Edit C:\Windows\System32\ceipdata.xml
<?xml version="1.0" encoding="UTF-8"?> <CeipAssistant> <FileAttributes> <Author>Microsoft Corporation</Author> <Version>5</Version> </FileAttributes> <ExecutionOptions> <GlobalTimeout>1800</GlobalTimeout> <QueryTimeout>10</QueryTimeout> <MaxRows>1000</MaxRows> <MaxErrors>2</MaxErrors> <ExecutionWindow>36</ExecutionWindow> </ExecutionOptions> <ExecutionGroups> <ExecutionGroup Id="1" TimeBeforeDataCollection="2160" RetryFrequency="360" ExecutionTimeAfterDataCollection="4320" RandomDelay="60"> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT AllowTSConnections FROM Win32_TerminalServiceSetting" QueryTimeout="20"> <WmiDatapoints> <WmiDatapoint DataId="2539" DataType="Dword"> <WmiPropertySelector PropertyName="AllowTSConnections" PropertyType="Dword" /> </WmiDatapoint> </WmiDatapoints> </WmiQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT MediaType FROM Win32_DiskDrive WHERE MediaType='Fixed hard disk media'" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="2517" Function="Count" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT Type FROM Win32_DiskPartition" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="2520" Function="Count" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT Model, Size FROM Win32_DiskDrive" QueryTimeout="20"> <WmiStreams> <WmiStream DataId="2918"> <WmiStreamColumns> <WmiStreamColumn DataType="String"> <WmiPropertySelector PropertyName="Model" PropertyType="String" /> </WmiStreamColumn> <WmiStreamColumn DataType="Dword"> <WmiPropertySelector PropertyName="Size" PropertyType="Qword"> <Transforms> <ScaleTransform Divisor="1048576" /> </Transforms> </WmiPropertySelector> </WmiStreamColumn> </WmiStreamColumns> </WmiStream> </WmiStreams> </WmiQuery> <RegistryQuery Hive="HKLM" Subkey="System\Setup"> <RegistryAggregates> <RegistryAggregate DataId="3076" Function="Exists"> <RegistryValueSelector ValueName="Upgrade" ValueType="Dword" /> </RegistryAggregate> </RegistryAggregates> </RegistryQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <CustomQuery QueryId="11" /> <CustomQuery QueryId="22" /> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <CustomQuery QueryId="14"> <Arguments> <Argument>5071</Argument> </Arguments> </CustomQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <CustomQuery QueryId="18"> <Arguments> <Argument>6705</Argument> </Arguments> </CustomQuery> <RegistryQuery Hive="HKLM" Subkey="Software\Policies\Microsoft\SQMClient\Windows"> <RegistryAggregates> <RegistryAggregate DataId="6707" Function="Exists"> <RegistryValueSelector ValueName="CEIPEnable" ValueType="Dword" /> </RegistryAggregate> </RegistryAggregates> </RegistryQuery> </Queries> </QueryGroup> <QueryGroup MaxErrors="7"> <Applicability> <Expression JoinOperator="And"> <QueryTest> <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name = 'ClusSvc' AND State = 'Running'"> <WmiAggregates> <WmiAggregate DataId="4294967295" Function="Exists" /> </WmiAggregates> </WmiQuery> <ValueTest Operator="Equals" DataType="Dword" Comparand="1" /> </QueryTest> </Expression> </Applicability> <Queries> <WmiQuery Namespace="root\MSCluster" Query="SELECT * from MSCluster_Node"> <WmiAggregates> <WmiAggregate DataId="2551" Function="Count" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MSCluster" Query="SELECT QuorumTypeValue from MSCluster_Cluster" QueryTimeout="20" MaxRows="1"> <WmiDatapoints> <WmiDatapoint DataId="2553" DataType="Dword"> <WmiPropertySelector PropertyName="QuorumTypeValue" PropertyType="Dword" /> </WmiDatapoint> </WmiDatapoints> </WmiQuery> <WmiQuery Namespace="root\MSCluster" Query="associators of {MSCluster_Cluster.Name='.'} Where AssocClass=MSCluster_ClusterToQuorumResource" MaxRows="1"> <WmiDatapoints> <WmiDatapoint DataId="2566" DataType="Dword"> <WmiPropertySelector PropertyName="Type" PropertyType="String"> <Transforms> <EnumTransform DefaultValue="0"> <Enum Name="Physical Disk" Value="1" /> <Enum Name="File Share Witness" Value="2" /> </EnumTransform> </Transforms> </WmiPropertySelector> </WmiDatapoint> </WmiDatapoints> </WmiQuery> <WmiQuery Namespace="root\MSCluster" Query="SELECT Type from MSCluster_Resource" QueryTimeout="30"> <WmiAggregates> <WmiAggregate DataId="2554" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="File Server" /> </WmiAggregate> <WmiAggregate DataId="2555" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="DHCP Service" /> </WmiAggregate> <WmiAggregate DataId="2556" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Distributed Transaction Coordinator" /> </WmiAggregate> <WmiAggregate DataId="2557" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Generic Application" /> </WmiAggregate> <WmiAggregate DataId="2558" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Generic Service" /> </WmiAggregate> <WmiAggregate DataId="2559" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Generic Script" /> </WmiAggregate> <WmiAggregate DataId="2560" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Microsoft iSNS" /> </WmiAggregate> <WmiAggregate DataId="2561" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="MSMQ" /> </WmiAggregate> <WmiAggregate DataId="2562" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="NFS Share" /> </WmiAggregate> <WmiAggregate DataId="2563" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Print Spooler" /> </WmiAggregate> <WmiAggregate DataId="2564" Function="Exists"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="WINS Service" /> </WmiAggregate> <WmiAggregate DataId="2565" Function="Count"> <WmiPropertySelector PropertyName="Type" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Physical Disk" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MSCluster" Query="SELECT Type from MSCluster_Resource WHERE Type='Virtual Machine' OR Type='Virtual Machine Configuration'" QueryTimeout="30"> <WmiAggregates> <WmiAggregate DataId="5895" Function="Exists" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MSCluster" Query="SELECT Type from MSCluster_Resource WHERE Type='SQL Server' OR Type='SQL Server Agent'" QueryTimeout="30"> <WmiAggregates> <WmiAggregate DataId="5890" Function="Exists" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MSCluster" Query="SELECT EnableSharedVolumes FROM MSCluster_Cluster WHERE EnableSharedVolumes=1" QueryTimeout="30"> <WmiAggregates> <WmiAggregate DataId="5887" Function="Exists" /> </WmiAggregates> </WmiQuery> <RegistryQuery Hive="HKLM" Subkey="System\CurrentControlSet\Services\Clussvc\Parameters"> <RegistryDatapoints> <RegistryDatapoint DataId="2552" DataType="Dword"> <RegistryValueSelector ValueName="InstanceHash" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="34" RequiredState="Installed" /> <QueryTest> <WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT Name FROM MicrosoftNLB_Cluster" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="4294967295" Function="Exists" /> </WmiAggregates> </WmiQuery> <ValueTest Operator="Equals" DataType="Dword" Comparand="1" /> </QueryTest> </Expression> </Applicability> <Queries> <WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT Name FROM MicrosoftNLB_Cluster" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="4143" Function="Count" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT Name FROM MicrosoftNLB_Node" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="4555" Function="Count" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT MulticastSupportEnabled, BDATeamActive FROM MicrosoftNLB_ClusterSetting" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="4556" Function="Count"> <WmiPropertySelector PropertyName="MulticastSupportEnabled" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="False" /> </WmiAggregate> <WmiAggregate DataId="4546" Function="Exists"> <WmiPropertySelector PropertyName="BDATeamActive" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT MulticastSupportEnabled FROM MicrosoftNLB_ClusterSetting WHERE MulticastSupportEnabled=TRUE AND IgmpSupport=FALSE" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="4553" Function="Count" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT MulticastSupportEnabled FROM MicrosoftNLB_ClusterSetting WHERE MulticastSupportEnabled=TRUE AND IgmpSupport=TRUE" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="4552" Function="Count" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT