Current File : //lib/python2.7/site-packages/salt/modules/win_lgpo.pyc
�
���^c @@ sE d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l m Z m Z d d l m Z d d l j j Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z e j! e" � Z# d Z$ i d d
6Z% e j& � j' Z( i i e) 6i e* 6Z+ i Z, e* Z- e. Z/ e. Z0 e. Z1 e. Z2 e. Z3 e. Z4 e. Z5 e. Z6 e. Z7 e. Z8 e. Z9 e. Z: e. Z; e. Z< e. Z= e. Z> e. Z? e. Z@ e. ZA e. ZB e. ZC e. ZD y�d d lE ZE d d lF ZF d d lG ZG d d lH ZH d d lG mI ZI d d lJ mK ZK e) Z- eI jL d
� Z/ eI jL d � Z0 eI jL d � Z1 eI jL d � Z2 eI jL d � Z3 eI jL d � Z4 eI jL d � Z5 eI jL d � Z6 eI jL d � Z7 eI jL d � Z8 eI jL d � Z9 eI jL d � Z: eI jL d � Z; eI jL d � Z< eI jL d � Z= eI jL d � Z> eI jL d � Z? eI jL d � Z@ eI jL d � ZA eI jL d � ZB eI jL d! � ZC eI jL d" � ZD e jM jN ZM e
jO jP eM jQ � d# � jR d$ d% � ZS Wn eT k
r�e* Z- n Xd& eU f d' � � YZV d( � ZW d) � ZX d* � ZY d+ � ZZ d, d- d. � Z[ d, d- d/ � Z\ d, d- d0 � Z] d1 � Z^ e. d2 � Z_ d3 � Z` d4 � Za d5 � Zb d6 � Zc d7 � Zd d8 � Ze d9 � Zf d: � Zg d; � Zh d< � Zi d= � Zj d> � Zk d? � Zl d@ � Zm dA � Zn dB � Zo dC � Zp dD � Zq dE � Zr e* dF � Zs e) dG � Zt e* e) dH � Zu dI � Zv e* dJ � Zw e* e. dK � Zx d- e* e* e* dL � Zy dM � Zz dN � Z{ dO � Z| dP � Z} dQ � Z~ dR � Z e* dS � Z� d- dT dU � Z� dV � Z� e* dW � Z� d- dX � Z� d- dY � Z� e. e) e* d- e* dZ � ZP e) d- d[ � Z� d- d\ � Z� e. e. e) d- d] � Z� d S(^ u%
Manage Local Policy on Windows
This module allows configuring local group policy (i.e. ``gpedit.msc``) on a
Windows server.
.. versionadded:: 2016.11.0
Administrative Templates
========================
Administrative template policies are dynamically read from ADMX/ADML files on
the server.
Windows Settings
================
Policies contained in the "Windows Settings" section of the ``gpedit.msc`` GUI
are statically defined in this module. Each policy is configured for the section
(Machine/User) in the module's _policy_info class. The ``_policy_info`` class
contains a "policies" dict on how the module will configure the policy, where
the policy resides in the GUI (for display purposes), data validation data, data
transformation data, etc.
Current known limitations
=========================
- At this time, start/shutdown scripts policies are displayed, but are not
configurable.
- Not all "Security Settings" policies exist in the _policy_info class
:depends:
- pywin32 Python module
- lxml
- uuid
- struct
- salt.utils.win_reg
i ( t absolute_importt unicode_literalst print_functionN( t CommandExecutionErrort SaltInvocationError( t deserialize( t six( t rangeu lgpou setu set_( t etree( t Registryu .//*[local-name() = "trueValue"]u! .//*[local-name() = "falseValue"]u .//*[local-name() = "elements"]u# .//*[local-name() = "enabledValue"]u$ .//*[local-name() = "disabledValue"]u" .//*[local-name() = "enabledList"]u# .//*[local-name() = "disabledList"]u .//*[local-name() = "value"]u .//*[local-name() = "trueList"]u .//*[local-name() = "falseList"]up //*[translate(@*[local-name() = "key"], "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz") = $keyvalue]u //*[@key = $keyvalue]u$ ancestor::*[local-name() = "policy"]uv //*[local-name() = "policy" and (@*[local-name() = "class"] = "Both" or @*[local-name() = "class"] = $registry_class)]uQ //*[local-name() = $displayNameType and @*[local-name() = "id"] = $displayNameId]u .//*[local-name() = "valueList"]uP .//*[local-name() = "item" and @*[local-name() = "displayName" = $display_name]]u� //*[local-name() = "policy" and @*[local-name() = "name"] = $policy_name and (@*[local-name() = "class"] = "Both" or @*[local-name() = "class"] = $registry_class)]uB //*[starts-with(text(), $policy_name) and @*[local-name() = "id"]]u� //*[local-name() = "policy" and @*[local-name() = "displayName"] = $display_name and (@*[local-name() = "class"] = "Both" or @*[local-name() = "class"] = $registry_class) ]u* ancestor::*[local-name() = "presentation"]u .//*[local-name() = "text"]u en_USu _u -t _policy_infoc B@ sa e Z d Z d � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z
e d � � Z e d � � Z e d
� � Z
e d � � Z e d � � Z e d
� � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z RS( um
Policy Helper Class
===================
The format of the policy dict is as follows:
The top most two key/value pairs in the dict divide the policies object into
the two sections of local group policy, using the keys "Machine" and "User".
The value make-up of these dicts are described below in "Policy Section
Definition"
Policy Section Definition
-------------------------
A policy section dict has two required key/value pairs:
============ ==============================================================
Key
============ ==============================================================
lgpo_section String matching how the policy section is displayed in the mmc
snap-in ("Computer Configuration" for "Machine" and "User
Configuration" for "User")
policies a dict containing the non-Administrative template policy
definitions, the key for each item is a short/unique
identifier for the policy, the value is described below in
"Policies Definition"
============ ==============================================================
Policies Definition
-------------------
A policies definition item describes the particular policy. There are three
child key/value pairs shared with all policy types:
============ ==============================================================
Key Value
============ ==============================================================
lgpo_section A list containing the hierarchical path to the policy in the
gpedit mmc snap-in.
Policy A string containing the name of the policy in the gpedit mmc
snap-in
Settings An object which describes valid settings for the policy. This
can be None for no validation, a list of possible settings, or
a dict with the following key/value pairs:
- **Function:** The class function to use to validate the
setting
- **Args:** A dict of kwargs to pass to the class function
============ ==============================================================
Additionally, each policies definition will contain a key/value pair that
defines the mechanism that will be used to configure the policy. The
available mechanisms are: NetUserModal, Registry, Secedit, and LsaRights
Registry Mechanism
------------------
Some policies simply set values in the Windows registry. The value of this
key is a dict with the following make-up:
===== =====================================================================
Key Value
===== =====================================================================
Hive A string containing the Registry hive, such as ``HKEY_LOCAL_MACHINE``
Path A string containing the registry key path, such as
``SYSTEM\\CurrentControlSet\\Control\\Lsa``
Value A string containing the name of the registry value, such as
**restrictanonymous**
Type A string containing the registry type of the value, such as
``REG_DWORD``
===== =====================================================================
Secedit Mechanism
-----------------
Some policies are configurable via the "secedit.exe" executable. The value
of this key is a dict with the following make-up:
======= ===================================================================
Key Value
======= ===================================================================
Option A string containing the name of the policy as it appears in an
export from secedit, such as **PasswordComplexity**
Section A string containing the name of the section in which the "Option"
value appears in an export from ``secedit``, such as "System
Access"
======= ===================================================================
LsaRights Mechanism
-------------------
LSA Rights policies are configured via the LsaRights mechanism. The value of
this key is a dict with the following make-up:
====== ====================================================================
Key Value
====== ====================================================================
Option A string containing the programmatic name of the Lsa Right, such as
**SeNetworkLogonRight**
====== ====================================================================
NetUserModal Mechanism
----------------------
Some policies are configurable by the **NetUserModalGet** and
**NetUserModalSet** function from pywin32. The value of this key is a dict
with the following make-up:
====== ====================================================================
Key Value
====== ====================================================================
Modal The modal "level" that the particular option is specified in (0-3),
see `here <https://msdn.microsoft.com/en-us/library/windows/desktop/
aa370656(v=vs.85).aspx>`_
Option The name of the structure member which contains the data for the
policy, for example **max_passwd_age**
====== ====================================================================
NetSH Mechanism
---------------
The firewall policies are configured by the ``netsh.exe`` executable. The
value of this key is a dict with the following make-up:
======= ===================================================================
Key Value
======= ===================================================================
Profile The firewall profile to modify. Can be one of Domain, Private, or
Public
Section The section of the firewall to modify. Can be one of state,
firewallpolicy, settings, or logging.
Option The setting within that section
Value The value of the setting
======= ===================================================================
More information can be found in the advfirewall context in netsh. This can
be access by opening a netsh prompt. At a command prompt type the following:
c:\>netsh
netsh>advfirewall
netsh advfirewall>set help
netsh advfirewall>set domain help
AdvAudit Mechanism
------------------
The Advanced Audit Policies are configured using a combination of the
auditpol command-line utility and modifying the audit.csv file in two
locations. The value of this key is a dict with the following make-up:
====== ===================================
Key Value
====== ===================================
Option The Advanced Audit Policy to modify
====== ===================================
Transforms
----------
Optionally, each policy definition can contain a "Transform" key. The
Transform key is used to handle data that is stored and viewed differently.
This key's value is a dict with the following key/value pairs:
=== =======================================================================
Key Value
=== =======================================================================
Get The name of the class function to use to transform the data from the
stored value to how the value is displayed in the GUI
Put The name of the class function to use to transform the data supplied by
the user to the correct value that the policy is stored in
=== =======================================================================
For example, "Minimum password age" is stored in seconds, but is displayed
in days. Thus the "Get" and "Put" functions for this policy do these
conversions so the user is able to set and view the policy using the same
data that is shown in the GUI.
c C@ s�\ i d d 6d d 6d d 6d d 6d d 6d d 6| _ i d
d 6d d 6d d 6d d 6d d 6| _ i d
d 6d d 6d d 6d d 6d d 6d d 6| _ i d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6| _ i d d 6d d 6d d 6d d 6d d 6| _ i d d 6d d 6d d 6d d 6| _ i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6| _ i d$ d 6d d 6d d 6d d 6d d 6| _
i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6| _ i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6| _ i d d% 6d d& 6d d 6d d 6| _
i d d 6d d 6i | j
d 6t d! 6d" 6i | j
d 6t d! 6d# 6| _ d' d( d) d* d+ g | _ d' d( d) d, d- g | _ d' d( d) d. d/ g | _ d' d( d) d* d0 g | _ d' d( d) d1 d2 g | _ d' d( d) d. d3 g | _ d' d( d) d* d4 g | _ i d5 d 6d6 d 6d7 d 6d d 6d d 6| _ i d8 d 6d9 d 6d d 6d d 6| _ i d: d 6d; d 6d< d 6d d 6d d 6| _ i d= d 6d> d 6d? d 6d d 6d d 6| _ i d@ d 6dA d 6d d 6d d 6| _ i dB d 6dC d 6dD d 6d d 6d d 6| _ i dE dF 6dG dH 6dI dJ 6dK dL 6| _ i dM dN 6dO dP 6dK dL 6| _ i dQ dR 6dS dT 6dK dL 6| _ i dU dR 6dV dT 6dK dL 6| _ i dU dR 6dS dT 6dK dL 6| _ i dW dX 6d: dY 6dK dL 6| _! i dZ d 6d[ d 6d\ d 6d] d 6d^ d_ 6d` da 6db dc 6d d 6d d 6| _" i dd d 6de d 6df d 6dg d 6dh d 6di d 6d d 6d d 6| _# i d8 d 6dj d 6d9 d 6d d 6d d 6| _$ i dZ d 6dk dl 6dm dn 6d d 6d d 6| _% i do d 6dp d 6dq d 6d d 6d d 6| _& i do d 6dr d 6ds d 6dt d 6du dv 6d d 6d d 6| _' i dw d 6dx d 6dy d 6d d 6d d 6| _( i do d 6dz d 6d{ d 6d| d 6d} dv 6d d 6d d 6| _) i dw d 6d~ d 6d} d 6d d 6d d 6| _* i d d 6d d 6| _+ i d d 6d d 6i | j+ d 6t d! 6d" 6i | j+ d 6t d! 6d# 6| _, i i d' d 6i� i d� d� 6d' d( d� d� g d 6i d� d� 6t- j. j/ t- j0 d� � d� d� d� d� d� � d� 6d� 6d� 6i d� d� 6d' d( d� d� g d 6i d� d� 6t- j. j/ t- j0 d� � d� d� d� d� d� � d� 6d� 6d� 6i d� d� 6d' d( d� d� g d 6i t- j. j/ t- j0 d� � d� d� d� d� d� � d� 6d� d� 6d� d� 6d� d� d g d� 6d� 6i d� d 6d� d 6d� 6d� 6i d� d� 6d' d( d� d� g d 6i d� d� 6t- j. j/ t- j0 d� � d� d� d� d� d� � d� 6d� 6d� 6i d� d� 6d' d( d� d� g d 6i d� d� 6t- j. j/ t- j0 d� � d� d� d� d� d� � d� 6d� 6d� 6i d� d� 6d' d( d� d� g d 6i t- j. j/ t- j0 d� � d� d� d� d� d� � d� 6d� d� 6d� d� 6d� d� d g d� 6d� 6i d� d 6d� d 6d� 6d� 6i d� d� 6| j d 6| j+ j1 � d� 6i d� d� 6d� d� 6d� 6| j, d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6| j d� 6d� 6i d� d� 6| j d 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6i d� d 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6| j d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6| j d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6| j d� 6d� 6i d� d� 6| j d 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6i d� d 6d� 6d� 6i d� d� 6| j d 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6i d� d 6d� 6d� 6i d� d� 6| j d 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6i d� d 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6| j d� 6d� 6i d� d� 6| j d 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6i d� d 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j! j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j! d 6t d! 6d" 6i | j! d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j! j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j! d 6t d! 6d" 6i | j! d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j! j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j! d 6t d! 6d" 6i | j! d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d� 6i d� d� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d 6i dd� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d6i dd� 6| j d 6d d� 6i d� d� 6dd� 6dd� 6d� 6d6i dd� 6| j d 6d d� 6i d� d� 6dd� 6dd� 6d� 6d6i d d� 6| j d 6d d� 6i d� d� 6dd� 6dd� 6d� 6d
6i d d� 6| j d 6d d� 6i d� d� 6dd� 6d d� 6d� 6d
6i dd� 6| j d 6d d� 6i d� d� 6dd� 6d d� 6d� 6d6i dd� 6| j d 6d d� 6i d� d� 6dd� 6d d� 6d� 6d6i dd� 6| j d 6| j j1 � d� 6i d� d� 6dd� 6dd� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d6i dd� 6| j d 6| j j1 � d� 6i d� d� 6dd� 6dd� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d6i dd� 6| j d 6| j j1 � d� 6i d� d� 6dd� 6dd� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d6i dd� 6| j d 6| j j1 � d� 6i d� d� 6dd� 6dd� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d6i d d� 6| j d 6| j j1 � d� 6i d� d� 6dd� 6dd� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d 6i d d� 6| j d 6| j j1 � d� 6i d� d� 6dd� 6dd� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d 6i d d� 6| j d 6i d!d"6i d d#6d$d%6d&6d� 6i d d'6d(d� 6d)6d*6i d+d� 6| j d 6i d!d"6i d d#6d,d%6d-d.6d&6d� 6i d d'6d/d� 6d)6i d0d 6d1d 6i d-d.6d" 6i d-d.6d# 6d� 6d26i d3d� 6| j d 6i d!d"6i d d#6d,d%6d&6d� 6i d d'6d4d� 6d)6i d0d 6d1d 6d� 6d56i d6d� 6| j d 6i d!d"6i d d#6d7d%6d&6d� 6i d d'6d8d� 6d)6d96i d:d� 6| j d 6| j+ j1 � d� 6i d;d� 6d� d� 6d� 6| j, d� 6d;6i d<d� 6| j d 6| j+ j1 � d� 6i d=d� 6d� d� 6d� 6| j, d� 6d>6i d?d� 6| j+ j1 � d� 6| j d 6i d@d� 6d� d� 6d� 6| j, d� 6dA6i dBd� 6| j j1 � d� 6| j d 6i d� d� 6dCd� 6dDd� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6dD6i dEd� 6| j+ j1 � d� 6| j d 6i dFd� 6d� d� 6d� 6| j, d� 6dG6i dHd� 6| j d 6| j j1 � d� 6i d� d� 6d� d� 6dId� 6d� d� 6d� 6| j d� 6dJ6i dKd� 6d d� 6| j d 6i dLd� 6d� d� 6d� 6i dMd 6dNd 6d� 6dO6i dPd� 6d d� 6| j d 6i dQd� 6d� d� 6d� 6i dMd 6dNd 6d� 6dR6i dSd� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6dTd� 6d� d� 6d� 6| j d� 6dT6i dUd� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6dTd� 6d� d� 6d� 6| j d� 6dV6i dWd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dYd� 6d� d� 6d� 6| j d� 6dY6i dZd� 6i d!d"6i d d#6d[d%6d&6d� 6| j d 6i d� d� 6d\d� 6d]d� 6d� d� 6d� 6d]6i d^d� 6| j j1 � d� 6| j d 6i d� d� 6d\d� 6d_d� 6d� d� 6d� 6| j d� 6d_6i d`d� 6| j j1 � d� 6| j d 6i d� d� 6d\d� 6dad� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6da6i dbd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dcd� 6d� d� 6d� 6| j d� 6dc6i ddd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6ded� 6d� d� 6d� 6| j d� 6de6i dfd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dgd� 6d� d� 6d� 6| j d� 6dg6i dhd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6did� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6di6i djd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dkd� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6dk6i dld� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dmd� 6d� d� 6d� 6| j d� 6dm6i dnd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dod� 6d� d� 6d� 6| j d� 6do6i dpd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dqd� 6d� d� 6d� 6| j d� 6dq6i drd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dsd� 6d� d� 6d� 6| j d� 6ds6i dtd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dud� 6d� d� 6d� 6| j d� 6du6i dvd� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6dwd� 6d� d� 6d� 6| j d� 6dw6i dxd� 6i d!d"6i d d#6dyd%6d&6d� 6| j d 6i d� d� 6d\d� 6dzd� 6d� d� 6d� 6dz6i d{d� 6i d!d"6i d d#6dyd%6d&6d� 6| j d 6i d� d� 6dCd� 6d|d� 6d� d� 6d� 6d|6i d}d� 6i d!d"6i d d#6d~d%6d&6d� 6| j d 6i d� d� 6dCd� 6dd� 6d� d� 6d� 6d6i d�d� 6| j d 6i d� d� 6dCd� 6d�d� 6d� d� 6d� 6i d� d 6d� 6d�6i d�d� 6| j d 6i d� d� 6dCd� 6d�d� 6d� d� 6d� 6i d� d 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6dCd� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6i d!d"6i d d#6d�d%6d&6d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j
