602 lines
25 KiB
Plaintext
602 lines
25 KiB
Plaintext
[version]
|
|
signature="$CHICAGO$"
|
|
ClassGUID={00000000-0000-0000-0000-000000000000}
|
|
LayoutFile=layout.inf
|
|
|
|
|
|
[Directories]
|
|
;
|
|
; ACLs for directories themselves
|
|
;
|
|
; LHS is directory: if starts with \ then relative to
|
|
; drive containing system, otherwise relative to sysroot
|
|
;
|
|
; RHS1 is ACL to put on directory itself; looked up in [ACL] section
|
|
; RHS2 is default ACL for files in that directory, looked up in [ACL section]
|
|
; If not present then files in that dir are not stamped with an ACL by default.
|
|
;
|
|
@@:@@:"" = d1,f1 ; don't use \ or we think it's x:\ (which is bad)
|
|
@@:@@:system32 = d1,f1
|
|
@@:@@:system32\config = d2,f1
|
|
@@:@@:system32\drivers = d3,f1
|
|
@@:@@:system = d1,f1
|
|
@@:@@:system32\ras = d4,f1
|
|
@@:@@:system32\spool = d5,f1
|
|
@@:@@:system32\spool\drivers = d5,f3
|
|
@@:@i:system32\spool\drivers\w32x86\2 = d5,f3
|
|
@@:@@:system32\spool\printers = d5,f3
|
|
@@:@@:system32\spool\prtprocs = d5,f3
|
|
@@:@i:system32\spool\prtprocs\w32x86 = d5,f3
|
|
@@:@@:system32\dhcp = d3,f1
|
|
@@:@@:repair = d11
|
|
@@:@@:system32\drivers\etc = d3,f1
|
|
@@:@i:system32\spool\drivers\w32x86 = d5,f1
|
|
@@:@@:system32\viewers = d1,f1
|
|
@@:@@:inf = d1,f1
|
|
@@:@@:help = d1,f1
|
|
@@:@@:fonts = d1,f1
|
|
@@:@@:config = d1,f1
|
|
@@:@@:Media = d1,f1
|
|
@@:@@:Cursors = d1,f1
|
|
@@:@@:system32\repl = d3
|
|
@@:@@:system32\repl\import = d7
|
|
@@:@@:system32\repl\import\scripts = d7
|
|
@@:@@:system32\repl\export = d7
|
|
@@:@@:system32\repl\export\scripts = d7
|
|
@@:@@:security\templates = d7,f1
|
|
|
|
\users = d8
|
|
\users\default = d9
|
|
\ = d10
|
|
\temp = d10
|
|
|
|
|
|
[FileOverride]
|
|
;
|
|
; Files that are not listed here get default for their directory
|
|
; The left hand side is the file name relative to sysroot. RHS is
|
|
; the ACL spec, which is looked up in [ACL]
|
|
;
|
|
system32\autoexec.nt = f2
|
|
system32\config.nt = f2
|
|
system32\decpsmon.dll = f3
|
|
system32\decpsmon.hlp = f3
|
|
system32\hpmon.dll = f3
|
|
system32\hpmon.hlp = f3
|
|
system32\midimap.cfg = f2
|
|
win.ini = f4
|
|
|
|
[ExtraFiles]
|
|
;
|
|
; Use only for files that are not listed in layout.inf for some reason.
|
|
; LHS is path relative to sysroot (if not starting with \) or a full path
|
|
; for the drive with the system on it (starting with \)
|
|
;
|
|
; RHS is ACL.