ClusterIPAddress FROM MicrosoftNLB_ClusterSetting WHERE ClusterIPAddress LIKE '%:%'" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="4547" Function="Exists" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT Affinity, EqualLoad, FilteringMode, Protocol, ClientStickinessTimeout FROM MicrosoftNLB_PortRuleEx" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="4557" Function="Count" /> <WmiAggregate DataId="4558" Function="Count"> <WmiPropertySelector PropertyName="Affinity" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="0" /> </WmiAggregate> <WmiAggregate DataId="4559" Function="Count"> <WmiPropertySelector PropertyName="Affinity" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="1" /> </WmiAggregate> <WmiAggregate DataId="4560" Function="Count"> <WmiPropertySelector PropertyName="Affinity" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="2" /> </WmiAggregate> <WmiAggregate DataId="4551" Function="Count"> <WmiPropertySelector PropertyName="EqualLoad" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> <WmiAggregate DataId="4561" Function="Count"> <WmiPropertySelector PropertyName="EqualLoad" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="False" /> </WmiAggregate> <WmiAggregate DataId="4562" Function="Count"> <WmiPropertySelector PropertyName="FilteringMode" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="1" /> </WmiAggregate> <WmiAggregate DataId="4554" Function="Count"> <WmiPropertySelector PropertyName="FilteringMode" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="2" /> </WmiAggregate> <WmiAggregate DataId="4550" Function="Count"> <WmiPropertySelector PropertyName="FilteringMode" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="3" /> </WmiAggregate> <WmiAggregate DataId="4563" Function="Count"> <WmiPropertySelector PropertyName="Protocol" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="1" /> </WmiAggregate> <WmiAggregate DataId="4564" Function="Count"> <WmiPropertySelector PropertyName="Protocol" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="2" /> </WmiAggregate> <WmiAggregate DataId="4548" Function="Count"> <WmiPropertySelector PropertyName="Protocol" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="3" /> </WmiAggregate> <WmiAggregate DataId="4549" Function="Count"> <WmiPropertySelector PropertyName="ClientStickinessTimeout" PropertyType="Dword" /> <ValueTest Operator="GreaterThan" DataType="Dword" Comparand="0" /> </WmiAggregate> <WmiAggregate DataId="4565" Function="Count"> <WmiPropertySelector PropertyName="ClientStickinessTimeout" PropertyType="Dword" /> <ValueTest Operator="Equals" DataType="Dword" Comparand="0" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <RegistryQuery Hive="HKLM" Subkey="SYSTEM\CurrentControlSet\Services\WLBS\Parameters"> <RegistryDatapoints> <RegistryDatapoint DataId="4142" DataType="Dword"> <RegistryValueSelector ValueName="InstanceHash" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> </Queries> </QueryGroup> <QueryGroup MaxErrors="5"> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="140" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <EventQuery Channel="System" Query="*[System[(EventID=5009) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2322" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5010) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2323" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5011) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2331" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5012) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2451" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5013) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2332" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5014) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2334" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5127) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2333" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5137) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2457" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5138) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2458" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5139) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2459" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5158) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2460" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=5002) and Provider[@Name='Microsoft-Windows-WAS'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2461" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="System" Query="*[System[(EventID=2003) and Provider[@Name='Microsoft-Windows-IIS-W3SVC-PerfCounters'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="2462" Function="Count" /> </EventAggregates> </EventQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\Web Service(_Total)\Get Requests/sec;Dword;100000</Argument> <Argument>\Web Service(_Total)\Service Uptime;Dword;100001</Argument> <Argument>\Web Service(_Total)\Total Get Requests;Dword;100002</Argument> <Argument>\Web Service Cache\URI Cache Hits;Dword;100003</Argument> <Argument>\Web Service Cache\Kernel: URI Cache Hits;Dword;100004</Argument> <Argument>\ASP.NET Apps v2.0.50727(__Total__)\Requests Total;Dword;100005</Argument> <Argument>\ASP.NET Apps v2.0.50727(__Total__)\Compilations Total;Dword;100006</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="2447" DataType="Dword"> <DataSelector SourceDataId="100000" /> </MetricsDatapoint> <MetricsDatapoint DataId="2279" DataType="Dword"> <DataSelector SourceDataId="100001" /> </MetricsDatapoint> <MetricsDatapoint DataId="2278" DataType="Dword"> <DataSelector SourceDataId="100002" /> </MetricsDatapoint> <MetricsDatapoint DataId="2280" DataType="Dword"> <DataSelector SourceDataId="100003" /> </MetricsDatapoint> <MetricsDatapoint DataId="2281" DataType="Dword"> <DataSelector SourceDataId="100004" /> </MetricsDatapoint> <MetricsDatapoint DataId="2448" DataType="Dword"> <DataSelector SourceDataId="100005" /> </MetricsDatapoint> <MetricsDatapoint DataId="2449" DataType="Dword"> <DataSelector SourceDataId="100006" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="150" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="17"> <Arguments> <Argument>\Active Server Pages\Requests Total;Dword;110000</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="2282" DataType="Dword"> <DataSelector SourceDataId="110000" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup MaxErrors="5"> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="176" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\IIS Extensions\MSDeploy\1"> <RegistryAggregates> <RegistryAggregate DataId="5122" Function="Exists"> <RegistryValueSelector ValueName="Install" ValueType="Dword" /> </RegistryAggregate> </RegistryAggregates> </RegistryQuery> <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\INETSTP\Components"> <RegistryAggregates> <RegistryAggregate DataId="5123" Function="Exists"> <RegistryValueSelector ValueName="FTPSvc" ValueType="Dword" /> </RegistryAggregate> <RegistryAggregate DataId="5124" Function="Exists"> <RegistryValueSelector ValueName="FTPExtensibility" ValueType="Dword" /> </RegistryAggregate> <RegistryAggregate DataId="5125" Function="Exists"> <RegistryValueSelector ValueName="WebDAV" ValueType="Dword" /> </RegistryAggregate> <RegistryAggregate DataId="5126" Function="Exists"> <RegistryValueSelector ValueName="PowerShellProvider" ValueType="Dword" /> </RegistryAggregate> </RegistryAggregates> </RegistryQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="184" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="17"> <Arguments> <Argument>\Microsoft FTP Service(_Total)\Microsoft FTP Service Uptime;Dword;120000</Argument> <Argument>\Microsoft FTP Service(_Total)\Total Connection Attempts;Dword;120001</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="2291" DataType="Dword"> <DataSelector SourceDataId="120000" /> </MetricsDatapoint> <MetricsDatapoint DataId="2292" DataType="Dword"> <DataSelector SourceDataId="120001" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="7" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='SPOOLER'" MaxRows="1"> <WmiDatapoints> <WmiDatapoint