Score

100%
Adjusted Score:100%
Original Score:100%
Compliance Status:BLUE

Pass:5Not Applicable:0
Fail:0Not Checked:0
Error:0Not Selected:0
Unknown:0Informational:0
Fixed:0Total:5
BLUE:Score equals 100
GREEN:Score is greater than or equal to 90
YELLOW:Score is greater than or equal to 80
RED:Score is greater than or equal to 0

System Information

Target Hostname:IP-AC100216
Operating System:Windows Server 2016 Datacenter
OS Version:1607
Domain: 
FQDN:IP-AC100216.
Processor:Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz
Processor Architecture:Intel64 Family 6 Model 63 Stepping 2
Processor Speed:2399 mhz
Physical Memory:1024 mb
Manufacturer:Xen
Model:HVM domU
Serial Number:ec2326ac-520a-95f4-41de-2b0c5dc41b44
BIOS Version:4.2.amazon
Interfaces:
  • [00000001] AWS PV Network Device
    • IP Addresses
      • 172.16.2.22
    • MAC Address: 16:5E:4E:98:57:A3

Content Information

Stream:MS_Dot_Net_Framework
Profile:
Id:MAC-1_Classified
Digital Signature Status:NOT DIGITALLY SIGNED
Stream Installation Date:2021-02-26
Status:accepted (2020-12-11)
Title:Microsoft DotNet Framework 4.0 Security Technical Implementation Guide
Description:This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Notice: 
Target Platforms:
  • cpe:/a:microsoft:.net_framework:4.0
Reference:
Href:https://cyber.mil
Publisher:DISA
Source:STIG.DOD.MIL
Stream Version:002.001
Start Time:2021-02-26T19:29:20
End Time:2021-02-26T19:31:06
Scanner:cpe:/a:spawar:scc:5.3.1
Identity:IP-AC100216\ec2-user
Identity Privileged:true
Identity Authenticated:true
Release Info:Release: 2.1 Benchmark Date: 22 Jan 2021

Results

Detailed Results

Digital signatures assigned to strongly named assemblies must be verified.

Rule ID:xccdf_mil.disa.stig_rule_SV-225223r615940_rule
Result:Pass
Version:APPNET0031
Identities:SV-7438
V-7055
CCI-000185 (NIST SP 800-53: IA-5 (2); NIST SP 800-53A: IA-5 (2).1; NIST SP 800-53 Rev 4: IA-5 (2) (a))
Description: A strong name consists of the assembly's identity, simple text name, version number, and culture information (if provided)—plus a public key and a digital signature. Strong names serve to identify the author of the code. If digital signatures used to sign strong name assemblies are not verified, any self signed code can be impersonated. This can lead to a loss of system integrity. false
Fix Text:Use regedit to remove the values stored in Windows registry key HKLM\Software\Microsoft\StrongName\Verification. There should be no assemblies or hash values listed under this registry key.

All assemblies must require strong name verification in a production environment.

Strong name assemblies that do not require verification in a development or test environment must have documented approvals from the IAO.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target Microsoft DotNet Framework 4-0
Publisher:DISA
Type:DPMS Target
Subject:Microsoft DotNet Framework 4-0
Identifier:4213
Definitions:
Definition ID:oval:mil.disa.fso.dotnet:def:2
Result:true
Title:APPNET0031 No Strong Name Verification
Description:Digital signatures assigned to strongly named assemblies must be verified.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.dotnet:tst:200 (registry_test)
Result:true
Title:No assemblies or hash values under HKLM\Software\Microsoft\StrongName\Verification
Check Existence:No collected items may exist.
Check:Result is based on check existence only.
Object ID:oval:mil.disa.fso.dotnet:obj:200 (registry_object)
Object Requirements:
  • behavior requirements:
    • recurse_direction = down
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'SOFTWARE\Microsoft\StrongName\Verification'
  • name must match the pattern '.*'

The Trust Providers Software Publishing State must be set to 0x23C00.

Rule ID:xccdf_mil.disa.stig_rule_SV-225224r615940_rule
Result:Pass
Version:APPNET0046
Identities:SV-7444
V-7061
CCI-000185 (NIST SP 800-53: IA-5 (2); NIST SP 800-53A: IA-5 (2).1; NIST SP 800-53 Rev 4: IA-5 (2) (a))
Description: Microsoft Windows operating systems provide a feature called Authenticode. Authenticode technology and its underlying code signing mechanisms serve to provide a structure to identify software publishers and ensure that software applications have not been tampered with. Authenticode technology relies on digital certificates and is based on Public Key Cryptography Standards (PKCS) #7 (encrypted key specification), PKCS #10 (certificate request formats), X.509 (certificate specification), and Secure Hash Algorithm (SHA) and MD5 hash algorithms.

