; (c) Microsoft Corporation 1997-2001 ; ; Security Configuration Template for Security Configuration Editor ; ; Template Name: Web_Secure.INF ; Template Version: 05.02.HB.0000 ; Originally based off of hisecureweb.inf by Michael Howard ; Modified by Eric Schultze ; ; ------------------------------------------------------------------- ; Revision History ; ------------------------------------------------------------------- ; Date Comment ; 03-Sep-1999 Original, based on the following assumptions: ; Machine is a not a Domain Controller ; DC's should not be web-servers ; Machine is a standalone server ; - If machine is joined to a domain, ; then domain-level policies may (or may not) ; overwrite these settings. ; - If machine is joined to a domain, ; it should be in it's own OU, and you would ; apply this template at the OU level. ; Machine is a dedicated web-server and physically protected ; Machine has the Windows 2000 clean-install defaults ; No one is allowed to log on locally to the machine accept an admin ; Admins are not allowed to log on over ; the network (they have to go to the Web server to administer it) ; Admin\Guest accounts are not renamed via this template ; 24-Jan-2000 Updated registry entries ; 23-May-2000 Updated to reduce SMB/Secure channel signing requirements. ; 26-Feb-2001 Updated with File and Reg Keys, and additional security settings (Eric) ; 07-Apr-2001 Updated to ACL dllhost.exe so .asp pages work Also added .msc files to file ACL list (Eric) ; ------------------------------------------------------------------- [version] signature="$CHICAGO$" Revision=1 [System Access] MinimumPasswordAge = 2 MaximumPasswordAge = 42 MinimumPasswordLength = 7 PasswordComplexity = 1 PasswordHistorySize = 8 LockoutBadCount = 5 ResetLockoutCount = 30 LockoutDuration = -1 RequireLogonToChangePassword = 0 ForceLogoffWhenHourExpire = 1 ClearTextPassword = 0 [System Log] RestrictGuestAccess = 1 [Security Log] MaximumLogSize = 10240 AuditLogRetentionPeriod = 1 RetentionDays = 14 RestrictGuestAccess = 1 [Application Log] RestrictGuestAccess = 1 ;---------------------------------------------------------------------- ; Local Policies\Audit Policy ;---------------------------------------------------------------------- [Event Audit] AuditSystemEvents = 3 AuditLogonEvents = 3 AuditObjectAccess = 2 AuditPrivilegeUse = 3 AuditPolicyChange = 3 AuditAccountManage = 3 AuditAccountLogon = 3 [Strings] SceInfAdministrator = Administrator SceInfAdmins = Administrators SceInfAcountOp = Account Operators SceInfAuthUsers = Authenticated Users SceInfBackupOp = Backup Operators SceInfDomainAdmins = Domain Admins SceInfDomainGuests = Domain Guests SceInfDomainUsers = Domain Users SceInfEveryone = Everyone SceInfGuests = Guests SceInfGuest = Guest SceInfPowerUsers = Power Users SceInfPrintOp = Print Operators SceInfReplicator = Replicator SceInfServerOp = Server Operators SceInfUsers = Users [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/SYSTEM/CurrentControlSet/Services/Tcpip/Parameters/SynAttackProtect] "ValueType"=dword:00000004 "DisplayType"=dword:00000000 "DisplayName"="TCPIP: Syn Attack Protection" [Registry Keys] "USERS\.DEFAULT\SOFTWARE\Microsoft\Protected Storage System Provider",1,"D:AR" "USERS\.DEFAULT\Software\Microsoft\NetDDE",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "USERS\.DEFAULT",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles",1,"D:AR" "MACHINE\SYSTEM\CurrentControlSet\Enum",1,"D:AR" "MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip",2,"D:(A;CI;GR;;;WD)" "MACHINE\SYSTEM\CurrentControlSet\Services\EventLog",2,"D:(A;CI;GR;;;WD)" "MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers",2,"D:(A;CI;GR;;;WD)" "MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions",2,"D:(A;CI;GR;;;WD)" "MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex",2,"D:(A;CI;GR;;;WD)" "MACHINE\SYSTEM\CurrentControlSet\Control\Computername",2,"D:(A;CI;GR;;;WD)" "MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security",2,"D:P(A;CI;GR;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg",2,"D:PAR(A;CI;KA;;;BA)" "MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts",2,"D:(A;CI;GR;;;WD)" "MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout",2,"D:(A;CI;GR;;;WD)" "MACHINE\SYSTEM\ControlSet010",1,"D:AR" "MACHINE\SYSTEM\ControlSet009",1,"D:AR" "MACHINE\SYSTEM\ControlSet008",1,"D:AR" "MACHINE\SYSTEM\ControlSet007",1,"D:AR" "MACHINE\SYSTEM\ControlSet006",1,"D:AR" "MACHINE\SYSTEM\ControlSet005",1,"D:AR" "MACHINE\SYSTEM\ControlSet004",1,"D:AR" "MACHINE\SYSTEM\ControlSet003",1,"D:AR" "MACHINE\SYSTEM\ControlSet002",1,"D:AR" "MACHINE\SYSTEM\ControlSet001",1,"D:AR" "MACHINE\SYSTEM\Clone",1,"D:AR" "MACHINE\System",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SecEdit",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009",1,"D:AR" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib",2,"D:P(A;CI;GR;;;IU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontMapper",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Classes",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AsrCommands",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)(A;CI;SDGWGR;;;BO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AEDebug",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion",2,"D:(A;CI;GR;;;WD)" "MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies",1,"D:AR" "MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer",1,"D:AR" "MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy",1,"D:AR" "MACHINE\SOFTWARE\Microsoft\SystemCertificates",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Secure",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider",1,"D:AR" "MACHINE\SOFTWARE\Microsoft\NetDDE",2,"D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" "MACHINE\Software\Classes",2,"D:(A;CI;GR;;;WD)" "MACHINE\Software",2,"D:P(A;CI;GR;;;BU)(A;CI;GR;;;PU)(A;CI;GA;;;BA)(A;CI;GA;;;SY)(A;CI;GA;;;CO)" [Registry Values] MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0 MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0 MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,1 MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14 MACHINE\System\CurrentControlSet\Control\Lsa\AuditBaseObjects=4,1 MACHINE\System\CurrentControlSet\Control\Lsa\SubmitControl=4,0 MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect=4,15 MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\diskspacethreshold=4,10 MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\hidden=4,1 MACHINE\SYSTEM\CurrentControlSet\Services\IPSEC\NoDefaultExempt=4,1 MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption=1,A T T E N T I O N ! MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=1,This is a private computer system. MACHINE\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing=3,1 MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters\MaximumDynamicBacklog=4,20000 ;MS KB Q142641 MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters\MinimumDynamicBacklog=4,20 ;MS KB Q142641 MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters\EnableDynamicBacklog=4,1 ;MS KB Q142641 MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters\DynamicBacklogGrowthDelta=4,10 ;MS KB Q142641 MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\NoNameReleaseOnDemand=4,1 MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxDataRetransmissions=4,3 ;see reskit regentry.chm MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxConnectResponseRetransmissions=4,2 ;MS KB Q142641 MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxHalfOpen=4,500 ;see reskit regentry.chm MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxHalfOpenRetried=4,400 ;see reskit regentry.chm MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxPortsExhausted=4,1 ;see reskit regentry.chm MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting=4,1 ;see reskit regentry.chm MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTime=4,300000 MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnablePMTUDiscovery=4,0 MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableDeadGWDetect=4,0 MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SynAttackProtect=4,1 ;MS KB Q142641 MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableSecurityFilters=4,1 ;see reskit regentry.chm MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirects=4,0 ;MS KB Q225344 MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\AutoShareServer=4,0 MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation=4,1 MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\DisableWebPrinting=4,1 MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,1 MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,0 MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,1 MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4,0 MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1 MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0 MACHINE\Software\Microsoft\Driver Signing\Policy=3,2 MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4,1 MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4,1 MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4,0 MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4,0 MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1 MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1 MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1 MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1 MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,1 MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,2 MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4,2 MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,1 [Group Membership] *S-1-5-32-547__Memberof = *S-1-5-32-547__Members = TelnetClients__Memberof = TelnetClients__Members = [Privilege Rights] SeNetworkLogonRight = *S-1-5-11 SeTcbPrivilege = SeMachineAccountPrivilege = SeBackupPrivilege = *S-1-5-32-544,*S-1-5-32-551 SeChangeNotifyPrivilege = *S-1-5-32-544,*S-1-5-32-551,*S-1-1-0,*S-1-5-32-547,*S-1-5-32-545 SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-32-547 SeCreatePagefilePrivilege = *S-1-5-32-544 SeCreateTokenPrivilege = SeCreatePermanentPrivilege = SeDebugPrivilege = *S-1-5-32-544 SeDenyNetworkLogonRight = SeDenyBatchLogonRight = SeDenyServiceLogonRight = SeDenyInteractiveLogonRight = SeEnableDelegationPrivilege = SeRemoteShutdownPrivilege = SeAuditPrivilege = SeIncreaseQuotaPrivilege = *S-1-5-32-544 SeIncreaseBasePriorityPrivilege = *S-1-5-32-544 SeLoadDriverPrivilege = *S-1-5-32-544 SeLockMemoryPrivilege = SeBatchLogonRight = SeInteractiveLogonRight = *S-1-5-32-545,*S-1-5-32-547,*S-1-5-32-551,*S-1-5-11,*S-1-5-32-544 SeSecurityPrivilege = *S-1-5-32-544 SeSystemEnvironmentPrivilege = *S-1-5-32-544 SeProfileSingleProcessPrivilege = *S-1-5-32-544,*S-1-5-32-547 SeSystemProfilePrivilege = *S-1-5-32-544 SeUndockPrivilege = *S-1-5-32-544,*S-1-5-32-547,*S-1-5-32-545 SeAssignPrimaryTokenPrivilege = SeRestorePrivilege = *S-1-5-32-544,*S-1-5-32-551 SeShutdownPrivilege = *S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-547,*S-1-5-32-545 SeSyncAgentPrivilege = SeTakeOwnershipPrivilege = *S-1-5-32-544 [Service General Setting] Alerter,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" ClipSrv,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" Browser,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" Dhcp,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" Fax,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" SharedAccess,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" Messenger,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" mnmsrvc,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" Spooler,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" RasAuto,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" RasMan,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" RemoteRegistry,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" Schedule,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" TapiSrv,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" TermService,4,"D:(A;;CCLCSWLOCRRC;;;IU)(A;;GA;;;BA)(A;;GA;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" PolicyAgent,2,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)" W3SVC,2,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)" IISADMIN,2,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)" Irmon,4,"D:AR(A;;RPWPDTRC;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)" cisvc,4,"D:(A;OICI;GA;;;WD)" lanmanserver,4,"D:(A;OICI;GA;;;WD)" lanmanworkstation,4,"D:(A;OICI;GA;;;WD)" Dfs,4,"D:(A;OICI;GA;;;WD)" Netlogon,4,"D:(A;OICI;GA;;;WD)" RpcLocator,4,"D:(A;OICI;GA;;;WD)" TlntSvr,4,"D:(A;OICI;GA;;;WD)" TermServLicensing,4,"D:(A;OICI;GA;;;WD)" [File Security] "%SystemDrive%\boot.ini",2,"D:P(A;;GXGR;;;PU)(A;;GA;;;BA)(A;;GA;;;SY)" "%SystemDrive%\ntdetect.com",2,"D:P(A;;GXGR;;;PU)(A;;GA;;;BA)(A;;GA;;;SY)" "%SystemDrive%\ntldr",2,"D:P(A;;GXGR;;;PU)(A;;GA;;;BA)(A;;GA;;;SY)" "%SystemDrive%\ntbootdd.sys",2,"D:P(A;;GXGR;;;PU)(A;;GA;;;BA)(A;;GA;;;SY)" "%SystemDrive%\autoexec.bat",2,"D:P(A;;GXGR;;;BU)(A;;GXGR;;;PU)(A;;GA;;;BA)(A;;GA;;;SY)" "%SystemDrive%\config.sys",2,"D:P(A;;GXGR;;;BU)(A;;GXGR;;;PU)(A;;GA;;;BA)(A;;GA;;;SY)" "%ProgramFiles%",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)(A;;GXGR;;;WD)" "%SystemRoot%\explorer.exe",2,"D:(A;;GXGR;;;WD)" "%SystemRoot%\CSC",1,"D:AR" "%SystemRoot%\debug",1,"D:AR" "%SystemRoot%\Offline Pages",1,"D:AR" "%SystemRoot%\Profiles",1,"D:AR" "%SystemRoot%\Registration",1,"D:AR" "%SystemRoot%\repair",2,"D:P(A;CI;GXGR;;;BU)(A;CI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\Tasks",1,"D:AR" "%SystemRoot%\Temp",2,"D:P(A;CI;0x100026;;;BU)(A;CI;0x100026;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\addins",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\Connection Wizard",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\Driver Cache",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\java",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\msagent",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\security",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\speech",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\twain_32",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\Web",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)(A;OICI;GXGR;;;WD)" "%SystemDirectory%\appmgmt",1,"D:AR" "%SystemDirectory%\DTCLog",1,"D:AR" "%SystemDirectory%\GroupPolicy",1,"D:AR" "%SystemDirectory%\NTMSData",1,"D:AR" "%SystemDirectory%\Setup",1,"D:AR" "%SystemDirectory%\ReinstallBackups",1,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\repl",1,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\repl\import",1,"D:(A;OICI;SDGXGWGR;;;RE)" "%SystemDirectory%\repl\export",1,"D:(A;OICI;SDGXGWGR;;;RE)" "%SystemDirectory%\spool\printers",1,"D:P(A;CI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\config",2,"D:P(A;CI;GXGR;;;BU)(A;CI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\dhcp",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\dllcache",2,"D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\drivers",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\CatRoot",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\ias",2,"D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\mui",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\ShellExt",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\wbem",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemDirectory%\wbem\mof",2,"D:P(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;PU)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)" "%SystemRoot%\system32\inetsrv\Data",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;WD)(A;OICI;FA;;;SY)" "%SystemRoot%\system32\Setup",2,"D:AR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;WD)(A;OICI;FA;;;SY)" "%SystemRoot%\Tasks",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;WD)(A;OICI;FA;;;SY)" "%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1f00ed;;;WD)(A;OICI;FA;;;SY)" "%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\HTML Help",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;WD)(A;OICI;FA;;;SY)" "%SystemDrive%\Documents and Settings\DRM",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;WD)(A;OICI;FA;;;SY)" "%SystemDrive%\Inetpub",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;WD)(A;OICI;FA;;;SY)" "%SystemRoot%\delttsul.