x-windows-userright-test_5.11.xsd

<?xml version="1.0" encoding="utf-8"?>
<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xmlns:win-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns:sch="http://purl.oclc.org/dsdl/schematron" targetNamespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" elementFormDefault="qualified" version="5.11">
	<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-common-5" schemaLocation="oval-common-schema.xsd"/>
	<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5" schemaLocation="oval-definitions-schema.xsd"/>
	<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" schemaLocation="oval-system-characteristics-schema.xsd"/>
	<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" schemaLocation="windows-definitions-schema.xsd"/>
	<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" schemaLocation="windows-system-characteristics-schema.xsd"/>
	<xsd:annotation>
		<xsd:appinfo>
			<schema>Experimental schema for the Windows User Right Test.</schema>
			<version>5.11</version>
			<date>07/23/2014 12:00:00 PM</date>
			<sch:ns prefix="oval-def" uri="http://oval.mitre.org/XMLSchema/oval-definitions-5"/>
			<sch:ns prefix="oval-sc" uri="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5"/>
			<sch:ns prefix="win-def" uri="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows"/>
			<sch:ns prefix="win-sc" uri="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows"/>
			<sch:ns prefix="xsi" uri="http://www.w3.org/2001/XMLSchema-instance"/>
		</xsd:appinfo>
	</xsd:annotation>
	<xsd:element name="userright_test" substitutionGroup="oval-def:test">
		<xsd:annotation>
			<xsd:documentation>The userright_test is used to enumerate all of the SIDs that have been granted a specific user right/privilege.</xsd:documentation>
			<xsd:appinfo>
				<oval:element_mapping>
					<oval:test>userright_test</oval:test>
					<oval:object>userright_object</oval:object>
					<oval:state>userright_state</oval:state>
					<oval:item target_namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows">userright_item</oval:item>
				</oval:element_mapping>
			</xsd:appinfo>
			<xsd:appinfo>
				<sch:pattern id="win-def_userrighttst">
					<sch:rule context="win-def:userright_test/win-def:object">
						<sch:assert test="@object_ref=ancestor::oval-def:oval_definitions/oval-def:objects/win-def:userright_object/@id"><sch:value-of select="../@id"/> - the object child
							element of a userright_test must reference a userright_object</sch:assert>
					</sch:rule>
					<sch:rule context="win-def:userright_test/win-def:state">
						<sch:assert test="@state_ref=ancestor::oval-def:oval_definitions/oval-def:states/win-def:userright_state/@id"><sch:value-of select="../@id"/> - the state child element
							of a userright_test must reference a userright_state</sch:assert>
					</sch:rule>
				</sch:pattern>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:complexType>
			<xsd:complexContent>
				<xsd:extension base="oval-def:TestType">
					<xsd:sequence>
						<xsd:element name="object" type="oval-def:ObjectRefType"/>
						<xsd:element name="state" type="oval-def:StateRefType" minOccurs="0" maxOccurs="unbounded"/>
					</xsd:sequence>
				</xsd:extension>
			</xsd:complexContent>
		</xsd:complexType>
	</xsd:element>
	<xsd:element name="userright_object" substitutionGroup="oval-def:object">
		<xsd:annotation>
			<xsd:documentation>The userright_object is used to collect the SIDs that have been granted a specific user right/privilege.</xsd:documentation>
			<xsd:appinfo>
				<sch:pattern id="win-def_userright_object_verify_filter_state">
					<sch:rule context="win-def:userright_object//oval-def:filter">
						<sch:let name="parent_object" value="ancestor::win-def:userright_object"/>
						<sch:let name="parent_object_id" value="$parent_object/@id"/>
						<sch:let name="state_ref" value="."/>
						<sch:let name="reffed_state" value="ancestor::oval-def:oval_definitions/oval-def:states/*[@id=$state_ref]"/>
						<sch:let name="state_name" value="local-name($reffed_state)"/>
						<sch:let name="state_namespace" value="namespace-uri($reffed_state)"/>
						<sch:assert test="(($state_namespace='http://oval.mitre.org/XMLSchema/oval-definitions-5#windows') and ($state_name='userright_state'))">State referenced in filter for
							<sch:value-of select="name($parent_object)"/> '<sch:value-of select="$parent_object_id"/>' is of the wrong type. </sch:assert>
					</sch:rule>
				</sch:pattern>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:complexType>
			<xsd:complexContent>
				<xsd:extension base="oval-def:ObjectType">
					<xsd:sequence>
						<xsd:choice>
							<xsd:element ref="oval-def:set"/>
							<xsd:sequence>
								<xsd:element name="userright" type="oval-def:EntityObjectUserRightType" minOccurs="1" maxOccurs="1">
									<xsd:annotation>
										<xsd:documentation>The userright entity holds a string that represents the name of a particular user right/privilege.</xsd:documentation>
									</xsd:annotation>
								</xsd:element>
								<xsd:element ref="oval-def:filter" minOccurs="0" maxOccurs="unbounded"/>
							</xsd:sequence>
						</xsd:choice>
					</xsd:sequence>
				</xsd:extension>
			</xsd:complexContent>
		</xsd:complexType>
	</xsd:element>
	<xsd:element name="userright_state" substitutionGroup="oval-def:state">
		<xsd:complexType>
			<xsd:annotation>
				<xsd:documentation>The userright_state is used to determine if a SID has been granted a user right/privilege.</xsd:documentation>
			</xsd:annotation>
			<xsd:complexContent>
				<xsd:extension base="oval-def:StateType">
					<xsd:sequence>
						<xsd:element name="userright" type="oval-def:EntityStateUserRightType" minOccurs="0" maxOccurs="1">
							<xsd:annotation>
								<xsd:documentation>The userright entity holds a string that represents the name of a particular user right/privilege.</xsd:documentation>
							</xsd:annotation>
						</xsd:element>
						<xsd:element name="trustee_sid" type="oval-def:EntityStateStringType" minOccurs="0" maxOccurs="1">
							<xsd:annotation>
								<xsd:documentation>The trustee_sid element identifies the SID that has been granted the specified user right/privilege. The trustee_sid element can be included multiple times in a system characteristic item in order to record that a user right/privilege has been granted to a number of SIDs. Note that the entity_check attribute associated with EntityStateStringType guides the evaluation of entities like trustee_sid that refer to items that can occur an unbounded number of times.</xsd:documentation>
							</xsd:annotation>
						</xsd:element>
					</xsd:sequence>
				</xsd:extension>
			</xsd:complexContent>
		</xsd:complexType>
	</xsd:element>
	<xsd:element name="userright_item" substitutionGroup="oval-sc:item">
		<xsd:complexType>
			<xsd:annotation>
				<xsd:documentation>The userright_item allows SIDs that have been granted a user right/privilege to be collected.</xsd:documentation>
			</xsd:annotation>
			<xsd:complexContent>
				<xsd:extension base="oval-sc:ItemType">
					<xsd:sequence>
						<xsd:element name="userright" type="oval-sc:EntityItemUserRightType" minOccurs="0" maxOccurs="1">
							<xsd:annotation>
								<xsd:documentation>The userright entity holds a string that represents the name of a particular user right/privilege.</xsd:documentation>
							</xsd:annotation>
						</xsd:element>
						<xsd:element name="trustee_sid" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="unbounded">
							<xsd:annotation>