|
|
;
|
|
system32\wins\system.mdb = f1
|
|
|
|
;
|
|
; ACE codes:
|
|
;
|
|
; Index Permission Inherit
|
|
;
|
|
; 1 AccountOpsRWXD Containers
|
|
; 2 AdminAll Containers, Objects
|
|
; 3 AdminRWXD Containers
|
|
; 4 CreatorOwnerAll Containers, Objects
|
|
; 5 NetUsersDenyAll Containers, Objects
|
|
; 6 PrintOperatorsAll Containers, Objects
|
|
; 7 ReplicatorRWXD Containers, Objects
|
|
; 8 ReplicatorRX Containers, Objects
|
|
; 9 SysOpsAll Containers, Objects
|
|
; 10 SysOpsRWXD Containers, Objects
|
|
; 11 WorldAll Containers, Objects
|
|
; 12 WorldRWX Containers
|
|
; 13 WorldRWXD Containers, Objects
|
|
; 14 WorldRX Containers
|
|
; 15 WorldRX Containers, Objects
|
|
; 16 WorldRWX Containers, Objects
|
|
; 17 SystemAll Containers, Objects
|
|
; 18 PowerUsersRWXD Containers, Objects
|
|
;
|
|
|
|
@s:[ServerACL]
|
|
@s:;
|
|
@s:; List of ACL profiles for server security
|
|
@s:;
|
|
@s:d1 = 2,13,4,10,17
|
|
@s:d2 = 14,4,2,17
|
|
@s:d3 = 15,4,2,9,17
|
|
@s:d4 = 15,4,2,9,13,17
|
|
@s:d5 = 15,4,2,9,6,17
|
|
@s:d6 = 2,4,9,15,17,18
|
|
@s:d7 = 15,10,2,7,4,17
|
|
@s:d8 = 14,3,1,17
|
|
@s:d9 = 12,4,17
|
|
@s:d10= 2,13,4,10,17
|
|
@s:d11= 2,17
|
|
|
|
@s:f1 = 2,15,10,17
|
|
@s:f2 = 2,13,10,17
|
|
@s:f3 = 2,15,9,6,17
|
|
@s:f4 = 11
|
|
|
|
@@:[WorkstationACL]
|
|
;
|
|
; List of ACL profiles for workstation security
|
|
; Also used for member servers so this section
|
|
; appears in both versions of the inf
|
|
;
|
|
@@:d1 = 2,13,4,17
|
|
@@:d2 = 2,4,14,17
|
|
@@:d3 = 15,4,2,17
|
|
@@:d4 = 15,4,2,13,17,18
|
|
@@:d5 = 15,4,2,17,18
|
|
@@:d6 = 2,4,15,17,18
|
|
@@:d7 = 15,2,7,4,17
|
|
@@:d8 = 14,3,17
|
|
@@:d9 = 12,4,17
|
|
@@:d10= 2,13,4,17
|
|
@@:d11= 2,17
|
|
|
|
@@:f1 = 2,15,17
|
|
@@:f2 = 2,13,17
|
|
@@:f3 = 2,15,17,18
|
|
@@:f4 = 11
|
|
|
|
|
|
@@:@i:[BootFiles]
|
|
@@:@i:;
|
|
@@:@i:; x86 boot files and the root of C:
|
|
@@:@i:;
|
|
@@:@i:\ = d1
|
|
@@:@i:\boot.ini = f1
|
|
@@:@i:\ntbootdd.sys = f1
|
|
@@:@i:\ntdetect.com = f1
|
|
@@:@i:\ntldr = f1
|
|
|
|
@@:@a:[BootFiles]
|
|
@@:@a:;
|
|
@@:@a:; amd64 boot files and the root of C:
|
|
@@:@a:;
|
|
@@:@a:\ = d1
|
|
@@:@a:\boot.ini = f1
|
|
@@:@a:\ntdetect.com = f1
|
|
@@:@a:\ntldr = f1
|
|
|
|
;
|
|
; ACE codes for the registry
|
|
;
|
|
; Index Permission Inherit
|
|
;
|
|
; 1 AdminFull Containers
|
|
; 2 AdminR Containers
|
|
; 3 AdminRW Containers
|
|
; 4 AdminRWD Containers
|
|
; 5 CreatorFull Containers
|
|
; 6 CreatorRW Containers
|
|
; 7 WorldFull Containers
|
|
; 8 WorldR Containers
|
|
; 9 WorldRW Containers
|
|
; 10 WorldRWD Containers
|
|
; 11 PowerUserFull Containers