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\explorer.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\hh.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\IsUninst.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\NOTEPAD.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\poledit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\regedit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\TASKMAN.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\twunk_16.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\twunk_32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\upwizun.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\winhelp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\winhlp32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemRoot%\winrep.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\login.cmd",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\usrlogon.cmd",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\accwiz.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\acsetups.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\actmovie.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\append.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\arp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\at.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\atmadm.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\attrib.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\autochk.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\autoconv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\autofmt.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\autolfn.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\bootok.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\bootvrfy.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cacls.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\calc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cdplayer.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\change.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\charmap.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\chglogon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\chgport.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\chgusr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\chkdsk.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\chkntfs.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cidaemon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cipher.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cisvc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ckcnv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cleanmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cliconfg.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\clipbrd.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\clipsrv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\clspack.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cluster.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cmd.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cmdl32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cmmgr32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cmmon32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cmstp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\comclust.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\comp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\compact.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\conime.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\control.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\convert.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\convlog.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cprofile.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\cscript.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\csrss.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\csvde.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dbgtrace.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dcomcnfg.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dcphelp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dcpromo.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ddeshare.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ddmprxy.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\debug.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dfrgfat.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dfrgntfs.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dfscmd.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dfsinit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dfssvc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\diantz.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\diskperf.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dllhost.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;WD)(A;OICI;FA;;;SY)" "%SystemDirectory%\dllhst3g.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dmadmin.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dmremote.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dns.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\doskey.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dosx.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dplaysvr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\drwatson.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\drwtsn32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dtcsetup.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dvdplay.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dxdiag.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\edlin.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\esentutl.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\eudcedit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\eventvwr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\exe2bin.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\expand.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\extrac32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\fastopen.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\faxcover.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\faxqueue.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\faxsend.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\faxsvc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\fc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\find.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\findstr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\finger.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\fixmapi.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\flattemp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\fontview.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\forcedos.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\freecell.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ftp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\gdi.