MZ@ !L!This program cannot be run in DOS mode. $Rؕ3}3}3}H̴3}H̱3}Rich3}PEd&b"   `.rsrc@@( @Xp    pMUI<$0AACX)01P[8prH? 1 5 5 \7 8 t9 $:/=@J,zTO8 СO ($$<l$ dT 8 DP X d! !001 12 233 445566$77889 999899 9 90929P9W94@@ @ @0BBdPUndefined Access (no effect) Bit 7 ,Unused message ID DELETE $READ_CONTROL WRITE_DAC WRITE_OWNER SYNCHRONIZE (ACCESS_SYS_SEC MAX_ALLOWED HUnknown specific access (bit 0) HUnknown specific access (bit 1) HUnknown specific access (bit 2) HUnknown specific access (bit 3) HUnknown specific access (bit 4) HUnknown specific access (bit 5) HUnknown specific access (bit 6) HUnknown specific access (bit 7) HUnknown specific access (bit 8) HUnknown specific access (bit 9) LUnknown specific access (bit 10) LUnknown specific access (bit 11) LUnknown specific access (bit 12) LUnknown specific access (bit 13) LUnknown specific access (bit 14) LUnknown specific access (bit 15) Not used HAssign Primary Token Privilege 4Lock Memory Privilege HIncrease Memory Quota Privilege @Unsolicited Input Privilege HTrusted Computer Base Privilege 0Security Privilege <Take Ownership Privilege DLoad/Unload Driver Privilege <Profile System Privilege <Set System Time Privilege LProfile Single Process Privilege LIncrement Base Priority Privilege <Create Pagefile Privilege LCreate Permanent Object Privilege ,Backup Privilege DRestore From Backup Privilege <Shutdown System Privilege (Debug Privilege PView or Change Audit Log Privilege TChange Hardware Environment Privilege XChange Notify (and Traverse) Privilege PRemotely Shut System Down Privilege P<value changed, but not displayed> (<value not set> <never> Enabled Disabled All None TAudit Policy query/set API Operation <Value change auditing for this registry type is not supported> Granted by Denied by LDenied by Integrity Policy check 4Granted by Ownership Not granted 4Granted by NULL DACL 4Denied by Empty DACL PGranted by NULL Security Descriptor 4Unknown or unchecked @Not granted due to missing HGranted by ACE on parent folder HDenied by ACE on parent folder HGranted by Central Access Rule PNOT Granted by Central Access Rule hGranted by parent folder's Central Access Rule pNOT Granted by parent folder's Central Access Rule $Unknown Type String 8Unsigned 64-bit Integer (64-bit Integer FQBN Blob Sid Boolean True False Invalid @an ACE too long to display \a Security Descriptor too long to display DNot granted to AppContainers ... (Identification $Impersonation Delegation LDenied by Process Trust Label ACE REG_NONE REG_SZ $REG_EXPAND_SZ REG_BINARY REG_DWORD 4REG_DWORD_BIG_ENDIAN REG_LINK REG_MULTI_SZ (New lines are replaced with *. A * is replaced with **) ,REG_RESOURCE_LIST DREG_FULL_RESOURCE_DESCRIPTOR HREG_RESOURCE_REQUIREMENTS_LIST REG_QWORD @New registry value created LExisting registry value modified 8Registry value deleted Sunday Monday Tuesday Wednesday Thursday Friday Saturday DTokenElevationTypeDefault (1) @TokenElevationTypeFull (2) DTokenElevationTypeLimited (3) (Account Enabled T'Home Directory Required' - Disabled P'Password Not Required' - Disabled P'Temp Duplicate Account' - Disabled @'Normal Account' - Disabled H'MNS Logon Account' - Disabled X'Interdomain Trust Account' - Disabled X'Workstation Trust Account' - Disabled L'Server Trust Account' - Disabled P'Don't Expire Password' - Disabled ,Account Unlocked d'Encrypted Text Password Allowed' - Disabled H'Smartcard Required' - Disabled P'Trusted For Delegation' - Disabled @'Not Delegated' - Disabled D'Use DES Key Only' - Disabled P'Don't Require Preauth' - Disabled D'Password Expired' - Disabled p'Trusted To Authenticate For Delegation' - Disabled h'Exclude Authorization Information' - Disabled l'Undefined UserAccountControl Bit 20' - Disabled 'Protect Kerberos Service Tickets with AES Keys' - Disabled l'Undefined UserAccountControl Bit 22' - Disabled l'Undefined UserAccountControl Bit 23' - Disabled l'Undefined UserAccountControl Bit 24' - Disabled l'Undefined UserAccountControl Bit 25' - Disabled l'Undefined UserAccountControl Bit 26' - Disabled l'Undefined UserAccountControl Bit 27' - Disabled l'Undefined UserAccountControl Bit 28' - Disabled l'Undefined UserAccountControl Bit 29' - Disabled l'Undefined UserAccountControl Bit 30' - Disabled l'Undefined UserAccountControl Bit 31' - Disabled ,Account Disabled P'Home Directory Required' - Enabled L'Password Not Required' - Enabled P'Temp Duplicate Account' - Enabled @'Normal Account' - Enabled D'MNS Logon Account' - Enabled T'Interdomain Trust Account' - Enabled