TFS XP/2003 rulesets with local edits 0 $(WINXP2003_BOOTDRIVE) 10000 1 false ID11 $(WINXP2003_SYSTEMDRIVE)\ffastun.ffl true $(WINXP2003_SYSTEMDRIVE)\ffastun.ffx true $(WINXP2003_SYSTEMDRIVE)\ffastun.ff0 true $(WINXP2003_SYSTEMDRIVE)\temp true $(WINXP2003_SYSTEMDRIVE)\ffastun.ffa true $(WINXP2003_SYSTEMDRIVE)\pagefile.sys true $(WINXP2003_PROGRAMFILES) true $(WINXP2003_SYSTEMROOT) true $(WINXP2003_SYSTEMDRIVE)\hiberfil.sys true 0 $(WINXP2003_SYSTEM32DIR) 10000 -1 false 1 Perflib_Perfdata*.dat *log.* *.log *.tmp ID16 $(WINXP2003_SYSTEM32DIR)\CatRoot 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\CatRoot2 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\DTCLog 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\LogFiles 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\LLS\LlsUser.LLS 10000 -1 false ID17 $(WINXP2003_SYSTEM32DIR)\LServer 10000 -1 false ID17 $(WINXP2003_SYSTEM32DIR)\NtmsData 10000 -1 false ID17 $(WINXP2003_SYSTEM32DIR)\NtmsData\Export 10000 -1 false ID18 $(WINXP2003_SYSTEM32DIR)\spool 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\wbem\Logs 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\wbem\Repository 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\ShellExt true $(WINXP2003_SYSTEM32DIR)\setup true $(WINXP2003_SYSTEM32DIR)\dhcp true $(WINXP2003_SYSTEM32DIR)\inetsrv\History true $(WINXP2003_SYSTEM32DIR)\cpl.cfg true $(WINXP2003_SYSTEM32DIR)\wins true $(WINXP2003_SYSTEM32DIR)\ras true $(WINXP2003_SYSTEM32DIR)\config true $(WINXP2003_SYSTEM32DIR)\mapisvc.inf true $(WINXP2003_SYSTEM32DIR)\inetsrv\metabase.bin true $(WINXP2003_SYSTEM32DIR)\dllcache true $(WINXP2003_SYSTEM32DIR)\dsa.msc true $(WINXP2003_SYSTEM32DIR)\ffastlog.txt true $(WINXP2003_SYSTEM32DIR)\drivers true $(WINXP2003_SYSTEM32DIR)\events.txt true $(WINXP2003_SYSTEM32DIR)\inetsrv\metabase.xml true 0 $(WINXP2003_SYSTEMDIR) 35 -1 false ID16 0 $(WINXP2003_SYSTEM32DIR)\config 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\config\systemprofile 10000 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\dhcp 10000 -1 false 1 *log* *.chk *.mdb ID16 $(WINXP2003_SYSTEM32DIR)\drivers\etc\hosts 10000 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\drivers\etc\networks 10000 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\drivers\etc\protocol 10000 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\drivers\etc\services 10000 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\inetsrv\History 10000 0 false ID17 $(WINXP2003_SYSTEM32DIR)\inetsrv\metabase.bin 10000 -1 false ID17 $(WINXP2003_SYSTEM32DIR)\ras 10000 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\setup 10000 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\ShellExt 10000 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\wins 10000 -1 false 1 *.log *edb* *sdb* ID17 $(WINXP2003_SYSTEM32DIR)\wins\wins_bak 10000 0 false ID17 $(WINXP2003_SYSTEMROOT)\security 10000 0 false ID17 $(WINXP2003_SYSTEMROOT)\security\templates 10000 -1 false ID18 $(WINXP2003_SYSTEM32DIR)\drivers\etc\lmhosts.sam 10000 0 false 1 ID16 $(WINXP2003_SYSTEM32DIR)\drivers\etc\lmhosts 10000 0 false 1 ID16 $(WINXP2003_SYSTEM32DIR)\dhcp\backup true 0 $(WINXP2003_SYSTEM32DIR)\drivers 