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\grpconv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\help.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\hostname.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ie4uinit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ieshwiz.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\iexpress.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\iisreset.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\internat.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ipconfig.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ipsecmon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ipxroute.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\irftp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ismserv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\jdbgmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\jetconv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\jview.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\krnl386.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\label.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lcwiz.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ldifde.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\licmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lights.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\llsmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\llssrv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lnkstub.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\locator.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lodctr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\logoff.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lpq.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lpr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lsass.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lserver.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\macfile.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\magnify.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\makecab.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mdm.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mem.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\migpwd.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mmc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mnmsrvc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mobsync.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mountvol.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mplay32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mpnotify.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mrinfo.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mscdexnt.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\msdtc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\msg.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mshta.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\msiexec.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mspaint.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\msswchx.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mstask.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\mstinit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\narrator.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\nbtstat.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\nddeapir.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\net.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\net1.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\netdde.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\netsh.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\netstat.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\nlsfunc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\notepad.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\nslookup.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntbackup.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntbooks.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntdsutil.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntfrs.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntfrsupg.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntkrnlpa.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntoskrnl.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntsd.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntvdm.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\nw16.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\nwscript.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\odbcad32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\odbcconf.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\os2.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\os2srv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\os2ss.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\osk.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\packager.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\pathping.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\pax.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\pentnt.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\perfmon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ping.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\posix.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\print.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\progman.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\proquota.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\psxss.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\qappsrv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\qprocess.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\query.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\quser.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\qwinsta.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rasadmin.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rasautou.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rasdial.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rasphone.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rcp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rdpclip.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\recover.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\redir.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\regedt32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\regini.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\register.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\regsvc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\regsvr32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\regtrace.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\regwiz.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\remrras.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\replace.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\reset.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rexec.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\route.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\routemon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\router.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rsh.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rsm.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rsnotify.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rsvp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\runas.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rundll32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\runonce.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rwinsta.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\savedump.