226 lines
26 KiB
XML
Executable File
226 lines
26 KiB
XML
Executable File
<?xml version="1.0" encoding="utf-16"?>
|
||
<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
|
||
<Identifier>
|
||
<Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{3869352D-95F3-4FB0-BCDA-40191D897625}</Identifier>
|
||
<Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
|
||
</Identifier>
|
||
<Name>Custom Event Channel Permissions</Name>
|
||
<IncludeComments>true</IncludeComments>
|
||
<CreatedTime>2019-12-04T04:33:09</CreatedTime>
|
||
<ModifiedTime>2019-12-04T05:55:03</ModifiedTime>
|
||
<ReadTime>2019-12-04T05:59:37.0612886Z</ReadTime>
|
||
<SecurityDescriptor>
|
||
<SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-1432213693-3031993202-888658363-1000G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1432213693-3031993202-888658363-1000)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1432213693-3031993202-888658363-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)</SDDL>
|
||
<Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1432213693-3031993202-888658363-1000</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
|
||
</Owner>
|
||
<Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1432213693-3031993202-888658363-513</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
|
||
</Group>
|
||
<PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
|
||
<Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
|
||
<InheritsFromParent>false</InheritsFromParent>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1432213693-3031993202-888658363-519</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1432213693-3031993202-888658363-1000</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>false</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1432213693-3031993202-888658363-512</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
</Permissions>
|
||
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
|
||
</SecurityDescriptor>
|
||
<FilterDataAvailable>true</FilterDataAvailable>
|
||
<Computer>
|
||
<VersionDirectory>27</VersionDirectory>
|
||
<VersionSysvol>27</VersionSysvol>
|
||
<Enabled>true</Enabled>
|
||
<ExtensionData>
|
||
<Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Windows/Registry" xsi:type="q1:RegistrySettings">
|
||
<q1:RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}">
|
||
<q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="ChannelAccess" status="ChannelAccess" image="7" changed="2017-07-22 01:25:45" uid="{CA8FB1DB-B0A8-427A-A00D-08C1D499DC32}">
|
||
<q1:GPOSettingOrder>1</q1:GPOSettingOrder>
|
||
<q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DNSServer/Audit" name="ChannelAccess" type="REG_SZ" value="O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)">
|
||
<q1:Values />
|
||
</q1:Properties>
|
||
<q1:Filters />
|
||
</q1:Registry>
|
||
<q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="ChannelAccess" status="ChannelAccess" image="7" changed="2017-07-22 06:26:23" uid="{837364B6-ECD8-46E8-9FF1-35C7B0D9F5FF}">
|
||
<q1:GPOSettingOrder>2</q1:GPOSettingOrder>
|
||
<q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBClient/Operational" name="ChannelAccess" type="REG_SZ" value="O:BAG:SYD:(A;;0x5;;;BA)(A;;0x1;;;S-1-5-20)(A;;0x1;;;S-1-5-32-573)">
|
||
<q1:Values />
|
||
</q1:Properties>
|
||
<q1:Filters />
|
||
</q1:Registry>
|
||
<q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="ChannelAccess" status="ChannelAccess" image="7" changed="2017-07-22 06:27:30" uid="{43ADFF5A-9412-44C6-8476-839EC6602558}">
|
||
<q1:GPOSettingOrder>3</q1:GPOSettingOrder>
|
||
<q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBServer/Audit" name="ChannelAccess" type="REG_SZ" value="O:BAG:SYD:(A;;0x5;;;BA)(A;;0x1;;;S-1-5-20)(A;;0x1;;;S-1-5-32-573)">
|
||
<q1:Values />
|
||
</q1:Properties>
|
||
<q1:Filters />
|
||
</q1:Registry>
|
||
<q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="ChannelAccess" status="ChannelAccess" image="7" changed="2019-12-04 05:55:03" uid="{F3952650-0492-4492-9BB4-D96379AC1D13}">
|
||
<q1:GPOSettingOrder>4</q1:GPOSettingOrder>
|
||
<q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational" name="ChannelAccess" type="REG_SZ" value="O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)">
|
||
<q1:Values />
|
||
</q1:Properties>
|
||
<q1:Filters />
|
||
</q1:Registry>
|
||
<q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="CustomSD" status="CustomSD" image="7" changed="2017-07-22 06:29:26" uid="{8D55AF86-069E-4A22-A9F9-AD8DCC1711C9}">
|
||
<q1:GPOSettingOrder>5</q1:GPOSettingOrder>
|
||
<q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SYSTEM\CurrentControlSet\Services\EventLog\DNS Server" name="CustomSD" type="REG_SZ" value="O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-20)(A;;0x1;;;S-1-5-32-573)">
|
||
<q1:Values />
|
||
</q1:Properties>
|
||
<q1:Filters />
|
||
</q1:Registry>
|
||
<q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="CustomSD" status="CustomSD" image="7" changed="2017-07-22 06:54:47" uid="{59ECA0A8-307C-4B14-9D55-BB118CC1B9D4}">
|
||
<q1:GPOSettingOrder>6</q1:GPOSettingOrder>
|
||
<q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SYSTEM\CurrentControlSet\Services\EventLog\Security" name="CustomSD" type="REG_SZ" value="O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)">
|
||
<q1:Values />
|
||
</q1:Properties>
|
||
<q1:Filters />
|
||
</q1:Registry>
|
||
</q1:RegistrySettings>
|
||
</Extension>
|
||
<Name>Windows Registry</Name>
|
||
</ExtensionData>
|
||
</Computer>
|
||
<User>
|
||
<VersionDirectory>1</VersionDirectory>
|
||
<VersionSysvol>1</VersionSysvol>
|
||
<Enabled>true</Enabled>
|
||
</User>
|
||
<LinksTo>
|
||
<SOMName>Domain Controllers</SOMName>
|
||
<SOMPath>windomain.local/Domain Controllers</SOMPath>
|
||
<Enabled>true</Enabled>
|
||
<NoOverride>true</NoOverride>
|
||
</LinksTo>
|
||
<LinksTo>
|
||
<SOMName>Servers</SOMName>
|
||
<SOMPath>windomain.local/Servers</SOMPath>
|
||
<Enabled>true</Enabled>
|
||
<NoOverride>true</NoOverride>
|
||
</LinksTo>
|
||
<LinksTo>
|
||
<SOMName>Workstations</SOMName>
|
||
<SOMPath>windomain.local/Workstations</SOMPath>
|
||
<Enabled>true</Enabled>
|
||
<NoOverride>true</NoOverride>
|
||
</LinksTo>
|
||
</GPO> |