|
|
; 12 PowerUserRW Containers
|
|
; 13 PowerUserRWD Containers
|
|
; 14 SystemOpFull Containers
|
|
; 15 SystemOpRW Containers
|
|
; 16 SystemOpRWD Containers
|
|
; 17 SystemFull Containers
|
|
; 18 SystemRW Containers
|
|
; 19 SystemR Containers
|
|
; 20 AdminRWE Containers
|
|
; 21 InteractiveUserFull Containers
|
|
; 22 InteractiveUserRead Containers
|
|
; 23 InteractiveUserRW Containers
|
|
; 24 InteractiveUserRWD Containers
|
|
; 25 NormalUsersRW Containers
|
|
;
|
|
|
|
[RegistryDACLs]
|
|
r1 = 1 ; [AdminFull]
|
|
r2 = 1,17 ; [AdminFull SystemFull]
|
|
r3 = 8,1 ; [WorldR AdminFull]
|
|
r4 = 8,1,5,17 ; [WorldR AdminFull CreatorFull SystemFull]
|
|
r5 = 8,1,5,16,17 ; [WorldR AdminFull CreatorFull SystemOpRWD SystemFull]
|
|
r6 = 8,1,5,16,13,17 ; [WorldR AdminFull CreatorFull SystemOpRWD PowerRWD SystemFull]
|
|
r7 = 8,1,17 ; [WorldR AdminFull SystemFull]
|
|
r8 = 8,1,15,17 ; [WorldR AdminFull SystemOpRW SystemFull]
|
|
r9 = 8,1,16,13,5,17 ; [WorldR AdminFull SystemOpRWD PowerRWD CreatorFull SystemFull]
|
|
r10= 8,1,14,5,17 ; [WorldR AdminFull SystemOpFull CreatorFull SystemFull]
|
|
r11= 8,1,15,12,5,17 ; [WorldR AdminFull SystemOpRW PowerRW CreatorFull SystemFull]
|
|
r12= 8,1,16,13,5,17 ; [WorldR AdminFull SystemOpRWD PowerRWD CreatorFull SystemFull]
|
|
r13= 8,4,17 ; [WorldR AdminRWD SystemFull]
|
|
r14= 8,24,1,5,17 ; [WorldR InteractiveRWD AdminFull CreatorFull SystemFull]
|
|
r15= 8,17 ; [WorldR SystemFull]
|
|
r16= 9,1,5,17 ; [WorldRW AdminFull CreatorFull SystemFull]
|
|
r17= 9,1,16,13,5,17 ; [WorldRW AdminFull SystemOpRWD PowerRWD CreatorFull SystemFull]
|
|
r18= 10,1,5,17 ; [WorldRWD AdminFull CreatorFull SystemFull]
|
|
|
|
|
|
;
|
|
; [Phase1RootKeys]
|
|
;
|
|
; [Phase2RootKeys]
|
|
;
|
|
; These sections list the root keys to be proccessed for
|
|
; security, on phase 1, and phase 2, respectivelly.
|
|
; These sections have the following format:
|
|
;
|
|
; [Phase1RootKeys]
|
|
; <Predefined key spec>, <Key path>, <DACL spec>, <Recurse flag>, <section name 1>, <section name 2>
|
|
;
|
|
; where:
|
|
;
|
|
; <Predef key spec>: A string associated with one of the predefined handles.
|
|
; It can be one of the following: HKLM for HKEY_LOCAL_MACHINE
|
|
; HKCR for HKEY_CLASSES_ROOT
|
|
; HKCU for HKEY_CURRENT_USER
|
|
; HKU for HKEY_USERS
|
|
; HKCC for HKEY_CURRENT_CONFIG
|
|
; This parameter is required.
|
|
;
|
|
;
|
|
; <Key path>: Path to a key to secure.
|
|
; The path is relative to a predefined key.
|
|
; If the key is a predefined key, then an empty string ""
|
|
; should be used as a key name.