The manner in which the Authenticode technology validates a certificate and determines what is considered a valid certificate can be modified to meet the mission of the Microsoft Windows system. Each facade of certificate validation is controlled through the bits that makeup the hexadecimal value for the Authenticode setting. An improper setting will allow non-valid certificates to be accepted and can put the integrity of the system into jeopardy.

The hexadecimal value of 0x23C00 will implement the following certificate enforcement policy:
- Trust the Test Root = FALSE
- Use expiration date on certificates = TRUE
- Check the revocation list = TRUE
- Offline revocation server OK (Individual) = TRUE
- Offline revocation server OK (Commercial) = TRUE
- Java offline revocation server OK (Individual) = TRUE
- Java offline revocation server OK (Commercial) = TRUE
- Invalidate version 1 signed objects = FALSE
- Check the revocation list on Time Stamp Signer = FALSE
- Only trust items found in the Trust DB = FALSE false
Fix Text:This fix must be performed for each user on the system.

Using regedit, change the hexadecimal value of the "HKEY_USER\[UNIQUE USER SID VALUE]\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State" registry key to 0x23C00.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target Microsoft DotNet Framework 4-0
Publisher:DISA
Type:DPMS Target
Subject:Microsoft DotNet Framework 4-0
Identifier:4213
Definitions:
Definition ID:oval:mil.disa.fso.dotnet:def:15
Result:true
Title:APPNET0046 The Trust Providers Software Publishing State must be set to 0x23c00
Description:The Trust Providers Software Publishing State must be set to 0x23c00 (SCC-only check)
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.dotnet:tst:1500 (registry_test)
Result:true
Title:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State == 0x23c00
Check Existence:Zero or more collected items may exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.dotnet:obj:300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_CURRENT_USER'
  • key must be equal to 'Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing'
  • name must be equal to 'State'
State ID:oval:mil.disa.fso.dotnet:ste:1500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '146432'
Collected Item Properties:
  • Message - 'Logon Name: ec2-user, Last Logon: Currently Logged On, Profile Directory: C:\Users\ec2-user'
  • hive equals 'HKEY_CURRENT_USER'
  • key equals 'Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing'
  • name equals 'State'
  • last_write_time equals '132588261900000000'
  • type equals 'reg_dword'
  • value equals '146432'
  • windows_view equals '64_bit'

The .NET CLR must be configured to use FIPS approved encryption modules.

Rule ID:xccdf_mil.disa.stig_rule_SV-225230r615940_rule
Result:Pass
Version:APPNET0062
Identities:SV-40966
V-30926
CCI-002450 (NIST SP 800-53 Rev 4: SC-13)
Description: FIPS encryption is configured via .NET configuration files. There are numerous configuration files that affect different aspects of .Net behavior. The .NET config files are described below.

Machine Configuration Files:
The machine configuration file, Machine.config, contains settings that apply to an entire computer. This file is located in the %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config directory for 32 bit .NET 4 installations and %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config for 64 bit systems. Machine.config contains configuration settings for machine-wide assembly binding, built-in remoting channels, and ASP.NET.

Application Configuration Files:
Application configuration files contain settings specific to an application. If checking these files, a .NET review of a specific .NET application is most likely being conducted. These files contain configuration settings that the Common Language Runtime reads (such as assembly binding policy, remoting objects, and so on), and settings that the application can read.

The name and location of the application configuration file depends on the application's host, which can be one of the following:

Executable–hosted application configuration files.

The configuration file for an application hosted by the executable host is in the same directory as the application. The name of the configuration file is the name of the application with a .config extension. For example, an application called myApp.exe can be associated with a configuration file called myApp.exe.config.

Internet Explorer-hosted application configuration files.

If an application hosted in Internet Explorer has a configuration file, the location of this file is specified in a tag with the following syntax.



In this tag, "location" represents a URL that point to the configuration file. This sets the application base. The configuration file must be located on the same web site as the application.

.NET 4.0 allows the CLR runtime to be configured to ignore FIPS encryption requirements. If the CLR is not configured to use FIPS encryption modules, insecure encryption modules might be employed which could introduce an application confidentiality or integrity issue. false
Fix Text:Examine the .NET CLR configuration files to find the runtime element and then the "enforceFIPSPolicy" element.