								<xsd:documentation>The trustee_sid element identifies the SID that has been granted the specified user right/privilege. The trustee_sid element can be included multiple times in a system characteristic item in order to record that a user right/privilege has been granted to a number of SIDs. Note that the entity_check attribute associated with EntityStateStringType guides the evaluation of entities like trustee_sid that refer to items that can occur an unbounded number of times.</xsd:documentation>
							</xsd:annotation>
						</xsd:element>
					</xsd:sequence>
				</xsd:extension>
			</xsd:complexContent>
		</xsd:complexType>
	</xsd:element>
	<xsd:complexType name="EntityObjectUserRightType">
		<xsd:annotation>
			<xsd:documentation>The EntityObjectUserRightType restricts a string value to a specific set of values that describe the different user rights/privileges. The empty string is also allowed to support empty elements associated with error conditions.</xsd:documentation>
		</xsd:annotation>
		<xsd:simpleContent>
			<xsd:restriction base="oval-def:EntityObjectStringType">
				<xsd:enumeration value="SE_ASSIGNPRIMARYTOKEN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to assign the primary token of a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_AUDIT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to generate audit-log entries.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_BACKUP_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform backup operations.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CHANGE_NOTIFY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to receive notifications of changes to files or directories.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_GLOBAL_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create named file mapping objects in the global namespace during Terminal Services sessions.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_PAGEFILE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a paging file.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_PERMANENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a permanent object.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_SYMBOLIC_LINK_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a symbolic link.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_TOKEN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a primary token.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DEBUG_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to debug and adjust the memory of a process owned by another account.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_ENABLE_DELEGATION_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to mark user and computer accounts as trusted for delegation.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_IMPERSONATE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to impersonate.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INC_BASE_PRIORITY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to increase the base priority of a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INCREASE_QUOTA_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to increase the quota assigned to a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INC_WORKING_SET_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to allocate more memory for applications that run in the context of users.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_LOAD_DRIVER_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to load or unload a device driver.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_LOCK_MEMORY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to lock physical pages in memory.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_MACHINE_ACCOUNT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a computer account.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_MANAGE_VOLUME_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to enable volume management privileges.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_PROF_SINGLE_PROCESS_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to gather profiling information for a single process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_RELABEL_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the mandatory integrity level of an object.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_REMOTE_SHUTDOWN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to shut down a system using a network request.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_RESTORE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform restore operations.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SECURITY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform a number of security-related functions, such as controlling and viewing audit messages.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SHUTDOWN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to shut down a local system.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYNC_AGENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required for a domain controller to use the Lightweight Directory Access Protocol directory synchronization services.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEM_ENVIRONMENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEM_PROFILE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to gather profiling information for the entire system.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEMTIME_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the system time.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TAKE_OWNERSHIP_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to take ownership of an object without being granted discretionary access.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TCB_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege identifies its holder as part of the trusted computer base.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TIME_ZONE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to adjust the time zone associated with the computer's internal clock.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TRUSTED_CREDMAN_ACCESS_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to access Credential Manager as a trusted caller.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_UNDOCK_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to undock a laptop.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_UNSOLICITED_INPUT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to read unsolicited input from a terminal device.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_BATCH_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the batch logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_BATCH_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the batch logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_NETWORK_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the network logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on remotely using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_SERVICE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the service logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_NETWORK_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the network logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_REMOTE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on remotely using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SERVICE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the service logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="">