|
|
; This parameter is required.
|
|
;
|
|
; <Recurse flag>: A flag that indicates if the DACL should be applied to
|
|
; the key and all its subkeys.
|
|
; It can be one of the following: 0... Apply to key only
|
|
; 1... Apply to key and subkeys
|
|
; If this parameter is not sopecified, or is invalid, '1' will
|
|
; be assumed.
|
|
;
|
|
; <DACL spec>: A string associated to the DACL to be applied to the key.
|
|
; It has to be one of the keys specified on [RegistryACL].
|
|
; This parameter is required.
|
|
;
|
|
; <section name 1>: This is an optional parameter.
|
|
; If present it indicates the section that contains the path
|
|
; to the subkeys (relative to <Key Path>) that should not be
|
|
; processed for security.
|
|
;
|
|
; The information in this section has the following format:
|
|
;
|
|
; [<section name 1>]
|
|
; <Key path 1>
|
|
; <Key path 2>
|
|
; .
|
|
; .
|
|
; .
|
|
;
|
|
; Where <Key path N> is relative to <Key path>
|
|
;
|
|
;
|
|
; <section name 2>: This is an optional parameter.
|
|
; If present it indicates the section that contains the path
|
|
; to the subkeys (relative to <Key Path>) that should get a
|
|
; DACL that is different than the one applied to <Key path>.
|
|
;
|
|
; The information in this section has the following format:
|
|
;
|
|
; [<section name 2>]
|
|
; <Key path 1> = <DACL spec 1>
|
|
; <Key path 2> = <DACL spec 2>
|
|
; .
|
|
; .
|
|
; .
|
|
;
|
|
; Where:
|
|
;
|
|
; <Key path N>: is a path to the key relative to <Key path>
|
|
;
|
|
; <Acl spec N>: A string associated to the DACL to be applied to the key.
|
|
; It has to be one of the keys specified on [RegistryDACLs].
|
|
; This parameter is required.
|
|
;
|
|
;
|
|
;
|
|
[Phase1RootKeys]
|
|
HKCU,"",1,r7,"HKCU.SKIP","HKCU.EXCEPTIONS" ; [AdminFull SystemFull WorldR]
|
|
|
|
;;;;;;;
|
|
;
|
|
; HKEY_CURRENT_USER (DEFAULT hive) sepcial keys
|
|
;
|
|
;;;;;;;
|
|
|
|
[HKCU.SKIP]
|
|
;
|
|
; Subkeys of HKEY_CURRENT_USER that should not
|
|
; have security descriptors applied to them.
|
|
;
|
|
|
|
[HKCU.EXCEPTIONS]
|
|
;
|
|
; Subkeys of HKEY_CLASSES_ROOT that should have a security
|
|
; descriptor applied to them and their subkeys, that is differnet than
|
|
; the one applied to their parent keys.
|
|
;
|
|
"Software\Microsoft\NetDDE" = r2 ; [SystemFull AdminFull]
|
|
"Software\Microsoft\Windows\CurrentVersion\Policies" = r12 ; [WorldR AdminFull SystemOpRWD PowerRWD SystemFull CreatorFull]
|
|
"Software\Policies" = r7 ; [WorldR AdminFull SystemFull]
|
|
|
|
|
|
|
|
|
|
[Phase2RootKeys]
|
|
HKLM,"SOFTWARE",1,r18,"HKLM.SOFTWARE.SKIP","HKLM.SOFTWARE.EXCEPTIONS" ; [WorldRWD AdminFull SystemFull CreatorFull]
|
|
HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib",0,r4 ; [WorldR AdminFull CreatorFull SystemFull]
|
|
HKLM,"SYSTEM",1,r18,"HKLM.SYSTEM.SKIP","HKLM.SYSTEM.EXCEPTIONS" ; [WorldR AdminRWD SystemFull]
|
|
HKCR,"",1,r14,"HKCR.SKIP","HKCR.EXCEPTIONS" ; [WorldR InteractiveRWD AdminFull SystemFull CreatorFull]
|
|
|
|
|
|
;;;;;;;
|
|
;
|
|
; HKEY_LOCAL_MACHINE\SOFTWARE sepcial keys
|
|
;
|
|
;;;;;;;
|
|
|
|
[HKLM.SOFTWARE.SKIP]
|
|
;
|
|
; Subkeys of HKEY_LOCAL_MACHINE\SOFTWARE that should not have a security
|
|
; descriptor applied to them.
