<?xml version="1.0" encoding="utf-8"?>
<ObjectCollector xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <Configuration ConfigName="SQLBPA Config File" ConfigVersion="9.00.1000.01" DownloadURL="http://go.microsoft.com/fwlink/?LinkId=82044" HelpFile="SqlBPA2005.chm">
    <ConfigPreprocessor ObjectType="0 Type Preprocessor" Assembly="BPA.Common.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Common.TypeConfigPreprocessor" />
    <ObjectProcessor ObjectType="Group" Assembly="BPA.Common.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Common.GroupObjectProcessor" />
    <ObjectProcessor ObjectType="Registry" Assembly="BPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.RegistryObjectProcessor" />
    <ObjectProcessor ObjectType="File" Assembly="BPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.FileObjectProcessor" />
    <ObjectProcessor ObjectType="If" Assembly="BPA.Common.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Common.IfObjectProcessor" />
    <ObjectProcessor ObjectType="WMI" Assembly="BPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.WMIObjectProcessor"/>
    <ObjectProcessor ObjectType="LookupAccount" Assembly="BPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.LookupAccountObjectProcessor"/>
    <ObjectProcessor ObjectType="Cache" Assembly="BPA.Common.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Common.CacheObjectProcessor"/>
    <ObjectProcessor ObjectType="SQL" Assembly="BPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.SQLObjectProcessor" />
    <ObjectProcessor ObjectType="SSAS" Assembly="AnalysisServicesRules.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.SsasObjectProcessor" />
    <ObjectProcessor ObjectType="SSIS" Assembly="IntegrationServicesRules.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.SqlServer.SsisProcessor" />
    <ObjectProcessor ObjectType="Xml" Assembly="BPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.XmlObjectProcessor"/>
    <ObjectProcessor ObjectType="Directory" Assembly="BPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.DirectoryObjectProcessor"/>
    <ObjectProcessor ObjectType="ExpandGroup" Assembly="BPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.ExpandGroupObjectProcessor"/>
    <ObjectProcessor ObjectType="DACL" Assembly="SqlBPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.SqlServer.DACLObjectProcessor"/>
    <ObjectProcessor ObjectType="EnumeratePermissions" Assembly="SqlBPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.SqlServer.EnumeratePermissionsObjectProcessor"/>
    <ObjectProcessor ObjectType="ExpandWinntGroup" Assembly="SqlBPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.SqlServer.ExpandWinntGroupObjectProcessor"/>
    <ObjectProcessor ObjectType="SQLESCAPE" Assembly="SqlBPA.ConfigCollector.dll" Class="Microsoft.WindowsServerSystem.BestPracticesAnalyzer.Extensions.SqlServer.SQLEscapeObjectProcessor"/>

    <!-- 
      This specific condition will be needed for many rules. 
      Hence defining a single substitution for ease of maintenance.
    -->
    <Substitution Name="Sql2005Check">starts-with('%SQLProductVersion%','9')</Substitution>
    <Substitution Name="Sql2000Check">starts-with('%SQLProductVersion%','8')</Substitution>
    <Substitution Name="IsEnterpriseEdition">('%SQLServerEdition%'='Enterprise Edition')</Substitution>
    <Substitution Name="IsStandardEdition">('%SQLServerEdition%'='Standard Edition')</Substitution>
    <Substitution Name="IsMsdbOnline">(upper-case('%MSDBSTATUS%')='ONLINE')</Substitution>
    <Substitution Name="IsMasterOnline">(upper-case('%MASTERSTATUS%')='ONLINE')</Substitution>
    <Substitution Name="IsTempdbOnline">(upper-case('%TEMPDBSTATUS%')='ONLINE')</Substitution>

    <!-- 
      This RestrictionType will define the IDs for each Rule. 
      These IDs will help in selectively running the rules. 
    -->
    <RestrictionType Name="RuleId" Description="A string to uniquely identify a rule" Collapse="True">
      <!-- Security Rules -->
      <!--RID0001 is merged into RID0002-->
      <Option Name="RID0002" Description="Authentication Mode"/>
      <Option Name="RID0003" Description="Database Mail"/>
      <Option Name="RID0004" Description="SQL Login Password Policy"/>
      <!--RID0005 (Binn Folder Permissions) Deferred till V2-->
      <!--RID0006 (Server Public permissions) Deferred till V2-->
      <!--RID0007 is merged into RID0034-->
      <Option Name="RID0008" Description="SQL Agent Service Recommended Account"/>
      <Option Name="RID0009" Description="SQL Agent Proxy Account"/>
      <!--RID0010 is deprecated and its functionality is split across RID0043, RID0044, RID0045-->
      <!--RID0013 (SSIS Builtin admin in undesirable roles) Deferred till V2-->
      <Option Name="RID0014" Description="SQL Server Integration Services Recommended Account"/>
      <Option Name="RID0015" Description="Sysdtslog90 Table on master/msdb"/>
      <Option Name="RID0016" Description="Trustworthy bit"/>
      <!--RID0017 is deprecated and its functionality is split across RID0008, RID0014, RID0018, RID0041 and RID0042-->
      <Option Name="RID0018" Description="SQL Server Database Engine Service Recommended Account"/>
      <Option Name="RID0019" Description="Symmetric Keys"/>
      <!--RID0022 deprecated and the Id is now available.-->
      <!--RID0023 deprecated and the Id is now available.-->
      <!--RID0024 deprecated and the Id is now available.-->
      <!--RID0025 deprecated and the Id is now available.-->
      <!--RID0026 scrapped by MSFT.-->
      <!--RID0027 is merged into RID3075-->
      <!--RID0028 scrapped by MSFT.-->
      <!--RID0029 scrapped by MSFT.-->
      <!--RID0030 (Restricting CmdExec Rights to Sysadmin) Deferred till V2-->
      <!--RID0032 is merged into RID0005-->
      <Option Name="RID0033" Description="SQL BuiltinSysAdmin check"/>
      <Option Name="RID0034" Description="SQL Server Guest Account"/>
      <!--RID0035 (Members of the Sysadmin Role) Deferred till V2-->
      <!--RID0036 (SQL Server Local Account Passwords) Deferred till V2-->
      <!--RID0037 is deprecated and its functionality is split across RID0008, RID0014, RID0018, RID0041 and RID0042-->
      <!--RID0038 (Data Folder Permissions) Deferred till V2-->
      <Option Name="RID0038" Description="Data Folder Permissions"/>
      <!--RID0039 scrapped by MSFT.-->
      <Option Name="RID0040" Description="Asymmetric Keys"/>
      <Option Name="RID0041" Description="Browser Service Recommended Account"/>
      <Option Name="RID0042" Description="Full Text Search Recommended Account"/>
      <Option Name="RID0043" Description="SQL Agent Token Replacement On RTM"/>
      <Option Name="RID0044" Description="SQL Agent Token Replacement Without Escape Macros"/>
      <!-- RID0045 (SQL Agent Token Replacement Without AlertReplacementRuntimeTokens) Rule is invalid"/ -->
      <!--RID0046 (Machine Admin As Analysis Server Admin) Deferred till V2 -->
      <Option Name="RID0047" Description="SQL Server Analysis Services Recommended Account"/>

      <!-- Database Engine Rules -->
      <!--RID1001 removed after rules review-->
      <Option Name="RID1002" Description="Allow Updates"/>
      <!--RID1003 scrapped by MSFT -->
      <Option Name="RID1004" Description="DB Files"/>
      <!--Analysis Services Rules-->
      <Option Name="RID2000" Description="No hierarchies in dimension"/>
      <Option Name="RID2001" Description="Unrelated attributes in hierarchy"/>
      <Option Name="RID2002" Description="Non aggregatable attributes in parent child dimensions"/>
      <Option Name="RID2003" Description="Explicit default members for non aggregatable attributes "/>
      <Option Name="RID2004" Description="Number of non aggregatable attributes"/>
      <!--RID2005 DEPRECATED -->
      <Option Name="RID2006" Description="Key attribute hierarchy visible"/>
      <Option Name="RID2007" Description="Ignore duplicate key error"/>
      <!--RID2008 DEPRECATED -->
      <!--RID2009 DEPRECATED -->
      <Option Name="RID2010" Description="Single attribute dimensions"/>
      <Option Name="RID2011" Description="Maximum measure groups in cube"/>
      <Option Name="RID2012" Description="Dimension with UnknownMember=Hidden"/>
      <Option Name="RID2013" Description="No AggregationDesigns Defined"/>
      <Option Name="RID2014" Description="AggregationDesigns Not Applied"/>
      <Option Name="RID2015" Description="Large KeyAttributes should be Numeric"/>
      <Option Name="RID2016" Description="Too many Aggregation Designs"/>
      <Option Name="RID2017" Description="Single Dimension in Cube"/>
      <Option Name="RID2018" Description="Non-Default Server Properties"/>
      <Option Name="RID2019" Description="MaxThreads Server Properties set non-optimal values"/>
      <Option Name="RID2020" Description="Dimensions that can be switched to ROLAP mode"/>
      <Option Name="RID2021" Description="Spare Aggregation Designs"/>
      <Option Name="RID2022" Description="Extreme Partition Sizes"/>
      <Option Name="RID2023" Description="Separate DistinctCount Measure"/>
      <Option Name="RID2024" Description="AttributeHierarchy Visible in Natural Hierarchy"/>

      <!--CSS Rules-->
      <Option Name="RID3000" Description="Outdated-Backup"/>
      <Option Name="RID3001" Description="Last Known Good DBCC CheckDB"/>
      <Option Name="RID3002" Description="Page-Verify-Checksum"/>
      <!--RID3003 Scrapped by MSFT-->
      <Option Name="RID3004" Description="Tempdb Concurrency Enhancement"/>
      <Option Name="RID3005" Description="Perf-Large-DataFiles"/>
      <Option Name="RID3006" Description="Errorlogs for Autogrowth info(CSS_PERFORMANCE_61)"/>
      <!--RID3007 Scrapped by MSFT-->
      <!--RID3008 Scrapped by MSFT-->
      <Option Name="RID3009" Description="Upgrade to Baseline Build 1007"/>
      <Option Name="RID3010" Description="SQL 2005 - Security, elevation of privs issue" />
      <Option Name="RID3011" Description="Upgrade from 8.00.2039 to 8.00.2187 or later" />
      <Option Name="RID3012" Description="BULK INSERT may not yield the UMS"/>
      <Option Name="RID3013" Description="SQL Version on IA64"/>
      <Option Name="RID3014" Description="PAE Kernel Without Proper Patch"/>
      <!--RID3015-->
      <!--RID3016 removed after rules review-->
      <Option Name="RID3017" Description="Common RedFlag Errors"/>
      <Option Name="RID3018" Description="Suspect Pages"/>
      <!--RID3019-->
      <Option Name="RID3020" Description="Read-Retry Issue"/>
      <Option Name="RID3021" Description="IO Delay warning"/>
      <!--RID3022-->
      <Option Name="RID3023" Description="Unexpected System Failures"/>
      <Option Name="RID3024" Description="Update Statistics Required"/>
      <Option Name="RID3025" Description="Replication Timeout Alerts"/>
      <Option Name="RID3026" Description="MAXDOP Not Optimized"/>
      <Option Name="RID3027" Description="Linked Server On IA64 Not Patched"/>
      <!--RID3028 removed after rules review-->
      <Option Name="RID3029" Description="Database Recovery Model"/>
      <!--RID3030 removed after rules review-->
      <Option Name="RID3031" Description="Open Objects Configuration Not Dynamic"/>
      <Option Name="RID3032" Description="Locks Configuration Not Dynamic"/>
      <Option Name="RID3033" Description="Default Trace Log Files Disabled"/>
      <Option Name="RID3034" Description="Affinity Mask And Affinity IO Mask Overlap"/>
      <Option Name="RID3035" Description="Replication Pub and Sub out of sync"/>
      <Option Name="RID3036" Description="Memory scribbler issue in SQL 2000 before SP4"/>
      <Option Name="RID3037" Description="Max worker thread setting"/>
      <Option Name="RID3038" Description="Replication Pub and Sub out of sync (Constraint Violation)"/>
      <Option Name="RID3039" Description="Replication Pub and Sub out of sync (Skipped Transactions)"/>
      <Option Name="RID3040" Description="Database Mirroring Does Not Support Distributed Transactions"/>
      <Option Name="RID3041" Description="Blocked Process Threshold Less Than Five"/>
      <Option Name="RID3042" Description="Replication Latency Threshold violations"/>
      <!--RID3043-->
      <Option Name="RID3044" Description="Network Packet Size Can Cause MemToLeave Pressure"/>
      <Option Name="RID3045" Description="SQL LOG Folder must not be compressed"/>
      <!--RID3046 - Removed after rule review-->
      <Option Name="RID3047" Description="DB collation different than that of master/model"/>
      <!--RID3048-->
      <Option Name="RID3049" Description="AutoShrink Databases"/>
      <Option Name="RID3050" Description="SQL error log too big"/>
      <Option Name="RID3051" Description="SQL Version 194 to 2189 and multiprocessor check"/>
      <!--RID3052-->
      <!--RID3053 Scrapped by MSFT.-->
      <Option Name="RID3054" Description="High TempDb space usage sessions"/>
      <!--RID3055-->
      <!--RID3056-->
      <!--RID3057-->
      <Option Name="RID3058" Description="Backups need to be on separate volumes"/>
      <Option Name="RID3059" Description="Parallel Query Scribbler Issue"/>
      <Option Name="RID3060" Description="Database AutoClose Performance Degradation"/>
      <Option Name="RID3061" Description="W32.Slammer Vulnerability"/>
      <!--RID3062-->
      <!--RID3063-->
      <!--RID3064-->
      <Option Name="RID3064" Description="CLR Enabled and SQL Version"/>
      <!--RID3065-->
      <Option Name="RID3066" Description="SQL2000 Version bulk insert corruption"/>
      <Option Name="RID3067" Description="SQL2000 Version auto-checkpoint issue"/>
      <Option Name="RID3068" Description="LightWeight Pooling Check"/>
      <!--RID3069-->
      <!--RID3070-->
      <Option Name="RID3071" Description="Data and log files compressed without read-only attribute"/>
      <!--RID3072-->
      <!--RID3073-->
      <!--RID3074-->
      <Option Name="RID3075" Description="SQL Server on PDC/BDC"/>
      <Option Name="RID3076" Description="SQL 2000 with AWE enabled"/>
      <Option Name="RID3077" Description="Stalled IO"/>
      <Option Name="RID3080" Description="MaintenancePlanTasks dll issue"/>
      <Option Name="RID3081" Description="Dell machine hardware corruption issue"/>

      <!--SSIS Rules-->
      <Option Name="RID5001" Description="SQL Server Destination Object over OLE DB Destination "/>
      <Option Name="RID5002" Description="SQL Server ActiveX Script Task object usage"/>
      <Option Name="RID5003" Description="SQL Server Missing Logging Task"/>
      <Option Name="RID5004" Description="SQL Server Missing Package Configuration"/>
      <Option Name="RID5005" Description="Select All Query Usage"/>
    </RestrictionType>