T'Workstation Trust Account' - Enabled L'Server Trust Account' - Enabled L'Don't Expire Password' - Enabled (Account Locked `'Encrypted Text Password Allowed' - Enabled H'Smartcard Required' - Enabled P'Trusted For Delegation' - Enabled <'Not Delegated' - Enabled D'Use DES Key Only' - Enabled L'Don't Require Preauth' - Enabled D'Password Expired' - Enabled p'Trusted To Authenticate For Delegation' - Enabled d'Exclude Authorization Information' - Enabled h'Undefined UserAccountControl Bit 20' - Enabled 'Protect Kerberos Service Tickets with AES Keys' - Enabled h'Undefined UserAccountControl Bit 22' - Enabled h'Undefined UserAccountControl Bit 23' - Enabled h'Undefined UserAccountControl Bit 24' - Enabled h'Undefined UserAccountControl Bit 25' - Enabled h'Undefined UserAccountControl Bit 26' - Enabled h'Undefined UserAccountControl Bit 27' - Enabled h'Undefined UserAccountControl Bit 28' - Enabled h'Undefined UserAccountControl Bit 29' - Enabled h'Undefined UserAccountControl Bit 30' - Enabled h'Undefined UserAccountControl Bit 31' - Enabled HAn Error occured during Logon. XThe specified user account has expired. TThe NetLogon component is not active. 0Account locked out. The user has not been granted the requested logon type at this machine. dThe specified account's password has expired. @Account currently disabled. \Account logon time restriction violation. `User not allowed to logon at this computer. PUnknown user name or bad password. <Domain sid inconsistent. dSmartcard logon is required and was not used. (Not Available. LRandom number generator failure. |Random number generation failed FIPS-140 pre-hash check. @Failed to zero secret data. XKey failed pair wise consistency check. lFailed to unprotect persistent cryptographic key. <Key export checks failed. LValidation of public key failed. HSignature verification failed. (Open key file. ,Delete key file. DRead persisted key from file. DWrite persisted key to file. XExport of persistent cryptographic key. XImport of persistent cryptographic key. Open Key. Create Key. Delete Key. Encrypt. Decrypt. Sign hash. ,Secret agreement. (Domain settings (Local settings $Add provider. ,Remove provider. $Add context. (Remove context. $Add function. ,Remove function. 8Add function provider. <Remove function provider. 8Add function property. <Remove function property. $Machine key. User key. (Key Derivation. 0Device Access Bit 0 0Device Access Bit 1 0Device Access Bit 2 0Device Access Bit 3 0Device Access Bit 4 0Device Access Bit 5 0Device Access Bit 6 0Device Access Bit 7 0Device Access Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 (Query directory Traverse @Create object in directory 4Create sub-directory PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 ,Query event state 0Modify event state PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 @ReadData (or ListDirectory) 8WriteData (or AddFile) tAppendData (or AddSubdirectory or CreatePipeInstance) ReadEA WriteEA ,Execute/Traverse DeleteChild (ReadAttributes (WriteAttributes PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 (Query key value $Set key value (Create sub-key 0Enumerate sub-keys DNotify about changes to keys Create Link PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 pEnable 64(or 32) bit application to open 64 bit key pEnable 64(or 32) bit application to open 32 bit key PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 0Query mutant state PUndefined Access (no effect) Bit 1 PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 8Communicate using port PUndefined Access (no effect) Bit 1 PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 <Force process termination DCreate new thread in process 8Set process session ID LPerform virtual memory operation <Read from process memory 8Write to process memory XDuplicate handle into or out of process HCreate a subprocess of process 0Set process quotas 8Set process information <Query process information DSet process termination port PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 (Control profile PUndefined Access (no effect) Bit 1 PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 0Query section state 4Map section for write 4Map section for read 8Map section for execute Extend size PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 4Query semaphore state 8Modify semaphore state PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 ,Use symbolic link PUndefined Access (no effect) Bit 1 PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 <Force thread termination <Suspend or resume thread 8Send an alert to thread 0Get thread context 0Set thread context 8Set thread information <Query thread information DAssign a token to the thread pCause thread to directly impersonate another thread LDirectly impersonate this thread PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 ,Query timer state 0Modify timer state PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 (AssignAsPrimary Duplicate Impersonate Query QuerySource ,AdjustPrivileges $AdjustGroups ,AdjustDefaultDacl (AdjustSessionID PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 HCreate instance of object type PUndefined Access (no effect) Bit 1 PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 Query State $Modify State 4Channel read message 4Channel write message <Channel query information 8Channel set information PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 (Assign process (Set Attributes ,Query Attributes $Terminate Job 8Set Security Attributes PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 (ConnectToServer (ShutdownServer ,InitializeServer $CreateDomain ,EnumerateDomains $LookupDomain PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 8ReadPasswordParameters 8WritePasswordParameters 0ReadOtherParameters 4WriteOtherParameters CreateUser ,CreateGlobalGroup ,CreateLocalGroup 8GetLocalGroupMembership $ListAccounts LookupIDs ,AdministerServer PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 (ReadInformation $WriteAccount AddMember $RemoveMember ListMembers PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 AddMember $RemoveMember ListMembers (ReadInformation $WriteAccount PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 8ReadGeneralInformation (ReadPreferences ,WritePreferences ReadLogon ReadAccount $WriteAccount hChangePassword (with knowledge of old password) hSetPassword (without knowledge of old password) ListGroups 0ReadGroupMembership 4ChangeGroupMembership PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 TView non-sensitive policy information HView system audit requirements LGet sensitive policy information LModify domain trust relationships xCreate special accounts (for assignment of user rights) 8Create a secret object 0Create a privilege <Set default quota limits LChange system audit requirements HAdminister audit log attributes 0Enable/Disable LSA ,Lookup Names/SIDs 0Change secret value 0Query secret value PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 DQuery trusted domain name/SID hRetrieve the controllers in the trusted domain dChange the controllers in the trusted domain |Query the Posix ID offset assigned to the trusted domain |Change the Posix ID offset assigned to the trusted domain PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 <Query account information TChange privileges assigned to account LChange quotas assigned to account dChange logon capabilities assigned to account Change the Posix ID offset assigned to the accounted domain PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 (KeyedEvent Wait (KeyedEvent Wake PUndefined Access (no effect) Bit 2 PUndefined Access (no effect) Bit 3 PUndefined Access (no effect) Bit 4 PUndefined Access (no effect) Bit 5 PUndefined Access (no effect) Bit 6 PUndefined Access (no effect) Bit 7 PUndefined Access (no effect) Bit 8 PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 0Enumerate desktops (Read attributes ,Access Clipboard (Create desktop ,Write attributes 0Access global atoms $Exit windows 0Unused Access Flag `Include this windowstation in enumerations Read screen $Read Objects $Create window Create menu $Hook control ,Journal (record) 0Journal (playback) TInclude this desktop in enumerations $Write objects 8Switch to this desktop 8Administer print server 0Enumerate printers $Full Control Print 0Administer Document DConnect to service controller 4Create a new service 0Enumerate services `Lock service database for exclusive access LQuery service database lock state dSet last-known-good state of service database XQuery service configuration information TSet service configuration information 8Query status of service LEnumerate dependencies of service ,Start the service ,Stop the service DPause or continue the service HQuery information from service XIssue service-specific control commands (DDE Share Read (DDE Share Write <DDE Share Initiate Static 8DDE Share Initiate Link ,DDE Share Request ,DDE Share Advise (DDE