|
|
;
|
|
"SOFTWARE\Classes"
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib"
|
|
|
|
|
|
[HKLM.SOFTWARE.EXCEPTIONS]
|
|
;
|
|
; Subkeys of HKEY_LOCAL_MACHINE\SOFTWARE that should have a security
|
|
; descriptor applied to them and their subkeys, that is differnet than
|
|
; the one applied to their parent keys.
|
|
;
|
|
"SOFTWARE\Policies" = r7 ; [WorldR AdminFull SystemFull]
|
|
"SOFTWARE\Program Groups" = r9 ; [WorldR AdminFull SystemFull SystemOpRWD PowerRWD CreatorFull]
|
|
|
|
"SOFTWARE\Secure" = r10 ; [WorldR AdminFull SystemOpFull SystemFull CreatorFull]
|
|
|
|
"SOFTWARE\Microsoft" = r18 ; [WorldRWD AdminFull SystemFull CreatorFull]
|
|
|
|
"SOFTWARE\Microsoft\Command Processor" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
|
|
"SOFTWARE\Microsoft\NetDDE" = r2 ; [SystemFull AdminFull]
|
|
|
|
"SOFTWARE\Microsoft\Ole" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
|
|
"SOFTWARE\Microsoft\Rpc" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Rpc\ClientProtocols" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Rpc\NameService" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Rpc\NetBios" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Rpc\ServerProtocols" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
|
|
"SOFTWARE\Microsoft\Secure" = r10 ; [WorldR AdminFull SystemOpFull SystemFull CreatorFull]
|
|
|
|
"SOFTWARE\Microsoft\Windows" = r17 ; [WorldRW AdminFull SystemOpRWD PowerRWD SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" = r5 ; [WorldR AdminFull SystemOpRWD SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions" = r12 ; [WorldR AdminFull SystemOpRWD PowerRWD SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony" = r6 ; [WorldR AdminFull SystemFull CreatorFull SystemOpRWD PowerRWD]
|
|
|
|
"SOFTWARE\Microsoft\Windows NT" = r12 ; [WorldR AdminFull SystemOpRWD PowerRWD SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion" = r12 ; [WorldR AdminFull SystemOpRWD PowerRWD SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\DiskQuota" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\drivers.desc" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Embedding" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\File Manager" = r6 ; [WorldR AdminFull SystemFull CreatorFull SystemOpRWD PowerRWD]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers" = r3 ; [WorldR AdminFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontCache" = r3 ; [WorldR AdminFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontMapper" = r3 ; [WorldR AdminFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\MCI" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\MCI Extensions" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Midimap" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network" = r6 ; [WorldR AdminFull SystemFull CreatorFull SystemOpRWD PowerRWD]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" = r5 ; [WorldR AdminFull SystemOpRWD SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" = r7 ; [WorldR AdminFull SystemFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\Type 1 Fonts" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" = r5 ; [WorldR AdminFull SystemOpRWD SystemFull CreatorFull]
|
|
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\WOW" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
|
|
|
|
;;;;;;;
|
|
;
|
|
; HKEY_LOCAL_MACHINE\SYSTEM sepcial keys
|
|
;
|
|
;;;;;;;
|
|
|
|
[HKLM.SYSTEM.SKIP]
|
|
;
|
|
; Subkeys of HKEY_LOCAL_MACHINE\SYSTEM that should not have a security
|
|
; descriptor applied to them.
