offlineUpgrade %WINDIR%\offlineUpgrade * [*] * [*] HKLM\SYSTEM\CurrentControlSet\Control\Lsa [Security Packages] HKLM\SYSTEM\Setup\Upgrade\* [*] HKLM\SYSTEM\CurrentControlSet\Services\NDIS\IfTypes\* [*] %WINDIR% [WindowsUpdate.log] %WINDIR%\SoftwareDistribution\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\* [*] %WINDIR%\System32\LogFiles\WMI\RtBackup* [*] %WINDIR%\SoftwareDistribution\DataStore\* [*] %WINDIR%\SoftwareDistribution\Download\* [*] %WINDIR%\SoftwareDistribution\ScanFile\* [*] %WINDIR%\SoftwareDistribution\SelfUpdate\* [*] %WINDIR%\SoftwareDistribution\WebSetup\* [*] %WINDIR%\SoftwareDistribution\WuRedir\* [*] %WINDIR%\SoftwareDistribution\Featured\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdateSysprepInProgress\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [SetupWizardLaunchTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [FirstDetectionFailureTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [BalloonType] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [BalloonTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [ScheduledInstallDate] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [ScheduledInstallDay] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [ScheduledInstallTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [ShowUnableToDetectUI] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [OfflineDetectionPending] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [UnableToDetectTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [DownloadExpirationTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [NextDetectionTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [NextFeaturedUpdatesNotificationTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [FeaturedUpdatesNotificationSeqNumGenTime] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [FeaturedUpdatesNotificationSeqNum] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\UAS\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Volatile\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\UXFirmwareInstallsAllowed\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\AutoFirmwareInstallsAllowedAtShutdown\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\RebootWatch\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\RebootNotCompleted\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\RebootCompletionReported\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\DontExpirePolledEvents\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\EventCache.v2\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [ResetAU] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update [SelfUpdateTime] %WINDIR% [WindowsUpdate.log] %WINDIR%\SoftwareDistribution\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\* [*] HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\* [*] HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation [ActiveTimeBias] HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\* [*] HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\$ [NetLuidIndex] HKLM\SYSTEM\CurrentControlSet\Control\Class\{6BDD1FC5-810F-11D0-BEC7-08002BE2092F}\$ [NetLuidIndex] HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002bE10318}\{* [*] HKLM\SYSTEM\CurrentControlSet\Control\Nsi\{eb004a11-9b1a-11d4-9123-0050047759bc}\10\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Nsi\{eb004a11-9b1a-11d4-9123-0050047759bc}\7\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Nsi\{eb004a11-9b1a-11d4-9123-0050047759bc}\6\* [*] HKLM\SYSTEM\CurrentControlSet\Services\NDIS\IfTypes\$ [IfType] HKLM\SYSTEM\CurrentControlSet\Services\NDIS\IfTypes\$ [IfUsedNetLuidIndices] MigXmlHelper.IsOSEarlierThan("NT","6.0.0.0") %WINDIR%\system32\config [*.evt] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\* [*] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\WinRM\* [*] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\WinRM\* [*] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security\AD FS 2.0 Auditing\*[*] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\ADAM* HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [File] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\* [*] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog [*] %WINDIR%\system32\config [*.evt] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [CustomSD] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [Isolation] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [Retention] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [AutoBackupLogFiles] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [MaxSize] MigXmlHelper.IsOSEarlierThan("NT","6.0.0.0") %WINDIR%\system32\winevt\logs [*] %WINDIR%\system32\config [*.evt] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\* [*] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\* [*] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security\AD FS 2.0 Auditing\*[*] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\ADAM* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{832d43c6-2e88-4be7-a4d1-61fc2430ff07}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{d6795c62-6f24-4363-99ce-2ff3f4b1faba}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{f863cf1c-c759-4dc0-98bb-81a109974cdf}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{fb5e81f8-9a5c-4c9e-8144-6b9123e078df}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{d2dd58ba-3ed4-4d5a-9987-af473bb6d0b0}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1be39648-5678-4fae-839b-10da2c4cf234}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{cd75048f-1233-4f58-b9ed-98ba2097ac7e}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{4153360c-6259-4e56-900c-818532b7897d}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5b33145c-1c66-49f3-b4ca-f563c165f2c0}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{13e8b4f7-4d1c-4f65-95a2-39c6b26a3012}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{986329a0-a1d5-46cf-8801-595d646c271f}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1fd7c1d2-d037-4620-8d29-b2c7e5fcc13a}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{560b2594-7530-4c77-8998-f067ae1e2918}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{a58d520f-c444-4982-bb61-8db7f0a5f217}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{4d5ae6a1-c7c8-4e6d-b840-4d8080b42e1b}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{eea178e3-e9d4-41ca-bb56-cede1a476629}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{4b3efc0a-e514-4022-bd50-532620d2d9fb}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{67beaf60-484b-4078-a99b-95cf827c