    <!-- 
      This RestrictionType will define the levels of scan to perform. Simple rules are listed under {Limited Scan}.
      Certain rules that are long running (like the ones using dbcc checkdb or event logs) are listed
      under {Detailed Scan}
    -->
    <RestrictionType Name="Level" Description="This restriction groups rules according to type of scan to be performed" Collapse="True">
      <Option Name="Limited" Description="Limited scan"/>
      <Option Name="Detailed" Description="Detailed scan"/>
    </RestrictionType>

    <!--<RestrictionType Name="Requirement" Description="This restriction groups rules based on whether they are used for SAP databases or notd" Collapse="True">
      <Option Name="SAP" Description="Rules taken as it is for SAP databases"/>
      <Option Name="NonSAP" Description="Rules not for SAP databases"/>
      <Option Name="ModifiedSAP" Description="Rules need to be changed for SAP databases"/>
    </RestrictionType>-->
  </Configuration>
  <!--Declare the Integration Services Rules Type.-->
  <Type Name="IntegrationServicesRules">
    <!--SQL Server Destination Object over OLE DB Destination
      RestrictionID: RID5001
      Description: Check if an OLEDB Destination object is using native SQL client
      Inputs:
        %PackageType% - Type of package: DtsServer/FileSystem.              
        %HOSTNAME% - If package is deployed on a DTS Server, name of DTS Server.              
        %PackagePath% - Package path.              
      Rules:
        pszOLEDBDestinationObjectUsage: This lists the OLEDB Destination objects using native SQL client.
    -->
    <Object Type="SSIS" Key1="%PackageType%" Key2="%HOSTNAME%" Key3="%PackagePath%" Key4="oledb_destination_object_usage_with_native_sql_client" Display="Hide" LogText="Processing OLEDB Destination Object Usage Rule" RuleId="RID5001" Name="RID5001" Requirement="NonSAP">
      <Setting>
        <Rule Name="pszOLEDBDestinationObjectUsage" Title="OLEDB destination object usage with native sql client - %PackagePath%" GUID="ff42e50e-2435-432d-a69e-c6684ac9dbd9" Error="Warning" Sev="3" Text="{0}" P0="$."/>
      </Setting>
    </Object>
    <!--ActiveX Script Task object usage
      RestrictionID: RID5002
      Description: Check if an ActiveX Script Task object has been used in the package.
      Inputs:
        %PackageType% - Type of package: DtsServer/FileSystem.              
        %HOSTNAME% - If package is deployed on a DTS Server, name of DTS Server.              
        %PackagePath% - Package path.              
      Rules:
        pszActiveXScriptTaskUsage: This notifies the user if an ActiveX Script Task object 
          has been used in the package.
    -->
    <Object Type="SSIS" Key1="%PackageType%" Key2="%HOSTNAME%" Key3="%PackagePath%" Key4="activex_script_task_usage" Display="Hide" LogText="Processing ActiveXScript Task Object Usage Rule" RuleId="RID5002" Name="RID5002" Requirement="NonSAP">
      <Setting>
        <Rule Name="pszActiveXScriptTaskUsage" Title="ActiveX script task usage in package - %PackagePath%" GUID="2ada318b-3e89-44d3-9c1f-350728f73779" Error="Warning" Sev="3" Text="{0}" P0="$."/>
      </Setting>
    </Object>
    <!--Missing Logging Task
      RestrictionID: RID5003
      Description: Check if logging is configured for a package.
      Inputs:
        %PackageType% - Type of package: DtsServer/FileSystem.              
        %HOSTNAME% - If package is deployed on a DTS Server, name of DTS Server.              
        %PackagePath% - Package path.              
      Rules:
        pszMissingLoggingTask: This notifies the user that logging hasn't been configured for a package.
    -->
    <Object Type="SSIS" Key1="%PackageType%" Key2="%HOSTNAME%" Key3="%PackagePath%" Key4="missing_logging_task" Display="Hide" LogText="Processing Logging Task Rule" RuleId="RID5003" Name="RID5003" Requirement="NonSAP">
      <Setting>
        <Rule Name="pszMissingLoggingTask" Title="Logging task missing for package - %PackagePath%" GUID="96442fce-259c-470d-bce9-cbc21cd6195f" Error="Warning" Sev="3" Text="{0}" P0="$."/>
      </Setting>
    </Object>
    <!--Missing Package Configuration
      RestrictionID: RID5004
      Description: Check if package configuration has been specified for the package.
      Inputs:
        %PackageType% - Type of package: DtsServer/FileSystem.              
        %HOSTNAME% - If package is deployed on a DTS Server, name of DTS Server.              
        %PackagePath% - Package path.              
      Rules:
        pszMissingPackageConfiguration: This notifies the user that no package configuration 
          has been specified.
    -->
    <Object Type="SSIS" Key1="%PackageType%" Key2="%HOSTNAME%" Key3="%PackagePath%" Key4="missing_package_configuration" Display="Hide" LogText="Processing Package Configuration Rule" RuleId="RID5004" Name="RID5004" Requirement="NonSAP">
      <Setting>
        <Rule Name="pszMissingPackageConfiguration" Title="Package configuration missing - %PackagePath%"  GUID="c3273fdc-fd05-4006-a50d-71b727bfd738" Error="Warning" Sev="3" Text="{0}" P0="$."/>
      </Setting>
    </Object>
    <!--'Select *' query usage
      RestrictionID: RID5005
      Description: Check if 'Select *' query has been used by a component instead of specifying desired
        columns.
      Inputs:
        %PackageType% - Type of package: DtsServer/FileSystem.              
        %HOSTNAME% - If package is deployed on a DTS Server, name of DTS Server.              
        %PackagePath% - Package path.              
      Rules:
        pszSelectAllQueryUsage: This notifies the user that 'Select *' syntax has been used by a component.
    -->
    <Object Type="SSIS" Key1="%PackageType%" Key2="%HOSTNAME%" Key3="%PackagePath%" Key4="select_all_query_usage" Display="Hide" LogText="Processing Select All Query Usage Rule" RuleId="RID5005" Name="RID5005" Requirement="NonSAP">
      <Setting>
        <Rule Name="pszSelectAllQueryUsage" Title="Select * syntax usage - %PackagePath%"  Error="Warning" Sev="3" Text="{0}" P0="$." />
      </Setting>
    </Object>
  </Type>
  <!--Declare the type that checks folder permissions.-->
  <Type Name="CheckFolderPermissions">
    <!--Get the Security Descriptor for Data/Binn folder-->
    <Object Type="File" Key1="%HOSTNAME%" Key2="%FOLDERPATH%">
      <Setting Key1="NTSD" Substitution="FOLDERNTSD"/>
      <!--Enumerate the SIDs-->
      <Object Type="DACL" Key1="%FOLDERNTSD%" Key2="Distinct">
        <Setting Key1="Sid" Substitution="TRUSTEESID"/>
        <Object Type="LookupAccount" Key1="Sid" Key2="%HOSTNAME%" Key3="%TRUSTEESID%">
          <Setting Key1="Domain" Substitution="TRUSTEEDOMAIN"/>
          <Setting Key1="Name" Substitution="TRUSTEENAME"/>
          <!--For each trustee, Enumerate the permissions it has.-->
          <Object Type="EnumeratePermissions" Key1="%FOLDERNTSD%" Key2="%TRUSTEESID%" Key3="Directory" Key4="%HOSTNAME%">
            <!--Does the trustee has {Read & Execute, List Folder Contents, Read} permissions.-->
            <Rule Name="fTrusteePermSetHasRecommendedAdminPermSet" Query="count(../Instance[@Name='ReadControl' or @Name='Synchronize' or @Name='FileListDirectory' or @Name='FileReadEA' or @Name='FileTraverse' or @Name='FileReadAttributes']) = 6"/>
            <!--Does the trustee has some permissions other than {Read & Execute, List Folder Contents, Read}.-->
            <Rule Name="fTrusteePermSetHasPermsOtherThanRecommendedAdminPermSet" Query="count(../Instance[@Name!='ReadControl' and @Name!='Synchronize' and @Name!='FileListDirectory' and @Name!='FileReadEA' and @Name!='FileTraverse' and @Name!='FileReadAttributes']) != 0"/>
            <!--Does the trustee has {Full control*, Modify, Read & Execute, List Folder Contents, Read, Write} permissions.-->
            <Rule Name="fTrusteePermSetHasRecommendedSQLServiceAccountPermSet" Query="count(../Instance[@Name='Delete' or @Name='ReadControl' or @Name='WriteDac' or @Name='WriteOwner' or @Name='Synchronize' or @Name='FileListDirectory' or @Name='FileAddFile' or @Name='FileAddSubdirectory' or @Name='FileReadEA' or @Name='FileWriteEA' or @Name='FileTraverse' or @Name='FileDeleteChild' or @Name='FileReadAttributes' or @Name='FileWriteAttributes']) = 14"/>
            <!--Does the trustee has some permissions other than {Full control*, Modify, Read & Execute, List Folder Contents, Read, Write}.-->
            <Rule Name="fTrusteePermSetHasPermsOtherThanRecommendedSQLServiceAccountPermSet" Query="count(../Instance[@Name!='Delete' and @Name!='ReadControl' and @Name!='WriteDac' and @Name!='WriteOwner' and @Name!='Synchronize' and @Name!='FileListDirectory' and @Name!='FileAddFile' and @Name!='FileAddSubdirectory' and @Name!='FileReadEA' and @Name!='FileWriteEA' and @Name!='FileTraverse' and @Name!='FileDeleteChild' and @Name!='FileReadAttributes' and @Name!='FileWriteAttributes']) != 0"/>

            <!--Does the trustee has exact{Read & Execute, List Folder Contents, Read} permissions.-->
            <Rule Name="fTrusteePermSetIsRecommendedAdminPermSet" Query="$fTrusteePermSetHasRecommendedAdminPermSet and not($fTrusteePermSetHasPermsOtherThanRecommendedAdminPermSet)"/>
            <!--Does the trustee has exact{Full control*, Modify, Read & Execute, List Folder Contents, Read, Write} permissions.-->
            <Rule Name="fTrusteePermSetIsRecommendedSQLServiceAccountPermSet" Query="$fTrusteePermSetHasRecommendedSQLServiceAccountPermSet and not($fTrusteePermSetHasPermsOtherThanRecommendedSQLServiceAccountPermSet)"/>
          </Object>
          <!--For each trustee, check for the membership in AllowedTrustees cache.-->
          <Object Type="Cache" Name="Allowed Trustees Cache" Key1="Dump" Key2="AllowedTrustees">
            <Setting Key1="AllowedTrusteeSid" Substitution="ALLOWEDTRUSTEESID" SubstitutionFormat="^(.+);(.+)$----$1"/>
            <Setting Key1="Category" Substitution="CATEGORY" SubstitutionFormat="^(.+);(.+)$----$2">
              <!--Check membership-->
              <Rule Name="fTrusteeInAllowedTrustees" Query="upper-case('%ALLOWEDTRUSTEESID%') = upper-case('%TRUSTEESID%')"/>
              <!--Builtin administrators group with not exact permission set.-->
              <Rule 
                Name="fBuiltinAdminGroupWithNotExactPermSet" 
                Query="not($fTrusteePermSetIsRecommendedAdminPermSet) and upper-case('%CATEGORY%') = upper-case('BuiltinAdministratorsGroup') and $fTrusteeInAllowedTrustees"
                Title="Improper Folder Permissions Granted To BuiltIn Administrators Group On Host [{3}]"
                Text="Permissions granted to Group [{0}\{1}] on Folder [{2}] on Host [{3}] do not match exactly with &lt;'Read and Execute', 'List Folder Contents', 'Read'&gt;."
                Error="Warning" 
                Score="High" 
                S0="%TRUSTEEDOMAIN%"
                S1="%TRUSTEENAME%"
                S2="%FOLDERPATH%"
                S3="%HOSTNAME%"/>
              <!--Allowed admin with not exact permission set.-->
              <Rule 
                Name="fAllowedAdminWithNotExactPermSet" 
                Query="not($fTrusteePermSetIsRecommendedAdminPermSet) and upper-case('%CATEGORY%') = upper-case('LocalAdmin') and $fTrusteeInAllowedTrustees"
                Title="Improper Folder Permissions Granted To Local Administrator On Host [{3}]" 
                Text="Permissions granted to Local administrator [{0}\{1}] on Folder [{2}] on Host [{3}] do not match exactly with &lt;'Read and Execute', 'List Folder Contents', 'Read'&gt;."
                Error="Warning" 
                Score="High" 
                S0="%TRUSTEEDOMAIN%"
                S1="%TRUSTEENAME%"
                S2="%FOLDERPATH%"
                S3="%HOSTNAME%"/>
              <!--Allowed sql group with not exact permission set.-->
              <Rule 
                Name="fAllowedSQLServiceGroupWithNotExactPermSet" 
                Query="not($fTrusteePermSetIsRecommendedSQLServiceAccountPermSet) and upper-case('%CATEGORY%') = upper-case('SQLServerGroup') and $fTrusteeInAllowedTrustees"
                Title="Improper Folder Permissions Granted To SQL Server Group On Host [{3}]" 
                Text="Permissions granted to SQL Server Group [{0}\{1}] on Folder [{2}] on Host [{3}] do not match exactly with &lt;'Full control', 'Modify', 'Read and Execute', 'List Folder Contents', 'Read', 'Write'&gt;."
                Error="Warning" 
                Score="High" 
                S0="%TRUSTEEDOMAIN%"
                S1="%TRUSTEENAME%"
                S2="%FOLDERPATH%"
                S3="%HOSTNAME%"/>
              <!--Allowed sql group member with not exact permission set.-->
              <Rule 
                Name="fAllowedSQLServiceGroupMemberWithNotExactPermSet" 
                Query="not($fTrusteePermSetIsRecommendedSQLServiceAccountPermSet) and upper-case('%CATEGORY%') = upper-case('SQLServerGroupMember') and $fTrusteeInAllowedTrustees"
                Title="Improper Folder Permissions Granted To SQL Server Group Member On Host [{3}]" 
                Text="Permissions granted to SQL Server Group Member [{0}\{1}] on Folder [{2}] on Host [{3}] do not match exactly with &lt;'Full control', 'Modify', 'Read and Execute', 'List Folder Contents', 'Read', 'Write'&gt;."
                Error="Warning" 
                Score="High" 
                S0="%TRUSTEEDOMAIN%"
                S1="%TRUSTEENAME%"
                S2="%FOLDERPATH%"
                S3="%HOSTNAME%"/>
              <!--Allowed sql account with not exact permission set.-->
              <Rule 
                Name="fAllowedSQLServiceAccountWithNotExactPermSet" 
                Query="not($fTrusteePermSetIsRecommendedSQLServiceAccountPermSet) and upper-case('%CATEGORY%') = upper-case('SQLServerServiceAccount') and $fTrusteeInAllowedTrustees"
                Title="Improper Folder Permissions Granted To SQL Server Service Account On Host [{3}]" 
                Text="Permissions granted to SQL Server Service Account [{0}\{1}] on Folder [{2}] on Host [{3}] do not match exactly with &lt;'Full control', 'Modify', 'Read and Execute', 'List Folder Contents', 'Read', 'Write'&gt;."
                Error="Warning" 
                Score="High" 
                S0="%TRUSTEEDOMAIN%"
                S1="%TRUSTEENAME%"
                S2="%FOLDERPATH%"
                S3="%HOSTNAME%"/>
            </Setting>

