D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;LS)(A;;FR;;;BU)
$(@%SystemRoot%\system32\RacEngn.dll,-501)
$(@%SystemRoot%\system32\RacEngn.dll,-501)
$(@%SystemRoot%\system32\RacEngn.dll,-502)
Microsoft\Windows\RAC\RacTask
true
<QueryList><Query Id="0" Path="Application"><Select Path="Application">*[System[Provider[@Name='Microsoft-Windows-CEIP'] and EventID=1007]]</Select></Query></QueryList>
P1D
false
2008-03-31T00:00:00Z
true
PT15M
true
PT15M
false
false
true
IgnoreNew
false
false
true
true
false
false
false
true
PT0S
S-1-5-19
LeastPrivilege
{42060D27-CA53-41f5-96E4-B1E8169308A6}
$(Arg0)