Example:






Delete the "enforceFIPSPolicy" runtime element, change the setting to "true" or there must be documented IAO approvals for the FIPS setting.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target Microsoft DotNet Framework 4-0
Publisher:DISA
Type:DPMS Target
Subject:Microsoft DotNet Framework 4-0
Identifier:4213
Definitions:
Definition ID:oval:mil.disa.fso.dotnet:def:9
Result:true
Title:APPNET0062
Description:The .NET CLR must be configured to use FIPS approved encryption modules.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.dotnet:tst:900 (xmlfilecontent_test)
Result:true
Title:Application configiguration files are configured to use FIPS approved encryption modules
Check Existence:Zero or more collected items may exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.dotnet:obj:900 (xmlfilecontent_object)
Object Requirements:
  • for filepath, at least one of the following must be true:
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\applaunch.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\caspol.exe.config'
    • filepath must be equal to 'C:\Program Files\Amazon\SSM\Plugins\awsCloudWatch\AWS.CloudWatch.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe.config'
    • filepath must be equal to 'C:\Windows\System32\AppVStreamingUX.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\caspol.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_regsql.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe.config'
    • filepath must be equal to 'C:\ProgramData\Amazon\EC2-Windows\Launch\Settings\Ec2LaunchSettings.exe.config'
    • filepath must be equal to 'C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe.config'
    • filepath must be equal to 'C:\Program Files\Amazon\SSM\Plugins\awsDomainJoin\AWS.DomainJoin.exe.config'
    • filepath must be equal to 'C:\Windows\System32\UevAppMonitor.exe.config'
    • filepath must be equal to 'C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe.config'
    • filepath must be equal to 'C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe.config'
    • filepath must be equal to 'C:\Windows\DfsrAdmin.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config'
    • filepath must be equal to 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Aspnet_regsql.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe.config'
    • filepath must be equal to 'C:\Program Files\Amazon\XenTools\Installer.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe.config'
  • xpath must be equal to 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
State ID:oval:mil.disa.fso.dotnet:ste:900 (xmlfilecontent_state)
State Requirements:
  • all value_of must be equal to 'true'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v1.0.3705'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'jsc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.0\WPF'
  • filename equals 'PresentationFontCache.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'AddInProcess32.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.config'
  • path equals 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0'
  • filename equals 'powershell_ise.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'ilasm.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\applaunch.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'applaunch.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'regasm.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'ieexec.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'EdmGen.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'ilasm.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\caspol.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'caspol.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Program Files\Amazon\SSM\Plugins\awsCloudWatch\AWS.CloudWatch.exe.config'
  • path equals 'C:\Program Files\Amazon\SSM\Plugins\awsCloudWatch'
  • filename equals 'AWS.CloudWatch.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'dfsvc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'ilasm.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'jsc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'DataSvcUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\System32\AppVStreamingUX.exe.config'
  • path equals 'C:\Windows\System32'
  • filename equals 'AppVStreamingUX.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v1.1.4322'
  • filename equals 'gacutil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'EdmGen.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'AddInUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'cvtres.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'regasm.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'caspol.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'SMSvcHost.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'Microsoft.Workflow.Compiler.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'AddInProcess32.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'AddInProcess.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'AddInProcess32.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'caspol.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\caspol.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'caspol.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'AddInUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'SMSvcHost.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'jsc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'cvtres.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'regasm.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'DataSvcUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'AddInProcess32.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_regsql.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'Aspnet_regsql.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'ilasm.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'ieexec.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\ProgramData\Amazon\EC2-Windows\Launch\Settings\Ec2LaunchSettings.exe.config'
  • path equals 'C:\ProgramData\Amazon\EC2-Windows\Launch\Settings'
  • filename equals 'Ec2LaunchSettings.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config'
  • path equals 'C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35'
  • filename equals 'PresentationFontCache.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'AddInProcess.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'DataSvcUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v1.1.4322'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'DataSvcUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Program Files\Amazon\SSM\Plugins\awsDomainJoin\AWS.DomainJoin.exe.config'
  • path equals 'C:\Program Files\Amazon\SSM\Plugins\awsDomainJoin'
  • filename equals 'AWS.DomainJoin.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\System32\UevAppMonitor.exe.config'
  • path equals 'C:\Windows\System32'
  • filename equals 'UevAppMonitor.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
  • path equals 'C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config'
  • path equals 'C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35'
  • filename equals 'PresentationFontCache.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation'
  • filename equals 'SMSvcHost.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'dfsvc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\DfsrAdmin.exe.config'
  • path equals 'C:\Windows'
  • filename equals 'DfsrAdmin.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v1.0.3705'
  • filename equals 'installutil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe.config'
  • path equals 'C:\Windows\System32\WindowsPowerShell\v1.0'
  • filename equals 'powershell_ise.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation'
  • filename equals 'SMSvcHost.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'InstallUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF'
  • filename equals 'PresentationFontCache.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'AddInUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
  • path equals 'C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'applaunch.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'AddInUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'regasm.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Aspnet_regsql.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'Aspnet_regsql.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'jsc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Program Files\Amazon\XenTools\Installer.exe.config'
  • path equals 'C:\Program Files\Amazon\XenTools'
  • filename equals 'Installer.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'InstallUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a'
  • filename equals 'dfsvc.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'AddInProcess.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'Microsoft.Workflow.Compiler.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'AddInProcess.exe.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.dotnet:tst:901 (xmlfilecontent_test)
Result:true
Title:Machine configiguration files are configured to use FIPS approved encryption modules
Check Existence:Zero or more collected items may exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.dotnet:obj:901 (xmlfilecontent_object)
Object Requirements:
  • behavior requirements:
    • recurse_direction = down
  • for path, at least one of the following must be true:
    • path must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config'
    • path must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config'
  • filename must be equal (case insensitive) to 'machine.config'
  • xpath must be equal to 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
State ID:oval:mil.disa.fso.dotnet:ste:900 (xmlfilecontent_state)
State Requirements:
  • all value_of must be equal to 'true'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config'
  • filename equals 'machine.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config'
  • filename equals 'machine.config'
  • xpath equals 'count(/configuration/runtime/enforceFIPSPolicy/@enabled) = 0 or /configuration/runtime/enforceFIPSPolicy/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'

