home *** CD-ROM | disk | FTP | other *** search
/ PC World Komputer 2010 April / PCWorld0410.iso / WindowsServerTrial / server.iso / sources / install.wim / 1 / Windows / System32 / ceipdata.xml < prev    next >
Encoding:
Extensible Markup Language  |  2008-01-19  |  66.5 KB  |  1,319 lines
  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <CeipAssistant>
  3.  
  4.     <FileAttributes>
  5.         <Author>Microsoft Corporation</Author>
  6.         <Version>4</Version>
  7.     </FileAttributes>
  8.  
  9.     <ExecutionOptions>
  10.         <GlobalTimeout>1800</GlobalTimeout>
  11.         <QueryTimeout>10</QueryTimeout>
  12.         <MaxRows>1000</MaxRows>
  13.         <MaxErrors>2</MaxErrors>
  14.     </ExecutionOptions>
  15.  
  16.     <QueryGroups>
  17.  
  18.     <QueryGroup>
  19.         <Applicability>
  20.         <Global />
  21.         </Applicability>
  22.         <Queries>
  23.         <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement" Query="SELECT ServiceName FROM SqlService WHERE SQLServiceType=1 AND ServiceName!='MSSQL$MICROSOFT##SSEE'" MaxRows="1">
  24.             <WmiStreams>
  25.             <WmiStream DataId="1452" MaxStreamRows="1">
  26.                 <WmiStreamColumns>
  27.                 <WmiStreamColumn DataType="Dword">
  28.                     <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
  29.                                     <Transforms>
  30.                                             <EnumTransform DefaultValue="1000">
  31.                                             <Enum Name="MSSQLSERVER" Value="1000" />
  32.                                             </EnumTransform>
  33.                                     </Transforms>
  34.                     </WmiPropertySelector>    
  35.                 </WmiStreamColumn>
  36.                 <WmiStreamColumn DataType="Dword">
  37.                     <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
  38.                                     <Transforms>
  39.                                             <EnumTransform DefaultValue="1">
  40.                                             <Enum Name="MSSQLSERVER" Value="1" />
  41.                                             </EnumTransform>
  42.                                     </Transforms>
  43.                     </WmiPropertySelector>    
  44.                 </WmiStreamColumn>
  45.                 </WmiStreamColumns>
  46.             </WmiStream>
  47.             </WmiStreams>
  48.         </WmiQuery>
  49.         <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement" Query="SELECT ServiceName FROM SQLServiceAdvancedProperty WHERE SqlServiceType=1 AND PropertyName='SKUNAME' AND PropertyStrValue!='Express Edition' AND ServiceName!='MSSQL$MICROSOFT##SSEE'" MaxRows="1">
  50.             <WmiStreams>
  51.             <WmiStream DataId="1452" MaxStreamRows="1">
  52.                 <WmiStreamColumns>
  53.                 <WmiStreamColumn DataType="Dword">
  54.                     <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
  55.                                     <Transforms>
  56.                                             <EnumTransform DefaultValue="1001">
  57.                                             <Enum Name="MSSQLSERVER" Value="1001" />
  58.                                             </EnumTransform>
  59.                                     </Transforms>
  60.                     </WmiPropertySelector>    
  61.                 </WmiStreamColumn>
  62.                 <WmiStreamColumn DataType="Dword">
  63.                     <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
  64.                                     <Transforms>
  65.                                             <EnumTransform DefaultValue="1">
  66.                                             <Enum Name="MSSQLSERVER" Value="1" />
  67.                                             </EnumTransform>
  68.                                     </Transforms>
  69.                     </WmiPropertySelector>    
  70.                 </WmiStreamColumn>
  71.                 </WmiStreamColumns>
  72.             </WmiStream>
  73.             </WmiStreams>
  74.         </WmiQuery>
  75.  
  76.         <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement" Query="SELECT ServiceName FROM SQLServiceAdvancedProperty WHERE SqlServiceType=1 AND PropertyName='SKUNAME' AND PropertyStrValue='Express Edition'" MaxRows="1">
  77.             <WmiStreams>
  78.             <WmiStream DataId="1452" MaxStreamRows="1">
  79.                 <WmiStreamColumns>
  80.                 <WmiStreamColumn DataType="Dword">
  81.                     <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
  82.                                     <Transforms>
  83.                                             <EnumTransform DefaultValue="1002">
  84.                                             <Enum Name="MSSQL$SQLEXPRESS" Value="1002" />
  85.                                             </EnumTransform>
  86.                                     </Transforms>
  87.                     </WmiPropertySelector>    
  88.                 </WmiStreamColumn>
  89.                 <WmiStreamColumn DataType="Dword">
  90.                     <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
  91.                                     <Transforms>
  92.                                             <EnumTransform DefaultValue="1">
  93.                                             <Enum Name="MSSQL$SQLEXPRESS" Value="1" />
  94.                                             </EnumTransform>
  95.                                     </Transforms>
  96.                     </WmiPropertySelector>    
  97.                 </WmiStreamColumn>
  98.                 </WmiStreamColumns>
  99.             </WmiStream>
  100.             </WmiStreams>
  101.         </WmiQuery>
  102.         </Queries>
  103.     </QueryGroup>
  104.  
  105.     <QueryGroup>
  106.         <Applicability>
  107.         <Global />
  108.         </Applicability>
  109.         <Queries>
  110.         <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeSA' OR Name='MSExchangeTransport' OR Name='MSExchangeADTopology' OR Name='MSExchangeIMAP4' OR Name='ADAM_MSExchange' OR Name='MSExchangeUM'" MaxRows="1">
  111.             <WmiStreams>
  112.             <WmiStream DataId="1452" MaxStreamRows="1">
  113.                 <WmiStreamColumns>
  114.                 <WmiStreamColumn DataType="Dword">
  115.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  116.                                     <Transforms>
  117.                                             <EnumTransform DefaultValue="1500">
  118.                                             <Enum Name="MSExchangeSA" Value="1500" />
  119.                                             </EnumTransform>
  120.                                     </Transforms>
  121.                     </WmiPropertySelector>    
  122.                 </WmiStreamColumn>
  123.                 <WmiStreamColumn DataType="Dword">
  124.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  125.                                     <Transforms>
  126.                                             <EnumTransform DefaultValue="1">
  127.                                             <Enum Name="MSExchangeSA" Value="1" />
  128.                                             </EnumTransform>
  129.                                     </Transforms>
  130.                     </WmiPropertySelector>    
  131.                 </WmiStreamColumn>
  132.                 </WmiStreamColumns>
  133.             </WmiStream>
  134.             </WmiStreams>
  135.         </WmiQuery>
  136.         <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeSA'" MaxRows="1">
  137.             <WmiStreams>
  138.             <WmiStream DataId="1452" MaxStreamRows="1">
  139.                 <WmiStreamColumns>
  140.                 <WmiStreamColumn DataType="Dword">
  141.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  142.                                     <Transforms>
  143.                                             <EnumTransform DefaultValue="1501">
  144.                                             <Enum Name="MSExchangeSA" Value="1501" />
  145.                                             </EnumTransform>
  146.                                     </Transforms>
  147.                     </WmiPropertySelector>    
  148.                 </WmiStreamColumn>
  149.                 <WmiStreamColumn DataType="Dword">
  150.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  151.                                     <Transforms>
  152.                                             <EnumTransform DefaultValue="1">
  153.                                             <Enum Name="MSExchangeSA" Value="1" />
  154.                                             </EnumTransform>
  155.                                     </Transforms>
  156.                     </WmiPropertySelector>    
  157.                 </WmiStreamColumn>
  158.                 </WmiStreamColumns>
  159.             </WmiStream>
  160.             </WmiStreams>
  161.         </WmiQuery>
  162.         <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeTransport' OR Name='MSExchangeADTopology'" MaxRows="1">
  163.             <WmiStreams>
  164.             <WmiStream DataId="1452" MaxStreamRows="1">
  165.                 <WmiStreamColumns>
  166.                 <WmiStreamColumn DataType="Dword">
  167.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  168.                                     <Transforms>
  169.                                             <EnumTransform DefaultValue="1502">
  170.                                             <Enum Name="MSExchangeTransport" Value="1502" />