|
|
;
|
|
"SYSTEM\Clone"
|
|
"SYSTEM\ControlSet001"
|
|
"SYSTEM\ControlSet001"
|
|
"SYSTEM\ControlSet002"
|
|
"SYSTEM\ControlSet003"
|
|
"SYSTEM\ControlSet004"
|
|
"SYSTEM\ControlSet005"
|
|
"SYSTEM\ControlSet006"
|
|
"SYSTEM\ControlSet007"
|
|
"SYSTEM\ControlSet008"
|
|
"SYSTEM\ControlSet009"
|
|
"SYSTEM\ControlSet010"
|
|
|
|
|
|
[HKLM.SYSTEM.EXCEPTIONS]
|
|
;
|
|
; Subkeys of HKEY_LOCAL_MACHINE\SYSTEM that should have a security
|
|
; descriptor applied to them and their subkeys, that is differnet than
|
|
; the one applied to their parent keys.
|
|
;
|
|
"SYSTEM\CurrentControlSet" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Control" = r5 ; [SystemOpRWD WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg" = r1 ; [AdminFull]
|
|
|
|
"SYSTEM\CurrentControlSet\Control\Session Manager\Executive" = r11 ; [WorldR AdminFull SystemOpRW PowerRW SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" = r7 ; [WorldR AdminFull SystemFull]
|
|
|
|
"SYSTEM\CurrentControlSet\Control\GraphicsDrivers" = r7 ; [WorldR AdminFull SystemFull]
|
|
"SYSTEM\CurrentControlSet\Control\Lsa" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Control\PriorityControl" = r16 ; [WorldRW AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Control\ProductOptions" = r4 ; [WorldR SystemFull AdminFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Control\TimeZoneInformation" = r11 ; [WorldR AdminFull SystemOpRW PowerRW SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Control\Windows" = r8 ; [WorldR AdminFull SystemFull SystemOpRW]
|
|
|
|
"SYSTEM\CurrentControlSet\Enum" = r15 ; [WorldR SystemFull]
|
|
|
|
"SYSTEM\CurrentControlSet\Hardware Profiles" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Hardware Profiles\0001" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software" = r18 ; [WorldRWD AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Hardware Profiles\0001\System" = r13 ; [WorldR AdminRWD SystemFull]
|
|
"SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Control" = r5 ; [SystemOpRWD WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum" = r5 ; [SystemOpRWD WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Services" = r5 ; [SystemOpRWD WorldR AdminFull SystemFull CreatorFull]
|
|
|
|
"SYSTEM\CurrentControlSet\Services" = r5 ; [WorldR AdminFull SystemOpRWD SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Services\EventLog" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
"SYSTEM\CurrentControlSet\Services\WinTrust" = r7 ; [AdminFull SystemFull WorldR]
|
|
|
|
"SYSTEM\Select" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
|
|
"SYSTEM\Setup" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
|
|
|
|
;;;;;;;
|
|
;
|
|
; HKEY_CLASSES_ROOT sepcial keys
|
|
;
|
|
;;;;;;;
|
|
|
|
[HKCR.SKIP]
|
|
;
|
|
; Subkeys of HKEY_CLASSES_ROOT that should not
|
|
; have security descriptors applied to them.
|
|
;
|
|
|
|
[HKCR.EXCEPTIONS]
|
|
;
|
|
; Subkeys of HKEY_CLASSES_ROOT that should have security descriptors
|
|
; that are different than the ones applied to the parent key.
|
|
;
|
|
"helpfile" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
".hlp" = r4 ; [WorldR AdminFull SystemFull CreatorFull]
|
|
|
|
|
|
|
|
@*: [UpgradePhase1RootKeys]
|
|
@*: ; This section specifies the security descriptors to be applied to
|
|
@*: ; certain keys on the upgrade case.
