direct member. For example, if a user is a member of group A, and group A is a member of group B, the only group that will be collected is group A. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a user_sid55_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The user_sid55_object represents a set of users on a Windows system. This set (which might contain only one user) is identified by a SID.
Child Elements Type MinOccurs MaxOccurs user_sid oval-def:EntityObjectStringType 1 1
The user_sid55_state element enumerates the different groups (identified by SID) that a Windows user might belong to. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs user_sid oval-def:EntityStateStringType 0 1 enabled oval-def:EntityStateBoolType 0 1 group_sid oval-def:EntityStateStringType 0 1
| Deprecated As Of Version: 5.5 Reason: Replaced by the user_sid55_test. This test uses user and group elements that are incorrectly named. A new test was created to change the element names to their correct values which are user_sid and group_sid. See the user_sid55_test. Comment: This test has been deprecated and will be removed in version 6.0 of the language. |
The user_sid_test is used to check information about Windows users. When the user_sid_test collects the user SIDs on the system, it should only include the local and built-in user SIDs and not domain user SIDs. However, it is important to note that domain user SIDs can still be looked up. Also, note that the collection of groups, for which a user is a member, is not recursive. The only groups that will be collected are those for which the user is a direct member. For example, if a user is a member of group A, and group A is a member of group B, the only group that will be collected is group A. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a user_sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
| Deprecated As Of Version: 5.5 Reason: Replaced by the user_sid55_object. This object uses a user element that is incorrectly named. A new object was created to change the element name to its correct value which is user_sid. See the user_sid55_object. Comment: This object has been deprecated and will be removed in version 6.0 of the language. |
The user_sid_object represents a set of users on a Windows system. This set (which might contain only one user) is identified by a SID.
Child Elements Type MinOccurs MaxOccurs user oval-def:EntityObjectStringType 1 1
| Deprecated As Of Version: 5.5 Reason: Replaced by the user_sid55_state. This state uses user and group elements that are incorrectly named. A new state was created to change the element names to their correct values which are user_sid and group_sid. See the user_sid55_state. Comment: This state has been deprecated and will be removed in version 6.0 of the language. |
The user_sid_state element enumerates the different groups (identified by SID) that a Windows user might belong to. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs user oval-def:EntityStateStringType 0 1 enabled oval-def:EntityStateBoolType 0 1 group oval-def:EntityStateStringType 0 1
The volume_test is used to check information about different storage volumes found on a Windows system. This includes the various system flags returned by GetVolumeInformation(). It is important to note that these system flags are specific to certain versions of Windows. As a result, the documentation for that version of Windows should be consulted for more information. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a volume_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The volume_object element is used by a volume test to define the specific volume(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A volume object defines the rootpath of the volume(s).
Child Elements Type MinOccurs MaxOccurs rootpath oval-def:EntityObjectStringType 1 1
The volume_state element defines the different metadata associate with a storage volume in Windows. This includes the rootpath, the file system type, name, and serial number, as well as any associated flags. Please refer to the individual elements in the schema for more details about what each represents. The GetVolumeInformation function as defined by Microsoft is also a good place to look for information.
Child Elements Type MinOccurs MaxOccurs rootpath oval-def:EntityStateStringType 0 1 file_system oval-def:EntityStateStringType 0 1 name oval-def:EntityStateStringType 0 1 volume_max_component_length oval-def:EntityStateIntType 0 1 serial_number oval-def:EntityStateIntType 0 1 file_case_sensitive_search oval-def:EntityStateBoolType 0 1 file_case_preserved_names oval-def:EntityStateBoolType 0 1 file_unicode_on_disk oval-def:EntityStateBoolType 0 1 file_persistent_acls oval-def:EntityStateBoolType 0 1 file_file_compression oval-def:EntityStateBoolType 0 1 file_volume_quotas oval-def:EntityStateBoolType 0 1 file_supports_sparse_files oval-def:EntityStateBoolType 0 1 file_supports_reparse_points oval-def:EntityStateBoolType 0 1 file_supports_remote_storage oval-def:EntityStateBoolType 0 1 file_volume_is_compressed oval-def:EntityStateBoolType 0 1 file_supports_object_ids oval-def:EntityStateBoolType 0 1 file_supports_encryption oval-def:EntityStateBoolType 0 1 file_named_streams oval-def:EntityStateBoolType 0 1 file_read_only_volume oval-def:EntityStateBoolType 0 1