  171.                         <Enum Name="MSExchangeADTopology" Value="1502" />
  172.                                             </EnumTransform>
  173.                                     </Transforms>
  174.                     </WmiPropertySelector>    
  175.                 </WmiStreamColumn>
  176.                 <WmiStreamColumn DataType="Dword">
  177.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  178.                                     <Transforms>
  179.                                             <EnumTransform DefaultValue="1">
  180.                                             <Enum Name="MSExchangeTransport" Value="1" />
  181.                         <Enum Name="MSExchangeADTopology" Value="1" />
  182.                                             </EnumTransform>
  183.                                     </Transforms>
  184.                     </WmiPropertySelector>    
  185.                 </WmiStreamColumn>
  186.                 </WmiStreamColumns>
  187.             </WmiStream>
  188.             </WmiStreams>
  189.         </WmiQuery>
  190.         <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeIMAP4'" MaxRows="1">
  191.             <WmiStreams>
  192.             <WmiStream DataId="1452" MaxStreamRows="1">
  193.                 <WmiStreamColumns>
  194.                 <WmiStreamColumn DataType="Dword">
  195.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  196.                                     <Transforms>
  197.                                             <EnumTransform DefaultValue="1503">
  198.                                             <Enum Name="MSExchangeIMAP4" Value="1503" />
  199.                                             </EnumTransform>
  200.                                     </Transforms>
  201.                     </WmiPropertySelector>    
  202.                 </WmiStreamColumn>
  203.                 <WmiStreamColumn DataType="Dword">
  204.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  205.                                     <Transforms>
  206.                                             <EnumTransform DefaultValue="1">
  207.                                             <Enum Name="MSExchangeIMAP4" Value="1" />
  208.                                             </EnumTransform>
  209.                                     </Transforms>
  210.                     </WmiPropertySelector>    
  211.                 </WmiStreamColumn>
  212.                 </WmiStreamColumns>
  213.             </WmiStream>
  214.             </WmiStreams>
  215.         </WmiQuery>
  216.         <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='ADAM_MSExchange'" MaxRows="1">
  217.             <WmiStreams>
  218.             <WmiStream DataId="1452" MaxStreamRows="1">
  219.                 <WmiStreamColumns>
  220.                 <WmiStreamColumn DataType="Dword">
  221.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  222.                                     <Transforms>
  223.                                             <EnumTransform DefaultValue="1504">
  224.                                             <Enum Name="ADAM_MSExchange" Value="1504" />
  225.                                             </EnumTransform>
  226.                                     </Transforms>
  227.                     </WmiPropertySelector>    
  228.                 </WmiStreamColumn>
  229.                 <WmiStreamColumn DataType="Dword">
  230.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  231.                                     <Transforms>
  232.                                             <EnumTransform DefaultValue="1">
  233.                                             <Enum Name="ADAM_MSExchange" Value="1" />
  234.                                             </EnumTransform>
  235.                                     </Transforms>
  236.                     </WmiPropertySelector>    
  237.                 </WmiStreamColumn>
  238.                 </WmiStreamColumns>
  239.             </WmiStream>
  240.             </WmiStreams>
  241.         </WmiQuery>
  242.         <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeUM'" MaxRows="1">
  243.             <WmiStreams>
  244.             <WmiStream DataId="1452" MaxStreamRows="1">
  245.                 <WmiStreamColumns>
  246.                 <WmiStreamColumn DataType="Dword">
  247.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  248.                                     <Transforms>
  249.                                             <EnumTransform DefaultValue="1505">
  250.                                             <Enum Name="MSExchangeUM" Value="1505" />
  251.                                             </EnumTransform>
  252.                                     </Transforms>
  253.                     </WmiPropertySelector>    
  254.                 </WmiStreamColumn>
  255.                 <WmiStreamColumn DataType="Dword">
  256.                     <WmiPropertySelector PropertyName="Name" PropertyType="String">
  257.                                     <Transforms>
  258.                                             <EnumTransform DefaultValue="1">
  259.                                             <Enum Name="MSExchangeUM" Value="1" />
  260.                                             </EnumTransform>
  261.                                     </Transforms>
  262.                     </WmiPropertySelector>    
  263.                 </WmiStreamColumn>
  264.                 </WmiStreamColumns>
  265.             </WmiStream>
  266.             </WmiStreams>
  267.         </WmiQuery>
  268.  
  269.         </Queries>
  270.     </QueryGroup>
  271.  
  272.     <QueryGroup>
  273.         <Applicability>
  274.         <Global />
  275.         </Applicability>
  276.         <Queries>
  277.         <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT AllowTSConnections FROM Win32_TerminalServiceSetting" QueryTimeout="20">
  278.             <WmiDatapoints>
  279.             <WmiDatapoint DataId="2539" DataType="Dword">
  280.                 <WmiPropertySelector PropertyName="AllowTSConnections" PropertyType="Dword" />
  281.             </WmiDatapoint>
  282.             </WmiDatapoints>
  283.         </WmiQuery>
  284.         <WmiQuery Namespace="root\cimv2" Query="SELECT MediaType FROM Win32_DiskDrive WHERE MediaType='Fixed hard disk media'" QueryTimeout="20">
  285.             <WmiAggregates>
  286.             <WmiAggregate DataId="2517" Function="Count" />                
  287.             </WmiAggregates>
  288.         </WmiQuery>
  289.         <WmiQuery Namespace="root\cimv2" Query="SELECT Type FROM Win32_DiskPartition" QueryTimeout="20">
  290.             <WmiAggregates>
  291.             <WmiAggregate DataId="2520" Function="Count" />                
  292.             </WmiAggregates>
  293.         </WmiQuery>
  294.         <WmiQuery Namespace="root\cimv2" Query="SELECT Model, Size FROM Win32_DiskDrive" QueryTimeout="20">
  295.             <WmiStreams>
  296.             <WmiStream DataId="2918">
  297.                 <WmiStreamColumns>
  298.                 <WmiStreamColumn DataType="String">
  299.                     <WmiPropertySelector PropertyName="Model" PropertyType="String" />    
  300.  
  301.  
  302.                 </WmiStreamColumn>
  303.                 <WmiStreamColumn DataType="Dword">
  304.                     <WmiPropertySelector PropertyName="Size" PropertyType="Qword">
  305.                     <Transforms>
  306.                                             <ScaleTransform Divisor="1048576" />                                           
  307.                                     </Transforms>
  308.  
  309.                     </WmiPropertySelector>    
  310.  
  311.                 </WmiStreamColumn>
  312.                 </WmiStreamColumns>
  313.             </WmiStream>
  314.             </WmiStreams>
  315.         </WmiQuery>
  316.         <RegistryQuery Hive="HKLM" Subkey="System\Setup">
  317.             <RegistryAggregates>
  318.             <RegistryAggregate DataId="3076" Function="Exists">
  319.                 <RegistryValueSelector ValueName="Upgrade" ValueType="Dword" />
  320.             </RegistryAggregate>
  321.             </RegistryAggregates>
  322.         </RegistryQuery>
  323.             <EventQuery Channel="System" Query="*[System/EventID=596]">
  324.                 <EventAggregates>
  325.                 <EventAggregate DataId="2534" Function="Count" />
  326.             </EventAggregates>
  327.             </EventQuery>
  328.             <EventQuery Channel="System" Query="*[System/EventID=23]">
  329.                 <EventAggregates>
  330.                 <EventAggregate DataId="2538" Function="Count" />
  331.             </EventAggregates>
  332.             </EventQuery>
  333.         </Queries>
  334.     </QueryGroup>
  335.  
  336.     <QueryGroup>
  337.         <Applicability>
  338.                 <Expression JoinOperator="And">
  339.                     <RoleTest RoleId="10" RequiredState="Installed" />
  340.                 </Expression>        
  341.         </Applicability>
  342.         <Queries>
  343.             <EventQuery Channel="System" Query="*[System/EventID=8225]">
  344.                 <EventAggregates>
  345.                 <EventAggregate DataId="2536" Function="Count" />
  346.             </EventAggregates>
  347.             </EventQuery>
  348.             <EventQuery Channel="System" Query="*[System/EventID=8226]">
  349.                 <EventAggregates>
  350.                 <EventAggregate DataId="2535" Function="Count" />
  351.             </EventAggregates>
  352.             </EventQuery>
  353.         </Queries>    
  354.     </QueryGroup>
  355.  