35 -1 false ID16 $(WINXP2003_SYSTEMROOT)\Driver Cache 35 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\drivers\smbios.dat 35 -1 false ID18 $(WINXP2003_SYSTEM32DIR)\drivers\etc\services true $(WINXP2003_SYSTEM32DIR)\drivers\etc\networks true $(WINXP2003_SYSTEM32DIR)\drivers\etc\hosts true $(WINXP2003_SYSTEM32DIR)\drivers\etc\protocol true 0 $(WINXP2003_SYSTEMROOT) 35 1 false 1 *.log ID16 $(WINXP2003_SYSTEMROOT)\bootstat.dat 35 -1 false ID18 $(WINXP2003_SYSTEMROOT)\Config 35 -1 false ID16 $(WINXP2003_SYSTEMROOT)\inf 35 -1 false ID16 $(WINXP2003_SYSTEM32DIR)\dllcache 35 -1 false ID16 $(WINXP2003_SYSTEMROOT)\repair 35 -1 false ID11 $(WINXP2003_SYSTEMDIR) true $(WINXP2003_SYSTEMROOT)\Help true $(WINXP2003_SYSTEMROOT)\Subscriptions true $(WINXP2003_SYSTEMROOT)\Web true $(WINXP2003_SYSTEMROOT)\Driver Cache true $(WINXP2003_SYSTEM32DIR) true $(WINXP2003_SYSTEMROOT)\Media true $(WINXP2003_SYSTEMROOT)\ShellIconCache true $(WINXP2003_SYSTEMROOT)\security true $(WINXP2003_SYSTEMROOT)\SchedLog.Txt true $(WINXP2003_SYSTEMROOT)\randseed.rnd true $(WINXP2003_SYSTEMROOT)\Cursors true $(WINXP2003_SYSTEMROOT)\History true $(WINXP2003_SYSTEMROOT)\SchedLgU.txt true $(WINXP2003_SYSTEMROOT)\temp true 0 $(WINXP2003_PROGRAMFILES) 35 1 false ID16 0 $(HKLM_CCS)\\Control\\LSA 10000 -1 false ID35 $(HKLM)\\SECURITY\\SAM\\Domains\\Account 10000 -1 false 1 F V ID35 $(HKLM)\\SAM\\SAM\\Domains\\Account 10000 -1 false 1 F V ID35 $(HKLM)\\SAM\\SAM\\Domains\\Account\\Users\\000001F4 true $(HKLM_CCS)\\Control\\LSA\\Audit\\Sources\\twagent_sec true $(HKLM)\\SAM\\SAM\\Domains\\Account\\Users\\000001F5 true $(HKLM_CCS)\\Control\\LSA\\Audit\\Sources\\TripwirePrintUtility_sec true $(HKLM_CCS)\\Control\\LSA\\Audit\\Sources\\TripwireAdminUtility_sec true 0 $(HKLM)\\SAM\\SAM\\Domains\\Account\\Users\\000001F4 10000 -1 false ID37 $(HKLM)\\SAM\\SAM\\Domains\\Account\\Users\\000001F4|F true $(HKLM)\\SAM\\SAM\\Domains\\Account\\Users\\000001F4|V true 0 $(HKLM)\\SAM\\SAM\\Domains\\Account\\Users\\000001F4|F 10000 -1 false ID35 0 $(HKLM)\\SAM\\SAM\\Domains\\Account\\Users\\000001F4|V 10000 -1 false ID35 0 $(HKLM)\\SAM\\SAM\\Domains\\Account\\Users\\000001F5 10000 -1 false ID37 0 $(HKLM_Services) 10000 -1 false ID35 $(HKLM_Services)\\Dhcp\\Parameters 10000 0 false ID39 $(HKLM_Services)\\LanmanServer\\Parameters 10000 0 false ID39 $(HKLM_Services)\\LicenseInfo\\FilePrint|LocalKey 10000 0 false ID39 $(HKLM_Services)\\NAVENG 10000 0 false ID39 $(HKLM_Services)\\NAVEX15 10000 0 false ID39 $(HKLM_Services)\\NTDS\\BackupInformation 10000 0 false ID39 $(HKLM_Services)\\SysmonLog\\Log Queries 10000 -1 false ID39 $(HKLM_Services)\\Tcpip\\Parameters\\DNSRegisteredAdapters 10000 0 false ID39 $(HKLM_Services)\\Tcpip\\Parameters\\Interfaces 10000 0 false ID39 $(HKLM_Services)\\TMFilter|CurrentPatternName 10000 0 false ID39 $(HKLM_Services)\\TrkWks\\Parameters 10000 0 false ID39 $(HKLM_Services)\\TrkSvr\\Parameters 10000 0 false ID39 $(HKLM_Services)\\W32Time\\Parameters|msSkewPerDay 10000 -1 false ID39 $(HKLM_Services)\\Wins 10000 0 false ID39 $(HKLM_Services)\\twagent true $(HKLM_EventLog)\\System\\twagent_sys true $(HKLM_EventLog)\\System\\TripwirePrintUtility_sys true $(HKLM_EventLog)\\Application\\twagent