| Deprecated As Of Version: 5.7 Reason: Replaced by the wmi57_test. This test only allows for single fields to be selected from WMI. A new test was created to allow more than one field to be selected in one statement. See the wmi57_test. Comment: This test has been deprecated and may be removed in a future version of the language. |
The wmi test is used to check information accessed by WMI. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a wmi_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
| Deprecated As Of Version: 5.7 Reason: Replaced by the wmi57_object. This object allows for single fields to be selected from WMI. A new object was created to allow more than one field to be selected in one statement. See the wmi57_object. Comment: This object has been deprecated and may be removed in a future version of the language. |
Child Elements Type MinOccurs MaxOccurs namespace oval-def:EntityObjectStringType 1 1 wql oval-def:EntityObjectStringType 1 1
| Deprecated As Of Version: 5.7 Reason: Replaced by the wmi57_state. This object allows for single fields to be selected from WMI. A new state was created to allow more than one field to be selected in one statement. See the wmi57_state. Comment: This state has been deprecated and may be removed in a future version of the language. |
Child Elements Type MinOccurs MaxOccurs namespace oval-def:EntityStateStringType 0 1 wql oval-def:EntityStateStringType 0 1 result oval-def:EntityStateAnySimpleType 0 1
The wmi57 test is used to check information accessed by WMI. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a wmi57_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
Child Elements Type MinOccurs MaxOccurs namespace oval-def:EntityObjectStringType 1 1 wql oval-def:EntityObjectStringType 1 1
Child Elements Type MinOccurs MaxOccurs namespace oval-def:EntityStateStringType 0 1 wql oval-def:EntityStateStringType 0 1 result oval-def:EntityStateRecordType 0 1
The wuaupdatesearcher_test is used to evaluate patch level in a Windows environment utilizing the WUA (Windows Update Agent) interface. It is based on the Search method of the IUpdateSearcher interface found in the WUA API. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a wuaupdatesearcher_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Note that WUA can work off of many different sources including WSUS, update.microsoft.com, and a local cab file. The content source is specific to a given system evaluating a wuaupdatesearcher_test and thus is not defined by this test. The tool being used for evaluation should determine what content source is best for the system being assessed and then evaluate this test based on that selection.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType 1 1 state oval-def:StateRefType 0 unbounded
The wuaupdatesearcher_object element is used by a wuaupdatesearcher_test to define the specific search criteria to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:WuaUpdateSearcherBehaviors 0 1 search_criteria oval-def:EntityObjectStringType 1 1
The wuaupdatesearcher_state element defines entities that can be tested related to a uaupdatesearcher_object. This includes the search criteria and updated id. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs search_criteria oval-def:EntityStateStringType 0 1 update_id oval-def:EntityStateStringType 0 1
The WuaUpdateSearcherBehaviors complex type defines behaviors that allow a more detailed definition of the wuaupdatesearcher_object being specified. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in.
Attributes:
- include_superseded_updates xsd:boolean (optional -- default='true')
The EntityStateAddrTypeType complex type restricts a string value to a specific set of values that describe address types associated with an interface. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description MIB_IPADDR_DELETED
The stated IP address is being deleted. The unsigned short value that this corresponds to is 0x0040
MIB_IPADDR_DISCONNECTED
The stated IP address is on a disconnected interface. The unsigned short value that this corresponds to is 0x0008.
MIB_IPADDR_DYNAMIC
The stated IP address is a dynamic IP address. The unsigned short value that this corresponds to is 0x0004.
MIB_IPADDR_PRIMARY
The stated IP address is a primary IP address. The unsigned short value that this corresponds to is 0x0001.
MIB_IPADDR_TRANSIENT
The stated IP address is a transient IP address. The unsigned short value that this corresponds to is 0x0080
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateAdstypeType complex type restricts a string value to a specific set of values that specify the different types of information that an active directory attribute can represents. For more information look at the ADSTYPEENUM enumeration defined by Microsoft. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description ADSTYPE_INVALID
The data type is invalid.
ADSTYPE_DN_STRING
The string is of Distinguished Name (path) of a directory service object.
ADSTYPE_CASE_EXACT_STRING
The string is of the case-sensitive type.
ADSTYPE_CASE_IGNORE_STRING
The string is of the case-insensitive type.
ADSTYPE_PRINTABLE_STRING
The string is displayable on the screen or in print.
ADSTYPE_NUMERIC_STRING
The string is of a numeric value to be interpreted as text.
ADSTYPE_BOOLEAN
The data is of a Boolean value.