            <!--Not an allowed trustee.-->
            <Rule
              Name="fNotAnAllowedTrustee"
              Query="not($fTrusteeInAllowedTrustees)"
              Error="Warning"
              GUID="da4a553f-cb73-4087-8f3a-034e6bfcc8c4" 
              Sev="2"
              Title="Improper Access To SQL Server Directory On Host [{3}]" 
              Text="Account [{0}\{1}] has access to directory [{2}] on server [{3}]. The account is neither identified as a SQL Server account nor as an administrator. We recommend that Microsoft® SQL Server™ directories have limited access to SQL Server service accounts and local Administrators only."
              S0="%TRUSTEEDOMAIN%"
              S1="%TRUSTEENAME%"
              S2="%FOLDERPATH%"
              S3="%HOSTNAME%"/>
          </Object>
        </Object>
      </Object>
    </Object>
  </Type>
  <!--Declare the type that performs privileged user account check.
  Inputs:
  SVCACCOUNTUSER  - User part of the service account name.
  SERVICENAME     - Service name.
  HOSTNAME        - Host name.
  ACCOUNTNAME     - Service account name in the format <domain\user> or <user>@<dnsforestname>.-->
  <Type Name="PrivilegedUserCheck">

    <Object Type="Cache" Name="Privileged Users Cache" Key1="Dump" Key2="PrivilegedUsers">
      <Setting Key1="PrivilegedUserSID" Substitution="PRIVILEGEDUSERSID" SubstitutionFormat="^(.+);(.+)$----$1"/>
      <Setting Key1="Category" Substitution="CATEGORY" SubstitutionFormat="^(.+);(.+)$----$2">
        <!--LocalSystem Rule-->
        <Rule 
            Name="cLocalSystem"
            Query="(upper-case('%PRIVILEGEDUSERSID%') = upper-case('%SVCACCOUNTSID%'))and(upper-case('%CATEGORY%') = upper-case('LocalSystem'))"
            Title="SQL Server Service [{1}\{0}] In LocalSystem On Host [{1}]." 
            Text="Service [{0}] on host [{1}] is found to be running under LocalSystem account. We recommend that SQL Server services should not run under LocalSystem account."
            Error="Warning" 
            Score="High" 
            S0="%SERVICENAME%"
            S1="%HOSTNAME%"/>

        <!--BuiltinAdmin Rule-->
        <Rule 
            Name="cBuiltinAdmin" 
            GUID="605f1174-09cb-4b0f-97bc-eae8418c728a" 
            Query="not($cLocalSystem) 
          and (upper-case('%PRIVILEGEDUSERSID%') = upper-case('%SVCACCOUNTSID%'))
          and (upper-case('%CATEGORY%') = upper-case('LocalAdmin'))"
            Title="SQL Server Service [{1}\{0}] In Local Administrator Account On Host [{3}]." 
            Text="Service [{0}] on host [{1}] is found to be running under [{2}] account that is a member of BUILTIN\Administrators. We recommend that SQL Server services should not run under local administrator accounts."
            Error="Warning" 
            Score="High" 
            S0="%SERVICENAME%"
            S1="%HOSTNAME%"
            S2="%ACCOUNTNAME%"
            S3="%HOSTNAME%"/>

        <!--DomainAdmin Rule-->
        <Rule 
          Name="cDomainAdmin" 
          Query="not($cLocalSystem) and not($cBuiltinAdmin)
          and (upper-case('%PRIVILEGEDUSERSID%') = upper-case('%SVCACCOUNTSID%'))
          and (upper-case('%CATEGORY%') = upper-case('DomainAdmin'))"
          Title="SQL Server Service [{1}\{0}] In Domain Administrator Account On Host [{3}]." 
          Text="Service [{0}] on host [{1}] is found to be running under [{2}] account that is a member of Domain Admins. We recommend that SQL Server services should not run under domain administrator accounts."
          Error="Warning" 
          Score="High" 
          S0="%SERVICENAME%"
          S1="%HOSTNAME%"
          S2="%ACCOUNTNAME%"
          S3="%HOSTNAME%"/>
      </Setting>
    </Object>
  </Type>
  <!--Declare the type that checks service accounts for SqlBrowser service.
  Inputs:
  HOSTNAME                - Host name.
  SQLBROWSERACCOUNTNAME   - SqlBrowser service start name, could be of the form <domain>\<user> or <user>@<dnsforest>
  SQLBROWSERACCOUNTSID    - SqlBrowser service account SID.-->
  <Type Name="CheckSQLBROWSERAccount">
    <!--Privileged User Check-->
    <Reference Type="PrivilegedUserCheck" Name="SQLBROWSERPrivilegedUserCheck">
      <Substitution Name="SVCACCOUNTSID">%SQLBROWSERACCOUNTSID%</Substitution>
      <Substitution Name="SERVICENAME">SQLBrowser</Substitution>
      <Substitution Name="ACCOUNTNAME">%SQLBROWSERACCOUNTNAME%</Substitution>
    </Reference>

    <!-- Recommended accounts check: SqlBrowser service is meant to run under Network Service Account.-->
    <Object Type="Group" Name="SQLBrowser Service Recommended Account">
      <Setting Key1="SQLBrowserServiceRecommendedAccount">
        <Rule
          Name="cSQLBROWSERInNSA" 
          GUID="f1bb9ec6-c70c-4cfb-9297-ae28dc4e60c8" 
          Query="not($SQLBROWSERPrivilegedUserCheck_cLocalSystem) and not($SQLBROWSERPrivilegedUserCheck_cBuiltinAdmin) and not($SQLBROWSERPrivilegedUserCheck_cDomainAdmin) and (upper-case('%SQLBROWSERACCOUNTSID%') != upper-case($iNSASid))"                      
          Title="SQL Server Service [{1}\{0}] In Unrecommended Account On Host [{1}]." 
          Text="We recommend that the service [{0}] on host [{1}] be run under Network Service Account. Currently it is designated to run under the account [{2}]."
          Error="Warning"
          Score="High"          
          S0="SQLBrowser"
          S1="%HOSTNAME%" 
          S2="%SQLBROWSERACCOUNTNAME%"/>
      </Setting>
    </Object>
  </Type>
  <!--Declare the type that checks service accounts for DTS service.
  Inputs:
  HOSTNAME        - Host name.
  DTSACCOUNTNAME  - DTS service start name, could be of the form <domain>\<user> or <user>@<dnsforest>
  DTSACCOUNTSID   - DTS service account SID.-->
  <Type Name="CheckDTSAccount">
    <!--Privileged User Check-->
    <Reference Type="PrivilegedUserCheck" Name="DTSPrivilegedUserCheck">
      <Substitution Name="SVCACCOUNTSID">%DTSACCOUNTSID%</Substitution>
      <Substitution Name="SERVICENAME">MsDtsServer</Substitution>
      <Substitution Name="ACCOUNTNAME">%DTSACCOUNTNAME%</Substitution>
    </Reference>

    <!-- Recommended accounts check: Dts service is meant to run under Network Service Account.-->
    <Object Type="Group" Name="DTS Service Recommended Account">
      <Setting Key1="DTSServiceRecommendedAccount">
        <Rule
          Name="cDtsInNSA" 
          GUID="f1bb9ec6-c70c-4cfb-9297-ae28dc4e60c8" 
          Query="not($DTSPrivilegedUserCheck_cLocalSystem) and not($DTSPrivilegedUserCheck_cBuiltinAdmin) and not($DTSPrivilegedUserCheck_cDomainAdmin) and (upper-case('%DTSACCOUNTSID%') != upper-case($iNSASid))"
          Title="SQL Server Service [{0}\{1}] In UnRecommended Account On Host [{1}]." 
          Text="We recommend that the service [{0}] on host [{1}] be run under Network Service Account. Currently it is designated to run under the account [{2}]."
          P0="'MsDtsServer'"
          S1="%HOSTNAME%" 
          S2="%DTSACCOUNTNAME%"
          Error="Warning"
          Score="High"/>
      </Setting>
    </Object>
  </Type>
  <!--Declare the type that checks service accounts for DB Engine.-->
  <Type Name="CheckDBEngineAccount">
    <!--Privileged User Check-->
    <Reference Type="PrivilegedUserCheck" Name="DBEnginePrivilegedUserCheck">
      <Substitution Name="SVCACCOUNTSID">%DBENGINEACCOUNTSID%</Substitution>
      <Substitution Name="SERVICENAME">%DBENGINESERVICENAME%</Substitution>
      <Substitution Name="ACCOUNTNAME">%DBENGINEACCOUNTNAME%</Substitution>
    </Reference>
    <!--Domain Account Rule:DBEngine is meant to run under a Domain Account.-->
    <Object Type="Group" Name="Domain Account Check">
      <Setting Key1="DomainAccountCheck">
        <!--Take note of the referenced rule names.-->
        <Rule 
          Name="cDBEngineInDomainAccount"
          GUID="f1bb9ec6-c70c-4cfb-9297-ae28dc4e60c8" 
          Query="not($DBEnginePrivilegedUserCheck_cLocalSystem) and not($DBEnginePrivilegedUserCheck_cBuiltinAdmin) and not($DBEnginePrivilegedUserCheck_cDomainAdmin) 
          and (upper-case('%DBENGINEACCOUNTDOMAIN%')=upper-case('nt authority') or upper-case('%DBENGINEACCOUNTDOMAIN%')=upper-case('%HOSTNAME%'))"
          Title="SQL Server Service [{1}\{0}] In Unrecommended Account On Host [{1}]." 
          Text="We recommend that the service [{0}] on host [{1}] be run under a Domain account. Currently it is designated to run under the account [{2}]."
          Error="Warning" 
          Score="High" 
          S0="%DBENGINESERVICENAME%"
          S1="%HOSTNAME%" 
          S2="%DBENGINEACCOUNTNAME%"/>
      </Setting>
    </Object>
  </Type>
  <!--Declare the type that checks service accounts for Agent service.
  Inputs:
  AGENTSERVICENAME      - Agent service name.
  HOSTNAME              - Host name.
  AGENTSERVICESTARTNAME - Agent service start name, could be of the form <domain>\<user> or <user>@<dnsforest>.
  AGENTSERVICESTARTSID  - Agent service start account SID.
  DBENGINESTARTNAME     - DB Engine start name, could be of the form <domain>\<user> or <user>@<dnsforest>
  DBENGINESTARTSID      - DB Engine start account SID.
  AGENTSERVICEUSER      - Agent account user name. This is format agnostic and can also be 'LocalSystem'.
  SP1                   - SP1 flag. True if the build of sql server is sp1 or later.
  NSASID                - Sid of network service account.-->
  <Type Name="CheckAgentAccount">
    <!--Privileged User Check-->
    <Reference Type="PrivilegedUserCheck" Name="AgentPrivilegedUserCheck">
      <Substitution Name="SVCACCOUNTSID">%AGENTSERVICESTARTSID%</Substitution>
      <Substitution Name="SERVICENAME">%AGENTSERVICENAME%</Substitution>
      <Substitution Name="ACCOUNTNAME">%AGENTSERVICESTARTNAME%</Substitution>
    </Reference>

    <!-- Recommended accounts check: SQL Server service account (RTM); Network service account (SP1)-->
    <Object Type="Group" Name="Agent Service Checks">
      <Setting Key1="AgentServiceChecks">
        <!--RTM check-->
        <Rule
          Name="cAgentInDBEngineAccountForRTM" 
          GUID="f1bb9ec6-c70c-4cfb-9297-ae28dc4e60c8" 
          Query="not($AgentPrivilegedUserCheck_cLocalSystem) and not($AgentPrivilegedUserCheck_cBuiltinAdmin) and not($AgentPrivilegedUserCheck_cDomainAdmin) 
          and not($iSP1) and (upper-case('%AGENTSERVICESTARTSID%')!=upper-case('%DBENGINESTARTSID%'))"                      
          Title="SQL Server Service [{1}\{0}] In Unrecommended Account On Host [{1}]." 
          Text="We recommend that the service [{0}] on host [{1}] be run under SQL Server Service Account. Currently it is designated to run under the account [{2}] while the SQL Server Service Account is [{3}]."
          S0="%AGENTSERVICENAME%"
          S1="%HOSTNAME%" 
          S2="%AGENTSERVICESTARTNAME%"
          S3="%DBENGINESTARTNAME%"
          Error="Warning"
          Score="High"/>

        <!--SP1 check-->
        <Rule
          Name="cAgentInNetworkServiceAccountForSP1"
          GUID="f1bb9ec6-c70c-4cfb-9297-ae28dc4e60c8" 
          Query="not($AgentPrivilegedUserCheck_cLocalSystem) and not($AgentPrivilegedUserCheck_cBuiltinAdmin) and not($AgentPrivilegedUserCheck_cDomainAdmin) 
            and ($iSP1) and (upper-case('%AGENTSERVICESTARTSID%') != upper-case($iNSASid))"                      
          Title="SQL Server Service [{1}\{0}] In Unrecommended Account On Host [{1}]." 
          Text="We recommend that the service [{0}] on host [{1}] be run under Network Service Account. Currently it is designated to run under the account [{2}]."
          S0="%AGENTSERVICENAME%"
          S1="%HOSTNAME%" 
          S2="%AGENTSERVICESTARTNAME%"
          Error="Warning"
          Score="High"/>
      </Setting>
    </Object>
  </Type>
  <!--Declare the type that checks service accounts for FTE service.
  Inputs:
  FTESERVICENAME        - FTE service name.
  HOSTNAME              - Host name.
  FTESERVICESTARTNAME   - FTE service start name, could be of the form <domain>\<user> or <user>@<dnsforest>
  FTESERVICESTARTSID    - FTE service account SID.
  DBENGINESTARTNAME     - DB Engine start name, could be of the form <domain>\<user> or <user>@<dnsforest>
  DBENGINESTARTSID      - DB Engine account SID.-->
  <Type Name="CheckFTEAccount">
    <!--Privileged User Check-->
    <Reference Type="PrivilegedUserCheck" Name="FTEPrivilegedUserCheck">
      <Substitution Name="SVCACCOUNTSID">%FTESERVICESTARTSID%</Substitution>
      <Substitution Name="SERVICENAME">%FTESERVICENAME%</Substitution>
      <Substitution Name="ACCOUNTNAME">%FTESERVICESTARTNAME%</Substitution>
    </Reference>