DataId="2481" DataType="Dword"> <WmiPropertySelector PropertyName="State" PropertyType="String"> <Transforms> <EnumTransform DefaultValue="0"> <Enum Name="Stopped" Value="1" /> <Enum Name="Start Pending" Value="2" /> <Enum Name="Stop Pending" Value="3" /> <Enum Name="Running" Value="4" /> <Enum Name="Continue Pending" Value="5" /> <Enum Name="Pause Pending" Value="6" /> <Enum Name="Paused" Value="7" /> </EnumTransform> </Transforms> </WmiPropertySelector> </WmiDatapoint> </WmiDatapoints> </WmiQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT LanguagesSupported FROM Win32_Printer WHERE Local='True'" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="2378" Function="Count" /> <WmiAggregate DataId="2488" Function="Count" > <WmiPropertySelector PropertyName="LanguagesSupported" PropertyType="Dword" IsArray="1" StartElement="0" MaxElements="100"/> <ValueTest Operator="Equals" DataType="Dword" Comparand="48" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT PortName FROM Win32_Printer WHERE Local='True' AND PortName LIKE 'XPS%'" QueryTimeout="20" MaxRows="1"> <WmiAggregates> <WmiAggregate DataId="2489" Function="Exists" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT SupportedPlatform FROM Win32_PrinterDriver"> <WmiAggregates> <WmiAggregate DataId="2379" Function="Count" /> <WmiAggregate DataId="2380" Function="Count" > <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Windows x64" /> </WmiAggregate> <WmiAggregate DataId="2381" Function="Count" > <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Windows IA64" /> </WmiAggregate> <WmiAggregate DataId="2382" Function="Count" > <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="Windows NT x86" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\Server\Server Sessions;Dword;130000</Argument> <Argument>\Server\Files Open;Dword;130001</Argument> <Argument>\Process(spoolsv)\Thread Count;Dword;130002</Argument> <Argument>\Process(spoolsv)\Handle Count;Dword;130003</Argument> <Argument>\Print Queue(_Total)\Total Jobs Printed;Dword;130004</Argument> <Argument>\Print Queue(_Total)\Max Jobs Spooling;Dword;130005</Argument> <Argument>\Print Queue(_Total)\Max References;Dword;130006</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="2482" DataType="Dword"> <DataSelector SourceDataId="130000" /> </MetricsDatapoint> <MetricsDatapoint DataId="2484" DataType="Dword"> <DataSelector SourceDataId="130001" /> </MetricsDatapoint> <MetricsDatapoint DataId="2485" DataType="Dword"> <DataSelector SourceDataId="130002" /> </MetricsDatapoint> <MetricsDatapoint DataId="2486" DataType="Dword"> <DataSelector SourceDataId="130003" /> </MetricsDatapoint> <MetricsDatapoint DataId="2491" DataType="Dword"> <DataSelector SourceDataId="130004" /> </MetricsDatapoint> <MetricsDatapoint DataId="2483" DataType="Dword"> <DataSelector SourceDataId="130005" /> </MetricsDatapoint> <MetricsDatapoint DataId="2487" DataType="Dword"> <DataSelector SourceDataId="130006" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <WmiQuery Namespace="root\cimv2" Query="SELECT Name, Instances FROM Win32_PerfFormattedData_ServiceModelService3000_ServiceModelService3000" QueryTimeout="20"> <WmiAggregates> <WmiAggregate DataId="2973" Function="Count" /> <WmiAggregate DataId="3095" Function="Sum" > <WmiPropertySelector PropertyName="Instances" PropertyType="Dword" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\Windows Workflow Foundation(_global_)\Workflows In Memory;Dword;140000</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="3094" DataType="Dword"> <DataSelector SourceDataId="140000" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="13" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <WmiQuery Namespace="root\cimv2" Query="SELECT Version From CIM_DataFile Where Name='%windir%\System32\dns.exe'"> <WmiDatapoints> <WmiDatapoint DataId="2988" DataType="String"> <WmiPropertySelector PropertyName="Version" PropertyType="String" /> </WmiDatapoint> </WmiDatapoints> </WmiQuery> <WmiQuery Namespace="root\MicrosoftDNS" Query="SELECT Name, DsIntegrated FROM MicrosoftDNS_Zone"> <WmiAggregates> <WmiAggregate DataId="3000" Function="Exists"> <WmiPropertySelector PropertyName="Name" PropertyType="String" /> <ValueTest Operator="Equals" DataType="String" Comparand="GlobalNames" /> </WmiAggregate> <WmiAggregate DataId="3001" Function="Count"> <WmiPropertySelector PropertyName="DsIntegrated" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> <WmiAggregate DataId="3005" Function="Count"> <WmiPropertySelector PropertyName="DsIntegrated" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="False" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <EventQuery Channel="DNS Server" Query="*[System[(EventID=4015) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="3003" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DNS Server" Query="*[System[(EventID=4011) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="3004" Function="Count" /> </EventAggregates> </EventQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="102" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2202) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4970" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2206) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4971" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2208) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4972" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2212) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4973" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2214) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4974" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2216) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4977" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2104) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4975" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2106) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4976" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=2102) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4978" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=4502) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4979" Function="Exists" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=4412) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4980" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=4402) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4981" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=4406) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4982" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=8019) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4983" Function="Exists" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=8028) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4984" Function="Exists" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=8029) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4985" Function="Exists" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=8023) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4986" Function="Exists" /> </EventAggregates> </EventQuery> <EventQuery Channel="DFS Replication" Query="*[System[(EventID=8025) and TimeCreated[timediff(@SystemTime) <= 129600000]]]"> <EventAggregates> <EventAggregate DataId="4987" Function="Exists" /> </EventAggregates> </EventQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <WmiQuery Namespace="root\cimv2" Query="SELECT HardwareAssisted, NoWriters, Count, ClientAccessible FROM Win32_ShadowCopy"> <WmiAggregates> <WmiAggregate DataId="5062" Function="Count"> <WmiPropertySelector PropertyName="HardwareAssisted" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> <WmiAggregate DataId="5063" Function="Count"> <WmiPropertySelector PropertyName="NoWriters" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="False" /> </WmiAggregate> <WmiAggregate DataId="5064" Function="Max"> <WmiPropertySelector PropertyName="Count" PropertyType="Dword" /> </WmiAggregate> <WmiAggregate DataId="5066" Function="Count"> <WmiPropertySelector PropertyName="ClientAccessible" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> </WmiAggregates> </WmiQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="431" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <WmiQuery