ADSTYPE_INTEGER
The data is of an integer value.
ADSTYPE_OCTET_STRING
The string is of a byte array.
ADSTYPE_UTC_TIME
The data is of the universal time as expressed in Universal Time Coordinate (UTC).
ADSTYPE_LARGE_INTEGER
The data is of a long integer value.
ADSTYPE_PROV_SPECIFIC
The string is of a provider-specific string.
ADSTYPE_OBJECT_CLASS
Not used.
ADSTYPE_CASEIGNORE_LIST
The data is of a list of case insensitive strings.
ADSTYPE_OCTET_LIST
The data is of a list of octet strings.
ADSTYPE_PATH
The string is of a directory path.
ADSTYPE_POSTALADDRESS
The string is of the postal address type.
ADSTYPE_TIMESTAMP
The data is of a time stamp in seconds.
ADSTYPE_BACKLINK
The string is of a back link.
ADSTYPE_TYPEDNAME
The string is of a typed name.
ADSTYPE_HOLD
The data is of the Hold data structure.
ADSTYPE_NETADDRESS
The string is of a net address.
ADSTYPE_REPLICAPOINTER
The data is of a replica pointer.
ADSTYPE_FAXNUMBER
The string is of a fax number.
ADSTYPE_EMAIL
The data is of an e-mail message.
ADSTYPE_NT_SECURITY_DESCRIPTOR
The data is of Windows NT/Windows 2000 Security Descriptor as represented by a byte array.
ADSTYPE_UNKNOWN
The data is of an undefined type.
ADSTYPE_DN_WITH_BINARY
The data is of ADS_DN_WITH_BINARY used for mapping a distinguished name to a non varying GUID.
ADSTYPE_DN_WITH_STRING
The data is of ADS_DN_WITH_STRING used for mapping a distinguished name to a non-varying string value.
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateAuditType complex type restricts a string value to a specific set of values: AUDIT_NONE, AUDIT_SUCCESS, AUDIT_FAILURE, and AUDIT_SUCCESS_FAILURE. These values describe which audit records should be generated. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description AUDIT_FAILURE
The audit type AUDIT_FAILURE is used to perform audits on all unsuccessful occurrences of specified events when auditing is enabled.
AUDIT_NONE
The audit type AUDIT_NONE is used to cancel all auditing options for the specified events.
AUDIT_SUCCESS
The audit type AUDIT_SUCCESS is used to perform audits on all successful occurrences of the specified events when auditing is enabled.
AUDIT_SUCCESS_FAILURE
The audit type AUDIT_SUCCESS_FAILURE is used to perform audits on all successful and unsuccessful occurrences of the specified events when auditing is enabled.
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateInterfaceTypeType complex type restricts a string value to a specific set of values. These values describe the different interface types. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description MIB_IF_TYPE_ETHERNET
The MIB_IF_TYPE_ETHERNET type is used to describe ethernet interfaces.
MIB_IF_TYPE_FDDI
The MIB_IF_TYPE_FDDI type is used to describe fiber distributed data interfaces (FDDI).
MIB_IF_TYPE_LOOPBACK
The MIB_IF_TYPE_LOOPBACK type is used to describe loopback interfaces.
MIB_IF_TYPE_OTHER
The MIB_IF_TYPE_OTHER type is used to describe unknown interfaces.
MIB_IF_TYPE_PPP
The MIB_IF_TYPE_PPP type is used to describe point-to-point protocol interfaces (PPP).
MIB_IF_TYPE_SLIP
The MIB_IF_TYPE_SLIP type is used to describe serial line internet protocol interfaces (SLIP).
MIB_IF_TYPE_TOKENRING
The MIB_IF_TYPE_TOKENRING type is used to describe token ring interfaces..
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateFileTypeType complex type restricts a string value to a specific set of values. These values describe the type of file being represented. For more information see the GetFileType and GetFileAttributesEx functions as defined by Microsoft. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description FILE_ATTRIBUTE_DIRECTORY
The handle identifies a directory.
FILE_TYPE_CHAR
The specified file is a character file, typically an LPT device or a console.
FILE_TYPE_DISK
The specified file is a disk file.
FILE_TYPE_PIPE
The specified file is a socket, a named pipe, or an anonymous pipe.
FILE_TYPE_REMOTE
Unused.
FILE_TYPE_UNKNOWN
Either the type of the specified file is unknown, or the function failed.