d 6t d! 6d" 6i | j
d 6t d! 6d# 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d�6i d�d� 6t2 d � t2 d � g d� 6| j d 6i d� d� 6d� d� 6d�d� 6d�d� 6d� 6i d�d 6d�d 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6dXd� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6d�d% d& d�g d� 6| j d 6i d� d� 6d\d� 6d�d� 6d� d� 6d� 6i d�d 6d�d 6d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d\d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d\d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6d�d�t2 d � d�t2 d � g d� 6| j d 6i d�d� 6d�d� 6d� 6i d�d 6d�d 6d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6i d!d"6i d d#6dyd%6d&6d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6d�6i d�d� 6| j
j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j d 6i d!d"6i d d#6d�d%6d&6d� 6i d d'6d�d� 6d)6i d�d 6d�d 6d� 6d�6i d�d� 6| j d 6i d!d"6i d d#6d�d%6d&6d� 6i d d'6d�d� 6d)6d�6i d�d� 6| j d 6i d!d"6i d d#6d�d%6d&6d� 6i d d'6d�d� 6d)6i d�d 6d�d 6d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�6| j d� 6d�6i d�d� 6| j d 6| j j1 � d� 6i d�d� 6d�6| j d� 6d�6i d d� 6| j d 6| j j1 � d� 6i d d� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d 6i d
d� 6| j d 6| j j1 � d� 6i d
d� 6d�6| j d� 6d 6i d d� 6| j d 6| j j1 � d� 6i d d� 6d�6| j d� 6d
6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i dd� 6| j d 6| j j1 � d� 6i dd� 6d�6| j d� 6d6i d d� 6| j d 6| j j1 � d� 6i d d� 6d�6| j d� 6d 6i d d� 6| j d 6| j j1 � d� 6i d d� 6d�6| j d� 6d 6i d d� 6| j d 6| j j1 � d� 6i d d� 6d�6| j d� 6d!6i d"d� 6| j d 6| j j1 � d� 6i d"d� 6d�6| j d� 6d#6i d$d� 6| j d 6| j j1 � d� 6i d$d� 6d�6| j d� 6d%6i d&d� 6| j d 6| j j1 � d� 6i d&d� 6d�6| j d� 6d'6i d(d� 6| j d 6| j j1 � d� 6i d(d� 6d�6| j d� 6d)6i d*d� 6| j d 6| j j1 � d� 6i d*d� 6d�6| j d� 6d+6i d,d� 6| j d 6| j j1 � d� 6i d,d� 6d�6| j d� 6d-6i d.d� 6| j d 6| j j1 � d� 6i d.d� 6d�6| j d� 6d/6i d0d� 6| j d 6| j j1 � d� 6i d0d� 6d�6| j d� 6d16i d2d� 6| j d 6| j j1 � d� 6i d2d� 6d�6| j d� 6d36i d4d� 6| j d 6| j j1 � d� 6i d4d� 6d�6| j d� 6d56i d6d� 6| j d 6| j j1 � d� 6i d6d� 6d�6| j d� 6d76i d8d� 6| j d 6| j j1 � d� 6i d8d� 6d�6| j d� 6d96i d:d� 6| j d 6| j j1 � d� 6i d:d� 6d�6| j d� 6d;6i d<d� 6| j d 6| j j1 � d� 6i d<d� 6d�6| j d� 6d=6i d>d� 6| j d 6| j j1 � d� 6i d>d� 6d�6| j d� 6d?6i d@d� 6| j d 6| j j1 � d� 6i d@d� 6d�6| j d� 6dA6i dBd� 6| j d 6| j j1 � d� 6i dBd� 6d�6| j d� 6dC6i dDd� 6| j d 6| j j1 � d� 6i dDd� 6d�6| j d� 6dE6i dFd� 6| j d 6| j j1 � d� 6i dFd� 6d�6| j d� 6dG6i dHd� 6| j d 6| j j1 � d� 6i dHd� 6d�6| j d� 6dI6i dJd� 6| j d 6| j j1 � d� 6i dJd� 6d�6| j d� 6dK6i dLd� 6| j d 6| j j1 � d� 6i dLd� 6d�6| j d� 6dM6i dNd� 6| j d 6| j j1 � d� 6i dNd� 6d�6| j d� 6dO6i dPd� 6| j d 6| j j1 � d� 6i dPd� 6d�6| j d� 6dQ6i dRd� 6| j d 6| j j1 � d� 6i dRd� 6d�6| j d� 6dS6i dTd� 6| j d 6| j j1 � d� 6i dTd� 6d�6| j d� 6dU6i dVd� 6| j d 6| j j1 � d� 6i dVd� 6d�6| j d� 6dW6i dXd� 6| j d 6| j j1 � d� 6i dXd� 6d�6| j d� 6dY6i dZd� 6| j d 6| j j1 � d� 6i dZd� 6d�6| j d� 6d[6i d\d� 6| j d 6| j j1 � d� 6i d\d� 6d�6| j d� 6d]6i d^d� 6| j d 6| j j1 � d� 6i d^d� 6d�6| j d� 6d_6i d`d� 6| j d 6| j j1 � d� 6i d`d� 6d�6| j d� 6da6i dbd� 6| j d 6| j j1 � d� 6i dbd� 6d�6| j d� 6dc6i ddd� 6| j d 6| j j1 � d� 6i ddd� 6d�6| j d� 6de6i dfd� 6| j d 6| j j1 � d� 6i dfd� 6d�6| j d� 6dg6i dhd� 6| j d 6d d� 6i did� 6dj6i dkd 6dld 6d� 6di6i dmd� 6| j d 6d d� 6i dnd� 6dj6i dkd 6dld 6d� 6dn6i dod� 6| j d 6d d� 6i dpd� 6dj6i dkd 6dld 6d� 6dp6i dqd� 6| j d 6d d� 6i drd� 6dj6i dkd 6dld 6d� 6dr6i dsd� 6| j d 6d d� 6i dtd� 6dj6i dkd 6dld 6d� 6dt6i dud� 6| j d 6d d� 6i dvd� 6dj6i dkd 6dld 6d� 6dv6i dwd� 6| j d 6d d� 6i dxd� 6dj6i dkd 6dld 6d� 6dx6i dyd� 6| j d 6d d� 6i dzd� 6dj6i dkd 6dld 6d� 6dz6i d{d� 6| j d 6d d� 6i d|d� 6dj6i dkd 6dld 6d� 6d|6i d}d� 6| j d 6d d� 6i d~d� 6dj6i dkd 6dld 6d� 6d~6i dd� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j d 6d d� 6i d�d� 6dj6i dkd 6dld 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j d 6t d! 6d" 6i | j d 6t d! 6d# 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6d d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d� d 6d� 6d�6i d�d� 6d d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d� d 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6d d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d�d 6d�d 6i | j" d 6t d! 6d" 6i | j" d 6t d! 6d# 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6| j d� 6d�6i d�d� 6| j d 6| j+ j1 � d� 6i d�d� 6d� d� 6d� 6| j, d� 6d�6i d�d� 6| j# j1 � d� 6| j d 6i d� d� 6d� d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j# d 6t d! 6d" 6i | j# d 6t d! 6d# 6d� 6d�6i d�d� 6| j$ j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j$ d 6t d! 6d" 6i | j$ d 6t d! 6d# 6d� 6d�6i d�d� 6d d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d�d 6d�d 6i | j% d 6t d! 6d" 6i | j% d 6t d! 6d# 6d� 6d�6i d�d� 6d d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d�d 6d�d 6i | j% d 6t d! 6d" 6i | j% d 6t d! 6d# 6d� 6d�6i d�d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d� d 6d� 6d�6i d�d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d� d 6d� 6d�6i d�d� 6| j& j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j& d 6t d! 6d" 6i | j& d 6t d! 6d# 6d� 6d�6i d�d� 6| j' j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j' d 6t d! 6d" 6i | j' d 6t d! 6d# 6d� 6d�6i d�d� 6| j( j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j( d 6t d! 6d" 6i | j( d 6t d! 6d# 6d� 6d�6i d�d� 6| j) j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j) d 6t d! 6d" 6i | j) d 6t d! 6d# 6d� 6d�6i d�d� 6| j* j1 � d� 6| j d 6i d� d� 6d�d� 6d�d� 6d� d� 6d� 6i d d 6d d 6i | j* d 6t d! 6d" 6i | j* d 6t d! 6d# 6d� 6d�6i d�d� 6| j j1 � d� 6| j d 6i d� d� 6dCd� 6d d� 6d� d� 6d� 6| j d� 6d 6i dd� 6| j j1 � d� 6| j d 6i d� d� 6dd� 6dd� 6d� d� 6d� 6| j d� 6d6i dd� 6| j j1 � d� 6| j d 6i d� d� 6dd� 6dd� 6d� d� 6d� 6| j d� 6d6i dd� 6| j j1 � d� 6| j d 6i d� d� 6dd� 6d d� 6d� d� 6d� 6| j d� 6d 6i d
d� 6| j d 6i d� d� 6d d� 6d d� 6d� d� 6d� 6i d� d 6d� 6d
6i dd� 6| j j1 � d� 6| j d 6i d� d� 6dd� 6dd� 6d� d� 6d� 6| j d� 6d6d6d� 6i dd 6i d6d6| _3 i i t- j. j/ t- j0 d� � d� d� dd� d6dd6dd 6dd6dd6d6i t- j. j/ t- j0 d� � d� d� d� d� d6d� d6d' d 6d d6d d6d� 6| _4 d | _5 t- j. j/ t- j0 d� � d� d� d � | _6 d S( Nu No auditingi u Successi u Failurei u Success, Failurei u Not Definedu No Auditingu Success and Failureu Not Configuredu No Actionu Lock Workstationu Force Logoffu/ Disconnect if a Remote Desktop Services sessionu (value not set)u Elevate without promptingu, Prompt for credentials on the secure desktopu( Prompt for consent on the secure desktopu Prompt for credentialsu Prompt for consenti u+ Prompt for consent for non-Windows binariesi u% Automatically deny elevation requestsu Disabledu Enabledu _dict_lookupu Getu Putu lookupu value_lookupu GetArgsu PutArgsu Defaultu 0u 1u Computer Configurationu Windows Settingsu Security Settingsu Local Policiesu Security Optionsu' Windows Firewall with Advanced SecurityuC Windows Firewall with Advanced Security - Local Group Policy Objectu Account Policiesu Password Policyu Audit Policyu# Advanced Audit Policy Configurationu1 System Audit Policies - Local Group Policy Objectu Account Lockout Policyu User Rights Assignmentu This policy is disabledu" Users can't add Microsoft accountsu1 Users can't add or log on with Microsoft accountsu Noneu Require signingu Offu Accept if provided by clientu Require from clientu( User display name, domain and user namesu User display name onlyu Do not display user informationu0 Classic - local users authenticate as themselvesu. Guest only - local users authenticate as Guestu< User input is not required when new keys are stored and usedu+ User is prompted when the key is first usedu3 User must enter a password each time they use a keyu Block (default)u blockinboundu Block all connectionsu blockinboundalwaysu Allowu allowinboundu Not configuredu
notconfiguredu Blocku
blockoutboundu Allow (default)u
allowoutboundu
Yes (default)u enableu Nou disableu Yesu No (default)u On (recommended)u onu offu
No minimumu DES_CBC_CRCu DES_CBD_MD5u RC4_MHAC_MD5u AES128_HMAC_SHA1i u AES256_HMAC_SHA1i u Future Encryption Typesi�u Send LM & NTLM responseu: Send LM & NTLM - use NTLMv2 session security if negotiatedu Send NTLM response onlyu Send NTLMv2 response onlyu$ Send NTLMv2 response only. Refuse LMu+ Send NTLMv2 response only. Refuse LM & NTLMu Negotiate signingu Require NTLMv2 session securityi u Require 128-bit encryptioni u Disableu# Enable auditing for domain accountsu Enable auditing for all accountsu, Enable for domain accounts to domain serversu Enable for domain accountsu Enable for domain serversu
Enable alli u Allow allu Deny all domain accountsu Deny all accountsu* Deny for domain accounts to domain serversu Deny for domain accountsu Deny for domain serversu Deny allu Audit allu lgpo_sectionu Startup Scriptsu Policyu Scripts (Startup/Shutdown)u Startupu Sectionu WINDIRu System32u GroupPolicyu Machineu Scriptsu scripts.iniu IniPathu ScriptIniu StartupScriptsu Startup Powershell Scriptsu
psscripts.iniu StartupPowershellScriptsu: Startup - For this GPO, run scripts in the following orderu
ScriptsConfigu StartExecutePSFirstu SettingNameu trueu falseu Settingsu# _powershell_script_order_conversionu+ _powershell_script_order_reverse_conversionu Transformu StartupPowershellScriptOrderu Shutdown Scriptsu Shutdownu ShutdownScriptsu Shutdown Powershell Scriptsu ShutdownPowershellScriptsu; Shutdown - For this GPO, run scripts in the following orderu EndExecutePSFirstu ShutdownPowershellScriptOrderu4 Network access: Allow anonymous SID/Name translationu LSAAnonymousNameLookupu Optionu
System Accessu SecedituB Network access: Do not allow anonymous enumeration of SAM accountsu HKEY_LOCAL_MACHINEu Hiveu$ SYSTEM\CurrentControlSet\Control\Lsau Pathu RestrictAnonymousSamu Valueu REG_DWORDu Typeu RegistryuD Network access: Restrict clients allowed to make remote calls to SAMu$ System\CurrentControlSet\Control\Lsau RestrictRemoteSAMu REG_SZu _string_put_transformuM Network access: Do not allow anonymous enumeration of SAM accounts and sharesu RestrictAnonymousu\ Network access: Do not allow storage of passwords and credentials for network authenticationu DisableDomainCredsuA Network access: Let Everyone permissions apply to anonymous usersu everyoneincludesanonymousu EveryoneIncludesAnonymousu< Network access: Named Pipes that can be accessed anonymouslyu9 SYSTEM\CurrentControlSet\Services\LanmanServer\Parametersu NullSessionPipesu REG_MULTI_SZu _multi_string_put_transformu2 Network access: Remotely accessible registry pathsuK SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedExactPathsu RemoteRegistryExactPathsu@ Network access: Remotely accessible registry paths and sub-pathsuF SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPathsu RemoteRegistryPathsuC Network access: Restrict anonymous access to Named Pipes and Sharesu9 System\CurrentControlSet\Services\LanmanServer\Parametersu RestrictNullSessAccessu7 Network access: Shares that can be accessed anonymouslyu NullSessionSharesu= Network access: Sharing and security model for local accountsu
ForceGuestu Network firewall: Domain: Stateu domainu Profileu stateu Stateu NetSHu WfwDomainStateu Network firewall: Private: Stateu privateu WfwPrivateStateu Network firewall: Public: Stateu publicu WfwPublicStateu- Network firewall: Domain: Inbound connectionsu firewallpolicyu Inboundu WfwDomainInboundConnectionsu. Network firewall: Private: Inbound connectionsu WfwPrivateInboundConnectionsu- Network firewall: Public: Inbound connectionsu WfwPublicInboundConnectionsu. Network firewall: Domain: Outbound connectionsu Outboundu WfwDomainOutboundConnectionsu/ Network firewall: Private: Outbound connectionsu WfwPrivateOutboundConnectionsu. Network firewall: Public: Outbound connectionsu WfwPublicOutboundConnectionsu: Network firewall: Domain: Settings: Display a notificationu settingsu InboundUserNotificationu WfwDomainSettingsNotificationu; Network firewall: Private: Settings: Display a notificationu WfwPrivateSettingsNotificationu: Network firewall: Public: Settings: Display a notificationu WfwPublicSettingsNotificationu> Network firewall: Domain: Settings: Apply local firewall rulesu LocalFirewallRulesu# WfwDomainSettingsLocalFirewallRulesu? Network firewall: Private: Settings: Apply local firewall rulesu$ WfwPrivateSettingsLocalFirewallRulesu> Network firewall: Public: Settings: Apply local firewall rulesu# WfwPublicSettingsLocalFirewallRulesuI Network firewall: Domain: Settings: Apply local connection security rulesu LocalConSecRulesu% WfwDomainSettingsLocalConnectionRulesuJ Network firewall: Private: Settings: Apply local connection security rulesu& WfwPrivateSettingsLocalConnectionRulesuI Network firewall: Public: Settings: Apply local connection security rulesu% WfwPublicSettingsLocalConnectionRulesu' Network firewall: Domain: Logging: Nameu loggingu FileNameu WfwDomainLoggingNameu( Network firewall: Private: Logging: Nameu WfwPrivateLoggingNameu' Network firewall: Public: Logging: Nameu WfwPublicLoggingNameu2 Network firewall: Domain: Logging: Size limit (KB)u MaxFileSizeu WfwDomainLoggingMaxFileSizeu3 Network firewall: Private: Logging: Size limit (KB)u WfwPrivateLoggingMaxFileSizeu2 Network firewall: Public: Logging: Size limit (KB)u WfwPublicLoggingMaxFileSizeu= Network firewall: Domain: Logging: Log successful connectionsu LogAllowedConnectionsu" WfwDomainLoggingAllowedConnectionsu> Network firewall: Private: Logging: Log successful connectionsu# WfwPrivateLoggingAllowedConnectionsu= Network firewall: Public: Logging: Log successful connectionsu" WfwPublicLoggingAllowedConnectionsu6 Network firewall: Domain: Logging: Log dropped packetsu LogDroppedConnectionsu" WfwDomainLoggingDroppedConnectionsu7 Network firewall: Private: Logging: Log dropped packetsu# WfwPrivateLoggingDroppedConnectionsu6 Network firewall: Public: Logging: Log dropped packetsu" WfwPublicLoggingDroppedConnectionsu Enforce password historyu _in_range_inclusiveu Functionu mini u maxu Argsu Modalu password_hist_lenu NetUserModalu PasswordHistoryu Maximum password agei�
%I���� u
zero_valueu max_passwd_ageu _seconds_to_daysu _days_to_secondsu MaxPasswordAgeu Minimum password ageu min_passwd_ageu MinPasswordAgeu Minimum password lengthi u min_passwd_lenu MinPasswordLenu* Password must meet complexity requirementsu PasswordComplexityu+ Store passwords using reversible encryptionu ClearTextPasswordu ClearTextPasswordsu& Accounts: Administrator account statusu EnableAdminAccountu AdminAccountStatusu" Accounts: Block Microsoft accountsu9 SOFTWARE\Microsoft\Windows\CurrentVersion\policies\systemu NoConnectedUseru Accounts: Guest account statusu EnableGuestAccountu GuestAccountStatusuJ Accounts: Limit local account use of blank passwords to console logon onlyu limitblankpassworduseu LimitBlankPasswordUseu& Accounts: Rename administrator accountu NewAdministratorNameu