Namespace="root\Microsoft\Windows\NFS" Query="SELECT UnmappedUserAccess, AnonymousAccess FROM MSFT_NfsShare"> <WmiAggregates> <WmiAggregate DataId="5109" Function="Count" /> <WmiAggregate DataId="5113" Function="Count"> <WmiPropertySelector PropertyName="UnmappedUserAccess" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> <WmiAggregate DataId="11050" Function="Count"> <WmiPropertySelector PropertyName="AnonymousAccess" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\Microsoft\Windows\NFS" Query="SELECT UnmLookupEnabled, AdLookupEnabled, LdapLookupEnabled FROM MSFT_NfsMappingStore"> <WmiAggregates> <WmiAggregate DataId="5111" Function="Count"> <WmiPropertySelector PropertyName="UnmLookupEnabled" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> <WmiAggregate DataId="5112" Function="Count"> <WmiPropertySelector PropertyName="AdLookupEnabled" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> <WmiAggregate DataId="11051" Function="Count"> <WmiPropertySelector PropertyName="LdapLookupEnabled" PropertyType="Boolean" /> <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" /> </WmiAggregate> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\Microsoft\Windows\NFS" Query="SELECT NetgroupStoreType FROM MSFT_NfsNetgroupStore"> <WmiDatapoints> <WmiDatapoint DataId="11052" DataType="String"> <WmiPropertySelector PropertyName="NetgroupStoreType" PropertyType="String" /> </WmiDatapoint> </WmiDatapoints> </WmiQuery> <WmiQuery Namespace="root\Microsoft\Windows\NFS" Query="SELECT NetgroupName FROM MSFT_NfsNetgroup"> <WmiAggregates> <WmiAggregate DataId="5115" Function="Count" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\Microsoft\Windows\NFS" Query="SELECT ClientGroupName FROM MSFT_NfsClientgroup"> <WmiAggregates> <WmiAggregate DataId="5117" Function="Count" /> </WmiAggregates> </WmiQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="18" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT LicensingType, TerminalServerMode FROM Win32_TerminalServiceSetting" MaxRows="1"> <WmiDatapoints> <WmiDatapoint DataId="2478" DataType="Dword"> <WmiPropertySelector PropertyName="LicensingType" PropertyType="Dword" /> </WmiDatapoint> <WmiDatapoint DataId="2480" DataType="Dword"> <WmiPropertySelector PropertyName="TerminalServerMode" PropertyType="Dword" /> </WmiDatapoint> </WmiDatapoints> </WmiQuery> <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT * FROM Win32_TSPublishedApplication"> <WmiAggregates> <WmiAggregate DataId="5846" Function="Count" /> </WmiAggregates> </WmiQuery> <RegistryQuery Hive="HKLM" Subkey="SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"> <RegistryDatapoints> <RegistryDatapoint DataId="5844" DataType="Dword"> <RegistryValueSelector ValueName="MaxXResolution" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5850" DataType="Dword"> <RegistryValueSelector ValueName="MaxYResolution" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5845" DataType="Dword"> <RegistryValueSelector ValueName="Maxmonitors" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5847" DataType="Dword"> <RegistryValueSelector ValueName="fDisableCam" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5848" DataType="Dword"> <RegistryValueSelector ValueName="fDisableAudioCapture" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5849" DataType="Dword"> <RegistryValueSelector ValueName="AllowedAudioQualityMode" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> <RegistryQuery Hive="HKLM" Subkey="SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"> <RegistryDatapoints> <RegistryDatapoint DataId="5844" DataType="Dword"> <RegistryValueSelector ValueName="MaxXResolution" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5850" DataType="Dword"> <RegistryValueSelector ValueName="MaxYResolution" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5845" DataType="Dword"> <RegistryValueSelector ValueName="Maxmonitors" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5847" DataType="Dword"> <RegistryValueSelector ValueName="fDisableCam" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5848" DataType="Dword"> <RegistryValueSelector ValueName="fDisableAudioCapture" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="5849" DataType="Dword"> <RegistryValueSelector ValueName="AllowedAudioQualityMode" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\MSDTC\Security"> <RegistryDatapoints> <RegistryDatapoint DataId="2919" DataType="Dword"> <RegistryValueSelector ValueName="NetworkDtcAccess" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="2920" DataType="Dword"> <RegistryValueSelector ValueName="NetworkDtcAccessClients" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="2921" DataType="Dword"> <RegistryValueSelector ValueName="NetworkDtcAccessAdmin" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="2922" DataType="Dword"> <RegistryValueSelector ValueName="NetworkDtcAccessInbound" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="2923" DataType="Dword"> <RegistryValueSelector ValueName="NetworkDtcAccessOutbound" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="2927" DataType="Dword"> <RegistryValueSelector ValueName="NetworkDtcAccessTip" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="2928" DataType="Dword"> <RegistryValueSelector ValueName="XATransactions" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\MSDTC"> <RegistryDatapoints> <RegistryDatapoint DataId="2924" DataType="Dword"> <RegistryValueSelector ValueName="AllowOnlySecureRpcCalls" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="2925" DataType="Dword"> <RegistryValueSelector ValueName="FallbackToUnsecureRPCIfNecessary" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="2926" DataType="Dword"> <RegistryValueSelector ValueName="TurnOffRpcSecurity" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\Distributed Transaction Coordinator\Committed Transactions;Dword;160000</Argument> <Argument>\Distributed Transaction Coordinator\Aborted Transactions;Dword;160001</Argument> <Argument>\Distributed Transaction Coordinator\Force Aborted Transactions;Dword;160002</Argument> <Argument>\Distributed Transaction Coordinator\Force Committed Transactions;Dword;160003</Argument> <Argument>\Distributed Transaction Coordinator\Response Time -- Average;Dword;160004</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="2929" DataType="Dword"> <DataSelector SourceDataId="160000" /> </MetricsDatapoint> <MetricsDatapoint DataId="2930" DataType="Dword"> <DataSelector SourceDataId="160001" /> </MetricsDatapoint> <MetricsDatapoint DataId="2931" DataType="Dword"> <DataSelector SourceDataId="160002" /> </MetricsDatapoint> <MetricsDatapoint DataId="2932" DataType="Dword"> <DataSelector SourceDataId="160003" /> </MetricsDatapoint> <MetricsDatapoint DataId="2933" DataType="Dword"> <DataSelector SourceDataId="160004" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <EventQuery Channel="System" Query="*[System[Provider[@Name='Microsoft-Windows-WHEA-Logger'] and TimeCreated[timediff(@SystemTime) <= 129600000]]]" QueryTimeout="20"> <TopEvents DataId="5068" EventCount="40" MSSpecificEvents="1" /> </EventQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <EventQuery Channel="System" Query="*[System[(Level=1 or Level=2) and TimeCreated[timediff(@SystemTime) <= 129600000]]]" QueryTimeout="20"> <TopEvents EventCount="10" MSSpecificEvents="1" /> </EventQuery> <EventQuery Channel="System" Query="*[System[(Level=3) and TimeCreated[timediff(@SystemTime) <= 129600000]]]" QueryTimeout="20"> <TopEvents EventCount="10" MSSpecificEvents="1" /> </EventQuery> <EventQuery Channel="System" Query="*[System[(Level=0 or Level=4) and TimeCreated[timediff(@SystemTime) <= 129600000]]]" QueryTimeout="20"> <TopEvents EventCount="10" MSSpecificEvents="1" /> </EventQuery> <EventQuery Channel="Application" Query="*[System[(Level=1 or Level=2) and TimeCreated[timediff(@SystemTime) <= 129600000]]]" QueryTimeout="20"> <TopEvents EventCount="10" MSSpecificEvents="1" /> </EventQuery> <EventQuery Channel="Application" Query="*[System[(Level=3) and TimeCreated[timediff(@SystemTime) <= 129600000]]]" QueryTimeout="20"> <TopEvents EventCount="10" MSSpecificEvents="1" /> </EventQuery> <EventQuery Channel="Application" Query="*[System[(Level=0 or Level=4) and