					<xsd:annotation>
						<xsd:documentation>The empty string value is permitted here to allow for detailed error reporting.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
			</xsd:restriction>
		</xsd:simpleContent>
	</xsd:complexType>
	<xsd:complexType name="EntityStateUserRightType">
		<xsd:annotation>
			<xsd:documentation>The EntityStateUserRightType restricts a string value to a specific set of values that describe the different user rights/privileges. The empty string is also allowed to support empty elements associated with error conditions.</xsd:documentation>
		</xsd:annotation>
		<xsd:simpleContent>
			<xsd:restriction base="oval-def:EntityStateStringType">
				<xsd:enumeration value="SE_ASSIGNPRIMARYTOKEN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to assign the primary token of a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_AUDIT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to generate audit-log entries.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_BACKUP_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform backup operations.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CHANGE_NOTIFY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to receive notifications of changes to files or directories.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_GLOBAL_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create named file mapping objects in the global namespace during Terminal Services sessions.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_PAGEFILE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a paging file.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_PERMANENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a permanent object.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_SYMBOLIC_LINK_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a symbolic link.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_TOKEN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a primary token.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DEBUG_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to debug and adjust the memory of a process owned by another account.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_ENABLE_DELEGATION_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to mark user and computer accounts as trusted for delegation.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_IMPERSONATE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to impersonate.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INC_BASE_PRIORITY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to increase the base priority of a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INCREASE_QUOTA_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to increase the quota assigned to a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INC_WORKING_SET_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to allocate more memory for applications that run in the context of users.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_LOAD_DRIVER_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to load or unload a device driver.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_LOCK_MEMORY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to lock physical pages in memory.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_MACHINE_ACCOUNT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a computer account.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_MANAGE_VOLUME_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to enable volume management privileges.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_PROF_SINGLE_PROCESS_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to gather profiling information for a single process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_RELABEL_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the mandatory integrity level of an object.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_REMOTE_SHUTDOWN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to shut down a system using a network request.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_RESTORE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform restore operations.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SECURITY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform a number of security-related functions, such as controlling and viewing audit messages.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SHUTDOWN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to shut down a local system.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYNC_AGENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required for a domain controller to use the Lightweight Directory Access Protocol directory synchronization services.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEM_ENVIRONMENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEM_PROFILE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to gather profiling information for the entire system.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEMTIME_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the system time.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TAKE_OWNERSHIP_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to take ownership of an object without being granted discretionary access.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TCB_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege identifies its holder as part of the trusted computer base.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TIME_ZONE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to adjust the time zone associated with the computer's internal clock.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TRUSTED_CREDMAN_ACCESS_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to access Credential Manager as a trusted caller.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_UNDOCK_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to undock a laptop.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_UNSOLICITED_INPUT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to read unsolicited input from a terminal device.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_BATCH_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the batch logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_BATCH_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the batch logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_NETWORK_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the network logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on remotely using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_SERVICE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the service logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_NETWORK_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the network logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_REMOTE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on remotely using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SERVICE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the service logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="">
					<xsd:annotation>
						<xsd:documentation>The empty string value is permitted here to allow for detailed error reporting.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
			</xsd:restriction>
		</xsd:simpleContent>
	</xsd:complexType>