true $(HKLM_EventLog)\\System\\TripwireAdminUtility_sys true $(HKLM_EventLog)\\Security\\TripwireAdminUtility_sec true $(HKLM_EventLog)\\Security\\TripwirePrintUtility_sec true $(HKLM_EventLog)\\Security\\Tripwire_sec true $(HKLM_EventLog)\\Application\\Tripwire true $(HKLM_EventLog)\\Security\\twagent_sec true $(HKLM_EventLog)\\Application\\TripwirePrintUtility true $(HKLM_EventLog)\\Application\\Tripwire Agent true $(HKLM_EventLog)\\Application\\TripwireAdminUtility true 0 $(HKCU_Windows_Policies) 10000 -1 false ID35 $(HKLM_WNTCV)\\Winlogon 10000 -1 false 1 Winlogon DomainCache ID43 $(HKLM_WNTCV)\\Winlogon|DCacheUpdate 10000 0 false ID39 $(HKLM_WNTCV)\\Winlogon\\GPExtensions 10000 0 false ID39 $(HKLM_WNTCV)\\Drivers 10000 -1 false ID35 $(HKLM_WNTCV)\\Drivers32 10000 -1 false ID35 $(HKLM_WNTCV)\\Network 10000 -1 false ID35 $(HKLM_WNTCV)\\ProfileList 10000 0 false ID39 $(HKLM_WNTCV)\\WOW 10000 -1 false ID35 $(HKLM_WNTCV)\\AeDebug 10000 -1 false ID35 $(HKLM_WNTCV)\\Embedding 10000 -1 false ID35 $(HKLM_WNTCV)\\Userinstallable.drivers 10000 -1 false ID35 0 $(HKLM)\\SOFTWARE\\Clients 35 -1 false ID35 $(HKLM)\\SOFTWARE\\Microsoft\\Rpc 35 -1 false ID35 $(HKLM)\\Software\\Microsoft\\Rpc|UuidSequenceNumber true 0 $(HKLM)\\hardware 35 -1 false ID39 $(HKLM)\\SYSTEM\\Setup 35 -1 false ID39 $(HKLM_CCS)\\Hardware Profiles 35 -1 false ID39 0 $(HKCR)\\AllFilesystemObjects 35 -1 false ID45 $(HKCR)\\AppID 35 -1 false ID45 $(HKCR)\\batfile 35 -1 false ID45 $(HKCR)\\CLSID 35 0 false ID45 $(HKCR)\\cmdfile 35 -1 false ID45 $(HKCR)\\comfile 35 -1 false ID45 $(HKCR)\\Component Categories 35 -1 false ID45 $(HKCR)\\Directory 35 -1 false ID45 $(HKCR)\\Drive 35 -1 false ID45 $(HKCR)\\exefile 35 -1 false ID45 $(HKCR)\\file 35 -1 false ID45 $(HKCR)\\FILETYPE 35 -1 false ID45 $(HKCR)\\Filter 35 -1 false ID45 $(HKCR)\\Folder 35 -1 false ID45 $(HKCR)\\Interface 35 -1 false ID45 $(HKCR)\\Typelib 35 0 false ID45 $(HKCR)\\ldap 35 -1 false ID45 $(HKCR)\\LDAPNamespace 35 -1 false ID45 $(HKCR)\\lnkfile 35 -1 false ID45 $(HKCR)\\Media Type 35 -1 false ID45 $(HKCR)\\MIME 35 -1 false ID45 $(HKCR)\\NDS 35 -1 false ID45 $(HKCR)\\NDSNamespace 35 -1 false ID45 $(HKCR)\\Network 35 -1 false ID45 $(HKCR)\\Pathname 35 -1 false ID45 $(HKCR)\\PROTOCOLS 35 -1 false ID45 $(HKCR)\\SecurityDescriptor 35 -1 false ID45 $(HKCR)\\Shell.Application 35 -1 false ID45 $(HKCR)\\Shell.Explorer 35 -1 false ID45 $(HKCR)\\txtfile 35 -1 false ID45 $(HKCR)\\Unknown 35 -1 false ID45 $(HKCR)\\WinNT 35 -1 false ID45 $(HKCR)\\WinNTNamespace 35 -1 false ID45 0 $(HKLM_WCV)\\Run 10000 -1 false ID35 $(HKLM_WCV)\\RunOnce 10000 -1 false ID35 $(HKLM_WCV)\\RunOnceEx 10000 -1 false ID35 $(HKCU_WCV)\\Run 10000 -1 false ID35 $(HKCU_WCV)\\RunOnce 10000 -1 false ID35 $(HKLM_WNTCV)\\IniFileMapping 10000 -1 false ID35 $(HKCU)\\Control Panel\\Desktop|ScreenSaveActive 10000 -1 false ID35 $(HKCU)\\Control Panel\\Desktop|ScreenSaverIsSecure 10000 -1 false ID35 $(HKCU)\\Control Panel\\Desktop|ScreenSaveTimeOut 10000 -1 false ID35 0 $(HKLM_CCS)\\Control\\FileSystem 10000 -1 false ID35 $(HKLM_CCS)\\Control\\NetworkProvider 10000 -1 false ID35 $(HKLM_CCS)\\Control\\Print\\Providers\\Lanman Print Services 10000 -1 