TimeCreated[timediff(@SystemTime) <= 129600000]]]" QueryTimeout="20"> <TopEvents EventCount="10" MSSpecificEvents="1" /> </EventQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>100000</Argument> <Argument>ualsvc</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="10240" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="100000" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RequiredState="Installed" RoleId="19"/> </Expression> </Applicability> <Queries> <RegistryQuery Hive="HKLM" Subkey="SOFTWARE\Microsoft\WDS"> <RegistryDatapoints> <RegistryDatapoint DataId="10517" DataType="Dword"> <RegistryValueSelector ValueName="SetupComplete" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="10658" DataType="Dword"> <RegistryValueSelector ValueName="DirectoryServicesEnabled" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> <RegistryQuery Hive="HKLM" Subkey="SOFTWARE\Microsoft\WDS\InstalledFeatures"> <RegistryDatapoints> <RegistryDatapoint DataId="10513" DataType="Dword"> <RegistryValueSelector ValueName="WdsDeploymentServer" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="10515" DataType="Dword"> <RegistryValueSelector ValueName="WdsTransportServer" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="10516" DataType="Dword"> <RegistryValueSelector ValueName="WdsMetadataServer" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> <RegistryQuery Hive="HKLM" Subkey="SYSTEM\CurrentControlSet\Services\WDSServer\Providers\WDSPXE\Providers\BINLSVC\AutoApprove"> <RegistryDatapoints> <RegistryDatapoint DataId="10519" DataType="Dword"> <RegistryValueSelector ValueName="Policy" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> <RegistryQuery Hive="HKLM" Subkey="SYSTEM\CurrentControlSet\Services\WDSServer\Providers\WDSPXE"> <RegistryDatapoints> <RegistryDatapoint DataId="10520" DataType="Dword"> <RegistryValueSelector ValueName="DisableRogueDetection" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="10523" DataType="Dword"> <RegistryValueSelector ValueName="UseDhcpPorts" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> <RegistryQuery Hive="HKLM" Subkey="SYSTEM\CurrentControlSet\Services\WDSServer\Providers\WDSTFTP"> <RegistryDatapoints> <RegistryDatapoint DataId="10522" DataType="Dword"> <RegistryValueSelector ValueName="EnableVariableWindowExtension" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> </Queries> </QueryGroup> </ExecutionGroup> <ExecutionGroup Id="2" TimeBeforeDataCollection="720" RetryFrequency="10" ExecutionTimeAfterDataCollection="720" RandomDelay="720" PerfConstraint="0"> <QueryGroup> <Applicability> <Global /> </Applicability> <Queries> <CustomQuery QueryId="17"> <Arguments> <Argument>\Server\Server Sessions;Dword;90000</Argument> <Argument>\Processor(_Total)\% Processor Time;Dword;90001</Argument> <Argument>\Memory\% Committed Bytes In Use;Dword;90002</Argument> <Argument>\Memory\Available MBytes;Qword;90007</Argument> <Argument>\Memory\Free System Page Table Entries;Dword;90008</Argument> <Argument>\Memory\Pages Input/sec;Dword;90009</Argument> <Argument>\Memory\Pages Output/sec;Dword;90010</Argument> <Argument>\Memory\Pool Paged Bytes;Qword;90011</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\TCPv4\Connections Established;Dword;90004</Argument> <Argument>\TCPv6\Connections Established;Dword;90005</Argument> <Argument>\Cache\Copy Read Hits %;Dword;90006</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4935" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4936" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4937" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4938" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4939" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4940" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4945" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4946" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4947" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90005" /> </MetricsDatapoint> <MetricsDatapoint DataId="4948" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90005" /> </MetricsDatapoint> <MetricsDatapoint DataId="5171" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90006" /> </MetricsDatapoint> <MetricsDatapoint DataId="5172" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90006" /> </MetricsDatapoint> <MetricsDatapoint DataId="4893" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90007" /> </MetricsDatapoint> <MetricsDatapoint DataId="5110" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90007" /> </MetricsDatapoint> <MetricsDatapoint DataId="5714" DataType="Qword"> <DataSelector SourceDataId="90007" /> </MetricsDatapoint> <MetricsDatapoint DataId="5065" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90008" /> </MetricsDatapoint> <MetricsDatapoint DataId="5492" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90008" /> </MetricsDatapoint> <MetricsDatapoint DataId="5495" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90009" /> </MetricsDatapoint> <MetricsDatapoint DataId="5496" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90009" /> </MetricsDatapoint> <MetricsDatapoint DataId="5497" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90010" /> </MetricsDatapoint> <MetricsDatapoint DataId="5498" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90010" /> </MetricsDatapoint> <MetricsDatapoint DataId="5499" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="90011" /> </MetricsDatapoint> <MetricsDatapoint DataId="5500" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="90011" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="140" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>100000</Argument> <Argument>w3svc</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\Web Service(_Total)\Service Uptime;Dword;100001</Argument> <Argument>\Web Service(_Total)\Total Get Requests;Dword;100002</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>100003</Argument> <Argument>100002</Argument> <Argument>100001</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4787" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="100000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4788" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="100002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4789" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="100002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4835" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="100003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4836" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="100003" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="10" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>110000</Argument> <Argument>ntds</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="10"> <Arguments> <Argument>110001</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\Security System-Wide Statistics\KDC TGS Requests;Dword;110003</Argument> <Argument>\DirectoryServices(NTDS)\DS Directory Reads/sec;Dword;110005</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>110006</Argument> <Argument>110003</Argument> <Argument>0</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4790" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="110001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4791" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="110000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4792" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="110003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4793" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="110003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4837" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="110006" /> </MetricsDatapoint> <MetricsDatapoint DataId="4838" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="110006" /> </MetricsDatapoint> <MetricsDatapoint DataId="4839" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="110005" /> </MetricsDatapoint> <MetricsDatapoint