	<xsd:complexType name="EntityItemUserRightType">
		<xsd:annotation>
			<xsd:documentation>The EntityItemUserRightType restricts a string value to a specific set of values that describe the different user rights/privileges. The empty string is also allowed to support empty elements associated with error conditions.</xsd:documentation>
		</xsd:annotation>
		<xsd:simpleContent>
			<xsd:restriction base="oval-sc:EntityItemStringType">
				<xsd:enumeration value="SE_ASSIGNPRIMARYTOKEN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to assign the primary token of a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_AUDIT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to generate audit-log entries.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_BACKUP_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform backup operations.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CHANGE_NOTIFY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to receive notifications of changes to files or directories.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_GLOBAL_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create named file mapping objects in the global namespace during Terminal Services sessions.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_PAGEFILE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a paging file.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_PERMANENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a permanent object.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_SYMBOLIC_LINK_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a symbolic link.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_CREATE_TOKEN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a primary token.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DEBUG_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to debug and adjust the memory of a process owned by another account.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_ENABLE_DELEGATION_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to mark user and computer accounts as trusted for delegation.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_IMPERSONATE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to impersonate.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INC_BASE_PRIORITY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to increase the base priority of a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INCREASE_QUOTA_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to increase the quota assigned to a process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INC_WORKING_SET_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to allocate more memory for applications that run in the context of users.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_LOAD_DRIVER_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to load or unload a device driver.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_LOCK_MEMORY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to lock physical pages in memory.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_MACHINE_ACCOUNT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to create a computer account.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_MANAGE_VOLUME_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to enable volume management privileges.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_PROF_SINGLE_PROCESS_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to gather profiling information for a single process.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_RELABEL_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the mandatory integrity level of an object.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_REMOTE_SHUTDOWN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to shut down a system using a network request.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_RESTORE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform restore operations.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SECURITY_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to perform a number of security-related functions, such as controlling and viewing audit messages.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SHUTDOWN_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to shut down a local system.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYNC_AGENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required for a domain controller to use the Lightweight Directory Access Protocol directory synchronization services.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEM_ENVIRONMENT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEM_PROFILE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to gather profiling information for the entire system.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SYSTEMTIME_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to modify the system time.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TAKE_OWNERSHIP_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to take ownership of an object without being granted discretionary access.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TCB_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege identifies its holder as part of the trusted computer base.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TIME_ZONE_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to adjust the time zone associated with the computer's internal clock.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_TRUSTED_CREDMAN_ACCESS_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to access Credential Manager as a trusted caller.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_UNDOCK_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to undock a laptop.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_UNSOLICITED_INPUT_NAME">
					<xsd:annotation>
						<xsd:documentation>This privilege is required to read unsolicited input from a terminal device.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_BATCH_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the batch logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_BATCH_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the batch logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_NETWORK_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the network logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on remotely using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_DENY_SERVICE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right explicitly denies an account the right to log on using the service logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_NETWORK_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the network logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_REMOTE_INTERACTIVE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on remotely using the interactive logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="SE_SERVICE_LOGON_NAME">
					<xsd:annotation>
						<xsd:documentation>This account right is required for an account to log on using the service logon type.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
				<xsd:enumeration value="">
					<xsd:annotation>
						<xsd:documentation>The empty string value is permitted here to allow for detailed error reporting.</xsd:documentation>
					</xsd:annotation>
				</xsd:enumeration>
			</xsd:restriction>
		</xsd:simpleContent>
	</xsd:complexType>
</xsd:schema>