    <!-- Recommended accounts check: FTE is meant to run under the account same as DBEngine.-->
    <Object Type="Group" Name="FTE Service Checks">
      <Setting Key1="FTEServiceChecks">
        <Rule
              Name="cFTEInDBEngineAccount" 
              GUID="f1bb9ec6-c70c-4cfb-9297-ae28dc4e60c8" 
              Query="not($FTEPrivilegedUserCheck_cLocalSystem) and not($FTEPrivilegedUserCheck_cBuiltinAdmin) and not($FTEPrivilegedUserCheck_cDomainAdmin) 
              and (upper-case('%DBENGINESTARTSID%') != upper-case('%FTESERVICESTARTSID%'))"                      
              Title="SQL Server Service [{1}\{0}] In Unrecommended Account On Host [{1}]." 
              Text="We recommend that the service [{0}] on host [{1}] be run under SQL Server Service Account. Currently it is designated to run under the account [{2}] while the SQL Server Service Account is [{3}]."
              Error="Warning"
              Score="High" 
              S0="%FTESERVICENAME%"
              S1="%HOSTNAME%" 
              S2="%FTESERVICESTARTNAME%"
              S3="%DBENGINESTARTNAME%"/>
      </Setting>
    </Object>
  </Type>
  <!--Declare the type that checks Recommended Service Accounts for DBEngine, Agent and FTE.-->
  <Type Name="CheckRecommendedAccounts">
    <!--DBEngine-->
    <Object 
    Type="WMI"
    Key1="%HOSTNAME%"
    Key3="Win32_Service"
    Key4="Name = '%DBENGINESERVICENAME%'">
      <Setting Key1="StartName" Substitution="DBENGINEACCOUNTNAME" SubstitutionFormat="\.\\----%HOSTNAME%\"/>

      <!--LocalSystemCheck-->
      <Object Type="If" Name="DB Engine Recommended Service Account" DisplayName="DB Engine Recommended Service Account" Key1="upper-case('%DBENGINEACCOUNTNAME%')=upper-case('localsystem')" Description="This checks if DB Engine is running under a privileged account. Also, it checks for service account of a DB Engine service to be a domain account." RuleId="RID0018" VulnerabilityID="RID0018">
        <Reference Type="CheckDBEngineAccount" Name="DBEngineInLocalSystemAccount">
          <Substitution Name="DBENGINEACCOUNTSID">S-1-5-18</Substitution>
          <Substitution Name="DBENGINESERVICENAME">%DBENGINESERVICENAME%</Substitution>
          <Substitution Name="DBENGINEACCOUNTNAME">%DBENGINEACCOUNTNAME%</Substitution>
          <Substitution Name="DBENGINEACCOUNTDOMAIN"></Substitution>
        </Reference>
        <!--End of LocalSystemCheck-->
      </Object>
      <!--NonLocalSystemCheck : service account name could be either <domainname>\<username> or <username>@<dnsforestname>.-->
      <Object Type="If" Name="DB Engine Recommended Service Account" DisplayName="DB Engine Recommended Service Account" Key1="upper-case('%DBENGINEACCOUNTNAME%')!=upper-case('localsystem')" Description="This checks if DB Engine is running under a privileged account. Also, it checks for service account of a DB Engine service to be a domain account." RuleId="RID0018" VulnerabilityID="RID0018">
        <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%DBENGINEACCOUNTNAME%">
          <Setting Key1="Sid" Substitution="DBENGINEACCOUNTSID"/>
          <Object Type="LookupAccount" Key1="Sid" Key2="%HOSTNAME%" Key3="%DBENGINEACCOUNTSID%">
            <Setting Key1="Domain" Substitution="DBENGINEACCOUNTDOMAIN"/>
            <Reference Type="CheckDBEngineAccount" Name="DBEngineInNonLocalSystemAccount">
              <Substitution Name="DBENGINEACCOUNTSID">%DBENGINEACCOUNTSID%</Substitution>
              <Substitution Name="DBENGINESERVICENAME">%DBENGINESERVICENAME%</Substitution>
              <Substitution Name="DBENGINEACCOUNTNAME">%DBENGINEACCOUNTNAME%</Substitution>
              <Substitution Name="DBENGINEACCOUNTDOMAIN">%DBENGINEACCOUNTDOMAIN%</Substitution>
            </Reference>
          </Object>
        </Object>
        <!--End of NonLocalSystemCheck-->
      </Object>

      <!--Agent Service-->
      <Object Type="WMI" Name="SQL Server Agent Service Recommended Account" DisplayName="SQL Server Agent Service Recommended Account" Key1="%HOSTNAME%" Key3="Win32_Service" Key4="Name = '%AGENTSERVICENAME%'" Description="SQL Server Agent service accounts should not be members of the local Administrators group or run as LocalSystem. Also, for RTM it should be same as DB Engine account and for SP1 it should be NSA." RuleId="RID0008" VulnerabilityID="RID0008">
        <Setting Key1="StartName" Substitution="AGENTSERVICESTARTNAME" SubstitutionFormat="\.\\----%HOSTNAME%\"/>

        <!--LocalSystemCheck-->
        <Object Type="If" Name="LocalSystemCheck" Key1="upper-case('%AGENTSERVICESTARTNAME%')=upper-case('localsystem')">
          <Object Type="If" Name="DBEngineLocalSystemCheck" Key1="upper-case('%DBENGINEACCOUNTNAME%')=upper-case('localsystem')">
            <Reference Type="CheckAgentAccount" Name="AgentAndDBInLS">
              <Substitution Name="AGENTSERVICENAME">%AGENTSERVICENAME%</Substitution>
              <Substitution Name="AGENTSERVICESTARTNAME">LocalSystem</Substitution>
              <Substitution Name="AGENTSERVICESTARTSID">S-1-5-18</Substitution>
              <Substitution Name="DBENGINESTARTNAME">LocalSystem</Substitution>
              <Substitution Name="DBENGINESTARTSID">S-1-5-18</Substitution>
            </Reference>
          </Object>
          <Object Type="If" Name="DBEngineNonLocalSystemCheck" Key1="upper-case('%DBENGINEACCOUNTNAME%')!=upper-case('localsystem')">
            <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%DBENGINEACCOUNTNAME%">
              <Setting Key1="Sid" Substitution="DBENGINEACCOUNTSID"/>
              <Reference Type="CheckAgentAccount" Name="AgentInLSDBInNonLS">
                <Substitution Name="AGENTSERVICENAME">%AGENTSERVICENAME%</Substitution>
                <Substitution Name="AGENTSERVICESTARTNAME">LocalSystem</Substitution>
                <Substitution Name="AGENTSERVICESTARTSID">S-1-5-18</Substitution>
                <Substitution Name="DBENGINESTARTNAME">%DBENGINEACCOUNTNAME%</Substitution>
                <Substitution Name="DBENGINESTARTSID">%DBENGINEACCOUNTSID%</Substitution>
              </Reference>
            </Object>
          </Object>
          <!--End of LocalSystemCheck-->
        </Object>
        <!--NonLocalSystemCheck : service account name could be either <domainname>\<username> or <username>@<dnsforestname>.-->
        <Object Type="If" Name="NonLocalSystemCheck" Key1="upper-case('%AGENTSERVICESTARTNAME%')!=upper-case('localsystem')">
          <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%AGENTSERVICESTARTNAME%">
            <Setting Key1="Sid" Substitution="AGENTSERVICEACCOUNTSID"/>
            <Object Type="If" Name="DBEngineLocalSystemCheck" Key1="upper-case('%DBENGINEACCOUNTNAME%')=upper-case('localsystem')">
              <Reference Type="CheckAgentAccount" Name="AgentInNonLSDBInLS">
                <Substitution Name="AGENTSERVICENAME">%AGENTSERVICENAME%</Substitution>
                <Substitution Name="AGENTSERVICESTARTNAME">%AGENTSERVICESTARTNAME%</Substitution>
                <Substitution Name="AGENTSERVICESTARTSID">%AGENTSERVICEACCOUNTSID%</Substitution>
                <Substitution Name="DBENGINESTARTNAME">LocalSystem</Substitution>
                <Substitution Name="DBENGINESTARTSID">S-1-5-18</Substitution>
              </Reference>
            </Object>
            <Object Type="If" Name="DBEngineNonLocalSystemCheck" Key1="upper-case('%DBENGINEACCOUNTNAME%')!=upper-case('localsystem')">
              <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%DBENGINEACCOUNTNAME%">
                <Setting Key1="Sid" Substitution="DBENGINEACCOUNTSID"/>
                <Reference Type="CheckAgentAccount" Name="AgentAndDBInNonLS">
                  <Substitution Name="AGENTSERVICENAME">%AGENTSERVICENAME%</Substitution>
                  <Substitution Name="AGENTSERVICESTARTNAME">%AGENTSERVICESTARTNAME%</Substitution>
                  <Substitution Name="AGENTSERVICESTARTSID">%AGENTSERVICEACCOUNTSID%</Substitution>
                  <Substitution Name="DBENGINESTARTNAME">%DBENGINEACCOUNTNAME%</Substitution>
                  <Substitution Name="DBENGINESTARTSID">%DBENGINEACCOUNTSID%</Substitution>
                </Reference>
              </Object>
            </Object>
          </Object>
          <!--End of NonLocalSystemCheck-->
        </Object>

        <!--End of Agent Service-->
      </Object>

      <!--FTE Service-->
      <Object Type="WMI" Name="SQL Server FTE Service Recommended Account" DisplayName="SQL Server FTE Service Recommended Account" Key1="%HOSTNAME%" Key3="Win32_Service" Key4="Name = '%FULLTEXTSERVICENAME%'" Description="SQL Server Agent service accounts should not be members of the local Administrators group or run as LocalSystem. Also, it should be same as DB Engine account." RuleId="RID0042" VulnerabilityID="RID0042">
        <Setting Key1="StartName" Substitution="FTESERVICESTARTNAME" SubstitutionFormat="\.\\----%HOSTNAME%\"/>

        <!--LocalSystemCheck-->
        <Object Type="If" Name="LocalSystemCheck" Key1="upper-case('%FTESERVICESTARTNAME%')=upper-case('localsystem')">
          <Object Type="If" Name="DBEngineLocalSystemCheck" Key1="upper-case('%DBENGINEACCOUNTNAME%')=upper-case('localsystem')">
            <Reference Type="CheckFTEAccount" Name="FTEAndDBInLS">
              <Substitution Name="FTESERVICENAME">%FULLTEXTSERVICENAME%</Substitution>
              <Substitution Name="FTESERVICESTARTNAME">LocalSystem</Substitution>
              <Substitution Name="FTESERVICESTARTSID">S-1-5-18</Substitution>
              <Substitution Name="DBENGINESTARTNAME">%DBENGINEACCOUNTNAME%</Substitution>
              <Substitution Name="DBENGINESTARTSID">S-1-5-18</Substitution>
            </Reference>
          </Object>
          <Object Type="If" Name="DBEngineNonLocalSystemCheck" Key1="upper-case('%DBENGINEACCOUNTNAME%')!=upper-case('localsystem')">
            <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%DBENGINEACCOUNTNAME%">
              <Setting Key1="Sid" Substitution="DBENGINEACCOUNTSID"/>
              <Reference Type="CheckFTEAccount" Name="FTEInLSDBInNonLS">
                <Substitution Name="FTESERVICENAME">%FULLTEXTSERVICENAME%</Substitution>
                <Substitution Name="FTESERVICESTARTNAME">LocalSystem</Substitution>
                <Substitution Name="FTESERVICESTARTSID">S-1-5-18</Substitution>
                <Substitution Name="DBENGINESTARTNAME">%DBENGINEACCOUNTNAME%</Substitution>
                <Substitution Name="DBENGINESTARTSID">%DBENGINEACCOUNTSID%</Substitution>
              </Reference>
            </Object>
          </Object>
          <!--End of LocalSystemCheck-->
        </Object>
        <!--NonLocalSystemCheck : service account name could be either <domainname>\<username> or <username>@<dnsforestname>.-->
        <Object Type="If" Name="NonLocalSystemCheck" Key1="upper-case('%FTESERVICESTARTNAME%')!=upper-case('localsystem')">
          <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%FTESERVICESTARTNAME%">
            <Setting Key1="Sid" Substitution="FTESERVICEACCOUNTSID"/>
            <Object Type="If" Name="DBEngineLocalSystemCheck" Key1="upper-case('%DBENGINEACCOUNTNAME%')=upper-case('localsystem')">
              <Reference Type="CheckFTEAccount" Name="FTEInNonLSDBInLS">
                <Substitution Name="FTESERVICENAME">%FULLTEXTSERVICENAME%</Substitution>
                <Substitution Name="FTESERVICESTARTNAME">%FTESERVICESTARTNAME%</Substitution>
                <Substitution Name="FTESERVICESTARTSID">%FTESERVICEACCOUNTSID%</Substitution>
                <Substitution Name="DBENGINESTARTNAME">LocalSystem</Substitution>
                <Substitution Name="DBENGINESTARTSID">S-1-5-18</Substitution>
              </Reference>
            </Object>
            <Object Type="If" Name="DBEngineNonLocalSystemCheck" Key1="upper-case('%DBENGINEACCOUNTNAME%')!=upper-case('localsystem')">
              <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%DBENGINEACCOUNTNAME%">
                <Setting Key1="Sid" Substitution="DBENGINEACCOUNTSID"/>
                <Reference Type="CheckFTEAccount" Name="FTEAndDBInNonLS">
                  <Substitution Name="FTESERVICENAME">%FULLTEXTSERVICENAME%</Substitution>
                  <Substitution Name="FTESERVICESTARTNAME">%FTESERVICESTARTNAME%</Substitution>
                  <Substitution Name="FTESERVICESTARTSID">%FTESERVICEACCOUNTSID%</Substitution>
                  <Substitution Name="DBENGINESTARTNAME">%DBENGINEACCOUNTNAME%</Substitution>
                  <Substitution Name="DBENGINESTARTSID">%DBENGINEACCOUNTSID%</Substitution>
                </Reference>
              </Object>
            </Object>
          </Object>
          <!--End of NonLocalSystemCheck-->
        </Object>
        <!--End of FTE Service-->
      </Object>
      <!--End of DBEngine-->
    </Object>
  </Type>
  <!--Declare the type that checks service accounts for MSOLAP service.
  Inputs:
  HOSTNAME                    - Host name.
  ANALYSISSERVICENAME         - MSOLAP service name.
  ANALYSISSERVICEACCOUNTNAME  - MSOLAP service start name, could be of the form <domain>\<user> or <user>@<dnsforest>
  ANALYSISSERVICEACCOUNTSID   - MSOLAP service account SID.-->
  <Type Name="CheckAnalysisServiceAccountHelper">
    <!--Privileged User Check-->
    <Reference Type="PrivilegedUserCheck" Name="MSOLAPPrivilegedUserCheck">
      <Substitution Name="SVCACCOUNTSID">%ANALYSISSERVICEACCOUNTSID%</Substitution>
      <Substitution Name="SERVICENAME">%ANALYSISSERVICENAME%</Substitution>
      <Substitution Name="ACCOUNTNAME">%ANALYSISSERVICEACCOUNTNAME%</Substitution>
    </Reference>