553b}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{2129b945-09ed-4965-820e-032243a31578}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{565bbeca-5b04-49bb-81c6-3e21527fcc8a}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{e98754d0-883b-11db-b606-0800200c9a66}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{95353826-4fbe-41d4-9c42-f521c6e86360}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{bc2eeeec-b77a-4a52-b6a4-dffb1b1370cb}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{57e0b31d-de8c-4181-bcd1-f70e880b49fc}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{8c9dd1ad-e6e5-4b07-b455-684a9d879900}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{e7ef96be-969f-414f-97d7-3ddb7b558ccc}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{98583af0-fc93-4e71-96d5-9f8da716c6b8}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{92ae46d7-6d9c-4727-9ed5-e49af9c24cbf}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{01979c6a-42fa-414c-b8aa-eee2c8202018}\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{3df0c2c1-5a04-4966-9790-df6ef0ccde9c}\* [*] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\Microsoft-Windows-MeetingSpace/Operational [*] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\Microsoft-Windows-Security-Licensing-SLC/Perf [*] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\Microsoft-Windows-TerminalServices-Gateway/* [*] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\Microsoft-Windows-Diagnosis-MSDT* [*] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\Microsoft-Windows-PrintSpooler* [*] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\Microsoft-Windows-Eventlog-ForwardPlugin/Debug [*] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\Microsoft-Windows-OfflineFiles* [*] %WINDIR%\system32\winevt\logs [Microsoft-Windows-TerminalServices-PnPDevices%4Analytic.etl] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\* [*] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\* [*] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog [*] %WINDIR%\system32\winevt\logs [*] %WINDIR%\system32\config [*.evt] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [File] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [File] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt [*] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [Enabled] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [ChannelAccess] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [Retention] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [AutoBackupLogFiles] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [BufferSize] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [MinBuffers] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [MaxBuffers] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [Latency] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [ClockType] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [SidType] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [Level] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [KeywordsLower] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [KeywordsUpper] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [FileMax] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [FileCounter] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\filters\* [*] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [CustomSD] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [Isolation] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [Flags] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [Retention] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [AutoBackupLogFiles] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [MaxSize] HKLM\Software\Microsoft\Windows\CurrentVersion\winevt\channels\$ [MaxSizeUpper] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [MaxSize] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\$ [MaxSizeUpper] HKLM\SYSTEM\CurrentControlSet\Services\partmgr\Parameters [SanPolicy] HKLM\SYSTEM\CurrentControlSet\Services\mountmgr [NoAutoMount] MigXmlHelper.DoesObjectExist("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\partmgr\Parameters [SanPolicy]") HKLM\SYSTEM\CurrentControlSet\Services\mountmgr [NoAutoMount] HKLM\SYSTEM\CurrentControlSet\Services\mountmgr [NoAutoMount] DCRoleOfflineUpgrade %WINDIR%\DCRoleOfflineUpgrade MigXmlHelper.DoesStringContentEqual("Registry", "HKLM\SYSTEM\CurrentControlSet\control\ProductOptions [ProductType]", "LanManNT") HKLM\SYSTEM\CurrentControlSet\Services\NTDS [DirectoryServiceExtPt] HKLM\SYSTEM\CurrentControlSet\Services\NTDS [LsaDbExtPt] HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [ServiceDll] HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics\* [*] HKLM\SYSTEM\CurrentControlSet\Services\NTDS\rid\* [*] HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\* [*] HKLM\SYSTEM\CurrentControlSet\Services\NTDS\RID Values\* [*] HKLM\SYSTEM\CurrentControlSet\control\ProductOptions [ProductType] HKLM\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters [SysVol] HKLM\SOFTWARE\Microsoft\NTDS\* [*] HKLM\System\CurrentControlSet\Services\NTDS [Start] MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%SystemRoot%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%ProgramFiles%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%SystemDrive%\Program Files") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%ProgramFiles(x86)%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%SystemDrive%\build") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%SystemDrive%\InstalledRepository") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%ProfilesFolder%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%ProgramData%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [DSA Working Directory]","%SystemDrive%\Documents and Settings") %DSA_WORKING_DIR%\* [*] MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%SystemRoot%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%ProgramFiles%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%SystemDrive%\Program Files") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%ProgramFiles(x86)%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%SystemDrive%\build") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%SystemDrive%\InstalledRepository") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%ProfilesFolder%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%ProgramData%") MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters [Database log files path]","%SystemDrive%\Documents and Settings") %DATABASE_LOG_FILES_PATH%\* [*]