_strip_quotesu _add_quotesu RenameAdministratorAccountu Accounts: Rename guest accountu NewGuestNameu RenameGuestAccountu0 Audit: Audit the access of global system objectsu AuditBaseObjectsur Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settingsu SceNoApplyLegacyAuditPolicyu0 Interactive logon: Do not display last user nameu9 Software\Microsoft\Windows\CurrentVersion\Policies\Systemu DontDisplayLastUserNameub Interactive logon: Number of previous logons to cache (in case domain controller is not available)i2 u5 Software\Microsoft\Windows NT\CurrentVersion\Winlogonu CachedLogonsCountuQ Interactive logon: Require Domain Controller authentication to unlock workstationu ForceUnlockLogonu. Interactive logon: Smart card removal behavioru ScRemoveOptionu. Interactive logon: Do not require CTRL+ALT+DELu
DisableCADuP User Account Control: Admin Approval Mode for the built-in Administrator accountu FilterAdministratorTokenuj User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktopu EnableUIADesktopToggleu` User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Modeu ConsentPromptBehaviorAdminuI User Account Control: Behavior of the elevation prompt for standard usersu ConsentPromptBehaviorUseruO User Account Control: Detect application installations and prompt for elevationu EnableInstallerDetectionuL User Account Control: Only elevate executables that are signed and validatedu ValidateAdminCodeSignaturesu_ User Account Control: Only elevate UIAccess applications that are installed in secure locationsu EnableSecureUIAPathsuC User Account Control: Run all administrators in Admin Approval Modeu EnableLUAuO User Account Control: Switch to the secure desktop when prompting for elevationu PromptOnSecureDesktopuW User Account Control: Virtualize file and registry write failures to per-user locationsu EnableVirtualizationuC Interactive logon: Prompt user to change password before expirationi� u PasswordExpiryWarningu4 Interactive logon: Machine account lockout thresholdu MaxDevicePasswordFailedAttemptsu+ Interactive logon: Machine inactivity limiti�' u InactivityTimeoutSecsu> Interactive logon: Message text for users attempting to log onu legalnoticetextu? Interactive logon: Message title for users attempting to log onu legalnoticecaptionuF Interactive logon: Display user information when the session is lockedu DontDisplayLockedUserIdu% Interactive logon: Require smart cardu
ScForceOptionu@ Microsoft network client: Digitally sign communications (always)u> SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parametersu RequireSecuritySignatureu Client_RequireSecuritySignatureuJ Microsoft network client: Digitally sign communications (if server agrees)u EnableSecuritySignatureu Client_EnableSecuritySignatureuN Microsoft network client: Send unencrypted password to third-party SMB serversu EnablePlainTextPassworduP Microsoft network server: Amount of idle time required before suspending sessioni�� u AutoDisconnectuF Microsoft network server: Attempt S4U2Self to obtain claim informationu EnableS4U2SelfForClaimsu@ Microsoft network server: Digitally sign communications (always)u Server_RequireSecuritySignatureuJ Microsoft network server: Digitally sign communications (if client agrees)u Server_EnableSecuritySignatureuD Microsoft network server: Disconnect clients when logon hours expireu EnableForcedLogoffuA Microsoft network server: Server SPN target name validation levelu SmbServerNameHardeningLevelu4 Audit: Audit the use of Backup and Restore privilegeu FullPrivilegeAuditingu
REG_BINARYu* _binary_enable_zero_disable_one_conversionu2 _binary_enable_zero_disable_one_reverse_conversionuD Audit: Shut down system immediately if unable to log security auditsu CrashOnAuditFailu. Devices: Allow undock without having to log onu UndockWithoutLogonu6 Devices: Prevent users from installing printer driversuN System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Serversu AddPrinterDriversu4 Devices: Allowed to format and eject removable mediau 9999u 2u AllocateDASDu _dasd_conversionu _dasd_reverse_conversionu> Devices: Restrict CD-ROM access to locally logged-on user onlyu AllocateCDRomsu> Devices: Restrict floppy access to locally logged-on user onlyu AllocateFloppiesu. Devices: Unsigned driver installation behavioru 3,0u 3,u0 MACHINE\Software\Microsoft\Driver Signing\Policyu Registry Valuesu _driver_signing_reg_conversionu& _driver_signing_reg_reverse_conversionu DriverSigningPolicyu; Domain controller: Allow server operators to schedule tasksu
SubmitControlu3 Domain controller: LDAP server signing requirementsu1 System\CurrentControlSet\Services\NTDS\Parametersu LDAPServerIntegrityu: Domain controller: Refuse machine account password changesu5 SYSTEM\CurrentControlSet\Services\Netlogon\Parametersu RefusePasswordChangeuE Domain member: Digitally encrypt or sign secure channel data (always)u5 System\CurrentControlSet\Services\Netlogon\Parametersu RequireSignOrSealuD Domain member: Digitally encrypt secure channel data (when possible)u SealSecureChanneluA Domain member: Digitally sign secure channel data (when possible)u SignSecureChannelu7 Domain member: Disable machine account password changesu DisablePasswordChangeu3 Domain member: Maximum machine account password ageu MaximumPasswordAgeuA Domain member: Require strong (Windows 2000 or later) session keyu RequireStrongKeyu Account lockout durationi��[ u lockout_durationu _seconds_to_minutesu _minutes_to_secondsu LockoutDurationu Account lockout thresholdi� u lockout_thresholdu LockoutThresholdu# Reset account lockout counter afteru lockout_observation_windowu
LockoutWindowu Audit account logon eventsu AuditAccountLogonu Event Auditu Audit account managementu AuditAccountManageu Audit directory service accessu
AuditDSAccessu Audit logon eventsu AuditLogonEventsu Audit object accessu AuditObjectAccessu Audit policy changeu AuditPolicyChangeu Audit privilege useu AuditPrivilegeUseu Audit process trackingu AuditProcessTrackingu Audit system eventsu AuditSystemEventsu Audit Credential Validationu AdvAuditu AuditCredentialValidationu% Audit Kerberos Authentication Serviceu" AuditKerberosAuthenticationServiceu( Audit Kerberos Service Ticket Operationsu$ AuditKerberosServiceTicketOperationsu Audit Other Account Logon Eventsu AuditOtherAccountLogonEventsu" Audit Application Group Managementu AuditApplicationGroupManagementu! Audit Computer Account Managementu AuditComputerAccountManagementu# Audit Distribution Group Managementu AuditDistributionGroupManagementu% Audit Other Account Management Eventsu! AuditOtherAccountManagementEventsu Audit Security Group Managementu AuditSecurityGroupManagementu Audit User Account Managementu AuditUserAccountManagementu Audit DPAPI Activityu AuditDPAPIActivityu Audit PNP Activityu AuditPNPActivityu Audit Process Creationu AuditProcessCreationu Audit Process Terminationu AuditProcessTerminationu Audit RPC Eventsu AuditRPCEventsu Audit Token Right Adjustedu AuditTokenRightAdjustedu, Audit Detailed Directory Service Replicationu( AuditDetailedDirectoryServiceReplicationu Audit Directory Service Accessu AuditDirectoryServiceAccessu Audit Directory Service Changesu AuditDirectoryServiceChangesu# Audit Directory Service Replicationu AuditDirectoryServiceReplicationu Audit Account Lockoutu AuditAccountLockoutu Audit User / Device Claimsu AuditUserDeviceClaimsu Audit Group Membershipu AuditGroupMembershipu Audit IPsec Extended Modeu AuditIPsecExtendedModeu Audit IPsec Main Modeu AuditIPsecMainModeu Audit IPsec Quick Modeu AuditIPsecQuickModeu Audit Logoffu AuditLogoffu Audit Logonu
AuditLogonu Audit Network Policy Serveru AuditNetworkPolicyServeru Audit Other Logon/Logoff Eventsu AuditOtherLogonLogoffEventsu Audit Special Logonu AuditSpecialLogonu Audit Application Generatedu AuditApplicationGeneratedu Audit Certification Servicesu AuditCertificationServicesu Audit Detailed File Shareu AuditDetailedFileShareu Audit File Shareu AuditFileShareu Audit File Systemu AuditFileSystemu# Audit Filtering Platform Connectionu AuditFilteringPlatformConnectionu$ Audit Filtering Platform Packet Dropu AuditFilteringPlatformPacketDropu Audit Handle Manipulationu AuditHandleManipulationu Audit Kernel Objectu AuditKernelObjectu Audit Other Object Access Eventsu AuditOtherObjectAccessEventsu Audit Registryu
AuditRegistryu Audit Removable Storageu AuditRemovableStorageu Audit SAMu AuditSAMu# Audit Central Access Policy Stagingu AuditCentralAccessPolicyStagingu Audit Audit Policy Changeu AuditAuditPolicyChangeu" Audit Authentication Policy Changeu AuditAuthenticationPolicyChangeu! Audit Authorization Policy Changeu AuditAuthorizationPolicyChangeu& Audit Filtering Platform Policy Changeu" AuditFilteringPlatformPolicyChangeu% Audit MPSSVC Rule-Level Policy Changeu AuditMPSSVCRuleLevelPolicyChangeu Audit Other Policy Change Eventsu AuditOtherPolicyChangeEventsu! Audit Non Sensitive Privilege Useu AuditNonSensitivePrivilegeUseu Audit Other Privilege Use Eventsu AuditOtherPrivilegeUseEventsu Audit Sensitive Privilege Useu AuditSensitivePrivilegeUseu Audit IPsec Driveru AuditIPsecDriveru Audit Other System Eventsu AuditOtherSystemEventsu Audit Security State Changeu AuditSecurityStateChangeu Audit Security System Extensionu AuditSecuritySystemExtensionu Audit System Integrityu AuditSystemIntegrityu- Access Credential Manager as a trusted calleru SeTrustedCredManAccessPrivilegeu LsaRightsu _sidConversionu _usernamesToSidObjectsu% Access this computer from the networku SeNetworkLogonRightu# Act as part of the operating systemu SeTcbPrivilegeu Add workstations to domainu SeMachineAccountPrivilegeu" Adjust memory quotas for a processu SeIncreaseQuotaPrivilegeu Allow log on locallyu SeInteractiveLogonRightu, Allow log on through Remote Desktop Servicesu SeRemoteInteractiveLogonRightu Backup files and directoriesu SeBackupPrivilegeu Bypass traverse checkingu SeChangeNotifyPrivilegeu Change the system timeu SeSystemtimePrivilegeu Change the time zoneu SeTimeZonePrivilegeu Create a pagefileu SeCreatePagefilePrivilegeu Create a token objectu SeCreateTokenPrivilegeu Create global objectsu SeCreateGlobalPrivilegeu Create permanent shared objectsu SeCreatePermanentPrivilegeu Create symbolic linksu SeCreateSymbolicLinkPrivilegeu Debug programsu SeDebugPrivilegeu- Deny access to this computer from the networku SeDenyNetworkLogonRightu Deny log on as a batch jobu SeDenyBatchLogonRightu Deny log on as a serviceu SeDenyServiceLogonRightu Deny log on locallyu SeDenyInteractiveLogonRightu+ Deny log on through Remote Desktop Servicesu! SeDenyRemoteInteractiveLogonRightu> Enable computer and user accounts to be trusted for delegationu SeEnableDelegationPrivilegeu# Force shutdown from a remote systemu SeRemoteShutdownPrivilegeu Generate security auditsu SeAuditPrivilegeu) Impersonate a client after authenticationu SeImpersonatePrivilegeu Increase a process working setu SeIncreaseWorkingSetPrivilegeu Increase scheduling priorityu SeIncreaseBasePriorityPrivilegeu Load and unload device driversu SeLoadDriverPrivilegeu Lock pages in memoryu SeLockMemoryPrivilegeu Log on as a batch jobu SeBatchLogonRightu Log on as a serviceu SeServiceLogonRightu Manage auditing and security logu SeSecurityPrivilegeu Modify an object labelu SeRelabelPrivilegeu" Modify firmware environment valuesu SeSystemEnvironmentPrivilegeu Perform volume maintenance tasksu SeManageVolumePrivilegeu Profile single processu SeProfileSingleProcessPrivilegeu Profile system performanceu SeSystemProfilePrivilegeu$ Remove computer from docking stationu SeUndockPrivilegeu Replace a process level tokenu SeAssignPrimaryTokenPrivilegeu Restore files and directoriesu SeRestorePrivilegeu Shut down the systemu SeShutdownPrivilegeu" Synchronize directory service datau SeSyncAgentPrivilegeu( Take ownership of files or other objectsu SeTakeOwnershipPrivilegeu6 Recovery console: Allow automatic administrative logonuB Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsoleu
SecurityLevelu RecoveryConsoleSecurityLeveluL Recovery console: Allow floppy copy and access to all drives and all foldersu
SetCommandu RecoveryConsoleSetCommanduU System Cryptography: Force strong key protection for user keys stored on the computeru( Software\Policies\Microsoft\Cryptographyu ForceKeyProtectionuW System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signingu8 System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicyu FIPSAlgorithmPolicyuZ DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntaxu+ Software\Policies\Microsoft\Windows NT\DCOMu MachineAccessRestrictionuZ DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntaxu MachineLaunchRestrictionuF Network security: Allow Local System to use computer identity for NTLMu UseMachineIdu9 Network security: Allow LocalSystem NULL session fallbacku+ SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0u allownullsessionfallbacku` Network security: Allow PKU2U authentication requests to this computer to use online identities.u* SYSTEM\CurrentControlSet\Control\Lsa\pku2uu
AllowOnlineIDuA Network security: Configure encryption types allowed for KerberosuM SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\Kerberos\Parametersu SupportedEncryptionTypesu _dict_lookup_bitwise_addu KrbSupportedEncryptionTypesuM Network security: Do not store LAN Manager hash value on next password changeu NoLMHashu6 Network security: Force logoff when logon hours expireu ForceLogoffWhenHourExpireu2 Network security: LAN Manager authentication levelu LmCompatibilityLevelu2 Network security: LDAP client signing requirementsu& SYSTEM\CurrentControlSet\Services\ldapu LDAPClientIntegrityu\ Network security: Minimum session security for NTLM SSP based (including secure RPC) clientsu+ System\CurrentControlSet\Control\Lsa\MSV1_0u NTLMMinClientSecu\ Network security: Minimum session security for NTLM SSP based (including secure RPC) serversu NTLMMinServerSecuU Network security: Restrict NTLM: Add remote server exceptions for NTLM authenticationu ClientAllowedNTLMServersuE Network security: Restrict NTLM: Add server exceptions in this domainu DCAllowedNTLMServersu< Network security: Restrict NTLM: Audit Incoming NTLM Trafficu+ SYSTEM\CurrentControlSet\Control\LSA\MSV1_0u AuditReceivingNTLMTrafficuI Network security: Restrict NTLM: Audit NTLM authentication in this domainu AuditNTLMInDomainu6 Network security: Restrict NTLM: Incoming NTLM trafficu RestrictReceivingNTLMTrafficuC Network security: Restrict NTLM: NTLM authentication in this domainu RestrictNTLMInDomainuH Network security: Restrict NTLM: Outgoing NTLM traffic to remote serversu RestrictSendingNTLMTrafficu? Shutdown: Allow system to be shut down without having to log onu ShutdownWithoutLogonu' Shutdown: Clear virtual memory pagefileuB System\CurrentControlSet\Control\SESSION MANAGER\MEMORY MANAGEMENTu ClearPageFileAtShutdownuE System objects: Require case insensitivity for non-Windows subsystemsu7 System\CurrentControlSet\Control\SESSION MANAGER\Kernelu ObCaseInsensitiveu_ System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)u0 System\CurrentControlSet\Control\SESSION MANAGERu ProtectionModeu$ System settings: Optional subsystemsu; System\CurrentControlSet\Control\SESSION MANAGER\SubSystemsu optionalu OptionalSubsystemsu_ System settings: Use Certificate Rules on Windows Executables for Software Restriction Policiesu9 SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiersu AuthenticodeEnabledu policiesu User Configurationu Useru Registry.polu policy_pathu
HKEY_USERSu hiveu gPCUserExtensionNamesu gpt_extension_locationuN [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}]u gpt_extension_guidu gPCMachineExtensionNamesuN [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]u 剐来 u gpt.ini(7 t Nonet audit_lookupt advanced_audit_lookupt sc_removal_lookupt uac_admin_prompt_lookupt uac_user_prompt_lookupt enabled_one_disabled_zerot Falset Truet# enabled_one_disabled_zero_transformt s4u2self_optionst audit_transformt advanced_audit_transformt! enabled_one_disabled_zero_stringst+ enabled_one_disabled_zero_strings_transformt security_options_gpedit_patht windows_firewall_gpedit_patht password_policy_gpedit_patht audit_policy_gpedit_patht! advanced_audit_policy_gpedit_patht" account_lockout_policy_gpedit_patht" user_rights_assignment_gpedit_patht block_ms_accountst ldap_server_signing_requirementst smb_server_name_hardening_levelst locked_session_user_infot force_guestt force_key_protectiont firewall_inbound_connectionst firewall_outbound_connectionst firewall_rule_mergingt firewall_log_packets_connectionst firewall_notificationt firewall_statet krb_encryption_typest lm_compat_levelst ldap_signing_reqst ntlm_session_security_levelst ntlm_audit_settingst ntlm_domain_audit_settingst incoming_ntlm_settingst ntlm_domain_auth_settingst outgoing_ntlm_settingst( enabled_one_disabled_zero_no_not_definedt2 enabled_one_disabled_zero_no_not_defined_transformt ost patht joint getenvt keyst chrt policiest admx_registry_classest reg_pol_headert gpt_ini_path( t self( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt __init__C s
$
c K@ s | r
t St Sd S( u.