  356.         <QueryGroup>
  357.             <Applicability>
  358.                 <Expression JoinOperator="And">
  359.                     <RoleTest RoleId="33" RequiredState="Running" />
  360.                 </Expression>
  361.             </Applicability>
  362.             <Queries>
  363.                 <WmiQuery Namespace="root\MSCluster" Query="SELECT * from MSCluster_Node">
  364.                     <WmiAggregates>
  365.                         <WmiAggregate DataId="2551" Function="Count" />
  366.                     </WmiAggregates>
  367.                 </WmiQuery>
  368.                 <WmiQuery Namespace="root\MSCluster" Query="SELECT QuorumType from MSCluster_Cluster" QueryTimeout="20" MaxRows="1">
  369.                     <WmiDatapoints>
  370.                         <WmiDatapoint DataId="2553" DataType="Dword">
  371.                 <WmiPropertySelector PropertyName="QuorumType" PropertyType="String">
  372.                 <Transforms>
  373.                                     <EnumTransform DefaultValue="0">
  374.                                         <Enum Name="Majority" Value="1" />
  375.                                         <Enum Name="Legacy Disk" Value="2" />
  376.                                     </EnumTransform>
  377.                                 </Transforms>
  378.                             </WmiPropertySelector>
  379.             </WmiDatapoint>
  380.                     </WmiDatapoints>
  381.                 </WmiQuery>
  382.         <WmiQuery Namespace="root\MSCluster" Query="associators of {MSCluster_Cluster.Name='.'} Where AssocClass=MSCluster_ClusterToQuorumResource" MaxRows="1">
  383.                     <WmiDatapoints>
  384.                         <WmiDatapoint DataId="2566" DataType="Dword">
  385.                 <WmiPropertySelector PropertyName="Type" PropertyType="String">
  386.                 <Transforms>
  387.                                     <EnumTransform DefaultValue="0">
  388.                                         <Enum Name="Physical Disk" Value="1" />
  389.                                         <Enum Name="File Share Witness" Value="2" />
  390.                                     </EnumTransform>
  391.                                 </Transforms>
  392.                             </WmiPropertySelector>
  393.             </WmiDatapoint>
  394.                     </WmiDatapoints>
  395.                 </WmiQuery>
  396.  
  397.                 <WmiQuery Namespace="root\MSCluster" Query="SELECT Type from MSCluster_Resource" QueryTimeout="30">
  398.                     <WmiAggregates>
  399.                         <WmiAggregate DataId="2554" Function="Exists">
  400.  
  401.     
  402.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  403.                             <ValueTest Operator="Equals" DataType="String" Comparand="File Server" />
  404.  
  405.  
  406.             </WmiAggregate>
  407.             <WmiAggregate DataId="2555" Function="Exists">
  408.     
  409.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  410.                             <ValueTest Operator="Equals" DataType="String" Comparand="DHCP Service" />
  411.  
  412.  
  413.             </WmiAggregate>
  414.             <WmiAggregate DataId="2556" Function="Exists">
  415.     
  416.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  417.                             <ValueTest Operator="Equals" DataType="String" Comparand="Distributed Transaction Coordinator" />
  418.  
  419.  
  420.             </WmiAggregate>
  421.             <WmiAggregate DataId="2557" Function="Exists">
  422.     
  423.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  424.                             <ValueTest Operator="Equals" DataType="String" Comparand="Generic Application" />
  425.  
  426.  
  427.             </WmiAggregate>
  428.             <WmiAggregate DataId="2558" Function="Exists">
  429.     
  430.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  431.                             <ValueTest Operator="Equals" DataType="String" Comparand="Generic Service" />
  432.  
  433.  
  434.             </WmiAggregate>
  435.             <WmiAggregate DataId="2559" Function="Exists">
  436.     
  437.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  438.                             <ValueTest Operator="Equals" DataType="String" Comparand="Generic Script" />
  439.  
  440.  
  441.             </WmiAggregate>
  442.             <WmiAggregate DataId="2560" Function="Exists">
  443.     
  444.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  445.                             <ValueTest Operator="Equals" DataType="String" Comparand="Microsoft iSNS" />
  446.  
  447.  
  448.             </WmiAggregate>
  449.             <WmiAggregate DataId="2561" Function="Exists">
  450.     
  451.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  452.                             <ValueTest Operator="Equals" DataType="String" Comparand="MSMQ" />
  453.  
  454.  
  455.             </WmiAggregate>
  456.             <WmiAggregate DataId="2562" Function="Exists">
  457.     
  458.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  459.                             <ValueTest Operator="Equals" DataType="String" Comparand="NFS Share" />
  460.  
  461.  
  462.             </WmiAggregate>
  463.             <WmiAggregate DataId="2563" Function="Exists">
  464.     
  465.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  466.                             <ValueTest Operator="Equals" DataType="String" Comparand="Print Spooler" />
  467.  
  468.  
  469.             </WmiAggregate>
  470.             <WmiAggregate DataId="2564" Function="Exists">
  471.     
  472.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  473.                             <ValueTest Operator="Equals" DataType="String" Comparand="WINS Service" />
  474.  
  475.  
  476.             </WmiAggregate>
  477.             <WmiAggregate DataId="2565" Function="Count">
  478.     
  479.             <WmiPropertySelector PropertyName="Type" PropertyType="String" />
  480.                             <ValueTest Operator="Equals" DataType="String" Comparand="Physical Disk" />
  481.  
  482.  
  483.             </WmiAggregate>
  484.                     </WmiAggregates>
  485.                 </WmiQuery>
  486.         <RegistryQuery Hive="HKLM" Subkey="System\CurrentControlSet\Services\Clussvc\Parameters">
  487.             <RegistryDatapoints>
  488.             <RegistryDatapoint DataId="2552" DataType="Dword">
  489.                 <RegistryValueSelector ValueName="InstanceHash" ValueType="Dword" />
  490.             </RegistryDatapoint>
  491.             </RegistryDatapoints>
  492.         </RegistryQuery>
  493.             </Queries>
  494.         </QueryGroup>
  495.  
  496.  
  497.         <QueryGroup MaxErrors="5">
  498.             <Applicability>
  499.                 <Expression JoinOperator="And">
  500.                     <RoleTest RoleId="140" RequiredState="Installed" />
  501.                 </Expression>
  502.             </Applicability>
  503.             <Queries>
  504.                 <WmiQuery Namespace="root\cimv2" Query="SELECT TotalGetRequests, ServiceUptime, GetRequestsPerSec FROM Win32_PerfFormattedData_W3SVC_WebService WHERE Name='_Total'" QueryTimeout="20" MaxRows="1">
  505.                     <WmiDatapoints>
  506.                         <WmiDatapoint DataId="2278" DataType="Dword">
  507.                             <WmiPropertySelector PropertyName="TotalGetRequests" PropertyType="Dword" />
  508.                         </WmiDatapoint>
  509.                         <WmiDatapoint DataId="2279" DataType="Dword">
  510.                             <WmiPropertySelector PropertyName="ServiceUptime" PropertyType="Dword" />
  511.                         </WmiDatapoint>
  512.                         <WmiDatapoint DataId="2447" DataType="Dword">
  513.                             <WmiPropertySelector PropertyName="GetRequestsPerSec" PropertyType="Dword" />
  514.                         </WmiDatapoint>
  515.                     </WmiDatapoints>
  516.                 </WmiQuery>
  517.                 <WmiQuery Namespace="root\cimv2" Query="SELECT URICacheHits, KernelURICacheHits FROM Win32_PerfFormattedData_W3SVC_WebServiceCache" QueryTimeout="20" MaxRows="1">
  518.                     <WmiDatapoints>
  519.                         <WmiDatapoint DataId="2280" DataType="Dword">
  520.                             <WmiPropertySelector PropertyName="URICacheHits" PropertyType="Dword" /> 
  521.                         </WmiDatapoint>
  522.                         <WmiDatapoint DataId="2281" DataType="Dword">
  523.                             <WmiPropertySelector PropertyName="KernelURICacheHits" PropertyType="Dword" /> 
  524.                         </WmiDatapoint>
  525.                     </WmiDatapoints>
  526.                 </WmiQuery>
  527.                 <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='W3SVC'" QueryTimeout="20" MaxRows="1">
  528.                     <WmiDatapoints>
  529.                         <WmiDatapoint DataId="2452" DataType="Dword">
  530.                             <WmiPropertySelector PropertyName="State" PropertyType="String">
  531.                                 <Transforms>
  532.                                     <EnumTransform DefaultValue="0">
  533.                                         <Enum Name="Stopped" Value="1" />
  534.                                         <Enum Name="Start Pending" Value="2" />
  535.                                         <Enum Name="Stop Pending" Value="3" />
  536.                                         <Enum Name="Running" Value="4" />
  537.                                         <Enum Name="Continue Pending" Value="5" />
  538.                                         <Enum Name="Pause Pending" Value="6" />
  539.                                         <Enum Name="Paused" Value="7" />
  540.                                     </EnumTransform>
  541.                                 </Transforms>
  542.                             </WmiPropertySelector>
  543.                         </WmiDatapoint>