Event tracing for Windows (ETW) for Common Language Runtime events must be enabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-225235r615940_rule
Result:Pass
Version:APPNET0067
Identities:SV-41075
V-31026
CCI-000130 (NIST SP 800-53: AU-3; NIST SP 800-53A: AU-3.1; NIST SP 800-53 Rev 4: AU-3)
Description: Event tracing captures information about applications utilizing the .NET CLR and the .NET CLR itself. This includes security oriented information, such as Strong Name and Authenticode verification.

Beginning with Windows Vista, ETW is enabled by default however, the .Net CLR and .Net applications can be configured to not utilize Event Tracing. If ETW event tracing is disabled, critical events that occurred within the runtime will not be captured in event logs. false
Fix Text:Open Windows explorer and search for all .NET config files including application config files (*.exe.config).

Examine the configuration settings for
.

Enable ETW Tracing by setting the etwEnable flag to "true" or obtain documented IAO approvals.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target Microsoft DotNet Framework 4-0
Publisher:DISA
Type:DPMS Target
Subject:Microsoft DotNet Framework 4-0
Identifier:4213
Definitions:
Definition ID:oval:mil.disa.fso.dotnet:def:12
Result:true
Title:APPNET0067
Description:Event tracing for Windows (ETW) for Common Language Runtime events must be enabled.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.dotnet:tst:1200 (xmlfilecontent_test)
Result:true
Title:Event tracing for Windows (ETW) for Common Language Runtime events is enabled for application configiguration files
Check Existence:Zero or more collected items may exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.dotnet:obj:1200 (xmlfilecontent_object)
Object Requirements:
  • for filepath, at least one of the following must be true:
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\applaunch.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\caspol.exe.config'
    • filepath must be equal to 'C:\Program Files\Amazon\SSM\Plugins\awsCloudWatch\AWS.CloudWatch.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe.config'
    • filepath must be equal to 'C:\Windows\System32\AppVStreamingUX.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\caspol.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_regsql.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe.config'
    • filepath must be equal to 'C:\ProgramData\Amazon\EC2-Windows\Launch\Settings\Ec2LaunchSettings.exe.config'
    • filepath must be equal to 'C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe.config'
    • filepath must be equal to 'C:\Program Files\Amazon\SSM\Plugins\awsDomainJoin\AWS.DomainJoin.exe.config'
    • filepath must be equal to 'C:\Windows\System32\UevAppMonitor.exe.config'
    • filepath must be equal to 'C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe.config'
    • filepath must be equal to 'C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe.config'
    • filepath must be equal to 'C:\Windows\DfsrAdmin.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config'
    • filepath must be equal to 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Aspnet_regsql.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe.config'
    • filepath must be equal to 'C:\Program Files\Amazon\XenTools\Installer.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe.config'
    • filepath must be equal to 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe.config'
  • xpath must be equal to 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
State ID:oval:mil.disa.fso.dotnet:ste:1200 (xmlfilecontent_state)
State Requirements:
  • all value_of must be equal to 'true'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v1.0.3705'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'jsc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.0\WPF'
  • filename equals 'PresentationFontCache.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'AddInProcess32.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.config'
  • path equals 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0'
  • filename equals 'powershell_ise.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'ilasm.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\applaunch.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'applaunch.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'regasm.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'ieexec.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'EdmGen.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'ilasm.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\caspol.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'caspol.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Program Files\Amazon\SSM\Plugins\awsCloudWatch\AWS.CloudWatch.exe.config'
  • path equals 'C:\Program Files\Amazon\SSM\Plugins\awsCloudWatch'
  • filename equals 'AWS.CloudWatch.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'dfsvc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'ilasm.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'jsc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'DataSvcUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\System32\AppVStreamingUX.exe.config'
  • path equals 'C:\Windows\System32'
  • filename equals 'AppVStreamingUX.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v1.1.4322'