ensures a value is not empty
N( R R ( t clst valt kwargs( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _notEmpty
s c K@ s> | j d d � } | d k r6 | | k r. d S| d Sd Sd S( u6
converts a number of seconds to days
u
zero_valuei i�Q u Not DefinedN( t getR ( RD RE RF t
zero_value( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _seconds_to_days s c K@ s> | j d d � } | d k r6 | d k r. | S| d Sd Sd S( u6
converts a number of days to seconds
u
zero_valuei i�Q u Not DefinedN( RH R ( RD RE RF RI ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _days_to_seconds! s c K@ s | d k r | d Sd Sd S( u9
converts a number of seconds to minutes
i< u Not DefinedN( R ( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _seconds_to_minutes. s c K@ s | d k r | d Sd Sd S( u7
converts number of minutes to seconds
i< u Not DefinedN( R ( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _minutes_to_seconds8 s c K@ s | j d d � S( u-
strips quotes from a string
u "u ( t replace( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt
_strip_quotesB s c K@ s
d j | � S( u.
add quotes around the string
u "{0}"( t format( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _add_quotesI s c K@ si yP | d k rK t | � d k r% d St | � d k r; d Sd j | � Sn d SWn t k
rd d SXd S( u;
converts a binary 0/1 to Disabled/Enabled
i u Disabledi u Enabledu Invalid Value: {0!r}u Not Definedu
Invalid ValueN( R t ordRP t TypeError( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt* _binary_enable_zero_disable_one_conversionP s
c K@ sS | d k rK | j � d k r( t d � S| j � d k rD t d � Sd Sn d Sd S( uZ
converts Enabled/Disabled to unicode char to write to a REG_BINARY value
u DISABLEDi u ENABLEDi N( R t upperR= ( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt2 _binary_enable_zero_disable_one_reverse_conversionb s
c K@ s{ | d k rs | d k s0 | d k s0 | d k r4 d S| d k sL | d k rP d S| d k sh | d k rl d
Sd Sn d Sd S(
u1
converts 0/1/2 for dasd reg key
u 0i u u Administratorsu 1i u Administrators and Power Usersu 2i u$ Administrators and Interactive Usersu Not DefinedN( R ( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _dasd_conversionq s $c K@ ss | d k rk | j � d k r" d S| j � d k r8 d S| j � d k rN d S| j � d k rd d Sd Sn d
Sd S( uA
converts DASD String values to the reg_sz value
u ADMINISTRATORSu 0u ADMINISTRATORS AND POWER USERSu 1u$ ADMINISTRATORS AND INTERACTIVE USERSu 2u NOT DEFINEDu 9999u
Invalid Valueu Not DefinedN( R RU ( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _dasd_reverse_conversion� s c K@ s� | j d d � } | j d d � } | j d d � } t | t j � r� | j � d k r^ t Sy t | � } Wq� t k
r� t SXn | d k r� | | k o� | k n s� | | k r� t St Sn t Sd S( u�
checks that a value is in an inclusive range
The value for 0 used by Max Password Age is actually 0xffffffff
u mini u maxi u
zero_valueu not definedN(
RH t
isinstanceR t string_typest lowerR t intt
ValueErrorR R ( RD RE RF t minimumt maximumRI ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _in_range_inclusive� s
(c K@ s� t j d | � | d
k r� | j d � } t | � d k r� | d d k rQ d S| d d k re d S| d d k ry d
S| d d k r� d Sd Sq� d Sn d Sd
S( u}
converts the binary value in the registry for driver signing into the
correct string representation
u' we have %s for the driver signing valueu ,i i u 0u Silently Succeedu 1u Warn but allow installationu 2u Do not allow installationu Not Definedu
Invalid ValueN( t logt debugR t splitt len( RD RE RF t _val( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _driver_signing_reg_conversion� s c K@ s� | d k r� | j � d k r1 d j d d g � S| j � d k r\ d j d t d � g � S| j � d k r� d j d t d � g � Sd Sn d
Sd S( um
converts the string value seen in the GUI to the correct registry value
for secedit
u SILENTLY SUCCEEDu ,u 3u 0u WARN BUT ALLOW INSTALLATIONi u DO NOT ALLOW INSTALLATIONi u
Invalid Valueu Not DefinedN( R RU R: R= ( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt& _driver_signing_reg_reverse_conversion� s c K@ s� t | t j � r$ | j d � } n g } x� | D]� } yP t j d | � } | d rs d j | d | d � } n d j | d � } Wn0 t k
r� t j | � } t j
d | � n X| j | � q1 W| S( uL
converts a list of pysid objects to string representations
u ,u i u {1}\{0}i u {0}uh Unable to convert SID "%s" to a friendly name. The SID will be disaplayed instead of a user/group name.( RY R RZ Rc t
win32securityt LookupAccountSidRP t Exceptiont ConvertSidToStringSidRa t warningt append( RD RE RF t usernamest _sidt userSid( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _sidConversion� s
c K@ s� | s
| St | t j � r. | j d � } n g } xp | D]h } y' t j d | � d } | j | � Wq; t k
r� } t j d � t
d j | | � � � q; Xq; W| S( u=
converts a list of usernames to sid objects
u ,u i u Handle this explicitlyuG There was an error obtaining the SID of user "{0}". Error returned: {1}( RY R RZ Rc Rh t LookupAccountNameRm Rj Ra t exceptionR RP ( RD RE RF t sidst _usert sidt e( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _usernamesToSidObjects� s
c K@ sT t j d | � | d k s( | d k r, d S| d k r< d S| d k rL d Sd Sd S(
u|
converts true/false/None to the GUI representation of the powershell
startup/shutdown script order
u script order value = %su Noneu Not Configuredu trueu$ Run Windows PowerShell scripts firstu falseu# Run Windows PowerShell scripts lastu
Invalid ValueN( Ra Rb R ( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt# _powershell_script_order_conversion s c K@ sP | j � d j � k r d S| j � d j � k r8 d S| d k rH d Sd Sd S( uc
converts powershell script GUI strings representations to
True/False/None
u$ Run Windows PowerShell scripts firstu trueu# Run Windows PowerShell scripts lastu falseu Not Configuredu
Invalid ValueN( RU R ( RD RE RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt+ _powershell_script_order_reverse_conversion s c K@ s� t j d | � | j d t � } d | k r� x� t j | d � D]� \ } } | r� t j | � j � t j | � j � k r� t j d | � | SqB t j | � j � t j | � j � k rB t j d | � | SqB Wn d S( u�
Retrieves the key or value from a dict based on the item
kwarg lookup dict to search for item
kwarg value_lookup bool to determine if item should be compared to keys
or values
u
item == %su value_lookupu lookupu returning key %su returning value %su
Invalid Value( Ra Rb RH R R t iteritemst text_typeR[ ( RD t itemRF t value_lookupt kt v( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _dict_lookup* s ** c
K@ sb | j d t � } | j d t � } d } t | � j � d k rF d S| rh t | t � s_ d Sd } n t | t j � s~ d Sg } d | k rZx� t j | d � D]� \ } } | r� t j
| � j � g | D] } | j � ^ q� k rS| | } qSq� t } | s | d k r t } q n | r� t | t � r� | | @| k r� | j
| � q� q� Wn d S| S( uY
kwarg value_lookup bool to determine if item_list should be compared to keys
or values
kwarg test_zero is used to determine if 0 should be tested when value_lookup is false
lookup should be a dict with integers for keys
if value_lookup is True, item is expected to be a list
the function will return the sum of the keys whose values are in the item list
if value_lookup is False, item is expected to be an integer
the function will return the values for the keys
which successfully "bitwise and" with item
u value_lookupu test_zerou not definedu
Invalid Valuei u lookupN( RH R R t strR[ RY t listR t
integer_typesR{ R| R R\ Rm (
RD R} RF R~ t test_zerot ret_valR R� t zt do_test( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _dict_lookup_bitwise_add@ s2 4 %c K@ sS t | t � r | St | t j � rK | j � d k r; d S| j d � Sn d Sd S( uO
transform for a REG_MULTI_SZ to properly handle "Not Defined"
u not definedu ,u
Invalid ValueN( RY R� R RZ R[ R Rc ( RD R} RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _multi_string_put_transforml s c K@ s3 t | t j � r/ | j � d k r( d S| Sn d S( uI
transfrom for a REG_SZ to properly handle "Not Defined"
u not definedN( RY R RZ R[ R ( RD R} RF ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _string_put_transform{ s ( t __name__t
__module__t __doc__RC t classmethodRG RJ RK RL RM RO RQ RT RV RW RX R` Rf Rg Rq Rx Ry Rz R� R� R� R� ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyR
� sN � � � � � � � � � � � � � � � � �
,c C@ s0 t j j j � s t d f St s, t d f St S( u'
Only works on Windows systems
u win_lgpo: Not a Windows Systemu) win_lgpo: Required modules failed to load( t saltt utilst platformt
is_windowsR t HAS_WINDOWS_MODULESt __virtualname__( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt __virtual__� s
c C@ s� d } | j j d � } | d k r8 | j | d } n | j } d j | | � | _ x� | j � D]t } t | j t j � rc d } | j j d � } | d k r� | j | d } n | j } d j | | � | _ qc qc W| S( uI
helper function to recursively update the namespaces of an item
u u }i i u
{{{0}}}{1}( t tagt findRP t getiteratorRY R RZ ( R} t
new_namespacet temp_itemt it child( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _updateNamespace� s c C@ sL xE | j � D]7 } d | j k r
d | j k rD | | j d <qD q
q
W| S( u�
helper function to add the reg key to each policies element definitions if
the key attribute is not defined to make xpath searching easier for each
child in the policy <elements> item
u valueNameu key( R� t attrib( t policy_itemt regkeyR� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _updatePolicyElements� s
c C@ sp t j j j | d � � } | j � } Wd QXt j d d | j d � d d �} t j j
t j | � � } | S( u�
attempts to remove the "encoding='unicode'" from an xml file
as lxml does not support that on a windows node currently
see issue #38100
u rbNu encoding=[\'"]+unicode[\'"]+u u utf-16t counti (
R� R� t filest fopent readt ret subt decodet lxmlR t parseR t StringIO( t xml_filet ft xml_contentt modified_xmlt xmltree( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _remove_unicode_encoding� s
$u c:\Windows\PolicyDefinitionsu en-USc # C@ s t } t j j d � } | j t j j d � � | j t j j d � � | j t j j d � � t j j d � } t j d � } t j d � } t j d � } t j d � } t j d
� } x%t j j j | � D]\ }
} } |
| k r� x�| D]�}
t
j j |
|
� } t j j d t
� } y t j j | d | �} Wn[ t j j k
r�y t | � } Wq�t k
r�t j d
� t j d | � q� q�Xn X| j � j } d } d% | k r�| d% | d <| j d% � d } n | j d j | � d | �d } | j d j | � d | �d } | j d j | � d | �} x: | D]2 } | } t | | � } | | � d j | � qPW| j d j | � d | �} x� | D]x } | } t | | � } d | j k r t | | j d � } | j d t | j d j � <n | | � d j | � q�W| j d j | � d | �} x: | D]2 } | } t | | � } | | � d j | � qLWt
j j |
| t
j j |
� d d � } t! d | � s�t j" d | |
� t
j j |
| j# d � d t
j j |
� d d � } t! d | � s�t j" d | d |
� t
j j |
| t
j j |
� d d � } t! d | � s�t j" d | |
� t
j j |
| j# d � d t
j j |
� d d � } t! d | � s�d! } t$ | j | | |
� � � q�q�q�n y t j j | � } Wn[ t j j k
riy t | � } Wqjt k
ret j d
� t j d" | � q� qjXn Xd% | k r�| d% | d <| j d% � n | | � } x: | D]2 }! |! }" t |" | � }" | | � d j |" � q�Wq� Wq� q� W| t% d# <| t% d$ <d% S(& u�
helper function to process all ADMX files in the specified policy_def_path
and build a single XML doc that we can search/use for ADMX policy processing
u policyDefinitionsu
categoriesu policiesu policyNamespacesu policyDefinitionResourcesu /policyDefinitions/policiesu /policyDefinitions/categoriesu# /policyDefinitions/policyNamespacesu1 //*[local-name() = "policyDefinitionResources"]/*u /policyDefinitionResourcest remove_commentst parseru Handle this explicitlyup A error was found while processing admx file %s, all policies from this file will be unavailable via this moduleu u Noneu None:u; /{0}policyDefinitions/{0}policyNamespaces/{0}target/@prefixt
namespacesi u> /{0}policyDefinitions/{0}policyNamespaces/{0}target/@namespaceu/ /{0}policyDefinitions/{0}categories/{0}categoryu+ /{0}policyDefinitions/{0}policies/{0}policyu keyu. /{0}policyDefinitions/{0}policyNamespaces/{0}*u .admlu file.file_existsu� An ADML file in the specified ADML language "%s" does not exist for the ADMX "%s", the the abbreviated language code will be tried.u -uz An ADML file in the specified ADML language code %s does not exist for the ADMX "%s", the fallback language will be tried.i u� An ADML file in the specified ADML fallback language "%s" does not exist for the ADMX "%s" the abbreviated fallback language code will be tried.ur An ADML file in the specified ADML language "{0}" and the fallback language "{1}" do not exist for the ADMX "{2}".u} An error was found while processing adml file %s, all policy language data from this file will be unavailable via this moduleu lgpo.policy_definitionsu lgpo.policy_resourcesN(& t INSTALL_LANGUAGER� R t ElementRm t XPathR� R� R9 t os_walkR8 R: t XMLParserR R� t XMLSyntaxErrorR� Rj Ra Rs t errort getroott nsmapR t popt xpathRP R� R� R� t adm_policy_key_mapR[ t splitextt __salt__t infoRc R t __context__(# R9 t languaget display_language_fallbackt t_policy_definitionst t_policy_definition_resourcest policydefs_policies_xpatht policydefs_categories_xpatht policydefs_policyns_xpatht$ policydefs_resources_localname_xpatht policydef_resources_xpatht roott dirsR� t t_admfilet admfileR� R� R� t namespace_stringt this_prefixt this_namespacet
categoriest categoryt temp_catR> t policyt temp_polt policy_namespacest policy_nst temp_nst adml_filet msgt policydefs_resourcest policydefs_resourcet t_poldef( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _load_policy_definitions� s� %
!
&
c C@ s7 d t k r/ t j d � t d | d | � n t d S( Nu lgpo.policy_definitionsu LGPO: Loading policy definitionsR9 R� ( R� Ra Rb R� ( R9 R� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _get_policy_definitionsX s
c C@ s7 d t k r/ t j d � t d | d | � n t d S( Nu lgpo.policy_resourcesu LGPO: Loading policy resourcesR9 R� ( R� Ra Rb R� ( R9 R� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _get_policy_resources` s
c C@ s3 i } x& | D] } | j d | | j d <q
W| S( u3
build a namespace map for an ADMX element
u namespaceu prefix( R� ( t using_elementst thisMapRw ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _buildElementNsmaph s
c C@ s d t k r� t j d � t d � } t j | � } i | j d 6} x� | D]� } d | d <| d | d <| d d k r� d
| d <nQ | d d k r� d | d <n4 | d d
k r� d | d <n d j | d � | d <| | | d <qL W| t d <n | r t d | St d Sd S( u
Loads audit.csv defaults into a dict in __context__ called
'lgpo.audit_defaults'. The dictionary includes fieldnames and all
configurable policies as keys. The values are used to create/modify the
``audit.csv`` file. The first entry is `fieldnames` used to create the
header for the csv file. The rest of the entries are the audit policy names.
Sample data follows:
{
'fieldnames': ['Machine Name',
'Policy Target',
'Subcategory',
'Subcategory GUID',
'Inclusion Setting',
'Exclusion Setting',
'Setting Value'],
'Audit Sensitive Privilege Use': {'Auditpol Name': 'Sensitive Privilege Use',
'Exclusion Setting': '',
'Inclusion Setting': 'No Auditing',
'Machine Name': 'WIN-8FGT3E045SE',
'Policy Target': 'System',
'Setting Value': '0',
'Subcategory': u'Audit Sensitive Privilege Use',
'Subcategory GUID': '{0CCE9228-69AE-11D9-BED3-505054503030}'},
'Audit Special Logon': {'Auditpol Name': 'Special Logon',
'Exclusion Setting': '',
'Inclusion Setting': 'No Auditing',
'Machine Name': 'WIN-8FGT3E045SE',
'Policy Target': 'System',
'Setting Value': '0',
'Subcategory': u'Audit Special Logon',
'Subcategory GUID': '{0CCE921B-69AE-11D9-BED3-505054503030}'},
'Audit System Integrity': {'Auditpol Name': 'System Integrity',
'Exclusion Setting': '',
'Inclusion Setting': 'No Auditing',
'Machine Name': 'WIN-8FGT3E045SE',
'Policy Target': 'System',
'Setting Value': '0',
'Subcategory': u'Audit System Integrity',
'Subcategory GUID': '{0CCE9212-69AE-11D9-BED3-505054503030}'},
...