  544.                     </WmiDatapoints>
  545.                 </WmiQuery>
  546.                 <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='WAS'" MaxRows="1">
  547.                     <WmiDatapoints>
  548.                         <WmiDatapoint DataId="2454" DataType="Dword">
  549.                             <WmiPropertySelector PropertyName="State" PropertyType="String">
  550.                                 <Transforms>
  551.                                     <EnumTransform DefaultValue="0">
  552.                                         <Enum Name="Stopped" Value="1" />
  553.                                         <Enum Name="Start Pending" Value="2" />
  554.                                         <Enum Name="Stop Pending" Value="3" />
  555.                                         <Enum Name="Running" Value="4" />
  556.                                         <Enum Name="Continue Pending" Value="5" />
  557.                                         <Enum Name="Pause Pending" Value="6" />
  558.                                         <Enum Name="Paused" Value="7" />
  559.                                     </EnumTransform>
  560.                                 </Transforms>
  561.                             </WmiPropertySelector>
  562.                         </WmiDatapoint>
  563.                     </WmiDatapoints>
  564.                 </WmiQuery>
  565.                 <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_SystemDriver WHERE Name='HTTP'" MaxRows="1">
  566.                     <WmiDatapoints>
  567.                         <WmiDatapoint DataId="2455" DataType="Dword">
  568.                             <WmiPropertySelector PropertyName="State" PropertyType="String">
  569.                                 <Transforms>
  570.                                     <EnumTransform DefaultValue="0">
  571.                                         <Enum Name="Stopped" Value="1" />
  572.                                         <Enum Name="Start Pending" Value="2" />
  573.                                         <Enum Name="Stop Pending" Value="3" />
  574.                                         <Enum Name="Running" Value="4" />
  575.                                         <Enum Name="Continue Pending" Value="5" />
  576.                                         <Enum Name="Pause Pending" Value="6" />
  577.                                         <Enum Name="Paused" Value="7" />
  578.                                     </EnumTransform>
  579.                                 </Transforms>
  580.                             </WmiPropertySelector>
  581.                         </WmiDatapoint>
  582.                     </WmiDatapoints>
  583.                 </WmiQuery>
  584.                 <WmiQuery Namespace="root\cimv2" Query="SELECT RequestsTotal, CompilationsTotal FROM Win32_PerfFormattedData_ASPNET2050727_ASPNETAppsv2050727 WHERE Name='__Total__'" QueryTimeout="20" MaxRows="1">
  585.                     <WmiDatapoints>
  586.                         <WmiDatapoint DataId="2448" DataType="Dword">
  587.                             <WmiPropertySelector PropertyName="RequestsTotal" PropertyType="Dword" />
  588.                         </WmiDatapoint>
  589.                         <WmiDatapoint DataId="2449" DataType="Dword">
  590.                             <WmiPropertySelector PropertyName="CompilationsTotal" PropertyType="Dword" />
  591.                         </WmiDatapoint>
  592.                     </WmiDatapoints>
  593.                 </WmiQuery>
  594.                 <WmiQuery Namespace="root\cimv2" Query="SELECT RequestsTotal FROM Win32_PerfFormattedData_ASP_ActiveServerPages" MaxRows="1">
  595.                     <WmiDatapoints>
  596.                         <WmiDatapoint DataId="2282" DataType="Dword">
  597.                             <WmiPropertySelector PropertyName="RequestsTotal" PropertyType="Dword" />
  598.                         </WmiDatapoint>
  599.                     </WmiDatapoints>
  600.                 </WmiQuery>
  601.         <EventQuery Channel="System" Query="*[System[(EventID=5009) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  602.                 <EventAggregates>
  603.              <EventAggregate DataId="2322" Function="Count" />
  604.             </EventAggregates>
  605.             </EventQuery>
  606.  
  607.         <EventQuery Channel="System" Query="*[System[(EventID=5010) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  608.             <EventAggregates>
  609.                 <EventAggregate DataId="2323" Function="Count" />
  610.             </EventAggregates>
  611.             </EventQuery>
  612.  
  613.         <EventQuery Channel="System" Query="*[System[(EventID=5011) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  614.             <EventAggregates>
  615.                 <EventAggregate DataId="2331" Function="Count" />
  616.             </EventAggregates>
  617.             </EventQuery>
  618.  
  619.         <EventQuery Channel="System" Query="*[System[(EventID=5012) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  620.                 <EventAggregates>
  621.                 <EventAggregate DataId="2451" Function="Count" />
  622.             </EventAggregates>
  623.             </EventQuery>
  624.  
  625.             <EventQuery Channel="System" Query="*[System[(EventID=5013) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  626.                 <EventAggregates>
  627.                 <EventAggregate DataId="2332" Function="Count" />
  628.             </EventAggregates>
  629.             </EventQuery>
  630.  
  631.             <EventQuery Channel="System" Query="*[System[(EventID=5014) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  632.                 <EventAggregates>
  633.                 <EventAggregate DataId="2334" Function="Count" />
  634.             </EventAggregates>
  635.             </EventQuery>
  636.  
  637.             <EventQuery Channel="System" Query="*[System[(EventID=5127) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  638.                 <EventAggregates>
  639.                 <EventAggregate DataId="2333" Function="Count" />
  640.             </EventAggregates>
  641.             </EventQuery>
  642.  
  643.             <EventQuery Channel="System" Query="*[System[(EventID=5137) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  644.                 <EventAggregates>
  645.                 <EventAggregate DataId="2457" Function="Count" />
  646.             </EventAggregates>
  647.             </EventQuery>
  648.  
  649.             <EventQuery Channel="System" Query="*[System[(EventID=5138) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  650.                 <EventAggregates>
  651.                 <EventAggregate DataId="2458" Function="Count" />
  652.             </EventAggregates>
  653.             </EventQuery>
  654.  
  655.             <EventQuery Channel="System" Query="*[System[(EventID=5139) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  656.                 <EventAggregates>
  657.                 <EventAggregate DataId="2459" Function="Count" />
  658.             </EventAggregates>
  659.             </EventQuery>
  660.  
  661.             <EventQuery Channel="System" Query="*[System[(EventID=5158) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  662.                 <EventAggregates>
  663.                 <EventAggregate DataId="2460" Function="Count" />
  664.             </EventAggregates>
  665.             </EventQuery>
  666.  
  667.             <EventQuery Channel="System" Query="*[System[(EventID=5002) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  668.                 <EventAggregates>
  669.                 <EventAggregate DataId="2461" Function="Count" />
  670.             </EventAggregates>
  671.             </EventQuery>
  672.  
  673.             <EventQuery Channel="System" Query="*[System[(EventID=2003) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  674.                 <EventAggregates>
  675.                 <EventAggregate DataId="2462" Function="Count" />
  676.             </EventAggregates>
  677.             </EventQuery>
  678.             </Queries>
  679.         </QueryGroup>
  680.  
  681.         <QueryGroup MaxErrors="5">
  682.             <Applicability>
  683.                 <Expression JoinOperator="And">
  684.                     <RoleTest RoleId="176" RequiredState="Installed" />
  685.                 </Expression>
  686.             </Applicability>
  687.             <Queries>
  688.                 <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM Site" QueryTimeout="20">
  689.                     <WmiAggregates>
  690.                         <WmiAggregate DataId="2317" Function="Count" />
  691.                     </WmiAggregates>
  692.                 </WmiQuery>
  693.                 <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM ApplicationPool" QueryTimeout="20">
  694.                     <WmiAggregates>
  695.                         <WmiAggregate DataId="2318" Function="Count" />
  696.                     </WmiAggregates>
  697.                 </WmiQuery>
  698.                 <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM Application" QueryTimeout="20">
  699.                     <WmiAggregates>
  700.                         <WmiAggregate DataId="2319" Function="Count" />
  701.                     </WmiAggregates>
  702.                 </WmiQuery>
  703.                 <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM WorkerProcess" QueryTimeout="20">
  704.                     <WmiAggregates>
  705.                         <WmiAggregate DataId="2320" Function="Count" />
  706.                     </WmiAggregates>
  707.                 </WmiQuery>
  708.                 <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM AppDomain" QueryTimeout="20">
  709.                     <WmiAggregates>
  710.                         <WmiAggregate DataId="2321" Function="Count" />
  711.                     </WmiAggregates>
  712.                 </WmiQuery>
  713.             </Queries>
  714.         </QueryGroup>
  715.         