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\scardsvr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\schupgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\secedit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\services.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sethc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\setreg.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\setup.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\setver.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sfc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sfmprint.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sfmpsexe.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sfmsvc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\shadow.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\share.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\shmgrate.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\shrpubw.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sigverif.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\skeys.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\smlogsvc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\smss.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sndrec32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sndvol32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sol.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sort.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\SPOOLSV.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sprestrt.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\srvmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\stimon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\stisvc.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\subst.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\svchost.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\syncapp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sysedit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\syskey.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\sysocmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\systray.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\taskman.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\taskmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tcmsetup.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tcpsvcs.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\telnet.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\termsrv.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tftp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\themes.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tlntadmn.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tlntsess.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tlntsvr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tracert.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tsadmin.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tscon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tsdiscon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tskill.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tsprof.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tsshutdn.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\unlodctr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\upg351db.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ups.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\user.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\userinit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\usrmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\utilman.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\verifier.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\vwipxspx.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\w32tm.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wextract.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winchat.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winfile.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winhlp32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winlogon.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winmine.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winmsd.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winspool.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winver.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wizmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wjview.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wlbs.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wowdeb.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wowexec.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wpnpinst.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\write.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wscript.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wupdmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\xcopy.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wbem\mofcomp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wbem\scrcons.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wbem\unsecapp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wbem\wbemtest.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wbem\winmgmt.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\inetsrv\fortutil.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\inetsrv\iisrstas.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\inetsrv\iissync.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\inetsrv\inetinfo.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\inetsrv\inetmgr.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\export\encinst.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\com\comrepl.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\com\comrereg.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\acssnap.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\certmgr.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\certsrv.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ciadv.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\compmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\devmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dfrg.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dfsgui.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dhcpmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\diskmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dnsmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\domain.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dsa.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\dssite.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\eventvwr.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\faxserv.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\fsmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\gpedit.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ias.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\lusrmgr.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntmsmgr.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\ntmsoprq.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\perfmon.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rrasmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\rsadmin.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\schmmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\secpol.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\services.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\tapimgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\winsmgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)" "%SystemDirectory%\wmimgmt.msc",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"