  • filename equals 'gacutil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'EdmGen.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'AddInUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'cvtres.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'regasm.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'caspol.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'SMSvcHost.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'Microsoft.Workflow.Compiler.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'AddInProcess32.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'AddInProcess.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'AddInProcess32.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'caspol.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\caspol.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'caspol.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'AddInUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'SMSvcHost.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'jsc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'cvtres.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'regasm.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'DataSvcUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'AddInProcess32.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_regsql.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'Aspnet_regsql.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'ilasm.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'ieexec.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\ProgramData\Amazon\EC2-Windows\Launch\Settings\Ec2LaunchSettings.exe.config'
  • path equals 'C:\ProgramData\Amazon\EC2-Windows\Launch\Settings'
  • filename equals 'Ec2LaunchSettings.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config'
  • path equals 'C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35'
  • filename equals 'PresentationFontCache.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'AddInProcess.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'DataSvcUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v1.1.4322'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'DataSvcUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Program Files\Amazon\SSM\Plugins\awsDomainJoin\AWS.DomainJoin.exe.config'
  • path equals 'C:\Program Files\Amazon\SSM\Plugins\awsDomainJoin'
  • filename equals 'AWS.DomainJoin.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\System32\UevAppMonitor.exe.config'
  • path equals 'C:\Windows\System32'
  • filename equals 'UevAppMonitor.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
  • path equals 'C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config'
  • path equals 'C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35'
  • filename equals 'PresentationFontCache.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation'
  • filename equals 'SMSvcHost.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'dfsvc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\DfsrAdmin.exe.config'
  • path equals 'C:\Windows'
  • filename equals 'DfsrAdmin.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v1.0.3705'
  • filename equals 'installutil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe.config'
  • path equals 'C:\Windows\System32\WindowsPowerShell\v1.0'
  • filename equals 'powershell_ise.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation'
  • filename equals 'SMSvcHost.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'InstallUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF'
  • filename equals 'PresentationFontCache.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'AddInUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
  • path equals 'C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'applaunch.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v3.5'
  • filename equals 'AddInUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'regasm.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Aspnet_regsql.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'Aspnet_regsql.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727'
  • filename equals 'jsc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'csc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Program Files\Amazon\XenTools\Installer.exe.config'
  • path equals 'C:\Program Files\Amazon\XenTools'
  • filename equals 'Installer.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'InstallUtil.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319'
  • filename equals 'vbc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v2.0.50727'
  • filename equals 'regsvcs.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a'
  • filename equals 'msbuild.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a'
  • filename equals 'dfsvc.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'AddInProcess.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319'
  • filename equals 'Microsoft.Workflow.Compiler.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v3.5'
  • filename equals 'AddInProcess.exe.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.dotnet:tst:1201 (xmlfilecontent_test)
Result:true
Title:Event tracing for Windows (ETW) for Common Language Runtime events is enabled for machine configiguration files
Check Existence:Zero or more collected items may exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.dotnet:obj:1201 (xmlfilecontent_object)
Object Requirements:
  • for path, at least one of the following must be true:
    • path must be equal to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config'
    • path must be equal to 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config'
  • filename must be equal (case insensitive) to 'machine.config'
  • xpath must be equal to 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
State ID:oval:mil.disa.fso.dotnet:ste:1200 (xmlfilecontent_state)
State Requirements:
  • all value_of must be equal to 'true'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config'
  • filename equals 'machine.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'
Collected Item Properties:
  • filepath equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config'
  • path equals 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config'
  • filename equals 'machine.config'
  • xpath equals 'count(/configuration/runtime/etwEnable/@enabled) = 0 or /configuration/runtime/etwEnable/@enabled = "true"'
  • value_of equals 'true'
  • windows_view equals '64_bit'