  716.         <QueryGroup>
  717.             <Applicability>
  718.                 <Expression JoinOperator="And">
  719.                     <RoleTest RoleId="183" RequiredState="Installed" />
  720.                 </Expression>
  721.             </Applicability>
  722.             <Queries>
  723.                 <WmiQuery Namespace="root\cimv2" Query="SELECT FtpServiceUptime, TotalConnectionAttemptsAllInstances FROM Win32_PerfFormattedData_MSFTPSVC_FtpService WHERE Name='_Total'" QueryTimeout="20" MaxRows="1">
  724.                     <WmiDatapoints>
  725.                         <WmiDatapoint DataId="2291" DataType="Dword">
  726.                             <WmiPropertySelector PropertyName="FtpServiceUptime" PropertyType="Dword"/>
  727.                         </WmiDatapoint>
  728.                         <WmiDatapoint DataId="2292" DataType="Dword">
  729.                             <WmiPropertySelector PropertyName="TotalConnectionAttemptsAllInstances" PropertyType="Dword"/>
  730.                         </WmiDatapoint>
  731.                     </WmiDatapoints>
  732.                 </WmiQuery>
  733.                 <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='MSFTPSVC'" QueryTimeout="20" MaxRows="1">
  734.                     <WmiDatapoints>
  735.                         <WmiDatapoint DataId="2453" DataType="Dword">
  736.                             <WmiPropertySelector PropertyName="State" PropertyType="String">
  737.                                 <Transforms>
  738.                                     <EnumTransform DefaultValue="0">
  739.                                         <Enum Name="Stopped" Value="1" />
  740.                                         <Enum Name="Start Pending" Value="2" />
  741.                                         <Enum Name="Stop Pending" Value="3" />
  742.                                         <Enum Name="Running" Value="4" />
  743.                                         <Enum Name="Continue Pending" Value="5" />
  744.                                         <Enum Name="Pause Pending" Value="6" />
  745.                                         <Enum Name="Paused" Value="7" />
  746.                                     </EnumTransform>
  747.                                 </Transforms>
  748.                             </WmiPropertySelector>
  749.                         </WmiDatapoint>
  750.                     </WmiDatapoints>
  751.                 </WmiQuery>
  752.             </Queries>
  753.         </QueryGroup>
  754.  
  755.         <QueryGroup>
  756.             <Applicability>
  757.                 <Expression JoinOperator="And">
  758.                     <RoleTest RoleId="7" RequiredState="Installed" />
  759.                 </Expression>
  760.             </Applicability>
  761.             <Queries>
  762.                 <WmiQuery Namespace="root\cimv2" Query="SELECT LanguagesSupported, DefaultLanguage FROM Win32_Printer WHERE Local='True'" QueryTimeout="20">
  763.                     <WmiAggregates>
  764.                         <WmiAggregate DataId="2378" Function="Count" />
  765.                         <WmiAggregate DataId="2490" Function="Count" >
  766.                             <WmiPropertySelector PropertyName="DefaultLanguage" PropertyType="String" />
  767.                             <ValueTest Operator="Equals" DataType="String" Comparand="XPS" />
  768.                         </WmiAggregate>
  769.                         <WmiAggregate DataId="2488" Function="Count" >
  770.                             <WmiPropertySelector PropertyName="LanguagesSupported" PropertyType="String" IsArray="1" StartElement="0" MaxElements="100"/>
  771.                             <ValueTest Operator="Equals" DataType="String" Comparand="XPS" />
  772.                         </WmiAggregate>
  773.                     </WmiAggregates>
  774.                 </WmiQuery>
  775.                 <WmiQuery Namespace="root\cimv2" Query="SELECT PortName FROM Win32_Printer WHERE Local='True' AND PortName LIKE 'XPS%'" QueryTimeout="20" MaxRows="1">
  776.                     <WmiAggregates>
  777.                         <WmiAggregate DataId="2489" Function="Exists" />
  778.                     </WmiAggregates>
  779.                 </WmiQuery>
  780.                 <WmiQuery Namespace="root\cimv2" Query="SELECT SupportedPlatform FROM Win32_PrinterDriver">
  781.                     <WmiAggregates>
  782.                         <WmiAggregate DataId="2379" Function="Count" /> 
  783.                         <WmiAggregate DataId="2380" Function="Count" >
  784.                             <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
  785.                             <ValueTest Operator="Equals" DataType="String" Comparand="Windows x64" />
  786.                         </WmiAggregate>
  787.                         <WmiAggregate DataId="2381" Function="Count" >
  788.                             <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
  789.                             <ValueTest Operator="Equals" DataType="String" Comparand="Windows IA64" />
  790.                         </WmiAggregate>
  791.                         <WmiAggregate DataId="2382" Function="Count" >
  792.                             <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
  793.                             <ValueTest Operator="Equals" DataType="String" Comparand="Windows NT x86" />
  794.                         </WmiAggregate>
  795.                     </WmiAggregates>
  796.                 </WmiQuery>
  797.                 <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='SPOOLER'" MaxRows="1">
  798.                     <WmiDatapoints>
  799.                         <WmiDatapoint DataId="2481" DataType="Dword">
  800.                             <WmiPropertySelector PropertyName="State" PropertyType="String">
  801.                                 <Transforms>
  802.                                     <EnumTransform DefaultValue="0">
  803.                                         <Enum Name="Stopped" Value="1" />
  804.                                         <Enum Name="Start Pending" Value="2" />
  805.                                         <Enum Name="Stop Pending" Value="3" />
  806.                                         <Enum Name="Running" Value="4" />
  807.                                         <Enum Name="Continue Pending" Value="5" />
  808.                                         <Enum Name="Pause Pending" Value="6" />
  809.                                         <Enum Name="Paused" Value="7" />
  810.                                     </EnumTransform>
  811.                                 </Transforms>
  812.                             </WmiPropertySelector>
  813.                         </WmiDatapoint>
  814.                     </WmiDatapoints>
  815.                 </WmiQuery>
  816.                 <WmiQuery Namespace="root\cimv2" Query="SELECT ServerSessions, FilesOpen FROM Win32_PerfFormattedData_PerfNet_Server" QueryTimeout="20" MaxRows="1">
  817.                     <WmiDatapoints>
  818.                         <WmiDatapoint DataId="2482" DataType="Dword">
  819.                             <WmiPropertySelector PropertyName="ServerSessions" PropertyType="Dword" />
  820.                         </WmiDatapoint>
  821.                         <WmiDatapoint DataId="2484" DataType="Dword">
  822.                             <WmiPropertySelector PropertyName="FilesOpen" PropertyType="Dword" />
  823.                         </WmiDatapoint>
  824.                     </WmiDatapoints>
  825.                 </WmiQuery>
  826.                 <WmiQuery Namespace="root\cimv2" Query="SELECT ThreadCount, HandleCount FROM Win32_PerfFormattedData_PerfProc_Process where Name='spoolsv'" QueryTimeout="20" MaxRows="1">
  827.                     <WmiDatapoints>
  828.                         <WmiDatapoint DataId="2485" DataType="Dword">
  829.                             <WmiPropertySelector PropertyName="ThreadCount" PropertyType="Dword" />
  830.                         </WmiDatapoint>
  831.                         <WmiDatapoint DataId="2486" DataType="Dword">
  832.                             <WmiPropertySelector PropertyName="HandleCount" PropertyType="Dword" />
  833.                         </WmiDatapoint>
  834.                     </WmiDatapoints>
  835.                 </WmiQuery>
  836.                 <WmiQuery Namespace="root\cimv2" Query="SELECT TotalJobsPrinted, MaxJobsSpooling, MaxReferences FROM Win32_PerfFormattedData_Spooler_PrintQueue" QueryTimeout="20" MaxRows="1">
  837.                     <WmiDatapoints>
  838.                         <WmiDatapoint DataId="2491" DataType="Dword">
  839.                             <WmiPropertySelector PropertyName="TotalJobsPrinted" PropertyType="Dword" />
  840.                         </WmiDatapoint>
  841.                         <WmiDatapoint DataId="2483" DataType="Dword">
  842.                             <WmiPropertySelector PropertyName="MaxJobsSpooling" PropertyType="Dword" />
  843.                         </WmiDatapoint>
  844.                         <WmiDatapoint DataId="2487" DataType="Dword">
  845.                             <WmiPropertySelector PropertyName="MaxReferences" PropertyType="Dword" />
  846.                         </WmiDatapoint>
  847.                     </WmiDatapoints>
  848.                 </WmiQuery>
  849.             </Queries>
  850.         </QueryGroup>
  851.  
  852.         <QueryGroup>
  853.             <Applicability>
  854.                 <Global />
  855.             </Applicability>
  856.             <Queries>
  857.                 <WmiQuery Namespace="root\cimv2" Query="SELECT Name, Instances FROM Win32_PerfFormattedData_ServiceModelService3000_ServiceModelService3000">
  858.                     <WmiAggregates>
  859.                         <WmiAggregate DataId="2973" Function="Count" />
  860.                         <WmiAggregate DataId="3095" Function="Sum" >
  861.                 <WmiPropertySelector PropertyName="Instances" PropertyType="Dword" />
  862.             </WmiAggregate>
  863.  