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityObjectNamingContextType restricts a string value to a specific set of values: domain, configuration, and schema. These values describe the different default naming context found in active directory. A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description domain
The domain naming context contains Active Directory objects present in the specified domain (e.g. users, computers, groups, and other objects).
configuration
The configuration naming context contains configuration data that is required for the Active Directory to operate as a directory service.
schema
The schema naming context contains all of the Active Directory object definitions.
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateNamingContextType restricts a string value to a specific set of values: domain, configuration, and schema. These values describe the different default naming context found in active directory. A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description domain
The domain naming context contains Active Directory objects present in the specified domain (e.g. users, computers, groups, and other objects).
configuration
The configuration naming context contains configuration data that is required for the Active Directory to operate as a directory service.
schema
The schema naming context contains all of the Active Directory object definitions.
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityObjectProtocolType restricts a string value to a specific set of values: TCP and UDP. These values describe the different protocols available to a port. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description TCP
The port uses the Transmission Control Protocol (TCP).
UDP
The port uses the User Datagram Protocol (UDP).
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateProtocolType restricts a string value to a specific set of values: TCP and UDP. These values describe the different protocols available to a port. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description TCP
The port uses the Transmission Control Protocol (TCP).
UDP
The port uses the User Datagram Protocol (UDP).
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityObjectRegistryHiveType restricts a string value to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. These values describe the possible hives in the registry. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description HKEY_CLASSES_ROOT
This registry subtree contains information that associates file types with programs and configuration data for automation (e.g. COM objects and Visual Basic Programs).
HKEY_CURRENT_CONFIG
This registry subtree contains configuration data for the current hardware profile.
HKEY_CURRENT_USER
This registry subtree contains the user profile of the user that is currently logged into the system.
HKEY_LOCAL_MACHINE
This registry subtree contains information about the local system.
HKEY_USERS
This registry subtree contains user-specific data.
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateRegistryHiveType restricts a string value to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. These values describe the possible hives in the registry. The empty string is also allowed to support empty element associated with variable references. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
Value Description HKEY_CLASSES_ROOT
This registry subtree contains information that associates file types with programs and configuration data for automation (e.g. COM objects and Visual Basic Programs).
HKEY_CURRENT_CONFIG
This registry subtree contains configuration data for the current hardware profile.
HKEY_CURRENT_USER
This registry subtree contains the user profile of the user that is currently logged into the system.
HKEY_LOCAL_MACHINE
This registry subtree contains information about the local system.
HKEY_USERS
This registry subtree contains user-specific data.
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateRegistryTypeType complex type defines the different values that are valid for the type entity of a registry state. These values describe the possible types of data stored in a registry key. The empty string is also allowed as a valid value to support an empty element that is found when a variable reference is used within the type entity. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values. Please note that the values identified are for the type entity and are not valid values for the datatype attribute. For information about how to encode registry data in OVAL for each of the different types, please visit the registry_state documentation.
Value Description reg_binary
The reg_binary type is used by registry keys that specify binary data in any form.
reg_dword
The reg_dword type is used by registry keys that specify a 32-bit number.
reg_expand_sz
The reg_expand_sz type is used by registry keys to specify a null-terminated string that contains unexpanded references to environment variables (for example, "%PATH%").
reg_multi_sz
The reg_multi_sz type is used by registry keys that specify an array of null-terminated strings, terminated by two null characters.
reg_none
The reg_none type is used by registry keys that have no defined value type.
reg_qword
The reg_qword type is used by registry keys that specify a 64-bit number.
reg_sz
The reg_sz type is used by registry keys that specify a single null-terminated string.
The empty string value is permitted here to allow for empty elements associated with variable references.
The EntityStateSharedResourceTypeType complex type defines the different values that are valid for the type entity of a shared resource state. Note that the Windows API returns a DWORD value and OVAL uses the constant name that is normally defined for these return values. This is done to increase readability and maintainability of OVAL Definitions. The empty string is also allowed as a valid value to support an empty element that is found when a variable reference is used within the type entity. Note that when using pattern matches and variables care must be taken to ensure that the regular expression and variable values align with the enumerated values.
It is also important to note that special shared resources are those reserved for remote administration, interprocess communication, and administrative shares.
Value Description STYPE_DISKTREE
The STYPE_DISKTREE type means that the shared resource is a disk drive. The DWORD value that this corresponds to is 0x00000000.
STYPE_DISKTREE_SPECIAL
The STYPE_DISKTREE_SPECIAL type means that the shared resource is a special disk drive. The DWORD value that this corresponds to is 0x80000000.