Share Poke ,DDE Share Execute 0DDE Share Add Items 4DDE Share List Items $Create Child $Delete Child $List Contents Write Self $Read Property (Write Property Delete Tree List Object (Control Access PUndefined Access (no effect) Bit 9 PUndefined Access (no effect) Bit 10 PUndefined Access (no effect) Bit 11 PUndefined Access (no effect) Bit 12 PUndefined Access (no effect) Bit 13 PUndefined Access (no effect) Bit 14 PUndefined Access (no effect) Bit 15 8Audit Set System Policy <Audit Query System Policy <Audit Set Per User Policy @Audit Query Per User Policy 4Audit Enumerate Users ,Audit Set Options 0Audit Query Options 0Port sharing (read) 4Port sharing (write) 0Default credentials 0Credentials manager ,Fresh credentials Kerberos $Preshared key 8Unknown authentication DES 3DES MD5 SHA1 (Local computer (Remote computer No state 8Sent first (SA) payload <Sent second (KE) payload 8Sent third (ID) payload Initiator Responder No state 8Sent first (SA) payload 0Sent final payload Complete Unknown Transport Tunnel XIKE/AuthIP DoS prevention mode started XIKE/AuthIP DoS prevention mode stopped Enabled Not enabled No state PSent first (EM attributes) payload @Sent second (SSPI) payload <Sent third (hash) payload IKEv1 AuthIP Anonymous NTLM V2 CGA Certificate SSL None DH group 1 DH group 2 DH group 14 ,DH group ECP 256 ,DH group ECP 384 AES-128 AES-192 AES-256 8Certificate ECDSA P256 8Certificate ECDSA P384 (SSL ECDSA P256 (SSL ECDSA P384 SHA 256 SHA 384 IKEv2 ,EAP payload sent @Authentication payload sent EAP DH group 24 System $Logon/Logoff $Object Access $Privilege Use ,Detailed Tracking $Policy Change 0Account Management DS Access $Account Logon (Success removed $Success Added (Failure removed $Failure added 8Success include removed 4Success include added 8Success exclude removed 4Success exclude added 8Failure include removed 4Failure include added 8Failure exclude removed 4Failure exclude added 4Security State Change <Security System Extension ,System Integrity $IPsec Driver 0Other System Events Logon Logoff (Account Lockout (IPsec Main Mode $Special Logon ,IPsec Quick Mode 0IPsec Extended Mode <Other Logon/Logoff Events 4Network Policy Server 4User / Device Claims File System Registry $Kernel Object SAM @Other Object Access Events 8Certification Services 4Application Generated 0Handle Manipulation File Share HFiltering Platform Packet Drop DFiltering Platform Connection 0Detailed File Share ,Removable Storage 8Central Policy Staging 8Sensitive Privilege Use @Non Sensitive Privilege Use @Other Privilege Use Events ,Process Creation 0Process Termination (DPAPI Activity RPC Events 4Plug and Play Events 0Audit Policy Change DAuthentication Policy Change @Authorization Policy Change HMPSSVC Rule-Level Policy Change LFiltering Platform Policy Change @Other Policy Change Events 8User Account Management @Computer Account Management <Security Group Management DDistribution Group Management DApplication Group Management HOther Account Management Events <Directory Service Access <Directory Service Changes DDirectory Service Replication XDetailed Directory Service Replication 4Credential Validation PKerberos Service Ticket Operations @Other Account Logon Events HKerberos Authentication Service Inbound Outbound Forward $Bidirectional IP Packet Transport Forward Stream $Datagram Data ICMP Error MAC 802.3 MAC Native vSwitch 0Resource Assignment Listen (Receive/Accept Connect ,Flow Established ,Resource Release ,Endpoint Closure ,Connect Redirect $Bind Redirect $Stream Packet ,ICMP Echo-Request (vSwitch Ingress (vSwitch Egress <Binary> [NULL] Value Added $Value Deleted LActive Directory Domain Services hActive Directory Lightweight Directory Services Yes No Add Delete Boot-time Persistent (Not persistent Block Permit Callout MD5 SHA-1 SHA-256 AES-GCM 128 AES-GCM 192 AES-GCM 256 DES 3DES AES-128 AES-192 AES-256 Transport Tunnel Responder Initiator $AES-GMAC 128 $AES-GMAC 192 $AES-GMAC 256 4AuthNoEncap Transport 0Enable WMI Account (Execute Method Full Write $Partial Write (Provider Write $Remote Access Subscribe Publish 4VS_VERSION_INFO%P%%P%?StringFileInfo040904B0LCompanyNameMicrosoft Corporation\FileDescriptionSystem object audit names1FileVersion6.3.9600.20517 (winblue_ltsb_escrow.220725-1737)6 InternalNamemsobjs.dll.LegalCopyright Microsoft Corporation. All rights reserved.> OriginalFilenamemsobjs.dllj%ProductNameMicrosoft Windows Operating SystemBProductVersion6.3.9600.20517DVarFileInfo$Translation |YՃ ycG7HIb MUI MUI en-US