  864.                     </WmiAggregates>
  865.                 </WmiQuery>
  866.                 <WmiQuery Namespace="root\cimv2" Query="Select WorkflowsInMemory From Win32_PerfFormattedData_WindowsWorkflowFoundation3000_WindowsWorkflowFoundation" MaxRows="1">
  867.                     <WmiDatapoints>
  868.                         <WmiDatapoint DataId="3094" DataType="Dword">
  869.                 <WmiPropertySelector PropertyName="WorkflowsInMemory" PropertyType="Dword" />
  870.             </WmiDatapoint>
  871.  
  872.                     </WmiDatapoints>
  873.                 </WmiQuery>
  874.             </Queries>
  875.         </QueryGroup>
  876.  
  877.         <QueryGroup>
  878.             <Applicability>
  879.                 <Expression JoinOperator="And">
  880.                     <RoleTest RoleId="13" RequiredState="Installed" />
  881.                 </Expression>
  882.             </Applicability>
  883.             <Queries>
  884.                 <WmiQuery Namespace="root\cimv2" Query="SELECT Version From CIM_DataFile Where Name='%windir%\System32\dns.exe'">
  885.             <WmiDatapoints>
  886.                     <WmiDatapoint DataId="2988" DataType="String">
  887.                             <WmiPropertySelector PropertyName="Version" PropertyType="String" />
  888.                         </WmiDatapoint>
  889.             </WmiDatapoints>
  890.                 </WmiQuery>
  891.                 <WmiQuery Namespace="root\MicrosoftDNS" Query="SELECT Name, DsIntegrated FROM MicrosoftDNS_Zone">
  892.                     <WmiAggregates>
  893.                         <WmiAggregate DataId="3000" Function="Exists">
  894.                 <WmiPropertySelector PropertyName="Name" PropertyType="String" />
  895.                 <ValueTest Operator="Equals" DataType="String" Comparand="GlobalNames" />
  896.  
  897.  
  898.             </WmiAggregate>
  899.             <WmiAggregate DataId="3001" Function="Count">
  900.                 <WmiPropertySelector PropertyName="DsIntegrated" PropertyType="Boolean" />
  901.                 <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" />
  902.  
  903.  
  904.             </WmiAggregate>
  905.             <WmiAggregate DataId="3005" Function="Count">
  906.                 <WmiPropertySelector PropertyName="DsIntegrated" PropertyType="Boolean" />
  907.                 <ValueTest Operator="Equals" DataType="Boolean" Comparand="False" />
  908.  
  909.  
  910.             </WmiAggregate>
  911.                     </WmiAggregates>
  912.                 </WmiQuery>
  913.  
  914.             <EventQuery Channel="DNS Server" Query="*[System[(EventID=4015) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  915.                 <EventAggregates>
  916.                 <EventAggregate DataId="3003" Function="Count" />
  917.             </EventAggregates>
  918.             </EventQuery>
  919.             <EventQuery Channel="DNS Server" Query="*[System[(EventID=4011) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  920.                 <EventAggregates>
  921.                 <EventAggregate DataId="3004" Function="Count" />
  922.             </EventAggregates>
  923.             </EventQuery>
  924.  
  925.             </Queries>
  926.         </QueryGroup>
  927.  
  928.         <QueryGroup>
  929.             <Applicability>
  930.                 <Expression JoinOperator="And">
  931.                     <RoleTest RoleId="125" RequiredState="Installed" />
  932.                 </Expression>
  933.             </Applicability>
  934.             <Queries>
  935.         <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\AccountPartner">
  936.             <RegistryDatapoints>
  937.             <RegistryDatapoint DataId="3007" DataType="Dword">
  938.                 <RegistryValueSelector ValueName="Count" ValueType="Dword" />
  939.             </RegistryDatapoint>
  940.             </RegistryDatapoints>
  941.         </RegistryQuery>
  942.         <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\ResourcePartner">
  943.             <RegistryDatapoints>
  944.             <RegistryDatapoint DataId="3008" DataType="Dword">
  945.                 <RegistryValueSelector ValueName="WithForestTrustCount" ValueType="Dword" />
  946.             </RegistryDatapoint>
  947.             <RegistryDatapoint DataId="3009" DataType="Dword">
  948.                 <RegistryValueSelector ValueName="WithoutForestTrustCount" ValueType="Dword" />
  949.             </RegistryDatapoint>
  950.             </RegistryDatapoints>
  951.         </RegistryQuery>
  952.         <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\Applications">
  953.             <RegistryDatapoints>
  954.             <RegistryDatapoint DataId="3012" DataType="Dword">
  955.                 <RegistryValueSelector ValueName="NtTokenAppCount" ValueType="Dword" />
  956.             </RegistryDatapoint>
  957.             <RegistryDatapoint DataId="3013" DataType="Dword">
  958.                 <RegistryValueSelector ValueName="ClaimsAppCount" ValueType="Dword" />
  959.             </RegistryDatapoint>
  960.             </RegistryDatapoints>
  961.         </RegistryQuery>
  962.         <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\Claims">
  963.             <RegistryDatapoints>
  964.             <RegistryDatapoint DataId="3014" DataType="Dword">
  965.                 <RegistryValueSelector ValueName="OrganizationalClaimCount" ValueType="Dword" />
  966.             </RegistryDatapoint>
  967.             <RegistryDatapoint DataId="3010" DataType="Dword">
  968.                 <RegistryValueSelector ValueName="CustomClaimsTransformExists" ValueType="Dword" />
  969.             </RegistryDatapoint>
  970.             <RegistryDatapoint DataId="3011" DataType="Dword">
  971.                 <RegistryValueSelector ValueName="AverageClaimsPerPartner" ValueType="Dword" />
  972.             </RegistryDatapoint>
  973.             </RegistryDatapoints>
  974.         </RegistryQuery>
  975.         <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData">
  976.             <RegistryDatapoints>
  977.             <RegistryDatapoint DataId="2989" DataType="Dword">
  978.                 <RegistryValueSelector ValueName="KerberosSigningUsed" ValueType="Dword" />
  979.             </RegistryDatapoint>
  980.             <RegistryDatapoint DataId="3006" DataType="Dword">
  981.                 <RegistryValueSelector ValueName="ADAMStoreCount" ValueType="Dword" />
  982.             </RegistryDatapoint>
  983.             </RegistryDatapoints>
  984.         </RegistryQuery>
  985.  
  986.             </Queries>
  987.         </QueryGroup>
  988.  
  989.         <QueryGroup>
  990.             <Applicability>
  991.                 <Expression JoinOperator="And">
  992.                     <RoleTest RoleId="120" RequiredState="Running" />
  993.                 </Expression>
  994.             </Applicability>
  995.             <Queries>
  996.                 <WmiQuery Namespace="root\cimv2" Query="SELECT * FROM Win32_PerfFormattedData_WMServer_WindowsMediaServices" QueryTimeout="20" MaxRows="1">
  997.                     <WmiDatapoints>
  998.                         <WmiDatapoint DataId="2417" DataType="Dword">
  999.                             <WmiPropertySelector PropertyName="TotalServerUptime" PropertyType="Dword" /> 
  1000.                         </WmiDatapoint>
  1001.                         <WmiDatapoint DataId="2418" DataType="Dword">
  1002.                             <WmiPropertySelector PropertyName="CurrentStreamingPlayers" PropertyType="Dword" /> 
  1003.                         </WmiDatapoint>
  1004.                         <WmiDatapoint DataId="2419" DataType="Dword">
  1005.                             <WmiPropertySelector PropertyName="CurrentStreamingHTTPPlayers" PropertyType="Dword" /> 
  1006.                         </WmiDatapoint>
  1007.                         <WmiDatapoint DataId="2420" DataType="Dword">
  1008.                             <WmiPropertySelector PropertyName="CurrentStreamingRTSPPlayers" PropertyType="Dword" /> 
  1009.                         </WmiDatapoint>
  1010.                         <WmiDatapoint DataId="2421" DataType="Dword">
  1011.                             <WmiPropertySelector PropertyName="PeakPlayerSendRateKbps" PropertyType="Dword" /> 
  1012.                         </WmiDatapoint>
  1013.                         <WmiDatapoint DataId="2422" DataType="Dword">
  1014.                             <WmiPropertySelector PropertyName="PeakStreamingPlayers" PropertyType="Dword" /> 
  1015.                         </WmiDatapoint>
  1016.                         <WmiDatapoint DataId="2423" DataType="Dword">
  1017.                             <WmiPropertySelector PropertyName="PeakOutgoingDistributionConnections" PropertyType="Dword" /> 
  1018.                         </WmiDatapoint>
  1019.                         <WmiDatapoint DataId="2424" DataType="Dword">
  1020.                             <WmiPropertySelector PropertyName="PeakOutgoingDistributionSendRateKbps" PropertyType="Dword" /> 
  1021.                         </WmiDatapoint>
  1022.                         <WmiDatapoint DataId="2425" DataType="Dword">
  1023.                             <WmiPropertySelector PropertyName="TotalAdvertisements" PropertyType="Dword" /> 
  1024.                         </WmiDatapoint>
  1025.                     </WmiDatapoints>
  1026.                 </WmiQuery>
  1027.             </Queries>
  1028.         </QueryGroup>
  1029.  