DataId="4840" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="110005" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="255" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>120000</Argument> <Argument>lanmanserver</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="8"> <Arguments> <Argument>120001</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4796" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="120000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4797" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="120001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4798" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="120001" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="102" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>130000</Argument> <Argument>dfsr</Argument> </Arguments> </CustomQuery> <WmiQuery Namespace="root\MicrosoftDfs" Query="SELECT ReplicationGroupGuid FROM DfsrReplicationGroupConfig"> <WmiAggregates> <WmiAggregate DataId="130004" Function="Count" DataFlags="1" /> </WmiAggregates> </WmiQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4799" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="130000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4899" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="130004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4900" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="130004" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="101" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>140000</Argument> <Argument>dfs</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="1"> <Arguments> <Argument>140001</Argument> <Argument>dfs</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="19"> <Arguments> <Argument>140004</Argument> <Argument>DFS Namespace Service Referrals</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\DFS Namespace Service Referrals(_Total)\Requests Processed;Qword;140002</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>140003</Argument> <Argument>140002</Argument> <Argument>140001</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4802" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="140000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4803" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="140002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4804" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="140002" /> </MetricsDatapoint> <MetricsDatapoint DataId="5713" DataType="Qword"> <DataSelector SourceDataId="140002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4843" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="140003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4844" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="140003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4897" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="140004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4898" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="140004" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="104" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>150000</Argument> <Argument>srmsvc</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="2"> <Arguments> <Argument>150001</Argument> <Argument>srmreports</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="4"> <Arguments> <Argument>150002</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="5"> <Arguments> <Argument>150003</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="6"> <Arguments> <Argument>150004</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4805" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="150000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4806" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="150001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4860" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="150002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4861" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="150002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4862" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="150003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4863" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="150003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4858" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="150004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4859" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="150004" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="431" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>160000</Argument> <Argument>nfsservice</Argument> </Arguments> </CustomQuery> <WmiQuery Namespace="root\Microsoft\Windows\NFS" Query="SELECT Path FROM MSFT_NfsShare"> <WmiAggregates> <WmiAggregate DataId="160001" DataFlags="1" Function="Count" /> </WmiAggregates> </WmiQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4807" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="160000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4808" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="160001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4809" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="160001" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="135" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>170000</Argument> <Argument>spooler</Argument> </Arguments> </CustomQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT DeviceId FROM Win32_Printer WHERE Shared=1"> <WmiAggregates> <WmiAggregate DataId="170001" Function="Count" DataFlags="1" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_PrinterDriver"> <WmiAggregates> <WmiAggregate DataId="170002" Function="Count" DataFlags="1" /> </WmiAggregates> </WmiQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4810" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="170000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4811" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="170001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4812" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="170001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4813" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="170002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4814" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="170002" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="13" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>180000</Argument> <Argument>dns</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="1"> <Arguments> <Argument>180001</Argument> <Argument>dns</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\DNS\Total Query Received;Dword;180002</Argument> <Argument>\DNS\Dynamic Update Received;Dword;180003</Argument> <Argument>\DNS\WINS Lookup Received;Dword;180004</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>180005</Argument> <Argument>180002</Argument> <Argument>180001</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>180006</Argument> <Argument>180003</Argument> <Argument>180001</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>180007</Argument> <Argument>180004</Argument> <Argument>180001</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4815" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="180000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4816" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="180002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4817" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="180002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4845" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="180005" /> </MetricsDatapoint> <MetricsDatapoint DataId="4846" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="180005" /> </MetricsDatapoint> <MetricsDatapoint DataId="4818" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="180003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4819" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="180003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4847" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="180006" /> </MetricsDatapoint> <MetricsDatapoint DataId="4848" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="180006" /> </MetricsDatapoint> <MetricsDatapoint DataId="4820" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="180004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4821" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="180004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4849" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="180007" /> </MetricsDatapoint> <MetricsDatapoint