false ID35 $(HKLM_CCS)\\Control\\SecurePipeServers 10000 -1 false ID35 $(HKLM_CCS)\\Control\\Windows 10000 -1 false ID35 $(HKLM_CCS_SM)\\Environment 10000 -1 false ID35 $(HKLM_CCS_SM)\\Executive 10000 -1 false ID35 $(HKLM_CCS_SM)\\KnownDLLs 10000 -1 false ID35 $(HKLM_CCS_SM)\\Memory Management|ClearPageFileAtShutdown 10000 -1 false ID35 $(HKLM_CCS_SM)\\SubSystems 10000 -1 false ID35 $(HKCU_WCV)\\Shell Extensions 10000 -1 false ID35 $(HKLM_WNTCV)\\Image File Execution Options 10000 -1 false ID35 $(HKLM_WNTCV)\\Hotfix 10000 -1 false ID35 $(HKLM_CCS)\\Control\\Windows|ShutdownTime true 0 $(HKCU)\\Environment 15 -1 false ID35 $(HKCU)\\Software\\Microsoft\\RegEdt32 15 -1 false ID35 $(HKCU)\\Software\\Microsoft\\SystemCertificates 15 -1 false ID35 $(HKCU_WCV)\\WinTrust 15 -1 false ID35 $(HKCU_WNTCV)\\Network\\Persistent Connections 15 -1 false ID35 $(HKCU_WNTCV)\\Winlogon 15 -1 false ID35 $(HKCU_WNTCV)\\Winlogon|DCacheUpdate 15 -1 false ID39 0 $(HKLM_EventLog)\\Application\\Tripwire 10000 -1 false ID35 $(HKLM_EventLog)\\Application\\Tripwire Agent 10000 -1 false ID35 $(HKLM_EventLog)\\Application\\TripwireAdminUtility 10000 -1 false ID35 $(HKLM_EventLog)\\Application\\TripwirePrintUtility 10000 -1 false ID35 $(HKLM_EventLog)\\Application\\twagent 10000 -1 false ID35 $(HKLM_EventLog)\\Security\\Tripwire_sec 10000 -1 false ID35 $(HKLM_EventLog)\\Security\\TripwireAdminUtility_sec 10000 -1 false ID35 $(HKLM_EventLog)\\Security\\TripwirePrintUtility_sec 10000 -1 false ID35 $(HKLM_EventLog)\\Security\\twagent_sec 10000 -1 false ID35 $(HKLM_EventLog)\\System\\TripwireAdminUtility_sys 10000 -1 false ID35 $(HKLM_EventLog)\\System\\TripwirePrintUtility_sys 10000 -1 false ID35 $(HKLM_EventLog)\\System\\twagent_sys 10000 -1 false ID35 $(HKLM_CCS)\\Control\\LSA\\Audit\\Sources\\TripwireAdminUtility_sec 10000 -1 false ID35 $(HKLM_CCS)\\Control\\LSA\\Audit\\Sources\\TripwirePrintUtility_sec 10000 -1 false ID35 $(HKLM_CCS)\\Control\\LSA\\Audit\\Sources\\twagent_sec 10000 -1 false ID35 $(HKLM_Services)\\twagent 10000 -1 false ID35 IET XP/2003 Hourly rules - v1.1 TFS - RrothymcsCugdsMSnx 2 Owner Create Temp Read-Only Archive Stream Count Compressed SACL System Write Group DACL Hidden Offline Stream MD5 1 Owner Create Temp Read-Only Archive Stream Count SACL Compressed MD5 SHA-1 System Write Group DACL Size Hidden Offline Stream MD5 TFS - rohymcsugdsMnx 2 DACL Owner Create Read-Only Stream Count SACL Hidden Offline System Write Stream MD5 Group 1 Owner Create Read-Only Stream Count SACL MD5 System Write Group DACL Size Hidden Offline Stream MD5 TFS - rothycugds 2 DACL Owner Create Read-Only Temp SACL Hidden Offline System Group 1 DACL Owner Create Read-Only Temp SACL Hidden Offline System Group TFS - rohycsugdsMnx 2 DACL Owner Create Read-Only Stream Count SACL Hidden Offline System Stream MD5 Group 1 Owner Create Read-Only Stream Count SACL MD5 System Group DACL Size Hidden Offline Stream MD5 TFS - ugdsTM 2 DACL Owner SACL Group 1 Data Type MD5 TFS - ugdsmTM 2 DACL Owner SACL Write Group 1 Data Type MD5 TFS - ugdsT 2 DACL Owner SACL Group 1 Data Type TFS - ugdsmTMS 2 DACL Owner SACL Write Group 1 Data Type SHA-1 MD5 TFS - ugdT 2 DACL Owner Group 1 Data Type