  1030.         <QueryGroup>
  1031.             <Applicability>
  1032.                 <Expression JoinOperator="And">
  1033.                     <RoleTest RoleId="18" RequiredState="Installed" />
  1034.                 </Expression>
  1035.             </Applicability>
  1036.             <Queries>
  1037.                 <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT LicensingType, DirectConnectLicenseServers, TerminalServerMode FROM Win32_TerminalServiceSetting" MaxRows="1">
  1038.                     <WmiDatapoints>
  1039.                         <WmiDatapoint DataId="2478" DataType="Dword">
  1040.                             <WmiPropertySelector PropertyName="LicensingType" PropertyType="Dword" />
  1041.                         </WmiDatapoint>
  1042.                         <WmiDatapoint DataId="2479" DataType="Boolean">
  1043.                             <WmiPropertySelector PropertyName="DirectConnectLicenseServers" PropertyType="String" >
  1044.                                 <Transforms>
  1045.                                     <LogicalTransform Operator="NotEquals" DataType="String" Comparand="" />
  1046.                                 </Transforms>
  1047.                             </WmiPropertySelector>
  1048.                         </WmiDatapoint>
  1049.                         <WmiDatapoint DataId="2480" DataType="Dword">
  1050.                             <WmiPropertySelector PropertyName="TerminalServerMode" PropertyType="Dword" />
  1051.                         </WmiDatapoint>
  1052.                     </WmiDatapoints>
  1053.                 </WmiQuery>
  1054.             </Queries>
  1055.         </QueryGroup>
  1056.  
  1057.         <QueryGroup>
  1058.             <Applicability>
  1059.         <Global />
  1060.             </Applicability>
  1061.         <Queries>
  1062.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1602) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1063.                 <EventAggregates>
  1064.                 <EventAggregate DataId="3027" Function="Count" />
  1065.             </EventAggregates>
  1066.             </EventQuery>
  1067.             <EventQuery Channel="Setup" Query="*[System[(EventID=1610) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1068.                 <EventAggregates>
  1069.                 <EventAggregate DataId="3028" Function="Count" />
  1070.             </EventAggregates>
  1071.             </EventQuery>
  1072.             <EventQuery Channel="Setup" Query="*[System[(EventID=1611) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1073.                 <EventAggregates>
  1074.                 <EventAggregate DataId="3029" Function="Count" />
  1075.             </EventAggregates>
  1076.             </EventQuery>
  1077.             <EventQuery Channel="Setup" Query="*[System[(EventID=1612) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1078.                 <EventAggregates>
  1079.                 <EventAggregate DataId="3030" Function="Count" />
  1080.             </EventAggregates>
  1081.             </EventQuery>
  1082.             <EventQuery Channel="Setup" Query="*[System[(EventID=1613) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1083.                 <EventAggregates>
  1084.                 <EventAggregate DataId="3031" Function="Count" />
  1085.             </EventAggregates>
  1086.             </EventQuery>
  1087.             <EventQuery Channel="Setup" Query="*[System[(EventID=1614) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1088.                 <EventAggregates>
  1089.                 <EventAggregate DataId="3032" Function="Count" />
  1090.             </EventAggregates>
  1091.             </EventQuery>
  1092.             <EventQuery Channel="Setup" Query="*[System[(EventID=1615) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1093.                 <EventAggregates>
  1094.                 <EventAggregate DataId="3033" Function="Count" />
  1095.             </EventAggregates>
  1096.             </EventQuery>
  1097.             <EventQuery Channel="Setup" Query="*[System[(EventID=1616) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1098.                 <EventAggregates>
  1099.                 <EventAggregate DataId="3034" Function="Count" />
  1100.             </EventAggregates>
  1101.             </EventQuery>
  1102.             <EventQuery Channel="Setup" Query="*[System[(EventID=1617) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1103.                 <EventAggregates>
  1104.                 <EventAggregate DataId="3035" Function="Count" />
  1105.             </EventAggregates>
  1106.             </EventQuery>
  1107.             <EventQuery Channel="Setup" Query="*[System[(EventID=1618) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1108.                 <EventAggregates>
  1109.                 <EventAggregate DataId="3036" Function="Count" />
  1110.             </EventAggregates>
  1111.             </EventQuery>
  1112.             <EventQuery Channel="Setup" Query="*[System[(EventID=1619) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1113.                 <EventAggregates>
  1114.                 <EventAggregate DataId="3037" Function="Count" />
  1115.             </EventAggregates>
  1116.             </EventQuery>
  1117.             <EventQuery Channel="Setup" Query="*[System[(EventID=1620) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1118.                 <EventAggregates>
  1119.                 <EventAggregate DataId="3038" Function="Count" />
  1120.             </EventAggregates>
  1121.             </EventQuery>
  1122.             <EventQuery Channel="Setup" Query="*[System[(EventID=1621) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1123.                 <EventAggregates>
  1124.                 <EventAggregate DataId="3039" Function="Count" />
  1125.             </EventAggregates>
  1126.             </EventQuery>
  1127.             <EventQuery Channel="Setup" Query="*[System[(EventID=1622) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1128.                 <EventAggregates>
  1129.                 <EventAggregate DataId="3040" Function="Count" />
  1130.             </EventAggregates>
  1131.             </EventQuery>
  1132.             <EventQuery Channel="Setup" Query="*[System[(EventID=1623) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1133.                 <EventAggregates>
  1134.                 <EventAggregate DataId="3041" Function="Count" />
  1135.             </EventAggregates>
  1136.             </EventQuery>
  1137.             <EventQuery Channel="Setup" Query="*[System[(EventID=1624) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1138.                 <EventAggregates>
  1139.                 <EventAggregate DataId="3077" Function="Count" />
  1140.             </EventAggregates>
  1141.             </EventQuery>
  1142.             <EventQuery Channel="Setup" Query="*[System[(EventID=1625) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1143.                 <EventAggregates>
  1144.                 <EventAggregate DataId="3078" Function="Count" />
  1145.             </EventAggregates>
  1146.             </EventQuery>
  1147.             <EventQuery Channel="Setup" Query="*[System[(EventID=1630) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1148.                 <EventAggregates>
  1149.                 <EventAggregate DataId="3042" Function="Count" />
  1150.             </EventAggregates>
  1151.             </EventQuery>
  1152.             <EventQuery Channel="Setup" Query="*[System[(EventID=1631) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1153.                 <EventAggregates>
  1154.                 <EventAggregate DataId="3043" Function="Count" />
  1155.             </EventAggregates>
  1156.             </EventQuery>
  1157.             <EventQuery Channel="Setup" Query="*[System[(EventID=1632) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1158.                 <EventAggregates>
  1159.                 <EventAggregate DataId="3044" Function="Count" />
  1160.             </EventAggregates>
  1161.             </EventQuery>
  1162.             <EventQuery Channel="Setup" Query="*[System[(EventID=1633) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1163.                 <EventAggregates>
  1164.                 <EventAggregate DataId="3045" Function="Count" />
  1165.             </EventAggregates>
  1166.             </EventQuery>
  1167.             <EventQuery Channel="Setup" Query="*[System[(EventID=1634) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1168.                 <EventAggregates>
  1169.                 <EventAggregate DataId="3046" Function="Count" />
  1170.             </EventAggregates>
  1171.             </EventQuery>
  1172.             <EventQuery Channel="Setup" Query="*[System[(EventID=1635) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1173.                 <EventAggregates>
  1174.                 <EventAggregate DataId="3047" Function="Count" />
  1175.             </EventAggregates>
  1176.             </EventQuery>
  1177.             <EventQuery Channel="Setup" Query="*[System[(EventID=1636) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1178.                 <EventAggregates>
  1179.                 <EventAggregate DataId="3048" Function="Count" />
  1180.             </EventAggregates>
  1181.             </EventQuery>
  1182.             <EventQuery Channel="Setup" Query="*[System[(EventID=1637) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1183.                 <EventAggregates>
  1184.                 <EventAggregate DataId="3049" Function="Count" />