DataId="4850" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="180007" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="130" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>200000</Argument> <Argument>termservice</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\Terminal Services\Total Sessions;Dword;200001</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4825" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="200000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4826" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="200001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4827" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="200001" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="133" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>210000</Argument> <Argument>tssdis</Argument> </Arguments> </CustomQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT NumberOfSessions FROM Win32_SessionDirectoryServer"> <WmiAggregates> <WmiAggregate DataId="210001" Function="Sum" DataFlags="1"> <WmiPropertySelector PropertyName="NumberOfSessions" PropertyType="Dword" /> </WmiAggregate> </WmiAggregates> </WmiQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4828" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="210000" /> </MetricsDatapoint> <MetricsDatapoint DataId="5289" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="210001" /> </MetricsDatapoint> <MetricsDatapoint DataId="5290" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="210001" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="131" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>220000</Argument> <Argument>termservlicensing</Argument> </Arguments> </CustomQuery> <WmiQuery Namespace="root\cimv2" Query="SELECT TotalLicenses FROM Win32_TSLicenseKeyPack WHERE KeyPackType != 4 AND KeyPackType != 6"> <WmiAggregates> <WmiAggregate DataId="220001" Function="Sum" DataFlags="1"> <WmiPropertySelector PropertyName="TotalLicenses" PropertyType="Dword" /> </WmiAggregate> </WmiAggregates> </WmiQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4829" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="220000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4830" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="220001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4831" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="220001" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="132" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>230000</Argument> <Argument>tsgateway</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\Terminal Service Gateway\Current connections;Dword;230001</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4832" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="230000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4833" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="230001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4834" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="230001" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="322" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>280000</Argument> <Argument>vmhostagent</Argument> </Arguments> </CustomQuery> <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT VmName FROM Win32_TSVm"> <WmiAggregates> <WmiAggregate DataId="280001" Function="Count" DataFlags="1" /> </WmiAggregates> </WmiQuery> <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT VmName FROM Win32_TSVmMetadataItem where Name='Exclude' AND Value='1'"> <WmiAggregates> <WmiAggregate DataId="280002" Function="Count" DataFlags="1" /> </WmiAggregates> </WmiQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="5924" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="280000" /> </MetricsDatapoint> <MetricsDatapoint DataId="5885" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="280001" /> </MetricsDatapoint> <MetricsDatapoint DataId="5886" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="280002" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="12" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>240000</Argument> <Argument>dhcpserver</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="3"> <Arguments> <Argument>240001</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="9"> <Arguments> <Argument>240002</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4864" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="240000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4865" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="240001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4866" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="240001" /> </MetricsDatapoint> <MetricsDatapoint DataId="4867" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="240002" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="205" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>260000</Argument> <Argument>ias</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="1"> <Arguments> <Argument>260010</Argument> <Argument>ias</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="17"> <Arguments> <Argument>\NPS Authentication Server\Access-Accepts;Dword;260001</Argument> <Argument>\NPS Authentication Server\Access-Accepts / sec.;Dword;260002</Argument> <Argument>\NPS Authentication Server\Access-Requests;Dword;260003</Argument> <Argument>\NPS Authentication Server\Access-Requests / sec.;Dword;260004</Argument> <Argument>\NPS Authentication Server\Server Up Time;Dword;260005</Argument> <Argument>\NPS Accounting Server\Accounting-Requests;Dword;260006</Argument> <Argument>\NPS Accounting Server\Server Up Time;Dword;260007</Argument> <Argument>\NPS System Health Validators(Windows Security Health Validator)\Shv Compliances;Dword;260011</Argument> <Argument>\NPS System Health Validators(Windows Security Health Validator)\Shv NonCompliances;Dword;260012</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>260008</Argument> <Argument>260003</Argument> <Argument>260005</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>260009</Argument> <Argument>260006</Argument> <Argument>260007</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>260013</Argument> <Argument>260011</Argument> <Argument>260010</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>260014</Argument> <Argument>260012</Argument> <Argument>260010</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="4896" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260000" /> </MetricsDatapoint> <MetricsDatapoint DataId="4901" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4902" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260004" /> </MetricsDatapoint> <MetricsDatapoint DataId="4903" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4904" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260002" /> </MetricsDatapoint> <MetricsDatapoint DataId="4891" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4892" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260003" /> </MetricsDatapoint> <MetricsDatapoint DataId="4905" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260008" /> </MetricsDatapoint> <MetricsDatapoint DataId="4906" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260008" /> </MetricsDatapoint> <MetricsDatapoint DataId="4894" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260006" /> </MetricsDatapoint> <MetricsDatapoint DataId="4895" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260006" /> </MetricsDatapoint> <MetricsDatapoint DataId="4907" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260009" /> </MetricsDatapoint> <MetricsDatapoint DataId="4908" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260009" /> </MetricsDatapoint> <MetricsDatapoint DataId="6843" DataType="Dword"> <DataSelector SourceDataId="260011" /> </MetricsDatapoint> <MetricsDatapoint DataId="6841" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260011" /> </MetricsDatapoint> <MetricsDatapoint DataId="6842" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260011" /> </MetricsDatapoint> <MetricsDatapoint DataId="6846" DataType="Dword"> <DataSelector SourceDataId="260012" /> </MetricsDatapoint> <MetricsDatapoint