    <!-- Recommended accounts check: MSOLAP service is meant to run under Network Service Account.-->
    <Object Type="Group" Name="MSOLAP Service Recommended Account">
      <Setting Key1="MSOLAPServiceRecommendedAccount">
        <Rule
          Name="cMSOLAPInNSA" 
          GUID="f1bb9ec6-c70c-4cfb-9297-ae28dc4e60c8" 
          Query="not($MSOLAPPrivilegedUserCheck_cLocalSystem) and not($MSOLAPPrivilegedUserCheck_cBuiltinAdmin) and not($MSOLAPPrivilegedUserCheck_cDomainAdmin) and (upper-case('%ANALYSISSERVICEACCOUNTSID%') != upper-case($iNSASid))"
          Title="SQL Server Service [{1}\{0}] In Unrecommended Account On Host [{1}]." 
          Text="We recommend that the service [{0}] on host [{1}] be run under Network Service Account. Currently it is designated to run under the account [{2}]."
          S0="%ANALYSISSERVICENAME%"
          S1="%HOSTNAME%" 
          S2="%ANALYSISSERVICEACCOUNTNAME%"
          Error="Warning"
          Score="High"/>
      </Setting>
    </Object>
  </Type>
  <!--Declare the type that checks Recommended Service Accounts for MSOLAP services.-->
  <Type Name="CheckAnalysisServiceAccount">
    <Object 
    Type="WMI"
    Key1="%HOSTNAME%"
    Key3="Win32_Service"
    Key4="Name = '%ANALYSISSERVICENAME%'">
      <Setting Key1="StartName" Substitution="ANALYSISSERVICEACCOUNTNAME" SubstitutionFormat="\.\\----%HOSTNAME%\"/>

      <!--LocalSystemCheck-->
      <Object Type="If" Name="LocalSystem Detection" Key1="upper-case('%ANALYSISSERVICEACCOUNTNAME%')=upper-case('localsystem')">
        <Reference Type="CheckAnalysisServiceAccountHelper" Name="ASInLocalSystem">
          <Substitution Name="ANALYSISSERVICEACCOUNTSID">S-1-5-18</Substitution>
          <Substitution Name="ANALYSISSERVICENAME">%ANALYSISSERVICENAME%</Substitution>
          <Substitution Name="ANALYSISSERVICEACCOUNTNAME">%ANALYSISSERVICEACCOUNTNAME%</Substitution>
        </Reference>
        <!--End of LocalSystemCheck-->
      </Object>
      <!--NonLocalSystemCheck : service account name could be either <domainname>\<username> or <username>@<dnsforestname>.-->
      <Object Type="If" Name="Non LocalSystem Detection" Key1="upper-case('%ANALYSISSERVICEACCOUNTNAME%')!=upper-case('localsystem')">
        <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%ANALYSISSERVICEACCOUNTNAME%">
          <Setting Key1="Sid" Substitution="ANALYSISSERVICEACCOUNTSID"/>
          <Reference Type="CheckAnalysisServiceAccountHelper" Name="ASNotInLocalSystem">
            <Substitution Name="ANALYSISSERVICEACCOUNTSID">%ANALYSISSERVICEACCOUNTSID%</Substitution>
            <Substitution Name="ANALYSISSERVICENAME">%ANALYSISSERVICENAME%</Substitution>
            <Substitution Name="ANALYSISSERVICEACCOUNTNAME">%ANALYSISSERVICEACCOUNTNAME%</Substitution>
          </Reference>
        </Object>
        <!--End of NonLocalSystemCheck-->
      </Object>

    </Object>
  </Type>
  <!--Get the machine names.-->
  <Object Type="Xml" Key1="%CONFIG_INPUT_SERVER%" Key2="%CONFIG_INPUT_FILEPATH%" Key3="SQLBPA/Computer" SecurityContext="WINLOGON">
    <Setting Key1="@Name" Substitution="HOSTNAME"/>
    <!--Registry Access Check-->
    <Object Type="Registry" Key1="%HOSTNAME%" Key2="HKEY_LOCAL_MACHINE" Key3="SOFTWARE\Microsoft">
      <Setting Key1="__KEYPATH"/>
      <!--WMI Access Check-->
      <Object Type="WMI" Key1="%HOSTNAME%" Key3="Win32_OperatingSystem">
        <Setting Key1="Name"/>
        <!--Common Information used by various rules.-->
        <Object Type="Group" Name="[%HOSTNAME%] Preparing to analyze host" LogText="Collecting common data for host [%HOSTNAME%]" TrackProgress="TrackProgress">

          <!--Create the local administrators cache.-->
          <Object Type="Group" Name="Local Administrators Cache" RuleId="RID0008,RID0013,RID0014,RID0018,RID0037,RID0041,RID0042,RID0047">
            <!--Nullify the cache-->
            <Object Type="Cache" Name="Local Administrators Cache" Key1="Delete" Key2="LocalAdmins" />
            <!--Fill in the cache-->
            <Object Type="ExpandWinntGroup" Key1="WinNT://%HOSTNAME%/Administrators" Key2="Leaf">
              <Setting Key1="objectSid" Substitution="LOCALADMINSID"/>
              <Object Type="Cache" Name="Local Administrators Cache" Key1="Add" Key2="LocalAdmins" Key3="%LOCALADMINSID%"/>
            </Object>
          </Object>

          <!--Create Privileged Users Cache-->
          <Object Type="Group" Name="Privileged Users Cache" RuleId="RID0008,RID0014,RID0018,RID0041,RID0042,RID0047">
            <!--Cache elements contain the SIDs of privileged accounts in the format <SID>;<Category>.-->
            <!--Nullify the cache-->
            <Object Type="Cache" Name="Privileged Users Cache" Key1="Delete" Key2="PrivilegedUsers" />
            <!--Fill in the cache.-->

            <!--Add LocalSystem SID S-1-5-18-->
            <Object Type="Cache" Name="Privileged Users Cache" Key1="Add" Key2="PrivilegedUsers" Key3="S-1-5-18;LocalSystem"/>

            <!--Add Local Admins-->
            <Object Type="Cache" Name="Local Administrators Cache" Key1="Dump" Key2="LocalAdmins">
              <Setting Key1="LocalAdminSID" Substitution="LOCALADMINSID"/>
              <Object Type="Cache" Name="Privileged Users Cache" Key1="Add" Key2="PrivilegedUsers" Key3="%LOCALADMINSID%;LocalAdmin"/>
            </Object>

            <!--Add Domain Admins.-->
            <Object Type="WMI" Key1="%HOSTNAME%" Key3="Win32_ComputerSystem">
              <Setting Key1="Domain" Substitution="DOMAINNAME"/>
              <!--Get the domain SID-->
              <Object Type="LookupAccount" Key1="Name" Key3="%DOMAINNAME%">
                <Setting Key1="Sid" Substitution="DOMAINSID"/>
                <!--Get the Domain Admins Group name.-->
                <Object Type="LookupAccount" Key1="Sid" Key3="%DOMAINSID%-512">
                  <Setting Key1="Name" Substitution="DOMAINADMINSGROUP"/>
                  <!--Get the Default Naming Context.-->
                  <Object Type="Directory" Key1="%DOMAINNAME%">
                    <Setting Key1="defaultNamingContext" Substitution="CONFIGDN" />
                    <!--Expand the domain admins group-->
                    <Object Type="ExpandGroup" Key1="%DOMAINNAME%" Key2="CN=%DOMAINADMINSGROUP%,CN=Users,%CONFIGDN%">
                      <Setting Key1="SAMAccountName" Substitution="SAMACCOUNTNAME"/>
                      <Setting Key1="canonicalname" Substitution="DOMAININFO" SubstitutionFormat="^([^/]+).*$----$1"/>
                      <!--Get the domain admin SID-->
                      <Object Type="LookupAccount" Key1="Name" Key3="%SAMACCOUNTNAME%@%DOMAININFO%">
                        <Setting Key1="Sid" Substitution="DOMAINADMINSID"/>
                        <!--Populate Privileged Users Cache-->
                        <Object Type="Cache" Name="Privileged Users Cache" Key1="Add" Key2="PrivilegedUsers" Key3="%DOMAINADMINSID%;DomainAdmin"/>
                        <!--End of Get the domain admin name-->
                      </Object>
                      <!--End of Expand the domain admins group-->
                    </Object>
                    <!--End of Get the Default Naming Context-->
                  </Object>
                  <!--End of Get the Domain Admins Group name.-->
                </Object>
                <!--End of Get the domain SID-->
              </Object>
              <!--End of Add Domain Admins-->
            </Object>

          </Object>


          <!--SID of Network Service Account.-->
          <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="NT AUTHORITY\Network Service" RuleId="RID0008,RID0014,RID0041,RID0047">
            <Setting Key1="Sid">
              <Rule Name="iNSASid" Query="$."/>
            </Setting>
          </Object>

          <!--End of Common Information-->
        </Object>
        <!--Instance Unaware Rules-->
        <Object Type="Group" Name="[%HOSTNAME%] Analyzing host" LogText="Processing rules for host [%HOSTNAME%]" TrackProgress="TrackProgress">

          <!--Browser Service Recommended Account
        RuleId: RID0041
        Applies to: SQL 2005
      
        This check determines the Microsoft® SQL Server™ service accounts on the scanned computer.
        If the services are running under a high privilege account, make a recommendation to run them 
        under the recommended low privilege accounts 
        Type   Service                            Service Name            Recommended Account
        7      SQL Server Browser 	              SQLBrowser	            Network service account 
        
        Inputs:
        %HOSTNAME% - Machine hosting the Browser Service.
        
        Outputs:
        iBrowserAccount - SQLBrowser service account name.
        iBrowserAccountInLocalDomain - Evaluates to true if SQLBrowser service account is a local machine account.
        
        Rules:
        cBrowserLocalSystem   - Evaluates to true if SQLBrowser service account is LocalSystem.
        cBrowserBuiltinAdmin  - Evaluates to true if SQLBrowser service account is a local administrator.
        cSQLBrowserInNSA      - Evaluates to true if SQLBrowser service account is neither LocalSystem not local administrator and also not NSA.-->
          <Object Type="Group" Name="SQL Server Browser Service Recommended Account" DisplayName="SQL Server Browser Service Recommended Account" Description="This checks whether the browser services is running under privileged account or not running under NSA." RuleId="RID0041" VulnerabilityID="RID0041" Requirement="SAP">
            <!--Cater for Browser Service.-->
            <Object 
            Type="WMI"
            Key1="%HOSTNAME%"
            Key3="Win32_Service"
            Key4="Name = 'SQLBrowser'" 
            Display="Hide">
              <Setting Key1="StartName" Substitution="SQLBROWSERACCOUNTNAME" SubstitutionFormat="\.\\----%HOSTNAME%\"/>

              <!--LocalSystemCheck-->
              <Object Type="If" Name="LocalSystemCheck" Key1="upper-case('%SQLBROWSERACCOUNTNAME%')=upper-case('localsystem')">
                <Reference Type="CheckSQLBROWSERAccount" Name="SQLBrowserInLS">
                  <Substitution Name="SQLBROWSERACCOUNTNAME">LocalSystem</Substitution>
                  <Substitution Name="SQLBROWSERACCOUNTSID">S-1-5-18</Substitution>
                </Reference>
                <!--End of LocalSystemCheck-->
              </Object>
              <!--NonLocalSystemCheck : service account name could be either <domainname>\<username> or <username>@<dnsforestname>.-->
              <Object Type="If" Name="NonLocalSystemCheck" Key1="upper-case('%SQLBROWSERACCOUNTNAME%')!=upper-case('localsystem')">
                <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%SQLBROWSERACCOUNTNAME%">
                  <Setting Key1="Sid" Substitution="SQLBROWSERACCOUNTSID"/>
                  <Reference Type="CheckSQLBROWSERAccount" Name="SQLBrowserNotInLS">
                    <Substitution Name="SQLBROWSERACCOUNTNAME">%SQLBROWSERACCOUNTNAME%</Substitution>
                    <Substitution Name="SQLBROWSERACCOUNTSID">%SQLBROWSERACCOUNTSID%</Substitution>
                  </Reference>
                </Object>
                <!--End of NonLocalSystemCheck-->
              </Object>
            </Object>
          </Object>

          <!--PAE Kernel Without Proper Patch
                RuleId: RID3014
                Applies To: Windows 2000, Windows XP, Windows Server 2003
                Inputs:
                  %HOSTNAME% - The network name of the client hosting the SQL Server services.
                Outputs:
                Rules:
                  cMS04_044: 
                    The check evaluates to true if a Windows 2000 server has PAE enabled
                    and does not confirm to MS04-044 security fix.
                  cSP2: 
                    The check evaluates to true if a Windows XP server has PAE enabled
                    and does not have SP2 or later installed on it.
                  cMS04_032: 
                    The check evaluates to true if a Windows 2003 server has PAE enabled,
                    does not have SP1 or later installed on it and does not confirm to 
                    MS04-032 security fix.-->
          <Object Type="Group" Name="PAE Kernel Without Proper Patch" LogText="Processing PAE Kernel Without Proper Patch" RuleId="RID3014" Requirement="SAP">
            <!--Get the PAE status of the operating system.-->
            <Object
              Type="Registry"
              Key1="%HOSTNAME%" 
              Key2="HKEY_LOCAL_MACHINE"
              Key3="SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"
              Key5="Base"
              Display="Hide">
              <Setting Key1="PhysicalAddressExtension" Substitution="PAE"/>
              <!--Check if PAE is enabled-->
              <Object Type="If" Name="PAE Status Check" Key1="%PAE% = 1">
                <!--Get the OS version-->
                <Object 
                  Type="WMI" 
                  Key1="%HOSTNAME%"
                  Key2="root\CIMV2" 
                  Key3="Win32_OperatingSystem"
                  Display="Hide">
                  <Setting Key1="Version" Substitution="MAJOR" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\..+)?$----$1"/>
                  <Setting Key1="Version" Substitution="MINOR" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\..+)?$----$2"/>
                  <Setting Key1="Version" Substitution="BUILD" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\..+)?$----$3"/>
                  <Setting Key1="SystemDirectory" Substitution="SYSTEMDIRECTORY"/>

                  <!--Process Windows 2000 box-->
                  <Object Type="If" Name="Windows 2000" Key1="%MAJOR% = 5 and %MINOR%=0">
                    <!--Check ntoskrnl.exe for MS04-044 fixes. The file version should be greater than or equal to 5.0.2195.6992.-->
                    <Object 
                       Type="File" 
                       Key1="%HOSTNAME%" 
                       Key2="%SYSTEMDIRECTORY%\ntoskrnl.exe">
                      <Setting Key1="Version" Substitution="NTOSKRNLBUILD" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\.([0-9]+).*)?$----$3">
                        <!--The substitution format matches strings of the form:
                              5.2.3790.306 (srv03_qfe.050407-1825)
                              5.2.3790.306
                              5.2.3790-->
                        <Rule Name="iNtoskrnlBuild" Query="%NTOSKRNLBUILD%"/>
                      </Setting>
                      <Setting Key1="Version" Substitution="NTOSKRNLPRIVATE" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\.([0-9]+).*)?$----$5">
                        <Rule 
                          Name="cMS04_044" 
                          Query="$iNtoskrnlBuild &lt; 2195 or ($iNtoskrnlBuild = 2195 and %NTOSKRNLPRIVATE% &lt; 6992)"
                          GUID="608c1119-24f5-466a-9ffe-ef073bec5a75" 
                          Sev="2"
                          Title="Apply Software Update for PAE Kernel On Host [{0}]"
                          Text="The machine [{0}] has PAE enabled and running Windows 2000. Consider upgrading to the security fix MS04-044 or later."
                          P0="'%HOSTNAME%'"/>
                      </Setting>
                    </Object>
                  </Object>

