202 lines
20 KiB
XML
202 lines
20 KiB
XML
<?xml version="1.0" encoding="utf-16"?>
|
||
<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
|
||
<Identifier>
|
||
<Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{4B3113E3-C8EF-4CED-813C-F0D888C55C61}</Identifier>
|
||
<Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
|
||
</Identifier>
|
||
<Name>Windows Event Forwarding Server</Name>
|
||
<IncludeComments>true</IncludeComments>
|
||
<CreatedTime>2017-07-21T07:47:00</CreatedTime>
|
||
<ModifiedTime>2017-07-21T21:50:09</ModifiedTime>
|
||
<ReadTime>2017-07-22T06:46:22.2172604Z</ReadTime>
|
||
<SecurityDescriptor>
|
||
<SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-2906110659-1782557030-2646142923-1000G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-2906110659-1782557030-2646142923-1000)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-2906110659-1782557030-2646142923-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)</SDDL>
|
||
<Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-2906110659-1782557030-2646142923-1000</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
|
||
</Owner>
|
||
<Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-2906110659-1782557030-2646142923-513</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
|
||
</Group>
|
||
<PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
|
||
<Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
|
||
<InheritsFromParent>false</InheritsFromParent>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-2906110659-1782557030-2646142923-519</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-2906110659-1782557030-2646142923-1000</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>false</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
<TrusteePermissions>
|
||
<Trustee>
|
||
<SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-2906110659-1782557030-2646142923-512</SID>
|
||
<Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
|
||
</Trustee>
|
||
<Type xsi:type="PermissionType">
|
||
<PermissionType>Allow</PermissionType>
|
||
</Type>
|
||
<Inherited>false</Inherited>
|
||
<Applicability>
|
||
<ToSelf>true</ToSelf>
|
||
<ToDescendantObjects>false</ToDescendantObjects>
|
||
<ToDescendantContainers>true</ToDescendantContainers>
|
||
<ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
|
||
</Applicability>
|
||
<Standard>
|
||
<GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
|
||
</Standard>
|
||
<AccessMask>0</AccessMask>
|
||
</TrusteePermissions>
|
||
</Permissions>
|
||
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
|
||
</SecurityDescriptor>
|
||
<FilterDataAvailable>true</FilterDataAvailable>
|
||
<Computer>
|
||
<VersionDirectory>2</VersionDirectory>
|
||
<VersionSysvol>2</VersionSysvol>
|
||
<Enabled>true</Enabled>
|
||
<ExtensionData>
|
||
<Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q1:RegistrySettings">
|
||
<q1:Policy>
|
||
<q1:Name>Configure target Subscription Manager</q1:Name>
|
||
<q1:State>Enabled</q1:State>
|
||
<q1:Explain>This policy setting allows you to configure the server address, refresh interval, and issuer certificate authority (CA) of a target Subscription Manager.
|
||
|
||
If you enable this policy setting, you can configure the Source Computer to contact a specific FQDN (Fully Qualified Domain Name) or IP Address and request subscription specifics.
|
||
|
||
Use the following syntax when using the HTTPS protocol:
|
||
Server=https://<FQDN of the collector>:5986/wsman/SubscriptionManager/WEC,Refresh=<Refresh interval in seconds>,IssuerCA=<Thumb print of the client authentication certificate>. When using the HTTP protocol, use port 5985.
|
||
|
||
If you disable or do not configure this policy setting, the Event Collector computer will not be specified.</q1:Explain>
|
||
<q1:Supported>At least Windows Vista</q1:Supported>
|
||
<q1:Category>Windows Components/Event Forwarding</q1:Category>
|
||
<q1:ListBox>
|
||
<q1:Name>SubscriptionManagers</q1:Name>
|
||
<q1:State>Enabled</q1:State>
|
||
<q1:ExplicitValue>false</q1:ExplicitValue>
|
||
<q1:Additive>false</q1:Additive>
|
||
<q1:ValuePrefix />
|
||
<q1:Value>
|
||
<q1:Element>
|
||
<q1:Data>Server=http://wef.windomain.local:5985/wsman/SubscriptionManager/WEC,Refresh=60</q1:Data>
|
||
</q1:Element>
|
||
</q1:Value>
|
||
</q1:ListBox>
|
||
</q1:Policy>
|
||
</Extension>
|
||
<Name>Registry</Name>
|
||
</ExtensionData>
|
||
</Computer>
|
||
<User>
|
||
<VersionDirectory>1</VersionDirectory>
|
||
<VersionSysvol>1</VersionSysvol>
|
||
<Enabled>true</Enabled>
|
||
</User>
|
||
<LinksTo>
|
||
<SOMName>windomain</SOMName>
|
||
<SOMPath>windomain.local</SOMPath>
|
||
<Enabled>true</Enabled>
|
||
<NoOverride>true</NoOverride>
|
||
</LinksTo>
|
||
<LinksTo>
|
||
<SOMName>Domain Controllers</SOMName>
|
||
<SOMPath>windomain.local/Domain Controllers</SOMPath>
|
||
<Enabled>true</Enabled>
|
||
<NoOverride>true</NoOverride>
|
||
</LinksTo>
|
||
</GPO> |