|
|
@*: ; The format of each line in this section is the same as the format
|
|
@*: ; defined for [Phase1RootKeys] section
|
|
@*: ;
|
|
@*:
|
|
@*:
|
|
@*:
|
|
@*: ;;;;;;;
|
|
@*: ;
|
|
@*: ; HKEY_CURRENT_USER (DEFAULT hive) sepcial keys
|
|
@*: ;
|
|
@*: ;;;;;;;
|
|
@*:
|
|
@*: [UPGRADE.HKCU.SKIP]
|
|
@*: ;
|
|
@*: ; Subkeys of HKEY_CURRENT_USER that should not
|
|
@*: ; have security descriptors applied to them.
|
|
@*: ;
|
|
@*:
|
|
@*: [UPGRADE.HKCU.EXCEPTIONS]
|
|
@*: ;
|
|
@*: ; Subkeys of HKEY_CLASSES_ROOT that should have a security
|
|
@*: ; descriptor applied to them and their subkeys, that is differnet than
|
|
@*: ; the one applied to their parent keys.
|
|
@*: ;
|
|
@*:
|
|
@*:
|
|
@*:
|
|
@*: [UpgradePhase2RootKeys]
|
|
@*: ; This section specifies the security descriptors to be applied to
|
|
@*: ; certain keys on the upgrade case.
|
|
@*: ; The format of each line in this section is the same as the format
|
|
@*: ; defined for [Phase1RootKeys] section
|
|
@*: ;
|
|
@*:
|
|
@*:
|
|
@*: ;;;;;;;
|
|
@*: ;
|
|
@*: ; HKEY_LOCAL_MACHINE\SOFTWARE sepcial keys
|
|
@*: ;
|
|
@*: ;;;;;;;
|
|
@*:
|
|
@*: [UPGRADE.HKLM.SOFTWARE.SKIP]
|
|
@*: ;
|
|
@*: ; Subkeys of HKEY_LOCAL_MACHINE\SOFTWARE that should not have a security
|
|
@*: ; descriptor applied to them.
|
|
@*: ;
|
|
@*:
|
|
@*:
|
|
@*: [UPGRADE.HKLM.SOFTWARE.EXCEPTIONS]
|
|
@*: ;
|
|
@*: ; Subkeys of HKEY_LOCAL_MACHINE\SOFTWARE that should have a security
|
|
@*: ; descriptor applied to them and their subkeys, that is differnet than
|
|
@*: ; the one applied to their parent keys.
|
|
@*: ;
|
|
@*:
|
|
@*: ;;;;;;;
|
|
@*: ;
|
|
@*: ; HKEY_LOCAL_MACHINE\SYSTEM sepcial keys
|
|
@*: ;
|
|
@*: ;;;;;;;
|
|
@*:
|
|
@*: [UPGRADE.HKLM.SYSTEM.SKIP]
|
|
@*: ;
|
|
@*: ; Subkeys of HKEY_LOCAL_MACHINE\SYSTEM that should not have a security
|
|
@*: ; descriptor applied to them.
|
|
@*: ;
|
|
@*:
|
|
@*: [UPGRADE.HKLM.SYSTEM.EXCEPTIONS]
|
|
@*: ;
|
|
@*: ; Subkeys of HKEY_LOCAL_MACHINE\SYSTEM that should have a security
|
|
@*: ; descriptor applied to them and their subkeys, that is differnet than
|
|
@*: ; the one applied to their parent keys.
|
|
@*: ;
|
|
@*:
|
|
@*: ;;;;;;;
|
|
@*: ;
|
|
@*: ; HKEY_CLASSES_ROOT sepcial keys
|
|
@*: ;
|
|
@*: ;;;;;;;
|
|
@*:
|
|
@*: [UPGRADE.HKCR.SKIP]
|
|
@*: ;
|
|
@*: ; Subkeys of HKEY_CLASSES_ROOT that should not
|
|
@*: ; have security descriptors applied to them.
|
|
@*: ;
|
|
@*:
|
|
@*: [UPGRADE.HKCR.EXCEPTIONS]
|
|
@*: ;
|
|
@*: ; Subkeys of HKEY_CLASSES_ROOT that should have security descriptors
|
|
@*: ; that are different than the ones applied to the parent key.
|
|
@*: ;
|
|
@*:
|
|
@*:
|