                  <!--Process Windows XP box-->
                  <Object Type="If" Name="Windows XP" Key1="%MAJOR% = 5 and %MINOR%=1">
                    <!--Check for SP2.-->
                    <Object 
                      Type="WMI" 
                      Key1="%HOSTNAME%"
                      Key2="root\CIMV2" 
                      Key3="Win32_OperatingSystem"
                      Display="Hide">
                      <!--The substitution format matches strings of the form:
                            Service Pack 2
                            <empty string>-->
                      <Setting Key1="CSDVersion" Substitution="SERVICEPACK" SubstitutionFormat="^(.*?([0-9]+).*$)?----$2">
                        <Rule 
                          Name="cSP2" 
                          Query="'%SERVICEPACK%' = '' or %SERVICEPACK% &lt; 2"
                          Error="Warning"
                          GUID="608c1119-24f5-466a-9ffe-ef073bec5a75="
                          Sev="2"
                          Title="Required upgrade to Service Pack 2 on Host [{0}]"
                          Text="The machine [{0}] has PAE enabled and running Windows XP. Consider upgrading to Service Pack 2 or later."
                          P0="'%HOSTNAME%'"/>
                      </Setting>
                    </Object>
                  </Object>

                  <!--Process Windows Server 2003 box-->
                  <Object Type="If" Name="Windows Server 2003" Key1="%MAJOR% = 5 and %MINOR%=2">
                    <!--Check for SP1-->
                    <Object 
                      Type="WMI" 
                      Key1="%HOSTNAME%"
                      Key2="root\CIMV2" 
                      Key3="Win32_OperatingSystem"
                      Display="Hide">
                      <!--The substitution format matches strings of the form:
                            Service Pack 1
                            <empty string>-->
                      <Setting Key1="CSDVersion" Substitution="SERVICEPACK" SubstitutionFormat="^(.*?([0-9]+).*$)?----$2"/>
                      <!--If not SP1 patched, check ntoskrnl.exe for RTMQFE of MS04-32.The version should be 5.2.3790.177 or greater.-->
                      <Object Type="If" Key1="'%SERVICEPACK%' = '' or %SERVICEPACK% &lt; 1">
                        <Object 
                           Type="File" 
                           Key1="%HOSTNAME%" 
                           Key2="%SYSTEMDIRECTORY%\ntoskrnl.exe">
                          <Setting Key1="Version" Substitution="NTOSKRNLBUILD" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\.([0-9]+).*)?$----$3">
                            <!--The substitution format matches strings of the form:
                                  5.2.3790.306 (srv03_qfe.050407-1825)
                                  5.2.3790.306
                                  5.2.3790-->
                            <Rule Name="iNtoskrnlBuild_2003" Query="%NTOSKRNLBUILD%"/>
                          </Setting>
                          <Setting Key1="Version" Substitution="NTOSKRNLPRIVATE" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\.([0-9]+).*)?$----$5">
                            <Rule 
                              Name="cMS04_032" 
                              Query="$iNtoskrnlBuild_2003 &lt; 3790 or ($iNtoskrnlBuild_2003 = 3790 and %NTOSKRNLPRIVATE% &lt; 177)"
                              Error="Warning"
                              GUID="608c1119-24f5-466a-9ffe-ef073bec5a75" 
                              Sev="2"
                              Title="Required security fix MS04-032 on Host [{0}]"
                              Text="Server [{0}] has PAE enabled and running Windows Server 2003. Consider upgrading to the security fix MS04-032 or later."
                              P0="'%HOSTNAME%'"/>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                  </Object>
                </Object>
              </Object>
            </Object>
          </Object>

          <!--End of Instance Unaware Rules-->
        </Object>
        <!--Get the SQL Server Database Engines for each machine-->
        <Object
          Type="Xml" 
          Key1="%CONFIG_INPUT_SERVER%" 
          Key2="%CONFIG_INPUT_FILEPATH%"
          Key3="SQLBPA/Computer[@Name=&quot;%HOSTNAME%&quot;]/SqlServers/SqlServer">
          <Setting Key1="@Name" Substitution="SRVNAME"/>
          <Setting Key1="@Name" Substitution="INSTANCENAME" SubstitutionFormat="^([^\\]+)(\\(.+))?$----$3"/>
          <Setting Key1="ConnectionString/text()" Substitution="CONNSTR"/>
          <Object Type="Group" Name="[%SRVNAME%] Analyzing SQL Server" LogText="Processing rules for server [%SRVNAME%]" TrackProgress="TrackProgress">
            <!-- Fetch some commonly used server properties-->
            <Object Type="Group" GroupingClass="True" Class="%HOSTNAME%">
              <Object 
                Type="SQL" 
                Key1="%CONNSTR%" 
                Key2="USE [master];DECLARE @versionInfo varchar(100);SET @versionInfo = @@VERSION;SELECT SERVERPROPERTY('productversion') as SQLVersion, SERVERPROPERTY('Edition') as SQLEdition,DATABASEPROPERTYEX('master','Status') AS master_status,DATABASEPROPERTYEX('model','Status') AS model_status,DATABASEPROPERTYEX('msdb','Status') AS msdb_status,DATABASEPROPERTYEX('tempdb','Status') AS tempdb_status,SUBSTRING(@versionInfo, CHARINDEX('(', @versionInfo) + 1, (CHARINDEX(')', @versionInfo) - CHARINDEX('(', @versionInfo) - 1)) As Platform;"
                Key4="true" 
                Display="Hide">
                <Setting Key1="SQLVersion" Substitution="SQLProductVersion" />
                <Setting Key1="SQLEdition" Substitution="SQLServerEdition" />
                <Setting Key1="SQLVersion" Substitution="SQLBuild" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\..+)?$----$3">
                  <Rule Name="iSP1" Query="%SQLBuild% &gt;= 2047"/>
                </Setting>
                <Setting Key1="master_status" Substitution="MASTERSTATUS"/>
                <Setting Key1="model_status" Substitution="MODELSTATUS"/>
                <Setting Key1="msdb_status" Substitution="MSDBSTATUS"/>
                <Setting Key1="tempdb_status" Substitution="TEMPDBSTATUS"/>
                <Setting Key1="Platform" Substitution="PLATFORMINFO" SubstitutionFormat="[a-zA-Z]+ ([a-zA-Z0-9]+)$----$1"/>
                <Setting Key1="Platform" Substitution="PLATFORMNUM" SubstitutionFormat="([a-zA-Z]+) ([a-zA-Z ]+)([0-9]+)$----$3"/>

                <Object Type="If" Name="VersionCheck" Key1="%Sql2005Check% or %Sql2000Check%" Display="Hide">

                  <!--Find out the SQLPath for the instance-->
                  <Object Type="Group" Name="SQLPath of the instance">
                    <!--For the Default instance-->
                    <Object Type="If" Key1="'%INSTANCENAME%'=''">
                      <Object Type="Registry" Key1="%HOSTNAME%" Key2="" Key3="SOFTWARE\Microsoft\MSSQLServer\Setup">
                        <Setting Key1="SQLPath" Substitution="SQLPATH"/>
                        <!-- Delete the entry (Initialise)-->
                        <Object Type="Cache" Name="SQL Server Cache" Key1="Delete" Key2="SQLPath" />
                        <!-- Add the newly computed SQLPath-->
                        <Object Type="Cache" Name="SQL Server Cache" Key1="Add" Key2="SQLPath" Key3="%SQLPATH%"/>
                      </Object>
                      <!--Code to handle WOW condition-->
                      <Object Type="Registry" Key1="%HOSTNAME%" Key2="" Key3="SOFTWARE\Wow6432Node\Microsoft\MSSQLServer\Setup">
                        <Setting Key1="SQLPath" Substitution="SQLPATH"/>
                        <!-- Delete the entry (Initialise)-->
                        <Object Type="Cache" Name="SQL Server Cache" Key1="Delete" Key2="SQLPath" />
                        <!-- Add the newly computed SQLPath-->
                        <Object Type="Cache" Name="SQL Server Cache" Key1="Add" Key2="SQLPath" Key3="%SQLPATH%"/>
                      </Object>
                      <!--WOW code ends-->
                    </Object>
                    <!--For a named Instance-->
                    <Object Type="If" Key1="'%INSTANCENAME%'!=''">
                      <Object Type="Registry" Key1="%HOSTNAME%" Key2="" Key3="SOFTWARE\Microsoft\Microsoft SQL Server\%INSTANCENAME%\Setup">
                        <Setting Key1="SQLPath" Substitution="SQLPATH"/>
                        <!-- Delete the entry (Initialise)-->
                        <Object Type="Cache" Name="SQL Server Cache" Key1="Delete" Key2="SQLPath" />
                        <!-- Add the newly computed SQLPath-->
                        <Object Type="Cache" Name="SQL Server Cache" Key1="Add" Key2="SQLPath" Key3="%SQLPATH%"/>
                      </Object>
                      <!--Code to handle WOW condition-->
                      <Object Type="Registry" Key1="%HOSTNAME%" Key2="" Key3="SOFTWARE\Wow6432Node\Microsoft\Microsoft SQL Server\%INSTANCENAME%\Setup">
                        <Setting Key1="SQLPath" Substitution="SQLPATH"/>
                        <!-- Delete the entry (Initialise)-->
                        <Object Type="Cache" Name="SQL Server Cache" Key1="Delete" Key2="SQLPath" />
                        <!-- Add the newly computed SQLPath-->
                        <Object Type="Cache" Name="SQL Server Cache" Key1="Add" Key2="SQLPath" Key3="%SQLPATH%"/>
                      </Object>
                      <!--WOW code ends-->
                    </Object>
                  </Object>

                  <!--Analyzing Server Instance Level Rules-->

                  <!--
                  RuleId: RID0002

                  Rule Name: Authentication Mode 
                  
                  Applies To: SQL2000, SQL2005
                  
                  Inputs:
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The name of the SQL Server Instance
                  
                  Logic:
                    Use 'IsIntegratedSecurityOnly' server property to get the current login mode. The configured value should be 
                    Windows Authentication.
                                      
                  Rules:
                    $cAuthenticationMode -  This rule is fired if server authentication mode is not Windows Authentication.
                -->
                  <Object Type="Group" Name="Authentication Mode" DisplayName="Authentication Mode" Description="Checks if the Server Authentication mode is something other than 'Windows Authentication'" LogText="Processing Authentication Mode" RuleId="RID0002" VulnerabilityID="RID0002" Requirement="NonSAP">
                    <Object GroupingClass="True" Class="%SRVNAME%" Type="SQL" Key1="%CONNSTR%" Key2="SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') AS LoginMode" Key4="true" Display="Hide">
                      <Setting Key1="LoginMode">
                        <Rule Name="cAuthenticationMode" GUID="88e90cfe-a54e-4fe5-864a-3ffb86d8a332" Error="BestPractice" Score="Medium" Query="$. = 0" Title="Authentication Mode Violation On Server [{0}]" Text="Server authentication for server [{0}] is set to 'Mixed mode'.  We recommend changing it to 'Windows Authentication' only." S0="%SRVNAME%" />
                      </Setting>
                    </Object>
                  </Object>

                  <!--
                  RuleId: RID0003

                  Rule Name: Database Mail

                  Applies To: SQL2005

                  Inputs:
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The name of the SQL Server instance
                    %Sql2005Check% - SQL2005 instance check
                  
                  Logic:
                    This rule uses the run value to check for the SQL Mail Availability configuration.
                  
                  Rules:
                      $cSQLMail - This rule is fired if SQL Mail is being used on this server.
                -->
                  <Object Type="If" Name="DatabaseMailPreCondition" DisplayName="Database Mail" Key1="%Sql2005Check%" Description="This check determines whether SQL mail is enabled on the SQL Server." LogText="Processing Database Mail" RuleId="RID0003" VulnerabilityID="RID0003" Requirement="SAP">
                    <Object Type="Group" Name="Database Mail">
                      <Object 
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%" 
                        Key2="SELECT [value_in_use] as [SQL Mail Availability] FROM sys.configurations WHERE [name] = N'SQL Mail XPs'"
                        Key4="true" 
                        Display="Hide">
                        <Setting Key1="SQL Mail Availability">
                          <Rule  
                            Name="cSQLMail" 
                            Query="$.=1" 
                            Error="Warning"
                            Score="High"
                            GUID="b08df7be-d8be-4184-a661-38ec0ac85cd1" 
                            Title="Use Database Mail Instead of SQL Mail On Server [{0}]"  
                            Text="Server [{0}] has 'SQL Mail XPs' server-wide configuration ON. Usage of SQL Mail is discouraged and we recommend to use Database Mail instead. SQL Mail runs in-process with your SQL Server service.  If SQL Mail crashes, so does your SQL Server service. Database Mail runs out of process.  It is scalable and doesn't require client components installed on the production server."
                            S0="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!--
                  RuleId: RID0004      

                  Rule Name: SQL Login Password Policy 
                  
                  Applies To: SQL2005
                  
                  Inputs:
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The name of the SQL Server instance
                    %SQLProductVersion% - The Product Version of SQL Server
                  
                  Intermediate Results:
                     $iPolicyChecked - Indicates if password Policy is enabled
                     $iExpirationChecked - Indicates if expiration is enabled
                  
                  Logic:
                    This rule checks whether the password policy and password expiration is enabled on
                    the server for each login.
                  
                  Rules:
                     $cSqlLoginPasswordPolicy - This rule is fired if one of the policy and expiration is 
                                                not enabled for any SQL Login. 
                -->
                  <Object Type="If" Name="SQLLoginPasswordPolicyPreCondition" DisplayName="SQL Login Password Policy" Key1="%Sql2005Check%" Description="Checks if the policy and expiration are both enabled for each SQL Login." LogText="Processing SQL Login Password Policy" RuleId="RID0004" VulnerabilityID="RID0004" Requirement="SAP">
                    <Object Type="Group" Name="SQL Login Password Policy">
                      <Object 
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%" 
                        Key2="SELECT [name], [is_policy_checked], [is_expiration_checked] FROM master.sys.sql_logins WHERE [is_policy_checked] = 0 OR [is_expiration_checked] = 0;"
                        Key4="true" 
                        Display="Hide">
                        <Setting Key1="is_policy_checked">
                          <Rule Name="iPolicyChecked" Query="$." />
                        </Setting>
                        <Setting Key1="is_expiration_checked">
                          <Rule Name="iExpirationChecked" Query="$." />
                        </Setting>
                        <Setting Key1="name">
                          <Rule 
                            Name="cSqlLoginPasswordPolicy" 
                            Title="SQL Login Password Policy Violation By Login [{0}] On Server [{3}]" 
                            GUID="7e3bf9da-a436-433d-847a-47c30428cad3"
                            Error="BestPractice" 
                            Query="true()" 
                            Text="Login [{0}] on Server [{3}] has Password Policy set to [{1}] and Password Expiration set to [{2}]. We recommend that both Password Policy and Expiration must be enabled for SQL accounts." 
                            P0="$." 
                            P1="$iPolicyChecked" 
                            P2="$iExpirationChecked" 
                            S3="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!--
                  RuleId: RID0008,RID0018,RID0042
                  
                  Rule Name: SQL Server service accounts [Recommended Accounts Check]
                  
                  Applies to: SQL2000, SQL2005
                
                  Logic:
                    This check determines the Microsoft® SQL Server™ service accounts on the scanned computer.
                    If the services are running under a high privilege account, make a recommendation to run them 
                    under the recommended low privilege accounts:
                    Type   Service                            Service Name            Recommended Account
                    1      SQL Server (MSSQLSERVER)           MSSQLSERVER	            Domain service account
                    3      SQL Server FullText Search         MSFTESQL	              SQL Server service account
                    2      SQL Server Agent (MSSQLSERVER) 	  SQLSERVERAGENT	        SQL Server service account (RTM)
                                                                                      Network service account (SP1)
                    
                    The rule check for default/named instance of service and call {CheckRecommendedAccounts} with 
                    the service names.
                    