}
.. note::
`Auditpol Name` designates the value to use when setting the value with
the auditpol command
Args:
option (str): The item from the dictionary to return. If ``None`` the
entire dictionary is returned. Default is ``None``
Returns:
dict: If ``None`` or one of the audit settings is passed
list: If ``fieldnames`` is passed
u lgpo.audit_defaultsu* Loading auditpol defaults into __context__u auditpol.get_auditpol_dumpu
fieldnamesu u Machine Nameu Subcategoryu
Auditpol Nameu Central Policy Stagingu# Audit Central Access Policy Stagingu Plug and Play Eventsu Audit PNP Activityu Token Right Adjusted Eventsu Audit Token Right Adjustedu Audit {0}N( R� Ra Rb t __utils__t csvt
DictReadert
fieldnamesRP ( t optiont dumpt readert audit_defaultst row( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _get_audit_defaultsr s( 8
c
C@ sU d t k rAt j j d d � } t j j | d d d � } t j j | d d d d
d d d � } t d
| � s� t d
| � r� t d | | � q� t d � } t d | � t d | d j | � � n i } t j j
j | d d ��C } t j
| � } x* | D]" } | j i | d | d 6� qWWd QX| t d <n t d j | d � S( u
Get the Advanced Auditing policy as configured in
``C:\Windows\Security\Audit\audit.csv``
Args:
option (str): The name of the setting as it appears in audit.csv
Returns:
bool: ``True`` if successful, otherwise ``False``
u lgpo.adv_audit_datau
SystemRootu
C:\Windowsu securityu auditu audit.csvu System32u GroupPolicyu Machineu Microsoftu
Windows NTu Auditu file.file_existsu file.copyu
fieldnamesu
file.makedirsu
file.writeu ,t modeu ru
Setting Valueu SubcategoryN( R� R8 t environRH R9 R: R� R� R� R� R� R� R� R� t updateR ( R� t system_roott f_auditt f_audit_gpot field_namest audit_settingst csv_fileR� R� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _findOptionValueAdvAudit� s(
c
C@ s� t j j d d � } t j j | d d d � } t j j | d d d d d
d d � } t j d d
d t d d d d � } i d d 6d d 6d d 6d d 6d d 6} zt j j
j | d d ���} t j
| � } t j j
j | j d d
��b} t j | d | j �}
|
j � t } x� | D]� } | d | k r�| d k s�| | | d <| | d <t j d j | | � � |
j | � n t j d! j | � � t } q$|
j | � q$W| sP| d k sGt j d j | | � � t | � }
|
j i |
d" d" 6|
d# d# 6|
d d 6|
d$ d$ 6| | d 6|
d% d% 6| d 6� n t } n Wd& QXWd& QX| r�t d' | j | d( t �t d) | � t d' | j | d( t �n Wd& | j � t d* | j � X| S(+ u�
Helper function that sets the Advanced Audit settings in the two .csv files
on Windows. Those files are located at:
C:\Windows\Security\Audit\audit.csv
C:\Windows\System32\GroupPolicy\Machine\Microsoft\Windows NT\Audit\audit.csv
Args:
option (str): The name of the option to set
value (str): The value to set. ['None', '0', '1', '2', '3']
Returns:
bool: ``True`` if successful, otherwise ``False``
u
SystemRootu
C:\Windowsu securityu auditu audit.csvu System32u GroupPolicyu Machineu Microsoftu
Windows NTu AuditR� u wt deletet suffixu .csvt prefixu No Auditingu Noneu 0u Successu 1u Failureu 2u Success and Failureu 3u rR� u Subcategoryu Inclusion Settingu
Setting Valueu LGPO: Setting {0} to {1}u LGPO: Removing {0}u Machine Nameu
Policy Targetu Subcategory GUIDu Exclusion SettingNu file.copyt remove_existingu
file.makedirsu file.remove( R8 R� RH R9 R: t tempfilet NamedTemporaryFileR R� R� R� R� R� R� t namet
DictWriterR� t writeheaderRa Rb RP t writerowR R� R� t close( R� t valueR� R� R� t f_tempt auditpol_valuesR� R� t tmp_filet writert
value_writtenR� t defaults( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _set_audit_file_data� sf
!
!
c C@ sT i d d 6d d 6d d 6d d 6d d 6} t | � } t d
d | d d
| | � S( u�
Helper function that updates the current applied settings to match what has
just been set in the audit.csv files. We're doing it this way instead of
running `gpupdate`
Args:
option (str): The name of the option to set
value (str): The value to set. ['None', '0', '1', '2', '3']
Returns:
bool: ``True`` if successful, otherwise ``False``
u No Auditingu Noneu 0u Successu 1u Failureu 2u Success and Failureu 3u auditpol.set_settingR u
Auditpol NameR ( R� R� ( R� R R
R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _set_auditpol_dataT s
c C@ s� t d | d | � s- t d j | � � � n t d | d | � s[ t j d j | � � n | d k r� t j d j | � � t d j | � n' t j d j | | � � | t d | <t S( u]
Helper function to update the Advanced Audit policy on the machine. This
function modifies the two ``audit.csv`` files in the following locations:
C:\Windows\Security\Audit\audit.csv
C:\Windows\System32\GroupPolicy\Machine\Microsoft\Windows NT\Audit\audit.csv
Then it applies those settings using ``auditpol``
After that, it updates ``__context__`` with the new setting
Args:
option (str): The name of the option to set
value (str): The value to set. ['None', '0', '1', '2', '3']
Returns:
bool: ``True`` if successful, otherwise ``False``
R� R u# Failed to set audit.csv option: {0}u" Failed to apply audit setting: {0}u' LGPO: Removing Advanced Audit data: {0}u lgpo.adv_audit_datau, LGPO: Updating Advanced Audit data: {0}: {1}N(
R R RP R Ra Rb R R� R� R ( R� R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _setOptionValueAdvAuditl s
c C@ s� d t k r i t d <n | t d k rx t j d j | � � t j j j d | d d � } t d j i | | 6� n t j d j t d | | � � t d | | S( Nu lgpo.netsh_datau( LGPO: Loading netsh data for {0} profilet profilet storeu lgpou LGPO: netsh returning value: {0}( R� Ra Rb RP R� R� t win_lgpo_netsht get_all_settingsR� ( R R� t settings( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _findOptionValueNetSH� s
c C@ s� | d k r$ t d j | � � � n t j d j | | | | � � | d k r� t j j j d | d | d k rv | n d d
| d k r� | n d d d
� n | d k r� t j j j d | d | d | d d
� n | d k rt j j j
d | d | d d
� n | d k r}| d k r6| d k r6d } q6n | j d � rR| d } n t j j j d | d | d | d d
� n t j d j | � � t
d j | � t S( Nu firewallpolicyu settingsu loggingu stateu LGPO: Invalid section: {0}uL LGPO: Setting the following
Profile: {0}
Section: {1}
Option: {2}
Value: {3}R t inboundu Inboundt outboundu OutboundR u lgpot settingR t stateu FileNameu MaxFileSizeu Not configuredu
notconfiguredu Logi u) LGPO: Clearing netsh data for {0} profileu lgpo.netsh_data( u firewallpolicyu settingsu loggingu state( u FileNameu MaxFileSize( R] RP Ra Rb R� R� R t set_firewall_settingsR t set_settingst set_statet
startswitht set_logging_settingsR� R� R ( R t sectionR� R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _setOptionValueNetSH� s6
c C@ s� zn t j j t d d j t � � } t d d d d | g � t j | d d �� } | j � } Wd QX| SWd t d
| � r� t d | � n Xd S( u�
Helper function that loads secedit data. It runs `secedit /export /cfg
<file_name>` which creates a file that contains the secedit data.
Returns:
str: The contents of the file generated by the secedit command
u cachediru secedit-{0}.txtu cmd.runu seceditu /exportu /cfgt encodingu utf-16Nu file.file_existsu file.remove(
R8 R9 R: t __opts__RP t UUIDR� t iot opent readlines( t f_expt fpt secedit_data( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _load_secedit_data� s c C@ s1 d t k r) t j d � t � t d <n t d S( u�
Helper function that returns the secedit data in __context__ if it exists
and puts the secedit data in __context__ if it does not.
Returns:
str: secedit data from __context__
u lgpo.secedit_datau LGPO: Loading secedit data( R� Ra Rb R, ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _get_secedit_data� s
c C@ sD t � } x4 | D], } | j | � r | j d � d j � Sq Wd S( uN
Helper function that looks for the passed option in the secedit data
u =i u Not Defined( R- R Rc t strip( R� R+ t _line( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _get_secedit_value� s
c C@ s� t j j t d d j t � � } t j j t d d j t � � } z^ t d | | � d d d | d | g } t d | � } | d
k r� t j d � t St
SWd t d
| � r� t d | � n t d
| � r� t d | � n Xd S( u?
Helper function to write secedit data to the database
u cachediru secedit-{0}.sdbu secedit-{0}.infu
file.writeu seceditu
/configureu /dbu /cfgu cmd.retcodei u lgpo.secedit_dataNu file.file_existsu file.remove( R8 R9 R: R$ RP R% R� R� R� R R ( t inf_datat f_sdbt f_inft cmdt retcode( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _write_secedit_data� s ""
c C@ s� i } d | k ry | | d k rr t � } | d | d k rT | d | d } n t | | d | � | | � S| Sn# d | k r� | d k r� d Sn | Sd S( u�
helper function to transform the policy value into something that more
closely matches how the policy is displayed in the gpedit GUI
u Transformu Argsu Registryu (value not set)u Not DefinedN( R
t getattr( R R� t transform_typet t_kwargst _policydata( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _transform_value s c C@ s� t j d j | | � � d | k r� | d r� t | d t � rY | | d k r� t Sq� t | d t � r� t � } t | | d d � | | d d � s� t Sq� q� n t St S( u�
helper function to validate specified value is appropriate for the policy
if the 'Settings' key is a list, the value will check that it is in the list
if the 'Settings' key is a dict we will try to execute the function name
from the 'Function' key, passing the value and additional arguments from
the 'Args' dict
if the 'Settings' key is None, we won't do any validation and just return
True
if the Policy has 'Children', we'll validate their settings too
u validating {0} for policy {1}u Settingsu Functionu Args(
Ra Rb RP RY R� R t dictR
R7 R ( R R� R: ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _validateSetting$ s
(
c C@ so yD | r? t j d t j � } | g } t j | | | � } n t SWn$ t k
rj } t j d | � t SXd S( u;
helper function to add an account right to a user
u7 Error attempting to add account right, exception was %sN(
Rh t
LsaOpenPolicyR t POLICY_ALL_ACCESSt LsaAddAccountRightsR Rj Ra Rs R ( t sidObjectt
user_rightt
_polHandlet user_rights_listt _retRw ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _addAccountRights? s c C@ sf y> t j d t j � } | g } t j | | t | � } t SWn! t k
ra } t j d � t SXd S( u@
helper function to remove an account right from a user
u( Error attempting to delete account rightN(
Rh R> R R? t LsaRemoveAccountRightsR R Rj Ra Rs ( RA RB RC RD RE Rw ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _delAccountRightsP s
c C@ s1 g } t j d t j � } t j | | � } | S( uI
helper function to return all the user rights assignments/users
N( Rh R> R R? t! LsaEnumerateAccountsWithUserRight( RB Rt t polHandle( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _getRightsAssignments^ s c C@ s� | j d � r� | j d � r� t j d d | � } | j d � } | d } | d } t | d | d | �} | r� x | D]
} | j SWq� n d
S( u/
helper function to take the 'displayName' attribute of an element and find
the value from the ADML data
adml_xml_data :: XML data of all ADML files to search
display_name :: the value of the displayName attribute from the ADMX entry
to search the ADML data for
u $(u )u (^\$\(|\)$)u u .i i t displayNameTypet
displayNameIdN( R t endswithR� R� Rc t ADML_DISPLAY_NAME_XPATHt textR ( t
adml_xml_datat display_namet displayname_typet displayname_idt search_resultst result( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _getAdmlDisplayNameh s
c
C@ s8 | j d j | � � } d } | r4x
| D]} t j | j � j } t | � } | rA| d } t | � rAx� | j � D]� } | | k r� Pq{ t j | j � j d k r| r� d j d � | t
| d d � j � f D� � } q t
| d d � rt
| d d � j � n d } q{ d } q{ W| j d � r>d } q>qAn | d k sY| d k r�| j d
� } x� | D]3 } | j
ro| d | j
j � j d � j � SqoWq+ | d k s�| d
k s�| d k s�| d k s�| d k s�| d k s�| d k r+ | j
r-| d | j
j � j d � j � Sq+ q+ Wn d S( uP
helper function to check for a presentation label for a policy element
u' //*[@*[local-name() = "refId"] = "{0}"]u i u textu c s@ s | ] } | r | Vq d S( N( ( t .0RP ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pys <genexpr>� s u .u textBoxu comboBoxu .//*[local-name() = "label"]u :u decimalTextBoxu longDecimalTextBoxu dropdownListu listBoxu checkBoxu multiTextBoxN( R� RP R t QNameR� t localnamet PRESENTATION_ANCESTOR_XPATHt TEXT_ELEMENT_XPATHt getchildrenR: R7 t rstripRN RP t lstripR (
t adml_datat ref_idRU t prepended_textRV t
the_localnamet presentation_elementt p_itemt label_itemst
label_item( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _getAdmlPresentationRefId� sF
43
+ .c C@ s� | t | k r t | | St d | � } | rv d | j k rv t | | j d � } | r� | t | | <| } q� nK | r� d | j k r� t | | j d � } | r� | t | | <| } q� n | j d � j � } | S( uD
helper function to retrieve the full policy name if needed
R� u displayNameu idu :( t adm_policy_name_mapR� R� RW Rh R^ ( R� t policy_namet return_full_policy_namest
adml_languageR` t fullPolicyName( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _getFullPolicyName� s c C@ s8 | r4 | r4 t j | | t j � } | r1 t Sq4 n t S( u�
helper function to do a search of Policy data from a registry.pol file
returns True if the regex search_string is found, otherwise False
( R� t searcht
IGNORECASER R ( t
search_stringt policy_datat match( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _regexSearchRegPolData� s
c C@ s� d } g } d j d � } | r* i } n | r�t � } t | j | � � d k r� | j t | j | � d j d � � } n d } t j | � } t j
| | t j � } g | D] } | ^ q� } | r�x�| D]�}
| |
j � | j
d j d � |
j � � !j | � } t | � d k rG| d j d � j t d � � } n t | � d k rN| d
} | d k s{| d k r�| r�| d k r�xU t j d
| � D] }
|
} q�Wq�| d k r�x# t j d | � D] }
|
} q�Wq�qKd } qN| d k r-| j d � j t d � � j t d � � } qN| j d � j t d � � } n | rnt j d � | | | <q� t | � d k r� t j d � | j | � q� q� Wq�n | r�| } n | S( u�
helper function to do a search of Policy data from a registry.pol file
returns the "data" field
https://msdn.microsoft.com/en-us/library/aa374407(VS.85).aspx
[key;value;type;size;data]
u ;u utf-16-lei i u utf-32-leu ]i i i i u REG_DWORDu REG_QWORDt It Qu REG_MULTI_SZu! we want value names and the valueu/ we have multiple matches, we will return a listN( R t encodeR Rd Rc t
vtype_reverseRR R� R� t escapet finditerRp t startt indext endR^ R= t structt unpackRa Rb Rm ( Rq Rr t return_value_nameR t valuest encoded_semicolont registryt vtypet matchest mRs t pol_entryt valueNameR� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _getDataFromRegPolData� sV ,
%
0!
