Microsoft.SQLServer.RunAs.2016.Addendum.MissingSidTypeRegistry.MonitorType (UnitMonitorType)

Element properties:

Member Modules:

Source Code:

<UnitMonitorType ID="Microsoft.SQLServer.RunAs.2016.Addendum.MissingSidTypeRegistry.MonitorType" Accessibility="Internal">

  <MonitorTypeStates>

    <MonitorTypeState ID="RegValueBad" NoDetection="false"/>

    <MonitorTypeState ID="RegValueGood" NoDetection="false"/>

  </MonitorTypeStates>

  <Configuration/>

  <MonitorImplementation>

    <MemberModules>

      <DataSource ID="RegDS" TypeID="Windows!Microsoft.Windows.RegistryProvider">

        <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

        <RegistryAttributeDefinitions>

          <RegistryAttributeDefinition>

            <AttributeName>ServiceSidType</AttributeName>

            <Path>SYSTEM\CurrentControlSet\Services\HealthService\ServiceSidType</Path>

            <PathType>1</PathType>

            <AttributeType>2</AttributeType>

          </RegistryAttributeDefinition>

        </RegistryAttributeDefinitions>

        <Frequency>14450</Frequency>

      </DataSource>

      <ConditionDetection ID="CDGood" TypeID="System!System.ExpressionFilter">

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="Integer">Values/ServiceSidType</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="Integer">1</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </ConditionDetection>

      <ConditionDetection ID="CDBad" TypeID="System!System.ExpressionFilter">

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="Integer">Values/ServiceSidType</XPathQuery>

            </ValueExpression>

            <Operator>NotEqual</Operator>

            <ValueExpression>

              <Value Type="Integer">1</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="RegValueBad">

        <Node ID="CDBad">

          <Node ID="RegDS"/>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="RegValueGood">

        <Node ID="CDGood">

          <Node ID="RegDS"/>

        </Node>

      </RegularDetection>

    </RegularDetections>

  </MonitorImplementation>

</UnitMonitorType>