Disable TLS RC4 cipher in .Net

Rule ID:xccdf_mil.disa.stig_rule_SV-225238r615940_rule
Result:Pass
Version:APPNET0075
Identities:SV-96209
V-81495
CCI-001762 (NIST SP 800-53 Rev 4: CM-7 (1) (b))
Description: Use of the RC4 cipher in TLS could allow an attacker to perform man-in-the-middle attacks and recover plaintext from encrypted sessions. Applications that target .Net version 4.x running on multiple Windows versions could be vulnerable to these types of attacks. The registry settings in this requirement will prevent .Net applications that target the 4.x framework from selecting and utilizing the Schannel.dll RC4 cipher for TLS connections. Applications that use TLS when connecting to remote systems will perform a handshake and negotiate the TLS version and cipher that is to be used between the client and the server. This is standard protocol for all TLS connections. If the server and client are not configured to use the same TLS version and cipher, the TLS connection may fail. Applications should be tested with these registry settings prior to production implementation of the fix in order to avoid application outages. false
Fix Text:Use regedit to access the following registry key.

For 32-bit systems:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\

For 64-bit systems:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\

Modify or create the following Windows registry value: SchUseStrongCrypto

Set SchUseStrongCrypto to a REG_DWORD value of “1”.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target Microsoft DotNet Framework 4-0
Publisher:DISA
Type:DPMS Target
Subject:Microsoft DotNet Framework 4-0
Identifier:4213
Definitions:
Definition ID:oval:mil.disa.fso.dotnet:def:16
Result:true
Title:Disable TLS RC4 cipher in .Net
Description:Use of the RC4 cipher in TLS could allow an attacker to perform man-in-the-middle attacks and recover plaintext from encrypted sessions. Applications that target .Net version 4.x running on multiple Windows versions could be vulnerable to these types of attacks. The registry settings in this requirement will prevent .Net applications that target the 4.x framework from selecting and utilizing the Schannel.dll RC4 cipher for TLS connections. Applications that use TLS when connecting to remote systems will perform a handshake and negotiate the TLS version and cipher that is to be used between the client and the server. This is standard protocol for all TLS connections. If the server and client are not configured to use the same TLS version and cipher, the TLS connection may fail. Applications should be tested with these registry settings prior to production implementation of the fix in order to avoid application outages.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.dotnet:tst:1601 (wmi57_test)
Result:false
Title:32-bit operating system check
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.dotnet:obj:1601 (wmi57_object)
Object Requirements:
  • namespace must be equal to 'root\cimv2'
  • wql must be equal to 'SELECT OSArchitecture from win32_operatingsystem'
State ID:oval:mil.disa.fso.dotnet:ste:1601 (wmi57_state)
State Requirements:
  • for all 'result' the following must be true:
    • osarchitecture must be equal to '32-bit'
Collected Item Properties:
  • namespace equals 'root\cimv2'
  • wql equals 'SELECT OSArchitecture from win32_operatingsystem'
  • collected 'result' result:
    • osarchitecture = '64-bit'
Additional Information:Check requirement not met.
Test ID:oval:mil.disa.fso.dotnet:tst:1602 (registry_test)
Result:true
Title:SchUseStrongCrypto key for 32 bit applications on a 64 bit system
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.dotnet:obj:1602 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319'
  • name must be equal to 'SchUseStrongCrypto'
State ID:oval:mil.disa.fso.dotnet:ste:1600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319'
  • name equals 'SchUseStrongCrypto'
  • last_write_time equals '132585691980000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.dotnet:tst:1600 (registry_test)
Result:true
Title:SchUseStrongCrypto key for applications that match the bitness of the system
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.dotnet:obj:1600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'SOFTWARE\Microsoft\.NETFramework\v4.0.30319'
  • name must be equal to 'SchUseStrongCrypto'
State ID:oval:mil.disa.fso.dotnet:ste:1600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'SOFTWARE\Microsoft\.NETFramework\v4.0.30319'
  • name equals 'SchUseStrongCrypto'
  • last_write_time equals '132585691980000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'