                  Inputs:
                    %HOSTNAME%      - Hostname.
                    %INSTANCENAME%  - DB Engine instance name.
                  
                  Rules:
                    The rules are fired in the {CheckRecommendedAccounts} Type.
                -->
                  <Object Type="Group" Name="SQL Server Service accounts(Recommended Accounts Check)" RuleId="RID0008,RID0018,RID0042" LogText="Processing SQL Server Service Accounts Rule" Requirement="SAP" GroupingClass="True" Class="%SRVNAME%">
                    <!--Cater for DBEngine, FTE and Agent Service.-->
                    <!--Default Instance.-->
                    <Object Type="If" Name="Default Instance Detection" Key1="'%INSTANCENAME%'=''">
                      <Reference Type="CheckRecommendedAccounts" Name="DefaultInstance">
                        <Substitution Name="DBENGINESERVICENAME">MSSQLSERVER</Substitution>
                        <Substitution Name="AGENTSERVICENAME">SQLSERVERAGENT</Substitution>
                        <Substitution Name="FULLTEXTSERVICENAME">msftesql</Substitution>
                      </Reference>
                      <!--End of Default Instance.-->
                    </Object>

                    <!--Named Instances.-->
                    <Object Type="If" Name="Named Instance Detection" Key1="'%INSTANCENAME%'!=''">
                      <Reference Type="CheckRecommendedAccounts" Name="NamedInstance">
                        <Substitution Name="DBENGINESERVICENAME">MSSQL$%INSTANCENAME%</Substitution>
                        <Substitution Name="AGENTSERVICENAME">SQLAgent$%INSTANCENAME%</Substitution>
                        <Substitution Name="FULLTEXTSERVICENAME">msftesql$%INSTANCENAME%</Substitution>
                      </Reference>
                      <!--End of Named Instance.-->
                    </Object>
                  </Object>

                  <!--
                  RuleId: RID0009
                  
                  Rule Name: SQL Agent Proxy Account
                  
                  Applies To: SQL2005
                  
                  Inputs:
                    %CONNSTR%           - The connection string to use
                    %SRVNAME%           - The name of the SQL Server instance
                    %Sql2005Check%      - SQL2005 instance check
                    %IsMsdbOnline%      - ONLINE check for msdb status
                  
                  Logic:
                    The rule query counts the number of SQL server login entries for 'Public' role that 
                    are associated with the SQL Server Agent Proxy account using msdb.dbo.sysproxylogin
                    
                  Rules:
                     $cPublicNotProxyLogin - This rule is fired if SQL Server Agent Proxy account 
                                             has been granted to 'Public' i.e. count is non-zero.
                -->
                  <Object Type="If" Name="SQLAgentProxyAccountPreCondition" DisplayName="SQL Agent Proxy Account" Key1="%Sql2005Check% and %IsMsdbOnline%" Description="This rule checks if an msdb Agent Proxy account has been granted to 'public'." LogText="Processing SQL Agent Proxy Account" RuleId="RID0009" VulnerabilityID="RID0009" Requirement="SAP">
                    <Object Type="Group" Name="SQL Agent Proxy Account">
                      <Object 
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%" 
                        Key2="USE [msdb]; SELECT COUNT(1) AS [PublicProxyAccounts] FROM dbo.sysproxylogin SPL JOIN sys.database_principals DP ON DP.SID = SPL.SID WHERE principal_id = USER_ID('public');"
                        Key4="true" 
                        Display="Hide">
                        <Setting Key1="PublicProxyAccounts">
                          <Rule 
                            Name="cPublicNotProxyLogin" 
                            GUID="950da9ca-fe7a-4b2f-bf64-882072539d5d" 
                            Query="$. != 0" 
                            Title="Proxy Account Granted To 'public' On Server [{0}]." 
                            Text="The database [{0}\msdb] has one or more proxy accounts granted to 'public'. We recommend that proxy accounts should not be granted to 'public' as it gives security hole for any user to associate the proxy." 
                            Error="Warning" 
                            Score="High" 
                            S0="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!--
					        RuleId: RID0015
                  
                  Rule Name: SQL Server Integration Services - sysdtslog90 Table on master/msdb
        					
					        Applies To: SQL2005
        					
					        Inputs:
						        %CONNSTR%                         - The connection string to use
						        %SRVNAME%                         - The name of the SQL Server instance 
						        %SQLProductVersion%               - The Product Version of SQL Server
						        %IsMasterOnline%                  - Detects online status for master
						        %IsMsdbOnline%                    - Detects online status for msdb
        					
					        Logic:
						        The query checks sys.objects on the [master] and [msdb] databases to check
						        for user table named {sysdtslog90}
        					
					        Intermediate Results:
						        $iSysdtslog90OnMaster             - Evaluates to true if Sysdtslog90 Table is found 
															        in database [master]
						        $iSysdtslog90OnMsdb               - Evaluates to true if Sysdtslog90 Table is found 
															        in database [msdb]
        					
					        Rules:
						        $cSysdtslog90OnBothMasterAndMsdb  - This rule is fired if Sysdtslog90 Table is found both 
															        in [master] and [msdb] databases.
						        $cSysdtslog90OnMaster             - This rule is fired if Sysdtslog90 Table is found in 
															        [master] and not in [msdb] database.
						        $cSysdtslog90OnMsdb               - This rule is fired if Sysdtslog90 Table is found in 
															        [msdb] and not in [master] database.
                -->
                  <Object Type="If" Name="Sysdtslog90TableOnMasterOrMsdbPreCondition" DisplayName="Sysdtslog90 Table on master/msdb" Key1="%Sql2005Check% and %IsMasterOnline% and %IsMsdbOnline%" Description="This check determines if the Sysdtslog90 table exists in Master and MSDB database."  LogText="Processing Sysdtslog90 Table on master/msdb" RuleId="RID0015" VulnerabilityID="RID0015" Requirement="SAP">
                    <Object Type="Group" Name="Sysdtslog90 Table on master/msdb">
                      <!--Check master and msdb for the presence of Sysdtslog90.-->
                      <Object 
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%" 
                        Key2="SELECT (SELECT COUNT(1) FROM master.dbo.sysobjects WHERE [name] = 'Sysdtslog90' and [type] = 'U') AS [Sysdtslog90OnMaster], (SELECT COUNT(1) FROM msdb.dbo.sysobjects WHERE [name] = 'Sysdtslog90' and [type] = 'U') AS [Sysdtslog90OnMsdb];"
                        Key4="true" 
                        Display="Hide">
                        <Setting Key1="Sysdtslog90OnMaster">
                          <Rule Name="iSysdtslog90OnMaster" Query="$. != 0"/>
                        </Setting>
                        <Setting Key1="Sysdtslog90OnMsdb">
                          <Rule Name="iSysdtslog90OnMsdb" Query="$. != 0"/>
                          <Rule 
                            Name="cSysdtslog90OnBothMasterAndMsdb" 
                            Query="$iSysdtslog90OnMaster and $iSysdtslog90OnMsdb" 
                            GUID="d0a339e7-3afe-4491-8bf5-d44e2b0aa858" 
                            Title="Sysdtslog90 Table Found in [master] And [msdb] Databases On Server [{0}]" 
                            Text="Sysdtslog90 Table is found both in [master] and [msdb] databases on Server [{0}]. Do not create the Sysdtslog90 table for logging in the [master] and [msdb] databases. This is not a security related concern but could be a performance issue since SSIS can generate a lot of logging data. We recommend creating a separate database for logging." 
                            Error="BestPractice" 
                            Score="Medium" 
                            S0="%SRVNAME%"/>
                          <Rule 
                            Name="cSysdtslog90OnMaster" 
                            Query="not($cSysdtslog90OnBothMasterAndMsdb) and $iSysdtslog90OnMaster" 
                            GUID="d0a339e7-3afe-4491-8bf5-d44e2b0aa858" 
                            Title="Sysdtslog90 Table In [master] On Server [{0}]" 
                            Text="Sysdtslog90 Table is found in [master] database on Server [{0}]. Do not create the Sysdtslog90 table for logging in the [master] and [msdb] databases. This is not a security related concern but could be a performance issue since SSIS can generate a lot of logging data. We recommend creating a separate database for logging." 
                            Error="BestPractice" 
                            Score="Medium" 
                            S0="%SRVNAME%"/>
                          <Rule 
                            Name="cSysdtslog90OnMsdb" 
                            Query="not($cSysdtslog90OnBothMasterAndMsdb) and $iSysdtslog90OnMsdb" 
                            GUID="d0a339e7-3afe-4491-8bf5-d44e2b0aa858" 
                            Title="Sysdtslog90 Table In [msdb] On Server [{0}]" 
                            Text="Sysdtslog90 Table is found in [msdb] database on Server [{0}]. Do not create the Sysdtslog90 table for logging in the [master] and [msdb] databases. This is not a security related concern but could be a performance issue since SSIS can generate a lot of logging data. We recommend creating a separate database for logging." 
                            Error="BestPractice" 
                            Score="Medium" 
                            S0="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!--
					        RuleId: RID0033

					        Rule Name: SQL BuiltinSysAdmin check

					        Applies To: SQL2000, SQL2005

					        Inputs:
						        %CONNSTR%           - The connection string to use
						        %SRVNAME%           - The name of the SQL Server instance 
						        %SQLProductVersion% - The Product Version of SQL Server

					        Logic:
						        Query the dbo.syslogins table to find if entry for role 'BUILTIN\Administrators'
						        has column value for [sysadmin] = 1
        						
					        Rules:
						        $cBuiltinAdministratorsInSysAdmin - This rule is fired if BUILTIN\Administrators is in the 
														           sysadmin role.
                -->
                  <Object Type="Group" Name="SQL BuiltinSysAdmin check" LogText="Processing SQL BuiltinSysAdmin check" DisplayName="SQL BuiltinSysAdmin check" Description="This check determines whether the built-in Administrators group is listed as a member of the Sysadmin role on Microsoft® SQL Server™" RuleId="RID0033" VulnerabilityID="RID0033" Requirement="SAP">
                    <Object 
                      Type="SQL"
                      GroupingClass="True" 
                      Class="%SRVNAME%"
                      Key1="%CONNSTR%" 
                      Key2="SELECT COUNT(1) AS [BuiltinAdminIsSysadmin] FROM master.dbo.syslogins WHERE [name] = 'BUILTIN\Administrators' AND [sysadmin] =1;"
                      Key4="true" 
                      Display="Hide">
                      <Setting Key1="BuiltinAdminIsSysadmin">
                        <Rule
                          Name="cBuiltinAdministratorsInSysAdmin" 
                          GUID="1b2a882b-9cb7-4ed6-b730-d99427341e23" 
                          Query ="$. != 0" 
                          Error="BestPractice" 
                          Score="Medium" 
                          Title="BUILTIN\Administrators In SysAdmin Role On Server [{0}]" 
                          Text="BUILTIN\Administrators group on server [{0}] is found to be part of the sysadmin role. We recommend that BUILTIN\Administrators should not be a part of Sysadmin fixed server role since it gives all the members of local Administrators group full access to all of your databases." 
                          S0="%SRVNAME%" />
                      </Setting>
                    </Object>
                  </Object>

                  <!--
					        RuleId: RID0043, RID0044

					        Rule Names:
						        SQL Agent Token Replacement On RTM; 
						        SQL Agent Token Replacement Without Escape Macros; 

					        Applies To: SQL2005

					        Inputs:
						        %CONNSTR% - The connection string to DB Engine
						        %SRVNAME% - The name of the SQL Server Instance

					        Logic:
						        1. Query sys.jobsteps to find out number of token replacement job steps.
        						
						        2. Query sys.jobsteps to find out number of token replacement job steps with escape characters is used.
        						
						        3. If token replacement is used on non-SP1 instance fire {cTokenReplacementWithoutSP1}						
        						
						        4. If number of token replacement jobsteps > number of token replacement jobsteps with macros
							        A. If server instance is SP1 fire {cTokenReplacementWithoutMacroUsageOnSP1}
							        B. If server instance is non-SP1 fire {cTokenReplacementWithoutMacroUsageOnRTM}
        							
        						
					        Intermediate Rules:
						        $iJobStepsUsingTokenReplacement            - Count of job steps that use token replacement.
						        $iJobStepsUsingTokenReplacementWithMacros  - Count of job steps that use token replacement with escape macros.
						        $iSP1                                      - Evaluates to true if SP1 of SQL Server is found.