c C@ s� d } t j | � } g } xc| | � D]U} d }
d } x | j � D]� } | d } d | j k rv | j d }
n | }
d | j k r� | j d } n) t j d t j | � j | j | j � Px} | | � D]o } t | |
| | | � } | r3t t
j | � | � r@|
d }
t j d |
| | � q@q� | j
| � q� WqG W| r( | d k r}| |
k r}t j d | � t Sq( q( W| r�t S| Sd S(
u�
helper function to process an enabled/disabled/true/falseList set
if test_items is True, it will determine if the policy is enabled or
disabled returning True if all items are configured in the registry.pol file
and false if they are not
if test_items is False, the expected strings for the items will be returned
as a list
returns True if the enabled/disabledList is 100% configured in the
registry.pol file, otherwise returns False
ut .//*[local-name() = "decimal" or local-name() = "delete" or local-name() = "longDecimal" or local-name() = "string"]i i u keyu valueNameuX %s item with attributes %s in policy %s does not have the required "valueName" attributeuc found the search string in the pol file,%s of %s items for policy %s are configured in registry.polu %s all items are setN( R R� R] R� Ra R� RY RZ t _processValueItemRt R� Ry Rb Rm R R ( t policy_elementRj t
policy_keyt xpath_objectt policy_file_datat
test_itemst xpath_stringt value_item_child_xpatht expected_stringst list_elementt configured_itemst required_itemsR} t item_keyt item_valuenamet
value_itemRq ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _checkListItem
sJ
c
C@ s� x | | � D]q } xh | j � D]Z } t | | | | | d | �}
| sN |
St t j |
� | � r t j d | � t Sq Wq
Wt S( uR
helper function to process the parent of a value item object
if test_item is True, it will determine if the policy is enabled/disabled
returns True if the value is configured in the registry.pol file, otherwise returns False
if test_item is False, the expected search string will be returned
value type parents:
boolean: https://msdn.microsoft.com/en-us/library/dn606009(v=vs.85).aspx
enabledValue: https://msdn.microsoft.com/en-us/library/dn606006(v=vs.85).aspx
disabledValue: https://msdn.microsoft.com/en-us/library/dn606001(v=vs.85).aspx
t
check_deletedu9 found the search string in the pol file, %s is configured( R] R� Rt R� Ry Ra Rb R R ( R� Rj R� t policy_valueNameR� R� R� t test_itemt elementR� Rq ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _checkValueItemParentG s c C@ s~ t d � j d � } | d k r% | St | t j � s^ t d j t | � t | � � � � n d j
| j d � | g � Sd S( Ni u utf-16-leu( Value {0} is not a string type
Type: {1}t ( R= Rw R RY R RZ RS RP t reprt typeR: ( R t encoded_null( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _encode_stringh s c
C@ s t � } d } d } d j d � } t d � j d � } | rQ | j d � } n | ri | j d � } n | r� | r� | d k r� t j d t | � � } q� | d k r� t j d t | � � } q� | d k r� t | � } q� n | r�d } d j d
j d � | | | d j d � | | | t | j | � j d � | t
j t d
j
t d � � j d � � � j d � | d j d � | d j d � g � } nv d j d
j d � | | | | | | t | j | � j d � | t
j t | � � j d � | | d j d � g
� } | S( us
helper function similar to _processValueItem to build a search string for a
known key/value/type/data
R� u ;u utf-16-lei u REG_DWORDRu u REG_QWORDRv u REG_SZu [u **del.u utf-32-leu {0}u u ]N( R R Rw R= R~ t packR\ R� R: R� R t unichrRd RP (
t reg_keyt
reg_valueNamet reg_vtypet reg_dataR� R� t this_element_valuet expected_stringR� R� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _buildKnownDataSearchStringt s^
3 c C@ s t � } d- } d } d j d � }
t d � j d � } | rQ | j d � } n | ri | j d � } n t j | � j d k rt j | � j d k rd } d | j k r� t j d t
| j d � � } q� t j d
t j | � j t j | � j | j | j � d- Sn�t j | � j d k r�t j | � j d k r�d } d | j k rut j d
t
| j d � � } q� t j d
t j | � j t j | � j | j | j � d- Sn t j | � j d k r�d } t
| j � } n�t j | � j d k r� t } t j | � j d k rX| t k r.t } n | s=d } n t j d d � } t } n�t j | � j d k rd } | }
| d- k r�t j d t
| � � } n d | j k r�| j d j � d k r�d } |
d- k r�t j |
� j d � } q�q�n | r�d } q�n�t j | � j d k r�d } | }
| d- k r[t j d
t
| � � } n d | j k r�| j d j � d k r�d } |
d- k r�t j |
� j d � } q�q�q�n8t j | � j d k rd } d | j k r | j d j � d k r d } q n t
| � } n�t j | � j d k r}| s>d n d } | d- k r�d j t d � j | � t d � � } q�ntt j | � j d k r�t } d } g } | } | d- k r�t g t d t | � d � D] } t | � ^ q�� } n d | j k r�| j d j � d k r�d j d j d � | | |
d j d � | |
t | j | � j d � |
t j t d! j t d � � j d � � � j d � |
d" j d � | d# j d � g � } q�n d | j k r�d } n | j j d$ d � j � d k rZ| d- k r�g | j � D] } t | � ^ q} g | j � D] } t | � ^ q<} q�n� d% | j k r�| j d% d& k r�| d- k r�g | D] } d' j | j d% | � ^ q�} q�q�n. | d- k r�g | D] } t | � ^ q�} n | s!| d- k r�t j d( | � | } t j d) | | � x� t | � D]� \ } } | d j d j d � | | |
| | j d � | |
t | j | � j d � |
t j t d' j | | t d � � j d � � � j d � |
t
| | � d# j d � g
� } q3Wq�| d j d j d � | | |
g � } q�d j d j d � | | |
d j d � | |
t | j | � j d � |
t j t d! j t d � � j d � � � j d � |
d" j d � | d# j d � g � } n* t j | � j d* k r�| d- k r�q�n | r� | r� | d- k r� d j d j d � | | |
| | |
t | j | � j d � |
t j t | � � j d � |
| d# j d � g
� } q� d j d j d � | | |
| | |
t | j | � j d � |
g � } q� n | s t j | � j d+ k s� | r�
d j d j d � | | |
d, j d � | | |
t | j | � j d � |
t j t d! j t d � � j d � � � j d � |
d" j d � | d# j d � g � } q d j d j d � | | |
| | |
t | j | � j d � |
t j t | � � j d � |
| d# j d � g
� } n | S(. uc
helper function to process a value type item and generate the expected
string in the Registry.pol file
element - the element to process
reg_key - the registry key associated with the element (some inherit from
their parent policy)
reg_valuename - the registry valueName associated with the element (some
inherit from their parent policy)
policy - the parent policy element
parent_element - the parent element (primarily passed in to differentiate
children of "elements" objects
check_deleted - if the returned expected string should be for a deleted
value
this_element_value - a specific value to place into the expected string
returned for "elements" children whose values are
specified by the user
u REG_SZu ;u utf-16-lei u decimalu elementsu REG_DWORDu valueRu u� The %s child %s element for the policy with attributes: %s does not have the required "value" attribute. The element attributes are: %su longDecimalu REG_QWORDRv u stringu booleanu Ii u storeAsTextu trueu textu
expandableu
REG_EXPAND_SZu multiTextu REG_MULTI_SZu {0}{1}{1}u listR� u additiveu falseu [u
**delvals.u utf-32-leu {0}u u ]u
explicitValueu valuePrefixu u {0}{1}u5 _processValueItem has an explicit element_value of %su1 element_valuenames == %s and element_values == %su enumu deleteu **del.N(! R R Rw R= R RY RZ R� R~ R� R\ Ra R� R� RP R R R[ R R| RP R: R� R Rd R� R� R� RH R< R� Rb t enumerate( R� R� t
reg_valuenameR� t parent_elementR� R� R� R� t
this_vtypeR� R� t standard_element_expected_stringt
requested_valt del_keyst element_valuenamest element_valuesR� R R� R� R} ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyR� � s� 0"
0"
! $ - ; 3 ! %+ 2 "
$
3
3 c 6 C@ s t j d | � t � } t | j | d � } g } i } i } i }
t d | � } t d | � } | r�t j d j | � � t j t
j j j
d j t d � � � d t j t
j j j
d j t d � � � d t j t j | j j d � � d | � � � j d
j d � � }
t j d t |
� � t j � } x?|
D]7} | j d j t d � � j d � � d j d � j � } | rA| t k r�t | d
t | �} t j d t | � � n8 t | d
| �} t j d | � t j d t | � � x{ | D]p } t j | � j d k r>| | k rq| j | � qqqx0 t | � D]" } | | k rK| j | � qKqKWqWqAqAWt j d t j � | � | rt j d � t j � } t | d | �} x* | D]" } | | k r�| j! | � q�q�Wx� | D]� } | j" | j# } | | k r*i | | <n d | | | j$ d <| r�| |
k r^i |
| <n t% d | d | j$ d d | d | � |
| | j$ d <n t j d | j$ d � | | k r�i | | <n t& d | d | d | � | | | j$ d <q�Wt j d t j � | � n t j d t | � � t j � } xY
| D]Q
} dR } d } t( } t) } d | j$ k ry| j$ d } n t j* d | j$ � Pd! | j$ k r�| j$ d! } n d | j$ k r�| j$ d } n t j* d" | j$ � P| j" | j# } t+ | � r�| d k r�t, | � s t- | � r.t) } t( } n t. | | | | t+ | � r�d# } t j d$ | � | | k rxi | | <n | | | | <q�n t- | � r)| d k r)t/ | � s�t+ | � r�t) } t( } n t. | | | | t- | � r)d% } t j d& | � | | k ri | | <n | | | | <q)n t/ | � r�| d k r�t, | � sYt- | � rht) } t( } n t0 | | | t/ | � r�d# } t j d' | � | | k r�i | | <n | | | | <q�n t, | � r]| d k r]t/ | � s�t+ | � rt) } t( } n t0 | | | t, | � r]d% } t j d( | � | | k rIi | | <n | | | | <q]n | rA| rAt1 t j t2 | | d) d* � � | � r�d# } t j d+ | � | | k r�i | | <n | | | | <qAt1 t j t2 | | d) dR d, t( �� | � rAd% } t j d- | � | | k r-i | | <n | | | | <qAn t3 | � rh| s_| d# k rhi } i } d } x�t3 | � D]�}! x�|! j4 � D]�}" t% d |" d |" j$ d. d | d | � }# dR | |# <| }$ | }% d |" j$ k r�|" j$ d }$ n d! |" j$ k r |" j$ d! }% n t j |" � j d/ k r |" j4 � r�
t5 |" � r� |# | k r� t. |" | |$ |% t5 | � r� t( | |# <t j d0 |" j$ d. � q� n t6 |" � r� |# | k r� t. |" | |$ |% t6 | � r� t) | |# <| d1 } t j d2 |" j$ d. � q� n t7 |" � rY
|# | k rY
t j d3 � t0 |" | | t7 | � rY
t( | |# <t j d0 |" j$ d. � qY
n t8 |" � r| |# | k r| t j d4 � t0 |" | | t8 | � r�
t) | |# <| d1 } t j d2 |" j$ d. � q�
q| qGt1 t j t9 |" |$ |% | |! d, t( �� | � r( t) | |# <| d1 } t j d2 |" j$ d. � qGt1 t j t9 |" |$ |% | |! d, t) �� | � rGt( | |# <t j d0 |" j$ d. � qGq�t j |" � j d5 k s� t j |" � j d6 k s� t j |" � j d7 k s� t j |" � j d8 k r� t1 t j t9 |" |$ |% | |! d, t( �� | � r= d% | |# <| d1 } t j d9 |" j$ d. � qGt1 t j t9 |" |$ |% | |! d, t) �� | � rGt: t9 |" |$ |% | |! d, t) �| � }& |& | |# <t j d: |" j$ d. |& � qGq�t j |" � j d; k r�
t1 t j t9 |" |$ |% | |! d, t( �� | � r4
t j d< |" j$ d. � d% | |# <| d1 } qGx|" j4 � D]� }' t. |' |" j$ d. |$ |% t; | � rA
t< |' � r�
t j d= � t0 |' | |$ t< | � r�
t j d> � t= | |' j$ d? � | |# <Pq�
q�
t= | |' j$ d? � | |# <PqA
qA
Wq�t j |" � j d@ k r�t) }( dA |" j$ k rI|" j$ dA j � dB k rIt j dC � t( }( n t1 t j t9 |" |$ |% | |! d, t) �� t
j j j
dD � | � r�t: t9 |" |$ |% | |! d, t) �| dE |( �}& |& | |# <t j dF |" j$ d. |& � qGt1 t j t9 |" |$ |% | |! d, t( �� | � rGd% | |# <| d1 } t j dG j |" j$ d. � � qGq�q�Wq~W| r,t | j> � � d k rbt | j> � � t | j> � � k rb| t | j> � � k r�t j dH j | � � | | k r�i | | <n d% | | | <q)| | k ri | | <n | | | | <t j dI j | � � qbqe| d# k re| | k rQi | | <n | | | | <qeqhn | r2| | k r2| | | k r2| |
k r�i |
| <n t% d | d | j$ d d | d | � |
| | <| j$ d | | | k r2|
| | }) | | | j? | j$ d � }* |* | | | |) <q2n | | k r<| | | k r<| | k rgi | | <n t& d | d | d | � | | | <q<q<Wt j dJ t j � | � n | rs| rs| rst j dK � t j � } i }+ i }, xmt@ | � D]_}- x� t@ | |- � D]� } |
|- | | |- k r�| |- | }. |. jA � |. j |
|- | � | |- j? | � | dL jB |. � <t( |, |
|- | <q
| |- j? | � | |- |
|- | <|- |+ k r�i |+ |- <n | |+ |- |
|- | <q
Wxo |+ |- D]c }/ | |- |+ |- |/ }. |. jA � |. j |/ � t j dM |. � | |- j? |/ � | dL jB |. � <q�Wq�Wt j dN t j � | � n x4 t@ | � D]& }- | |- i k r�| j? |- � q�q�W| r| r| r�t j dO � t j � } x| D]� }- x� | |- D]� }0 |0 | |- k r�i }1 t( }2 xv | |- |0 D]f }3 i }4 |2 rt|0 }5 | rM|
|- |0 }5 n i | |- j? |0 � |5 6|4 |3 <t) }2 n
|1 |4 |3 <|4 }1 q W|1 r�tC jD | |1 � } q�q�q�W|- | k r�| |- i k r�| j? |- � q�q�Wt j dN t j � | � n i i | dP 6| j | dQ 6} n | S(S u
rewrite of _getAllAdminTemplateSettingsFromRegPolFile where instead of
looking only at the contents of the file, we're going to loop through every
policy and look in the registry.pol file to determine if it is
enabled/disabled/not configured
u POLICY CLASS == %su policy_pathR� u POLICY CLASS {0} has file datau \]{0}$i R� u ^\[{0}u utf-16-leu ][u Parsing %s policies...u {0};t keyvalueu) Found %s policies using the mapped methodu
%s not mappedu+ Found %s policies using the original methodu policyu Parsing complete: %s secondsu! Gathering non configured policiest registry_classu Not Configuredu nameR� Rj Rk Rl u- building hierarchy for non-configured item %st policy_definitionu Gathering complete: %s secondsu Examining %s policies...u keyu9 policy item %s does not have the required "key" attributeu valueNameu: policy item %s does not have the required "name" attributeu Enabledu- %s is enabled by detected ENABLED_VALUE_XPATHu Disabledu/ %s is disabled by detected DISABLED_VALUE_XPATHu, %s is enabled by detected ENABLED_LIST_XPATHu. %s is disabled by detected DISABLED_LIST_XPATHu REG_DWORDu 1u9 %s is enabled by no explicit enable/disable list or valueR� u: %s is disabled by no explicit enable/disable list or valueu idu booleanu element %s is configured truei u element %s is configured falseu checking trueListu checking falseListu decimalu textu longDecimalu multiTextu element %s is disabledu" element %s is enabled, value == %su enumu enum element %s is disabledu enum item has a valueListu! all valueList items exist in fileu displayNameu listu
explicitValueu trueu. explicitValue list, we will return value namesu (?!\*\*delvals\.)R� u element %s is enabled values: %su element {0} is disabledu$ {0} is disabled by all enum elementsu {0} is enabled by enum elementsu Examination complete: %s secondsu$ Compiling non hierarchical return...u \u full_path_list == %su Compilation complete: %s secondsu Compiling hierarchical return...u Administrative Templatesu lgpo_sectionN(E Ra Rb R
t _read_regpol_fileR? R� R� RP R� R� R� R� t stringutilst to_bytesR= Ry R@ Rw Rc Rd t timeR� R[ R� t REGKEY_XPATH_MAPPEDt REGKEY_XPATHRl R RY RZ Rm t POLICY_ANCESTOR_XPATHt ALL_CLASS_POLICY_XPATHt removeR� R� R� Rn t _build_parent_listR R R R� t ENABLED_VALUE_XPATHt DISABLED_LIST_XPATHt DISABLED_VALUE_XPATHR� t ENABLED_LIST_XPATHR� Rt R� t ELEMENTS_XPATHR] t TRUE_VALUE_XPATHt FALSE_VALUE_XPATHt TRUE_LIST_XPATHt FALSE_LIST_XPATHR� R� t VALUE_XPATHt VALUE_LIST_XPATHRW R< R� R� t reverseR: t
dictupdateR� (6 t policy_classRl Rk t hierarchical_returnt return_not_configuredt module_policy_dataR� t
admx_policiest policy_valst hierarchyt
full_namest admx_policy_definitionst adml_policy_resourcest policy_filedata_splitt
start_timeR� t policy_item_keyt
admx_itemst admx_itemt not_configured_policiest not_configured_policyt not_configured_policy_namespacet admx_policyt this_valuenamet this_policy_settingt element_only_enabled_disabledt% explicit_enable_disable_value_settingt this_keyt this_policynamet this_policynamespacet required_elementst configured_elementst policy_disabled_elementst
elements_itemt
child_itemt this_element_namet child_keyt child_valuenamet configured_valuet enum_itemR� t full_nameR t
unpathed_dictt pathed_dictt policy_namespacet full_path_listt path_neededt hierarchy_itemt tdictt
first_itemR} t newdictt
h_policy_name( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _checkAllAdmxPolicies� sr !' !
:
+$
"
#
(
c
C@ s� g } t | j j � � d } | j d j | � d | j �} t d | � } | r� | d } d j | � } t | j | d | j �� } t j | | j � } t d | d | d | d | d
| d | � } n | S( u[
helper function to build a list containing parent elements of the ADMX
policy
i u {0}:parentCategory/@refR� R� u) /policyDefinitions/policyNamespaces/{0}:*R9 R� t parent_categoryt policy_nsmapRk Rl (
R� R� R< R� RP R� R� R� R� t _admx_policy_parent_walk( R� Rk Rl t parent_listR� R R� t nsmap_xpatht this_namespace_map( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyR� � s.