STYPE_DISKTREE_TEMPORARY
The STYPE_DISKTREE_TEMPORARY type means that the shared resource is a temporary disk drive. The DWORD value that this corresponds to is 0x40000000.
STYPE_DISKTREE_SPECIAL_TEMPORARY
The STYPE_DISKTREE_SPECIAL_TEMPORARY type means that the shared resource is a temporary, special disk drive. The DWORD value that this corresponds to is 0xC0000000.
STYPE_PRINTQ
The STYPE_PRINTQ type means that the shared resource is a print queue. The DWORD value that this corresponds to is 0x00000001.
STYPE_PRINTQ_SPECIAL
The STYPE_PRINTQ_SPECIAL type means that the shared resource is a special print queue. The DWORD value that this corresponds to is 0x80000001.
STYPE_PRINTQ_TEMPORARY
The STYPE_PRINTQ_TEMPORARY type means that the shared resource is a temporary print queue. The DWORD value that this corresponds to is 0x40000001.
STYPE_PRINTQ_SPECIAL_TEMPORARY
The STYPE_PRINTQ_SPECIAL_TEMPORARY type means that the shared resource is a temporary, special print queue. The DWORD value that this corresponds to is 0xC0000001.
STYPE_DEVICE
The STYPE_DEVICE type means that the shared resource is a communication device. The DWORD value that this corresponds to is 0x00000002.
STYPE_DEVICE_SPECIAL
The STYPE_DEVICE_SPECIAL type means that the shared resource is a special communication device. The DWORD value that this corresponds to is 0x80000002.
STYPE_DEVICE_TEMPORARY
The STYPE_DEVICE_TEMPORARY type means that the shared resource is a temporary communication device. The DWORD value that this corresponds to is 0x40000002.
STYPE_DEVICE_SPECIAL_TEMPORARY
The STYPE_DEVICE_SPECIAL_TEMPORARY type means that the shared resource is a temporary, special communication device. The DWORD value that this corresponds to is 0xC0000002.
STYPE_IPC
The STYPE_IPC type means that the shared resource is a interprocess communication. The DWORD value that this corresponds to is 0x00000003.
STYPE_IPC_SPECIAL
The STYPE_IPC_SPECIAL type means that the shared resource is a special interprocess communication. The DWORD value that this corresponds to is 0x80000003.
STYPE_IPC_TEMPORARY
The STYPE_IPC_TEMPORARY type means that the shared resource is a temporary interprocess communication. The DWORD value that this corresponds to is 0x40000003.
STYPE_IPC_SPECIAL_TEMPORARY
The STYPE_IPC_SPECIAL_TEMPORARY type means that the shared resource is a temporary, special interprocess communication. The DWORD value that this corresponds to is 0xC0000003.
STYPE_SPECIAL
The STYPE_SPECIAL type means that this is a special share reserved for interprocess communication (IPC$) or remote administration of the server (ADMIN$). Can also refer to administrative shares such as C$, D$, E$, and so forth. The DWORD value that this corresponds to is 0x40000000.
Deprecated As Of Version: 5.6
Reason: In version 5.6 of the OVAL Language, the EntityStateSharedResourceTypeType was changed to include all of the different shared resource types as specified in Microsoft's documentation of the shi2_type member of the SHARE_INFO_2 structure. As a result, the STYPE_SPECIAL value by itself is no longer valid because it would actually be equal to the value STYPE_DISKTREE_SPECIAL (0x80000000) which is STYPE_DISKTREE (0x00000000) OR'd with STYPE_SPECIAL (0x80000000).
Comment: This value has been deprecated and will be removed in version 6.0 of the language.STYPE_TEMPORARY
The STYPE_TEMPORARY type means that the shared resource is a temporary share. The DWORD value that this corresponds to is 0x80000000.
Deprecated As Of Version: 5.6
Reason: In version 5.6 of the OVAL Language, the EntityStateSharedResourceTypeType was changed to include all of the different shared resource types as specified in Microsoft's documentation of the shi2_type member of the SHARE_INFO_2 structure. As a result, the STYPE_TEMPORARY value by itself is no longer valid because it would actually be equal to the value STYPE_DISKTREE_TEMPORARY (0x40000000) which is STYPE_DISKTREE (0x00000000) OR'd with STYPE_TEMPORARY (0x40000000).
Comment: This value has been deprecated and will be removed in version 6.0 of the language.
The empty string value is permitted here to allow for empty elements associated with variable references.