  1185.             </EventAggregates>
  1186.             </EventQuery>
  1187.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1651) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1188.                 <EventAggregates>
  1189.                 <EventAggregate DataId="3051" Function="Count" />
  1190.             </EventAggregates>
  1191.             </EventQuery>
  1192.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1652) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1193.                 <EventAggregates>
  1194.                 <EventAggregate DataId="3052" Function="Count" />
  1195.             </EventAggregates>
  1196.             </EventQuery>
  1197.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1653) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1198.                 <EventAggregates>
  1199.                 <EventAggregate DataId="3053" Function="Count" />
  1200.             </EventAggregates>
  1201.             </EventQuery>
  1202.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1654) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1203.                 <EventAggregates>
  1204.                 <EventAggregate DataId="3054" Function="Count" />
  1205.             </EventAggregates>
  1206.             </EventQuery>
  1207.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1655) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1208.                 <EventAggregates>
  1209.                 <EventAggregate DataId="3055" Function="Count" />
  1210.             </EventAggregates>
  1211.             </EventQuery>
  1212.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1656) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1213.                 <EventAggregates>
  1214.                 <EventAggregate DataId="3056" Function="Count" />
  1215.             </EventAggregates>
  1216.             </EventQuery>
  1217.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1657) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1218.                 <EventAggregates>
  1219.                 <EventAggregate DataId="3057" Function="Count" />
  1220.             </EventAggregates>
  1221.             </EventQuery>
  1222.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1658) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1223.                 <EventAggregates>
  1224.                 <EventAggregate DataId="3058" Function="Count" />
  1225.             </EventAggregates>
  1226.             </EventQuery>
  1227.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1659) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1228.                 <EventAggregates>
  1229.                 <EventAggregate DataId="3059" Function="Count" />
  1230.             </EventAggregates>
  1231.             </EventQuery>
  1232.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1660) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1233.                 <EventAggregates>
  1234.                 <EventAggregate DataId="3060" Function="Count" />
  1235.             </EventAggregates>
  1236.             </EventQuery>
  1237.             <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1661) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
  1238.                 <EventAggregates>
  1239.                 <EventAggregate DataId="3061" Function="Count" />
  1240.             </EventAggregates>
  1241.             </EventQuery>
  1242.         </Queries>
  1243.         </QueryGroup>
  1244.  
  1245.         <QueryGroup>
  1246.             <Applicability>
  1247.         <Global />
  1248.             </Applicability>
  1249.         <Queries>
  1250.             <WmiQuery Namespace="root\cimv2" Query="SELECT * FROM Win32_PerfFormattedData_MSDTC_DistributedTransactionCoordinator" QueryTimeout="20" MaxRows="1">
  1251.                         <WmiDatapoints>
  1252.                             <WmiDatapoint DataId="2929" DataType="Dword">
  1253.                     <WmiPropertySelector PropertyName="CommittedTransactions" PropertyType="Dword" />
  1254.                 </WmiDatapoint>
  1255.                             <WmiDatapoint DataId="2930" DataType="Dword">
  1256.                     <WmiPropertySelector PropertyName="AbortedTransactions" PropertyType="Dword" />
  1257.                 </WmiDatapoint>
  1258.                             <WmiDatapoint DataId="2931" DataType="Dword">
  1259.                     <WmiPropertySelector PropertyName="ForceAbortedTransactions" PropertyType="Dword" />
  1260.                 </WmiDatapoint>
  1261.                             <WmiDatapoint DataId="2932" DataType="Dword">
  1262.                     <WmiPropertySelector PropertyName="ForceCommittedTransactions" PropertyType="Dword" />
  1263.                 </WmiDatapoint>
  1264.                             <WmiDatapoint DataId="2933" DataType="Dword">
  1265.                     <WmiPropertySelector PropertyName="ResponseTimeAverage" PropertyType="Dword" />
  1266.                 </WmiDatapoint>
  1267.                         </WmiDatapoints>
  1268.                     </WmiQuery>
  1269.             <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\MSDTC\Security">
  1270.                 <RegistryDatapoints>
  1271.                 <RegistryDatapoint DataId="2919" DataType="Dword">
  1272.                     <RegistryValueSelector ValueName="NetworkDtcAccess" ValueType="Dword" />
  1273.                 </RegistryDatapoint>
  1274.                 <RegistryDatapoint DataId="2920" DataType="Dword">
  1275.                     <RegistryValueSelector ValueName="NetworkDtcAccessClients" ValueType="Dword" />
  1276.                 </RegistryDatapoint>
  1277.                 <RegistryDatapoint DataId="2921" DataType="Dword">
  1278.                     <RegistryValueSelector ValueName="NetworkDtcAccessAdmin" ValueType="Dword" />
  1279.                 </RegistryDatapoint>
  1280.                 <RegistryDatapoint DataId="2922" DataType="Dword">
  1281.                     <RegistryValueSelector ValueName="NetworkDtcAccessInbound" ValueType="Dword" />
  1282.                 </RegistryDatapoint>
  1283.                 <RegistryDatapoint DataId="2923" DataType="Dword">
  1284.                     <RegistryValueSelector ValueName="NetworkDtcAccessOutbound" ValueType="Dword" />
  1285.                 </RegistryDatapoint>
  1286.                 <RegistryDatapoint DataId="2927" DataType="Dword">
  1287.                     <RegistryValueSelector ValueName="NetworkDtcAccessTip" ValueType="Dword" />
  1288.                 </RegistryDatapoint>
  1289.                 <RegistryDatapoint DataId="2928" DataType="Dword">
  1290.                     <RegistryValueSelector ValueName="XATransactions" ValueType="Dword" />
  1291.                 </RegistryDatapoint>
  1292.                 </RegistryDatapoints>
  1293.             </RegistryQuery>
  1294.             <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\MSDTC">
  1295.                 <RegistryDatapoints>
  1296.                 <RegistryDatapoint DataId="2924" DataType="Dword">
  1297.                     <RegistryValueSelector ValueName="AllowOnlySecureRpcCalls" ValueType="Dword" />
  1298.                 </RegistryDatapoint>
  1299.                 <RegistryDatapoint DataId="2925" DataType="Dword">
  1300.                     <RegistryValueSelector ValueName="FallbackToUnsecureRPCIfNecessary" ValueType="Dword" />
  1301.                 </RegistryDatapoint>
  1302.                 <RegistryDatapoint DataId="2926" DataType="Dword">
  1303.                     <RegistryValueSelector ValueName="TurnOffRpcSecurity" ValueType="Dword" />
  1304.                 </RegistryDatapoint>
  1305.                 </RegistryDatapoints>
  1306.             </RegistryQuery>
  1307.         </Queries>
  1308.         </QueryGroup>
  1309.  
  1310.         <QueryGroup>
  1311.             <Applicability>
  1312.         <Global />
  1313.             </Applicability>
  1314.         <Queries>
  1315.         <EventQuery Channel="System" Query="*[System[(Level=1  or Level=2) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
  1316.                 <TopEvents EventCount="10" MSSpecificEvents="1" />
  1317.  
  1318.             </EventQuery>
  1319.         <EventQuery Channel="System" Query="*[System[(Level=3) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
  1320.                 <TopEvents EventCount="10" MSSpecificEvents="1" />
  1321.  
  1322.             </EventQuery>
  1323.         <EventQuery Channel="System" Query="*[System[(Level=0 or Level=4) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
  1324.                 <TopEvents EventCount="10" MSSpecificEvents="1" />
  1325.  
  1326.             </EventQuery>
  1327.         <EventQuery Channel="Application" Query="*[System[(Level=1  or Level=2) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
  1328.                 <TopEvents EventCount="10" MSSpecificEvents="1" />
  1329.  
  1330.             </EventQuery>
  1331.         <EventQuery Channel="Application" Query="*[System[(Level=3) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
  1332.                 <TopEvents EventCount="10" MSSpecificEvents="1" />
  1333.  
  1334.             </EventQuery>
  1335.         <EventQuery Channel="Application" Query="*[System[(Level=0 or Level=4) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
  1336.                 <TopEvents EventCount="10" MSSpecificEvents="1" />
  1337.  
  1338.             </EventQuery>
  1339.         </Queries>
  1340.         </QueryGroup>
  1341.  
  1342.     </QueryGroups>
  1343. </CeipAssistant>