DataId="6847" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260012" /> </MetricsDatapoint> <MetricsDatapoint DataId="6848" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260012" /> </MetricsDatapoint> <MetricsDatapoint DataId="6844" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260013" /> </MetricsDatapoint> <MetricsDatapoint DataId="6845" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260013" /> </MetricsDatapoint> <MetricsDatapoint DataId="6850" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="260014" /> </MetricsDatapoint> <MetricsDatapoint DataId="6849" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="260014" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="469" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="2"> <Arguments> <Argument>270000</Argument> <Argument>RemoteAccess</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="7"> <Arguments> <Argument>270001</Argument> <Argument>270002</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="5316" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="270000" /> </MetricsDatapoint> <MetricsDatapoint DataId="5322" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="270001" /> </MetricsDatapoint> <MetricsDatapoint DataId="5317" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="270002" /> </MetricsDatapoint> <MetricsDatapoint DataId="5318" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="270002" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="134" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <CustomQuery QueryId="17"> <Arguments> <Argument>\ASP.NET Applications(_LM_W3SVC_1_ROOT_RDWEB)\Requests Total;Dword;250002</Argument> </Arguments> </CustomQuery> <CustomQuery QueryId="13"> <Arguments> <Argument>250003</Argument> <Argument>250002</Argument> <Argument>0</Argument> </Arguments> </CustomQuery> </Queries> <Metrics> <MetricsDatapoints> <MetricsDatapoint DataId="6905" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="250002" /> </MetricsDatapoint> <MetricsDatapoint DataId="6906" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="250002" /> </MetricsDatapoint> <MetricsDatapoint DataId="6903" DataType="Dword" DataFunction="Max"> <DataSelector SourceDataId="250003" /> </MetricsDatapoint> <MetricsDatapoint DataId="6904" DataType="Dword" DataFunction="Average"> <DataSelector SourceDataId="250003" /> </MetricsDatapoint> </MetricsDatapoints> </Metrics> </QueryGroup> </ExecutionGroup> <ExecutionGroup Id="3" TimeBeforeDataCollection="10080" RetryFrequency="10" ExecutionTimeAfterDataCollection="10080" RandomDelay="60" PerfConstraint="0"> <QueryGroup MaxErrors="5"> <Applicability> <Global /> </Applicability> <Queries> <CustomQuery QueryId="21"> <Arguments> <Argument>30</Argument> </Arguments> </CustomQuery> <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement10" Query="SELECT ServiceName FROM SqlService WHERE SQLServiceType=1 AND ServiceName!='MSSQL$MICROSOFT##SSEE'" MaxRows="1"> <WmiStreams> <WmiStream DataId="1452" MaxStreamRows="1"> <WmiStreamColumns> <WmiStreamColumn DataType="Dword"> <WmiPropertySelector PropertyName="ServiceName" PropertyType="String"> <Transforms> <EnumTransform DefaultValue="1010"> <Enum Name="MSSQLSERVER" Value="1010" /> </EnumTransform> </Transforms> </WmiPropertySelector> </WmiStreamColumn> <WmiStreamColumn DataType="Dword"> <WmiPropertySelector PropertyName="ServiceName" PropertyType="String"> <Transforms> <EnumTransform DefaultValue="1"> <Enum Name="MSSQLSERVER" Value="1" /> </EnumTransform> </Transforms> </WmiPropertySelector> </WmiStreamColumn> </WmiStreamColumns> </WmiStream> </WmiStreams> </WmiQuery> <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement10" Query="SELECT ServiceName FROM SQLServiceAdvancedProperty WHERE SqlServiceType=1 AND PropertyName='SKUNAME' AND NOT PropertyStrValue LIKE 'Express Edition%' AND ServiceName!='MSSQL$MICROSOFT##SSEE'" MaxRows="1"> <WmiStreams> <WmiStream DataId="1452" MaxStreamRows="1"> <WmiStreamColumns> <WmiStreamColumn DataType="Dword"> <WmiPropertySelector PropertyName="ServiceName" PropertyType="String"> <Transforms> <EnumTransform DefaultValue="1011"> <Enum Name="MSSQLSERVER" Value="1011" /> </EnumTransform> </Transforms> </WmiPropertySelector> </WmiStreamColumn> <WmiStreamColumn DataType="Dword"> <WmiPropertySelector PropertyName="ServiceName" PropertyType="String"> <Transforms> <EnumTransform DefaultValue="1"> <Enum Name="MSSQLSERVER" Value="1" /> </EnumTransform> </Transforms> </WmiPropertySelector> </WmiStreamColumn> </WmiStreamColumns> </WmiStream> </WmiStreams> </WmiQuery> <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement10" Query="SELECT ServiceName FROM SQLServiceAdvancedProperty WHERE SqlServiceType=1 AND PropertyName='SKUNAME' AND PropertyStrValue LIKE 'Express Edition%'" MaxRows="1"> <WmiStreams> <WmiStream DataId="1452" MaxStreamRows="1"> <WmiStreamColumns> <WmiStreamColumn DataType="Dword"> <WmiPropertySelector PropertyName="ServiceName" PropertyType="String"> <Transforms> <EnumTransform DefaultValue="1012"> <Enum Name="MSSQL$SQLEXPRESS" Value="1012" /> </EnumTransform> </Transforms> </WmiPropertySelector> </WmiStreamColumn> <WmiStreamColumn DataType="Dword"> <WmiPropertySelector PropertyName="ServiceName" PropertyType="String"> <Transforms> <EnumTransform DefaultValue="1"> <Enum Name="MSSQL$SQLEXPRESS" Value="1" /> </EnumTransform> </Transforms> </WmiPropertySelector> </WmiStreamColumn> </WmiStreamColumns> </WmiStream> </WmiStreams> </WmiQuery> <RegistryQuery Hive="HKLM" Subkey="SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels"> <RegistryAggregates> <RegistryAggregate DataId="9637" Function="Exists" DataFunction="Common"> <RegistryValueSelector ValueName="ServerCore" ValueType="Dword" /> </RegistryAggregate> <RegistryAggregate DataId="9638" Function="Exists" DataFunction="Common"> <RegistryValueSelector ValueName="Server-Gui-Mgmt" ValueType="Dword" /> </RegistryAggregate> <RegistryAggregate DataId="9639" Function="Exists" DataFunction="Common"> <RegistryValueSelector ValueName="Server-Gui-Shell" ValueType="Dword" /> </RegistryAggregate> <RegistryAggregate DataId="9640" Function="Exists" DataFunction="Common"> <RegistryValueSelector ValueName="ServerCoreExtended" ValueType="Dword" /> </RegistryAggregate> </RegistryAggregates> <RegistryDatapoints> <RegistryDatapoint DataId="9637" DataType="Dword" DataFunction="Common"> <RegistryValueSelector ValueName="ServerCore" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="9638" DataType="Dword" DataFunction="Common"> <RegistryValueSelector ValueName="Server-Gui-Mgmt" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="9639" DataType="Dword" DataFunction="Common"> <RegistryValueSelector ValueName="Server-Gui-Shell" ValueType="Dword" /> </RegistryDatapoint> <RegistryDatapoint DataId="9640" DataType="Dword" DataFunction="Common"> <RegistryValueSelector ValueName="ServerCoreExtended" ValueType="Dword" /> </RegistryDatapoint> </RegistryDatapoints> </RegistryQuery> </Queries> </QueryGroup> <QueryGroup> <Applicability> <Expression JoinOperator="And"> <RoleTest RoleId="33" RequiredState="Installed" /> </Expression> </Applicability> <Queries> <EventQuery Channel="Microsoft-Windows-ClusterAwareUpdating/Admin" Query="*[System[(EventID=2011) and TimeCreated[timediff(@SystemTime) <= 604800000]]]"> <EventAggregates> <EventAggregate DataId="9616" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="Microsoft-Windows-ClusterAwareUpdating/Admin" Query="*[System[(EventID=2012) and TimeCreated[timediff(@SystemTime) <= 604800000]]]"> <EventAggregates> <EventAggregate DataId="9614" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="Microsoft-Windows-ClusterAwareUpdating/Admin" Query="*[System[(EventID=2005) and TimeCreated[timediff(@SystemTime) <= 604800000]]]"> <EventAggregates> <EventAggregate DataId="11012" Function="Count" /> </EventAggregates> </EventQuery> <EventQuery Channel="Microsoft-Windows-ClusterAwareUpdating/Admin" Query="*[System[(EventID=2006) and TimeCreated[timediff(@SystemTime) <= 604800000]]]"> <EventAggregates> <EventAggregate DataId="11013" Function="Count" /> </EventAggregates> </EventQuery> </Queries> </QueryGroup> </ExecutionGroup> </ExecutionGroups> </CeipAssistant>
Ms-Dos/Windows
Unix
Write backup
jsp File Browser version 1.2 by
www.vonloesch.de