c
C@ su t d | � } d } d } | j d � d k r� | j d � d } | j d � d } | j | � } t j | t | j | d | �� � } n | j | | � } | j | d | �rq| j | d | �d } t d | d | j d
d | d | � }
| j
|
� | j d
j | � d | �rqt d | d | d | j d
j | � d | �d d | d | d | � } qqn | S( uo
helper function to recursively walk up the ADMX namespaces and build the
hierarchy for the policy
R� u7 /policyDefinitions/categories/{0}:category[@name="{1}"]u- /policyDefinitions/policyNamespaces/{0}:usingu :i i R� R� Rj u nameRk Rl u {0}:parentCategory/@refR9 R� R R ( R� R� Rc RP R� R� R� R� Rn R� Rm R ( R9 R� R R Rk Rl R� t category_xpath_stringt using_xpath_stringt tparent_categoryt this_parent_name( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyR � s:
"c C@ sL d } t j j | � rH t j j j | d � � } | j � } Wd QXn | S( uK
helper function to read a reg policy file and return decoded data
u rbN( R R8 R9 t existsR� R� R� R� R� ( t reg_pol_patht
returndatat pol_file( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyR� � s
c C@ s� | r� t j j j d � } d j t j j j d � t j | � d | t j | � d g � } t j | | t j � } | r� | | j � | j
d | j � � d !Sn d S( u�
helper function to do a search of Policy data from a registry.pol file
for a policy_regpath and policy_regkey combo
u (\*\*Del\.|\*\*DelVals\.){0,1}R� u \[t ;t ]i N(
R� R� R� R� R: R� Ry Ro Rp R{ R| R} R ( Rr t policy_regpatht
policy_regkeyt specialValueRegext _thisSearchRs ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _regexSearchKeyValueCombo� s *c C@ s� y�d } t j j | � s, t d | � n t j j j | d � �E } | j | j d � � sx | j
| j d � � n | j
| � Wd QXy�d } t j j | � r� t j j j | d � � } | j � } Wd QXn t d | � s� d | } n t d
j
t j | � � | � r�t j d j
t j | � � | t j t j B� } | | j � | j � !}
t d j
t j | � � |
� s-|
j d
� }
| |
d |
d <d
j |
� }
| d | j � !|
| | j � } q-nT t j d | t j t j B� } d j
| | j � | j � !| | | | j � � } t d | � ret j d | t j t j B� } | | j � | j � !}
|
j d
� }
t j d t j d t |
d � � � } | j � d j � k r�| d | d d f } n3 | j � d j � k r| d d | d f } n t j d t j d | � � d } d j
| d | j � !d | | | j � � } n� t j d | t j t j B� } | j � d j � k r�d } n! | j � d j � k r�d } n d j
| | j � | j � !d t d j
t j | d � j d � t j | d � j d � � d � | | j � � } | rst j j j | d � � } | j
| � Wd QXn Wn> t k
r�} d j
| | � } t j! | � t" | � � n XWn> t k
r�} d j
| | � } t j! | � t" | � � n Xd S( uS
helper function to actually write the data to a Registry.pol file
also updates/edits the gpt.ini file to include the ADM policy extensions
to let the computer know user and/or machine registry policy files need
to be processed
data_to_write: data to write into the user/machine registry.pol file
policy_file_path: path to the registry.pol file
gpt_ini_path: path to gpt.ini file
gpt_extension: gpt extension list name from _policy_info class for this registry class gpt_extension_location
gpt_extension_guid: admx registry extension guid for the class
u 剐来 u
file.makedirsu wbu utf-16-leNu u ru \[General\]\r\nu [General]
u {0}=u ^{0}=.*\r\nu {0}u =i i u ^\[General\]\r\nu {0}{1}={2}
{3}u Version=u ^Version=.*\r\ns >2Hs >Iu gPCMachineExtensionNamesu gPCUserExtensionNamesu Versionu {0}{1}i i u wuC An error occurred attempting to write to {0}, the exception was {1}( i i ( i i (# R8 R9 R
R� R� R� R� R� R Rw t writeR� Rt RP R� Ry Ro Rp t MULTILINER{ R} Rc R: R~ R R� R\ R[ R R| t zfillRj Ra Rs R ( t
data_to_writet policy_file_pathRA t
gpt_extensiont gpt_extension_guidR@ R
t gpt_ini_datat gpt_filet gpt_ext_loct gpt_ext_strt general_locationt version_loct version_strt version_numst version_numRw R� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _write_regpol_data
s�
+ (" "
c C@ s� | s d } n t j j j d � } x� | D]� } | j d � d j d � } t j | d | j d � d d t j �} t j
d | � t | | | � } | r� t j
d | | � | j | | � } q+ t j
d
| � d j
| | g � } q+ W| S( u�
helper function to take a list of strings for registry.pol file data and
update existing strings or append the strings
R� u (\*\*Del\.|\*\*DelVals\.){0,1}R i t [i t flagsu item value name is %su replacing %s with %su appending %s( R� R� R� R� Rc R_ R� R� Rp Ra Rb R RN R: ( t string_listRr R t this_stringt
list_item_keyt list_item_value_namet data_to_replace( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _policyFileReplaceOrAppendListu s&
c C@ s� | s d } n t j j j d � } d } d } d } | s� | j d � d j d � } t j | d | j d � d d t j �} t
j d | � t | | | � } n | r� t
j d | | � | j
| | � } n% t
j d
| � d j | | g � } | S( u�
helper function to take a ADMX policy string for registry.pol file data and
update existing string or append the string to the data
R� u (\*\*Del\.|\*\*DelVals\.){0,1}R i R& i R' u item value name is %su replacing %s with %su appending %sN( R� R� R� R� R Rc R_ R� R� Rp Ra Rb R RN R: ( R) Rr t append_onlyR R� t item_value_nameR, ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _policyFileReplaceOrAppend� s( u Machinec C@ s, d } t � } d } t d | � } t d | � } y� t d | d | d t d t d t � } x� | D]� } x� | | D]� }
t j | | |
� j � d k r� | j | i � j |
d: � d: k rt j d
|
� qqu t j d |
� | | k ri | | <n | | |
| | |
<qu Wqd Wx�
| D]�
} x�
| | D]�
} t j d | � t } d: }
d: } t j | | | � j � d
k r�t j d | � | j
| j | � d i | d 6�} | r� | d } d | j k r�| j d | k s�| j d d k r�d | j k r| j d }
n t j d | j � Pd | j k rN| j d } n t | � r�t } t | | |
| t d: d t d t �} t | | � } n t | � r�t } t | | |
t d: d t �} t j d | � t | | � } n | r%| r%t |
| d d: d t �} t | | � } n t | � r�t j d | � x<t | � D]+} x"| j � D]} |
} | } d | j k r�| j d } n d | j k r�| j d } n t j | � j d k rMt | � s�t | � rMi t d 6t d 6} x}| D]J } t | | | | | d: d t �} t j d | | � t | | � } q�Wqat j | � j d k s�t j | � j d! k s�t j | � j d" k s�t j | � j d# k s�t j | � j d$ k s�t j | � j d% k r t | | | | | d t �} t j d& | � t | | � } qat j | � j d' k rat | | | | | d t �} t j d& | � t | | � } qaqaWqNWq�q�t j d( | | � q�t j d) | j � q� q7t j d* | � | j
| j | � d i | d 6�} t j d+ | � | r7| d } d | j k r� | j d | k s<| j d d k r� d | j k r[| j d }
n t j d | j � Pd | j k r�| j d } n t! | � r�t } t | | |
| t! d: d t d t �} t | | � } n t" | � r+t } t | | |
t" d: d t �} t j d, | � t | | � } n | re| ret |
| d d- d t �} t | | � } n t | � r� xAt | � D]0} x'| j � D]} |
} | } d | j k r�| j d } n d | j k r�| j d } n | j d. | | | k r�t j | � j d k r�t | � s,t | � r�g } | | | | j d. r�t | | | t d: d t �} t j d/ j | � � n t | | | t d: d t �} t | | � } q� t j | � j d k rd t# | � s�t$ | � rd d0 } | | | | j d. r+ t | | | | t# d: d t d t �} n' t | | | | t$ d: d t d t �} t | | � } q� t j | � j d k s� t j | � j d! k s� t j | � j d" k s� t j | � j d# k s� t j | � j d$ k r5
t | | | | | d t d1 | | | | j d. �} t j d2 | � t | | � } q� t j | � j d% k r0 xW| j � D]� } | | | | j d. t% | | j d3 � j& � k rZ
t | | j d. | | t' d: d t d t �} t | | � } t( | � r% t | | | t( d: d t �} t j d4 | j d. � t | | � } n PqZ
qZ
Wq� t j | � j d' k r� t | | | | | d t d1 | | | | j d. �} t j d2 | � t | | d5 t �} q� q�q�Wq~Wq� q� q� q7q7Wq&Wt) | | j* | d6 | j+ | j* | d7 | j* | d8 � Wn$ t, k
r' } t j- d9 | � t SXt S(; u�
helper function to prep/write adm template data to the Registry.pol file
each file begins with REGFILE_SIGNATURE (u'剐来') and
REGISTRY_FILE_VERSION (u'\x01\00')
https://msdn.microsoft.com/en-us/library/aa374407(VS.85).aspx
+ https://msdn.microsoft.com/en-us/library/cc232696.aspx
[Registry Path<NULL>;Reg Value<NULL>;Reg Type;SizeInBytes;Data<NULL>]
R� u% //ns1:*[@id = "{0}" or @name = "{0}"]R� R� Rl Rk R� R� u not configuredu Policy "%s" removedu! adding %s to base_policy_settingsu working on admPolicy %su disabledu time to disable %sR� u ns1i u classu Bothu keyu9 policy item %s does not have the required "key" attributeu valueNameR� R� R� u' working with disabledList portion of %su REG_DWORDu checking elements of %su booleanu trueListu falseListu working with %s portion of %su decimalu textu longDecimalu multiTextu enumu" I have disabled value string of %su listuG policy %s was found but it does not appear to be valid for the class %su; policy item %s does not have the requried "class" attributeu& time to enable and set the policy "%s"u found this_policy == %su& working with enabledList portion of %su 1u idu$ working with trueList portion of {0}u R� u! I have enabled value string of %su displayNameu$ working with valueList portion of %sR. u policy_pathu gpt_extension_locationu gpt_extension_guiduR Unhandled exception %s occurred while attempting to write Adm Template Policy FileN(. R
R� R� R� R R R| R[ RH R� R Ra Rb R� RP R� R� R� R R� R0 R� R� R- R� R� R] R RY RZ R� R� R� R� R� R� R� RW R. R� R� R% R? RA Rj Rs ( t admtemplate_dataRl R� t
existing_dataRr t policySearchXpathR� R� t base_policy_settingst
adm_namespacet
adm_policyt admPolicyR� R� R� t this_policyt disabled_value_stringt disabled_list_stringsR� R� R� R� t temp_dictt this_listt enabled_value_stringt enabled_list_stringst list_stringst value_stringR� Rw ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _writeAdminTemplateRegPolFile� sf
#$
#%
&
%
&
+c C@ s� d } t j j | d d � r�t j j j | d d d � � } | j � } Wd QX| r�y2 t | j
d � j d � � } t j
d | � Wn3 t k
r� } t j d | d � t | � � n Xd
| d k r�| d d
j � g | j � D] } | j � ^ q� k r�d | d k r�t j
d | d d � | d d j � g | | d d
j � D] } | j � ^ q^k r�| | d d
| d d j � Sd Sq�| | d d
Sq�d Sq�n d S(
u
helper function to parse/read a GPO Startup/Shutdown script file
psscript.ini and script.ini file definitions are here
https://msdn.microsoft.com/en-us/library/ff842529.aspx
https://msdn.microsoft.com/en-us/library/dd303238.aspx
u ScriptIniu IniPathu rbNu utf-16-leu u Have deserialized data %su7 An error occurred attempting to deserialize data for %su Policyu Sectionu SettingNameu Need to look for %s( R R8 R9 t isfileR� R� R� R� R� R R� R_ Ra Rb Rj Rs R R[ R< ( t policy_infot
_existingDatat fhrR� R� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _getScriptSettingsFromIniFile s( # IE"
c C@ s� t j j t j d � d d d d d � } t j j t j d � d d d d d � } t j j t j d � d d d d d � } t j j t j d � d d d d d � } d S(
u�
helper function to write local GPO startup/shutdown script
scripts are stored in scripts.ini and psscripts.ini files in
``WINDIR\System32\GroupPolicy\Machine|User\Scripts``
these files have the hidden attribute set
files have following format:
empty line
[Startup]
0CmdLine=<path to script 0>
0Parameters=<script 0 parameters>
[Shutdown]
0CmdLine=<path to shutdown script 0>
0Parameters=<shutdown script 0 parameters>
Number is incremented for each script added
psscript file also has the option of a [ScriptsConfig] section, which has
the following two parameters:
StartExecutePSFirst
EndExecutePSFirst
these can be set to True/False to denote if the powershell startup/shutdown
scripts execute first (True) or last (False), if the value isn't set, then
it is 'Not Configured' in the GUI
u WINDIRu System32u GroupPolicyu Machineu Scriptsu scripts.iniu
psscripts.iniu UserN( R8 R9 R: R; ( t psscriptt _machineScriptPolicyPatht" _machinePowershellScriptPolicyPatht _userScriptPolicyPatht _userPowershellScriptPolicyPath( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _writeGpoScript" s0 c C@ sp g } t d | � } t d | � } t | d | d | �} | rt | � d k r� | d } t d | d | j d d t d | � } | j | � | j | j d � t d
| d t d | � } | j � | j | � | j d j
| � � t | | d) f Sd }
t d) g |
f Sn<t
| d | �} g } | }
| s{d | k r{| j d � } | j � } t
| d | �} q{n | rTt } d
} g } t | � d k r�t j d | � t } x'| D] } t | d d
� j � | k s�| j | � q�| r�t j d | � d j | j j d � d | j d � } d j | j | | � } g } | j | d | j �} | s�t j d | � | j | � n x� | D]� } t j d | � t d
| d t d | � } | j � | | k r*d }
t j |
| | � t | � d k rZt j d � | j | � qZq�t j d | | � t j d | � | j | � q�Wt | � d k r�| j | d � q�q�d j | j j d � d | j d � } t | d | d | �} | s�| j | � q�q�Wn x* | D]" } | | k r�| j | � q�q�Wt | � d k r3| r3t } n x�| D]�} t j d | j | j � d j | j j d � d | j d � } t j d | � | s�t j d | | � t | d | d | �} n | r:t j d j | � � t j d! j | � � t | � d k s| r�| r�t } xa| D]Y} t } | r�t d
| d t d | � } | j � t j d" | | � | | k r�t } q�n t } | r$t j d# | | � d | j k rUt d | d | j d d t d | � } | j | � | j | j d � t d
| d t d | � } | j � | j | � | j d j
| � � t | | d) f Sd$ }
|
j | � }
t d) g |
f Sq$q$W| s"d% j |
� }
t d) g |
f Sq%xy | D]n } t d
| d t d | � } | j � | j | � | rd& j
| d j
| � g � } q�d j
| � } q�Wq:q:W| rTd' }
t d) g |
j | | � f Sn t d) g d( j | | � f S(* uD
(success_flag, policy_xml_item, policy_name_list, message)
R� Rj R� i i R� u nameRk Rl R� u \u8 ADMX policy name/id "{0}" is used in multiple ADMX filesu u7 multiple ADML entries found matching the policy name %su textu we have hierarchy of %su
$({0}.{1})u }u iduK //{0}:policy[@displayName = "{1}" and (@class = "Both" or @class = "{2}") ]R� u; No admx was found for the adml entry %s, it will be removedu policy_name == %su7 hierarchy %s does not match this item's hierarchy of %suY only 1 admx was found and it does not match this adml, it is safe to remove from the listu+ hierarchy %s matches item's hierarchy of %su! search_result %s added to resultsRR u1 found an ADML entry matching the string! %s -- %su searching for displayName == %suG search for an admx entry matching display_name %s and registry_class %su% processing admx_search_results of {0}u multiple_adml_entries is {0}u testing %s == %su8 found the ADMX policy matching the display name %s -- %suN ADMX policy with the display name {0} does nothave the required name attribtueu% Unable to correlate {0} to any policyu , u� ADML policy name "{0}" is used as the display name for multiple policies. These policies matched: {1}. You can utilize these long names to specify the correct policyu Unable to find {0} policy {1}N( R� R� t ADMX_SEARCH_XPATHRd Rn R� R Rm R� R� R: R R t ADML_SEARCH_XPATHRc R� Ra Rb R7 R. RP R� R� R� R� t ADMX_DISPLAYNAME_SEARCH_XPATHR� ( Rj R� Rl t policy_aliasesR� R� t admx_search_resultst
the_policyt policy_display_nameR� R� t adml_search_resultsR� t hierarchy_policy_namet multiple_adml_entriest suggested_policiest adml_to_removet adml_search_resultt display_name_searchvalt policy_search_stringt admx_resultst these_admx_search_resultst
search_resultt this_hierarchyt admlt foundt possible_policyt this_parent_list( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt _lookup_admin_templateY sH
c C@ s� i | d 6| d 6g d 6t d 6t d 6g d 6d d 6} | j � } t � } | | j j � k r� d j | j j � � } d
j | | � | d <| S| | j | d k r| d j | j | d | d � t | d <d
| d <d | j | d | k r
t | d <n | Sx� | j | d D]� } | j | d | d j � | j � k r | d j | � t | d <d
| d <d | j | d | k r�t | d <n | Sq Wt
d | d | d | � \ } } } }
| r~x� t | � D]x } xo | j � D]a } t
d | d | j d d t d | � }
| d j i | j d d 6| j d |
g d 6� q�Wq�W| | d <t | d <d
| d <| S|
| d <| S( u
Returns information about a specified policy
Args:
policy_name (str):
The name of the policy to lookup
policy_class (str):
The class of policy, i.e. machine, user, both
adml_language (str):
The ADML language to use for Administrative Template data lookup
Returns:
dict: Information about the specified policy
CLI Example:
.. code-block:: bash
salt '*' lgpo.get_policy_info 'Maximum password age' machine
You can use ``lgpo.get_policy_info`` to get all the possible names that
could be used in a state file or from the command line (along with elements
that need to be set/etc). The key is to match the text you see in the
``gpedit.msc`` gui exactly, including quotes around words or phrases. The
"full path" style is really only needed when there are multiple policies
that use the same base name. For example, ``Access data sources across
domains`` exists in ~10 different paths. If you put that through
``get_policy_info`` you'll get back a message that it is used for multiple
policies and you need to be more specific.
CLI Example:
.. code-block:: bash
salt-call --local lgpo.get_policy_info ShellRemoveOrderPrints_2 machine
local:
----------
message:
policy_aliases:
- Turn off the "Order Prints" picture task
- ShellRemoveOrderPrints_2
- System\Internet Communication Management\Internet Communication settings\Turn off the "Order Prints" picture task
policy_class:
machine
policy_elements:
policy_found:
True
policy_name:
ShellRemoveOrderPrints_2
rights_assignment:
False
Escaping can get tricky in cmd/Powershell. The following is an example of
escaping in Powershell using backquotes:
.. code-block:: bash
PS>salt-call --local lgpo.get_policy_info "Turn off the `\`"Order Prints`\`" picture task" machine
local:
----------
message:
policy_aliases:
- Turn off the "Order Prints" picture task
- ShellRemoveOrderPrints_2
- System\Internet Communication Management\Internet Communication settings\Turn off the "Order Prints" picture task
policy_class:
machine
policy_elements:
policy_found:
True
policy_name:
Turn off the "Order Prints" picture task
rights_assignment:
False
This function can then be used to get the options available for specifying
Group Policy Objects to be used in state files. Based on the above any of
these *should* be usable:
.. code-block:: bash
internet_communications_settings:
lgpo.set:
- computer_policy:
Turn off the "Order Prints" picture task: Enabled
.. code-block:: bash
internet_communications_settings:
lgpo.set:
- computer_policy:
ShellRemoveOrderPrints_2: Enabled
When using the full path, it might be a good idea to use single quotes
around the path:
.. code-block:: bash
internet_communications_settings:
lgpo.set:
- computer_policy:
'System\Internet Communication Management\Internet Communication settings\Turn off the "Order Prints" picture task': 'Enabled'
If you struggle to find the policy from ``get_policy_info`` using the name
as you see in ``gpedit.msc``, the names such as "ShellRemoveOrderPrints_2"
come from the ``.admx`` files. If you know nothing about ``.admx/.adml``
relationships (ADML holds what you see in the GUI, ADMX holds the more
technical details), then this may be a little bit too much info, but here is
an example with the above policy using Powershell:
.. code-block:: bash
PS>Get-ChildItem -Path C:\Windows\PolicyDefinitions -Recurse -Filter *.adml | Select-String "Order Prints"
C:\windows\PolicyDefinitions\en-US\ICM.adml:152: <string id="ShellRemoveOrderPrints">Turn off the "Order Prints" picture task</string>
C:\windows\PolicyDefinitions\en-US\ICM.adml:153: <string id="ShellRemoveOrderPrints_Help">This policy setting specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders.
C:\windows\PolicyDefinitions\en-US\ICM.adml:155:The Order Prints Online Wizard is used to download a list of providers and allow users to order prints online.
C:\windows\PolicyDefinitions\en-US\ICM.adml:157:If you enable this policy setting, the task "Order Prints Online" is removed from Picture Tasks in File Explorer folders.
From this grep, we can see id "ShellRemoveOrderPrints" is the ID of the
string used to describe this policy, then we search for it in the ADMX:
.. code-block:: bash
PS>Get-ChildItem -Path C:\Windows\PolicyDefinitions -Recurse -Filter *.admx | Select-String "ShellRemoveOrderPrints"
C:\windows\PolicyDefinitions\ICM.admx:661: <policy name="ShellRemoveOrderPrints_1" class="User" displayName="$(string.ShellRemoveOrderPrints)" explainText="$(string.ShellRemoveOrderPrints_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="NoOnlinePrintsWizard">
C:\windows\PolicyDefinitions\ICM.admx:671: <policy name="ShellRemoveOrderPrints_2" class="Machine" displayName="$(string.ShellRemoveOrderPrints)" explainText="$(string.ShellRemoveOrderPrints_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="NoOnlinePrintsWizard">
Now we have two to pick from. And if you notice the ``class="Machine"`` and
``class="User"`` (which details if it is a computer policy or user policy
respectively) the ``ShellRemoveOrderPrints_2`` is the "short name" we could
use to pass through ``get_policy_info`` to see what the module itself is
expecting.
u policy_nameu policy_classu policy_aliasesu policy_foundu rights_assignmentu policy_elementsu policy not foundu messageu , uO The requested policy class "{0}" is invalid, policy_class should be one of: {1}u policiesu Policyu u LsaRightsRj R� Rl R� u idRk u
element_idu element_aliases( R t titleR
R> R< R: RP Rm R R[ Rd R� R] Rn R� ( Rj R� Rl t retRr t policy_classest polt successt policy_xml_itemt policy_name_listt messageR� R� R� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt get_policy_info sf �
+
c C@ s� i } i } t � } | d$ k s3 | j � d k rE | j j � } nv | j � g | j j � D] } | j � ^ q^ k r� d } t | j | d j | j j � � � � � n | j � g } x-| D]%}
| j |
d } i } x�| D]�}
d$ } |
| j |
d k r!| j |
d |
} ne xb | j |
d D]O } | j |
d | d j � |
j � k r3| j |
d | } | }
q3q3W| rK|
} d | k r�t
d | d d | d d | d d
� d | |
<t j d | |
|
� nVd
| k r t
d | d
d � } | | |
<n&d | k rVt d | d d d | d d � | |
<n� d | k r�t d | d d � | |
<n� d | k r�| d d | k r�t j d$ | d d � | | d d <n | | d d | d d | |
<nV d | k rt | d d � | |
<n/ d | k rDt j d |
� t | � | |
<n |
| k r�t d | |
d | j |
d |
d d � | |
<n | r�| j |
� | | d <| d } n | rfd | k rHt } i } xW t | d � D]E } i } | ri | j | � | 6| | <t } n
| | | <| } q�W| rEt j | | � } qEqHqfq� d } t | j |
� � � q� Wt j | t d |
d | d! | d" | d# | � � } | j |
d | k r�i | | j |
d 6} | } n t j | | � } q� W| S(% uY
Get a policy value
Args:
policy_class (str):
Some policies are both user and computer, by default all policies
will be pulled, but this can be used to retrieve only a specific
policy class User/USER/user = retrieve user policies
Machine/MACHINE/machine/Computer/COMPUTER/computer = retrieve
machine/computer policies
return_full_policy_names (bool):
True/False to return the policy name as it is seen in the
``gpedit.msc`` GUI or to only return the policy key/id.
hierarchical_return (bool):
True/False to return the policy data in the hierarchy as seen in the
``gpedit.msc`` GUI. The default of False will return data split only
into User/Computer configuration sections
adml_language (str):
The ADML language to use for processing display/descriptive names
and enumeration values of ADMX template data, defaults to en-US
return_not_configured (bool):
Include Administrative Template policies that are 'Not Configured'
in the return data
Returns:
dict: A dictionary containing the policy values for the specified class
CLI Example:
.. code-block:: bash
salt '*' lgpo.get machine return_full_policy_names=True
u bothua The policy_class {0} is not an available policy class, please use one of the following: {1}, Bothu , u policiesu Policyu Registryu reg.read_valueu Hiveu Pathu Valueu vdatau Value %r found for reg policy %su SeceditR� u Optionu NetSHR u Profileu AdvAuditu NetUserModalu Modalu LsaRightsu ScriptIniu! Working with ScriptIni setting %sR R� R8 u Getu lgpo_sectionuT The specified policy {0} is not currently available to be configured via this moduleR� Rl Rk R� R� N( R
R R[ R> R< R RP R: Re RU R� Ra Rb R0 R R� t win32nett NetUserModalsGetRK RF R; R� R t reversedR R� R� R� ( R� Rk R� Rl R� t valst
modal_returnsR: R� R� t p_classt this_class_policy_namest
class_valsRj t _polR� t
vals_key_nameRe t firstItemR� t levelR� R; ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyRH � s� * 4*
+
%
c C@ s5 i } | | | <t d | d d d | d | � } | S( u�
Set a single computer policy
Args:
name (str):
The name of the policy to configure
setting (str):
The setting to configure the named policy with
cumulative_rights_assignments (bool): Determine how user rights
assignment policies are configured. If True, user right assignment
specifications are simply added to the existing policy. If False,
only the users specified will get the right (any existing will have
the right revoked)
adml_language (str): The language files to use for looking up
Administrative Template policy data (i.e. how the policy is
displayed in the GUI). Defaults to 'en-US' (U.S. English).
Returns:
bool: True if successful, otherwise False
CLI Example:
.. code-block:: bash
salt '*' lgpo.set_computer_policy LockoutDuration 1440
t computer_policyt user_policyt cumulative_rights_assignmentsRl N( t set_R ( R R R| Rl Rh Rf ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt set_computer_policyr s !
c C@ s5 i } | | | <t d | d d d t d | � } | S( u|
Set a single user policy
Args:
name (str):
The name of the policy to configure
setting (str):
The setting to configure the named policy with
adml_language (str):
The language files to use for looking up Administrative Template
policy data (i.e. how the policy is displayed in the GUI). Defaults
to 'en-US' (U.S. English).
Returns:
bool: True if successful, Otherwise False
CLI Example:
.. code-block:: bash
salt '*' lgpo.set_user_policy "Control Panel\Display\Disable the Display Control Panel" Enabled
R{ Rz R| Rl N( R} R R ( R R Rl Rh Rf ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt set_user_policy� s
c - C@ s� | r+ t | t � r+ d } t | � � n | rV t | t � rV d } t | � � n i } | | d <| | d <| r�t d | � } x| D]�} i } i } i }
i } i } i }
i } t � } | | r� x� | | D] } dm } | } | | j | d k r| j | d | } ne xb | j | d D]O } | j | d | d j � | j � k r-| j | d | } | } q-q-W| r
t d | | | d | j | d | d
d � } t d | d | j | d | � sd } t | j
| | | | � � � n d
| k r<t j d | � i | d 6| d 6|
| <qY
d | k r�t j d | � | d d | k r�g | | d d <n | | d d j
d j | d d d t j | � g � � qY
d | k r,t j d | � | j | i | d d d 6| d d d 6| d d d 6t j | � d 6� qY
d | k rj|
j | i | d d d 6t j | � d 6� qY
d | k r�t j d | � | d d | k r�i | | d d <n | | | d d | d d <qY
d! | k rY
t j d" | � i | d 6| d 6| | <qY
q� | | | } t j d# | � t d$ | d% | d& | � \ } } } } | r�| j d' } | j | j } | | k r�i | | <n | | | | <n t | � � | r� | | | k r� | dm k r� t j d( t j | | | � j � � t j t j | | | � j � � t j | | | � j � d) k rY
t j | | | � j � d* k rY
t | � r
t | | | t � r� x�t | � D]V} xM| j � D]?} t j d+ | j d, � dm } t d- | d$ | j d, d. t d& | � } t j d/ | j d, | � | | | | k r | } nI | j d, | | | k rK| j d, } n d0 } t | j
| | � � � d1 | j k r�| j d1 j � d2 k r�| | | | s�d3 } t | j
| � � � q�n t j | � j d4 k rt | | | | t � s� d5 } t | j
| � � � q� n�t j | � j d6 k sHt j | � j d7 k rd8 } d9 } d: | j k ryt | j d: � } n d; | j k r�t | j d; � } n t | | | | � | k s�t | | | | � | k r� d< } t | j
| | | � � � q� n�t j | � j d= k r�t } xL | j � D]> } | | | | t! | | j d> � j" � k r,t } Pq,q,W| s� d? } t | j
| � � � q� n t j | � j d@ k rY dA | j k r | j dA j � d2 k r t | | | | t � sV dB } | j
| � } t | � � qV q� t | | | | t# � s� dC } | j
| � } t | � � q� nZ t j | � j dD k r� t | | | | t# � s� dC } | j
| � } t | � � q� n | | | j$ | � | | | | j d, <q�Wq�WqS
dE } | j
| � } t | � � qV
t j | | | � j � dF k rV
dG } | j
| � } t | � � qV
qY
q� q� W|
r� x}|
D]r}! t j dH |! � |
|! d dm k r |
|! d dI k r t% dJ |
|! d d
dK |
|! d d
dL |
|! d d
dM |
|! d |
|! d d
dN � }" n� t% dO |
|! d d
dK |
|! d d
dL |
|! d d
dM � }" |" dP r� |" dQ dI k r� t% dR |
|! d d
dK |
|! d d
dL |
|! d d
dM � }" n |" sj
dS } t& | j
|! � � � qj
qj
Wn | r
x | D]}# dm }$ | s! t' | |# d d! d � }$ n | |# d r� x\ | |# d D]I }% t( |% | |# d d! d � }" |" s> dT } t | j
|# � � � q> q> Wn |$ r� xk |$ D]` }% |% | |# d k r� t) |% | |# d d! d � }" |" s� dU } t | j
|# � � � q� q� q� Wq� q� Wn | r�
t j | � dV j dW dX g � }& dY dZ d[ d\ g }' xT |' D]L }( |( | k rJ
dV j |& d] j d^ |( d_ g � dV j | |( � g � }& qJ
qJ
WdV j |& d` da db g � }& t j dc |& � t* |& � s�
dd } t& | � � q�
n | r8xF | D]; }) t j de j
|) � � t j | |) � t+ | |) � q�
Wn |
r�xF |
D]; }) t j df j
|) � � t j |
|) � t, |
|) � qEWn | r2t j | � x� | D]� }* yQ t- j. dm |* � }+ t/ j0 |+ | |* � }, t j dg |, � t- j1 dm |* |, � }" Wq�t2 k
r*dh } t j3 | � t& | � � q�Xq�Wn | r�t }" t j di | � t4 | d& | dj | �}" |" s�dk } t& | � � q�q�q� q� Wt Sdl } t | � � dm S(n u�
Set a local server policy.
Args:
computer_policy (dict):
A dictionary of "policyname: value" pairs of computer policies to
set. 'value' should be how it is displayed in the gpedit GUI, i.e.
if a setting can be 'Enabled'/'Disabled', then that should be passed
Administrative Template data may require dicts within dicts, to
specify each element of the Administrative Template policy.
Administrative Templates policies are always cumulative.
Policy names can be specified in a number of ways based on the type
of policy:
Windows Settings Policies:
These policies can be specified using the GUI display name
or the key name from the _policy_info class in this module.
The GUI display name is also contained in the _policy_info
class in this module.
Administrative Template Policies:
These can be specified using the policy name as displayed in
the GUI (case sensitive). Some policies have the same name,
but a different location (for example, "Access data sources
across domains"). These can be differentiated by the "path"
in the GUI (for example, "Windows Components\Internet
Explorer\Internet Control Panel\Security Page\Internet
Zone\Access data sources across domains").
Additionally, policies can be specified using the "name" and
"id" attributes from the ADMX files.
For Administrative Templates that have policy elements, each
element can be specified using the text string as seen in
the GUI or using the ID attribute from the ADMX file. Due to
the way some of the GUI text is laid out, some policy
element names could include descriptive text that appears
lbefore the policy element in the GUI.
Use the get_policy_info function for the policy name to view
the element ID/names that the module will accept.
user_policy (dict):
The same setup as the computer_policy, except with data to configure
the local user policy.
cumulative_rights_assignments (bool):
Determine how user rights assignment policies are configured.
If True, user right assignment specifications are simply added to
the existing policy
If False, only the users specified will get the right (any existing
will have the right revoked)
adml_language (str):
The language files to use for looking up Administrative Template
policy data (i.e. how the policy is displayed in the GUI). Defaults
to 'en-US' (U.S. English).
Returns:
bool: True is successful, otherwise False
CLI Example:
.. code-block:: bash
salt '*' lgpo.set computer_policy="{'LockoutDuration': 2, 'RestrictAnonymous': 'Enabled', 'AuditProcessTracking': 'Succes, Failure'}"
u+ computer_policy must be specified as a dictu' user_policy must be specified as a dictu Useru MachineR� u policiesu PolicyR R� R8 u PutuD The specified value {0} is not an acceptable setting for policy {1}.u Registryu %s is a registry policyu policyu valueu Seceditu %s is a Secedit policyu Sectionu u Optionu =u NetSHu %s is a NetSH policyu Profileu profileu sectionu optionu AdvAuditu NetUserModalu %s is a NetUserModal policyu Modalu LsaRightsu %s is a LsaRights policyu searching for "%s" in admx dataRj R� Rl u nameu
setting == %su disabledu not configuredu checking element %su idR� Rk u/ id attribute == "%s" this_element_name == "%s"uI Element "{0}" must be included in the policy configuration for policy {1}u requiredu trueu. Element "{0}" requires a value to be specifiedu booleanu, Element {0} requires a boolean True or Falseu decimalu longDecimali i' u minValueu maxValueu/ Element "{0}" value must be between {1} and {2}u enumu displayNameu) Element "{0}" does not have a valid valueu listu
explicitValueu5 Each list item of element "{0}" requires a dict valueu# Element "{0}" requires a list valueu multiTextu6 The policy "{0}" has elements which must be configuredu enableduH The policy {0} must either be "Enabled", "Disabled", or "Not Configured"u %s is a Registry policyu (value not set)u
reg.set_valueu Hiveu Pathu Valueu Typeu reg.read_valueu successu vdatau reg.delete_valueug Error while attempting to set policy {0} via the registry. Some changes may not be applied as expectedu= An error occurred attempting to configure the user right {0}.uQ An error occurred attempting to remove previouslyconfigured users with right {0}.u
u [Unicode]u Unicode=yesu
System Accessu Event Auditu Registry Valuesu Privilege Rightsu u [u ]u [Version]u signature="$CHICAGO$"u
Revision=1u ini_data == %su_ Error while attempting to set policies via secedit. Some changes may not be applied as expectedu Setting firewall policy: {0}u" Setting Advanced Audit policy: {0}u NEW MODAL SET = %suR An unhandled exception occurred while attempting to set policy via NetUserModalSetu+ going to write some adm template data :: %sR� uq Error while attempting to write Administrative Template Policy data. Some changes may not be applied as expectedu You have to specify something!N(5 RY R< R R� R
R R> RU R; R= RP Ra Rb Rm R: R R| t
setdefaultRd R� R� R� R[ R� R] Rn R R RY RZ t boolR\ R RW R. R� R� R� R RK RF RH R6 R" R Rn Ro R� R� t NetUserModalsSetRj Rs RA (- Rz R{ R| Rl R� R> R� Rs t _seceditst _netshst
_advauditst _modal_setst _admTemplateDatat _regeditst
_lsarightsR: Rj Rv t policy_key_nameR� t _valueRi RR Rk R� R� R� t temp_element_nameR� t min_valt max_valRa R� t regeditRE t lsarightt _existingUserst acctt ini_datat _seceditSectionst _seceditSectionR t
_modal_sett _existingModalDatat _newModalSetData( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyR} � s O
# !
"'$##
5#
(
)
(� R� t
__future__R R R R� R& R8 t loggingR� t localet ctypesR R� t uuidt salt.exceptionsR R t salt.serializers.configparserR t salt.utils.dictupdateR� R� t salt.utils.filesR� t salt.utils.patht salt.utils.platformt salt.utils.stringutilst salt.utils.win_lgpo_netsht salt.extR t salt.ext.six.movesR t getLoggerR� Ra R� t __func_alias__t uuid4t hexR% R R Ri R� R� R R� R� R� R� R� R� R� R� R� R� R� R� R� R� RO R� t ENUM_ITEM_DISPLAY_NAME_XPATHRM RN RO R[ R\ Rn Rh R� R~ R t salt.utils.win_regR R� t windllt kernel32t windows_localeRH t GetSystemDefaultUILanguageRN R� t ImportErrort objectR
R� R� R� R� R� R� R� R� R� R� R R R R R" R, R- R0 R6 R; R= RF RH RK RW Rh Rn Rt R� R� R� R� R� R� R� R� R R� R R% R- R0 RA RF RL Rd Rm R~ R R} ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/win_lgpo.pyt <module>' sV
"
� � � � � � � � � � � � � � � � � �
�
V + a ) "
,
9 ?
8� � � + h � P " 9 � � � ) #
Mini Shell