					        Rules:
						        $cTokenReplacementWithoutSP1               - This rule is fired if the token replacement feature is used on a non SP1 server instance.
						        $cTokenReplacementWithoutMacroUsageOnSP1   - This rule is fired if the token replacement feature is used on a SP1 server without escape macros.
						        $cTokenReplacementWithoutMacroUsageOnRTM   - This rule is fired if the token replacement feature is used on a pre-SP1 server without escape macros.
                -->
                  <Object Type="If" Name="SQL Agent Token Replacement" Key1="%Sql2005Check%" LogText="Processing SQL Agent Token Replacement Rule" RuleId="RID0043,RID0044" Requirement="SAP">
                    <Object Type="Group" Name="SQL Agent Token Replacement">
                      <!--Get the job step count that use token replacement.-->
                      <Object
                        Type="SQL"
                        Key1="%CONNSTR%"
                        Key2="SELECT (SELECT COUNT(1) FROM msdb.dbo.sysjobsteps WHERE CHARINDEX('$(',[command])&lt;&gt;0) AS [job_steps_using_token_replacement],(SELECT COUNT(1) FROM msdb.dbo.sysjobsteps WHERE CHARINDEX(LOWER('$(ESCAPE'),LOWER([command]))&lt;&gt;0) AS [job_steps_using_token_replacement_with_macros];"
                        Key4="true" 
                        Display="Hide">
                        <Setting Key1="job_steps_using_token_replacement">
                          <Rule Name="iJobStepsUsingTokenReplacement" Query="$."/>
                        </Setting>
                        <Setting Key1="job_steps_using_token_replacement_with_macros">
                          <Rule Name="iJobStepsUsingTokenReplacementWithMacros" Query="$."/>
                        </Setting>

                        <!--Start defining the rules.-->
                        <Object Type="Group" Name="SQL Agent Token Replacement On RTM" DisplayName="SQL Agent Token Replacement On RTM" Description="Checks whether token replacement feature is used on pre-sp1 build of SQL Server 2005" RuleId="RID0043" VulnerabilityID="RID0043" GroupingClass="True" Class="%SRVNAME%_RTM">
                          <Setting Key1="SQL Agent Token Replacement On RTM">
                            <Rule 
                              Name="cTokenReplacementWithoutSP1"
                              Query="$iJobStepsUsingTokenReplacement!=0 and not($iSP1)"
                              GUID="f8fe9e91-85b5-4f9b-9ca9-21b028832a76" 
                              Title="Token Replacement Without SP1 On Server [{0}]" 
                              Text="Token replacement feature is used in some of the job steps on server [{0}] that is detected to be having a pre-SP1 build. We recommend that you upgrade to SP1 and use the safe replacement macros."
                              Error="Error"
                              Sev="1" 
                              Score="Error" 
                              S0="%SRVNAME%"/>
                          </Setting>
                        </Object>
                        <Object Type="Group" Name="SQL Agent Token Replacement Without Escape Macros" DisplayName="SQL Agent Token Replacement Without Escape Macros" Description="Checks whether token replacement feature without escape macros is used on sp1/post-SP1 build of SQL Server 2005" RuleId="RID0044" VulnerabilityID="RID0044" GroupingClass="True" Class="%SRVNAME%_NoEscapeMacros">
                          <Setting Key1="SQL Agent Token Replacement Without Escape Macros">
                            <Rule 
                              Name="cTokenReplacementWithoutMacroUsageOnSP1"
                              Query="($iJobStepsUsingTokenReplacement > $iJobStepsUsingTokenReplacementWithMacros) and $iSP1"
                              GUID="f8fe9e91-85b5-4f9b-9ca9-21b028832a76" 
                              Title="Token Replacement Without Escape Macros On Server [{0}]" 
                              Text="Token replacement feature without escape macros is used in some of the job steps on server [{0}]. An escape macro must accompany all tokens used in job steps, or else those job steps will fail."
                              Error="Error"
                              Score="Error" 
                              Sev="1" 
                              S0="%SRVNAME%"/>

                            <Rule 
                              Name="cTokenReplacementWithoutMacroUsageOnRTM"
                              Query="($iJobStepsUsingTokenReplacement > $iJobStepsUsingTokenReplacementWithMacros) and not($iSP1)"
                              GUID="f8fe9e91-85b5-4f9b-9ca9-21b028832a76" 
                              Title="Token Replacement Without Escape Macros On Server [{0}]" 
                              Text="Token replacement feature without escape macros is used in some of the job steps on server [{0}] that is detected to be having a pre-SP1 build. We recommend that you upgrade to SP1 and use an escape macro for all tokens used in job steps."
                              Error="Error"
                              Score="Error" 
                              Sev="1" 
                              S0="%SRVNAME%"/>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!--
					        RuleId: RID1002
        					
					        Rule Name: Allow Updates
        					
					        Applies To: SQL2000
        					
					        Inputs:
					          %CONNSTR% - The connection string to use
					          %SRVNAME% - The name of the SQL Server instance 
					          %SQLProductVersion% - The Product Version of SQL Server
        					
					        Logic:
						        1. Get the config value for 'Allow Updates' [102]
						        2. If allow updates is enabled then fire {fAllowUpdatesRule}						
        					
					        Rules:
						        $fAllowUpdatesRule - Check if the allow updates is not set to false
                -->
                  <Object Type="If" Name="AllowUpdatesPreCondition" Key1="%Sql2000Check%" LogText="Processing Allow Updates" RuleId="RID1002" Requirement="SAP">
                    <Object 
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Name="AllowUpdates" 
                        Description="Get the value for the configuration 'allow updates'" 
                        Key1="%CONNSTR%" 
                        Key2="SELECT [value] FROM master.dbo.sysconfigures WHERE [config] = 102"
                        Key4="true" 
                        Display="Hide">
                      <Setting Key1="value">
                        <Rule 
                          Name="fAllowUpdatesRule" 
                          Query="$. != 0" 
                          Error="Error" 
                          Title="Set Allow Updates Option to Zero On Server [{0}]" 
                          Text="Updates to system tables are enabled on server [{0}]. We recommend disabling this option, so users cannot update system tables through ad hoc updates." 
                          S0="%SRVNAME%"/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
					        RuleId: RID3004
        					
					        Rule Name: Tempdb Concurrency Enhancement
        					
					        Applies To: SQL2000, SQL2005
        					
					        Inputs:
						        %CONNSTR% - The connection string to use
						        %SRVNAME% - The sql server instance
        					
					        Logic:
						        1. Get the following data for tempdb database on current server
							        A. Status of trace flag 1118
							        B. number of data files
							        C. number of logical CPUs on the machine
							        D. are all data files of equal size
						        2. If any of the following is true then fire {cPossibileTempdbConcurrencyEnhancement}
							        A. logical CPU count >=8 AND trace flag 1118 is reset
							        B. number of data files < logical CPU count
							        C. all data files are not equally sized
        							
					        Intermediate Rules:
						        iT1118Status                              - t1118 status for sql 2005 instance.
						        iDatafileCount                            - Data file count of tempdb database for sql 2005 instance.
						        iLogicalCpuCount                          - Logical CPU count of server for sql 2005 instance.
						        iTempdbDatafilesCountSameAsCPUCount       - Evaluates to true if tempdb data files count is the same as logical CPU count for sql 2005 instance.
						        iAreDatafilesEquallySized                 - Evaluates to true if tempdb data files are equally sized for sql 2005 instance.
						        iT1118Status_2000                         - t1118 status for sql 2000 instance.
						        iDatafileCount_2000                       - Data file count of tempdb database for sql 2000 instance.
						        iLogicalCpuCount_2000                     - Logical CPU count of server for sql 2000 instance.
						        iTempdbDatafilesCountSameAsCPUCount_2000  - Evaluates to true if tempdb data files count is the same as logical CPU count for sql 2000 instance.
						        iAreDatafilesEquallySized_2000            - Evaluates to true if tempdb data files are equally sized for sql 2000 instance.
        					
					        Rules:
						        $cPossibileTempdbConcurrencyEnhancement      - Evaluates to true if t1118 is Off or tempdb datafile count is different than logical cpu count or tempdb datafiles not equally sized for sql 2005 instance.
						        $cPossibileTempdbConcurrencyEnhancement_2000 - Evaluates to true if t1118 is Off or tempdb datafile count is different than logical cpu count or tempdb datafiles not equally sized for sql 2000 instance.
                -->
                  <Object Type="If" Name="TempdbConcurrencyEnhancementPreCondition" LogText="Processing Tempdb Concurrency Enhancement"  Key1="%IsTempdbOnline%" RuleId="RID3004" Requirement="NonSAP">
                    <Object Type="If" Name="VersionTest" Key1="%Sql2005Check%" Display="Hide">
                      <Object
                        Type="SQL" 
                        Key1="%CONNSTR%"
                        Key2="USE [tempdb];DECLARE @t1118Status int, @tempdbDatafileCount int, @areTempdbDatafilesEqualInSize int, @logicalCPUCount int;SELECT @tempdbDatafileCount = COUNT(1) FROM sys.database_files WHERE [type] = 0;SELECT @areTempdbDatafilesEqualInSize = CASE COUNT(1) WHEN 1 THEN 1 ELSE 0 END FROM (SELECT COUNT(1) AS [sameSizeCount] FROM sys.database_files WHERE [type] = 0 GROUP BY [size])T;SELECT @logicalCPUCount = [scheduler_count] FROM master.sys.dm_os_sys_info;DECLARE @tracestatus TABLE(TraceFlag int,Status int,Global int,Session int);INSERT INTO @tracestatus EXEC ('DBCC TRACESTATUS (1118) WITH NO_INFOMSGS');SELECT @t1118Status = Status FROM @tracestatus;SELECT @tempdbDatafileCount AS [datafile_count], @logicalCPUCount AS [logical_cpu_count], @areTempdbDatafilesEqualInSize AS [are_datafiles_equally_sized], @t1118Status AS [t1118_status];"
                        Key4="true"
                        Display="Hide">
                        <Setting Key1="t1118_status">
                          <Rule Name="iT1118Status" Query="$."/>
                        </Setting>
                        <Setting Key1="datafile_count">
                          <Rule Name="iDatafileCount" Query="$."/>
                        </Setting>
                        <Setting Key1="logical_cpu_count">
                          <Rule Name="iLogicalCpuCount" Query="$."/>
                          <Rule Name="iTempdbDatafilesCountGreaterThanOrEqualToCPUCount" Query="$iDatafileCount &gt;= $."/>
                        </Setting>
                        <Setting Key1="are_datafiles_equally_sized">
                          <Rule Name="iAreDatafilesEquallySized" Query="$."/>
                        </Setting>
                        <Object Type="Group" Name="Tempdb Concurrency Enhancement Rules" GroupingClass="True" Class="%SRVNAME%">
                          <Setting Key1="Tempdb Concurrency Enhancement Rules">
                            <Rule Name="cPossibleTempdbConcurrencyEnhancement" 
                              Query="($iLogicalCpuCount &gt;= 8) and (not($iT1118Status = 1) or not($iTempdbDatafilesCountGreaterThanOrEqualToCPUCount) or not($iAreDatafilesEquallySized = 1))"
                              Error="BestPractice"
                              GUID="a4c7d677-03b1-41de-8414-ea1a46440cbf" 
                              Sev="1"
                              Title="Improve [tempdb] Performance on Server [{0}]"
                              Text="Server [{0}] has trace flag 1118 status as [{1}] , tempdb datafiles count [{2}], logical cpu count [{3}] and the predicate 'tempdb datafiles are equally sized' as [{4}]. We recommend that to reduce the allocation resource contention for tempdb that is experiencing heavy usage, trace flag 1118 should be turned on, the number of tempdb data files should equal the number of processors and these files should be equally sized."
                              S0="%SRVNAME%"
                              P1="$iT1118Status"
                              P2="$iDatafileCount"
                              P3="$iLogicalCpuCount"
                              P4="$iAreDatafilesEquallySized"/>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                    <Object Type="If" Name="VersionTest" Key1="%Sql2000Check%" Display="Hide">
                      <Object
                        Type="SQL" 
                        Key1="%CONNSTR%"
                        Key2="USE tempdb;DECLARE @t1118Status int, @tempdbDatafileCount int, @areTempdbDatafilesEqualInSize int, @logicalCPUCount int;SELECT @tempdbDatafileCount = COUNT(1) FROM dbo.sysfiles WHERE groupid = 1;SELECT @areTempdbDatafilesEqualInSize = CASE COUNT(1) WHEN 1 THEN 1 ELSE 0 END FROM (SELECT COUNT([size]) AS [sameSizeCount] FROM dbo.sysfiles WHERE groupid = 1 GROUP BY [size])T;CREATE TABLE #umsstats(Statistic nvarchar(512), Value int);INSERT #umsstats EXEC ('DBCC SQLPERF(UMSSTATS)');SELECT @logicalCPUCount = COUNT(DISTINCT Value) FROM #umsstats WHERE LOWER(Statistic) = LOWER('Scheduler ID');DROP TABLE #umsstats;CREATE TABLE #tracestatus (TraceFlag int,Status int);/*NOTE: It might happen that status of t1118 is ON but it is not visible just because this session is not enabled for trace options. Thus, enable trace options for this connection. This will not affect any other sessions and will provide us the trace flag status.*/DBCC TRACEON;INSERT INTO #tracestatus EXEC ('DBCC TRACESTATUS (1118) WITH NO_INFOMSGS');SELECT @t1118Status = Status FROM #tracestatus;DROP TABLE #tracestatus;SELECT @tempdbDatafileCount AS [datafile_count], @logicalCPUCount AS [logical_cpu_count], @areTempdbDatafilesEqualInSize AS [are_datafiles_equally_sized], @t1118Status AS [t1118_status];"
                        Key4="true"
                        Display="Hide">
                        <Setting Key1="t1118_status">
                          <Rule Name="iT1118Status_2000" Query="$."/>
                        </Setting>
                        <Setting Key1="datafile_count">
                          <Rule Name="iDatafileCount_2000" Query="$."/>
                        </Setting>
                        <Setting Key1="logical_cpu_count">
                          <Rule Name="iLogicalCpuCount_2000" Query="$."/>
                          <Rule Name="iTempdbDatafilesCountGreaterThanOrEqualToCPUCount_2000" Query="$iDatafileCount_2000 &gt;= $."/>
                        </Setting>
                        <Setting Key1="are_datafiles_equally_sized">
                          <Rule Name="iAreDatafilesEquallySized_2000" Query="$."/>
                        </Setting>
                        <Object Type="Group" Name="Tempdb Concurrency Enhancement Rules" GroupingClass="True" Class="%SRVNAME%">
                          <Setting Key1="Tempdb Concurrency Enhancement Rules">
                            <Rule Name="cPossibleTempdbConcurrencyEnhancement_2000" 
                              Query="($iLogicalCpuCount_2000 &gt;= 8) and (not($iT1118Status_2000 = 1) or not($iTempdbDatafilesCountGreaterThanOrEqualToCPUCount_2000) or not($iAreDatafilesEquallySized_2000 = 1))"
                              Error="BestPractice"
                              GUID="a4c7d677-03b1-41de-8414-ea1a46440cbf" 
                              Sev="1"
                              Title="Improve [tempdb] Performance On Server [{0}]"
                              Text="Server [{0}] has trace flag 1118 status as [{1}] , tempdb datafiles count [{2}], logical cpu count [{3}] and the predicate 'tempdb datafiles are equally sized' as [{4}]. We recommend that to reduce the allocation resource contention for tempdb that is experiencing heavy usage, trace flag 1118 should be turned on, the number of tempdb data files should equal the number of processors and these files should be equally sized."
                              S0="%SRVNAME%"
                              P1="$iT1118Status_2000"
                              P2="$iDatafileCount_2000"
                              P3="$iLogicalCpuCount_2000"
                              P4="$iAreDatafilesEquallySized_2000"/>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!--
					        RuleId: RID3006
        					
					        Rule Name: Reading Error Logs for Autogrowth failures or long durations.
        					
					        Applies To: SQL2000, SQL2005
        					
					        Logic:
						        1. Enumerate the error log files using sp_enumerrorlogs
						        2. For SQL2005:
							        A. Read the error logs into a temporary variable
							        B. Query the variable for Autogrowth failure/Long duration messages
							        C. If results found in 2.B. then fire {autoGrowthFailedOrLongTime2005}
						        3. For SQL2000:
							        A. Read the error logs into a temporary table
							        B. Query the temp table for Autogrowth failure/Long duration messages
							        C. If results found in 3.B. then fire {autoGrowthFailedOrLongTime2000}
							        D. Drop temporary table
        						
						        Checks the error logs if an message for an Autogrowth Failure/larger duration exists.

					        Inputs:
						        %CONNSTR% - The connection string to use
						        %SRVNAME% - The name of the SQL Server instance 
                
					        Rules:
                    $autoGrowthFailedOrLongTime2005 - Evaluates to true if Autogrowth failure/Long duration messages are encountered for sql 2005 instance.
                    $autoGrowthFailedOrLongTime2000 - Evaluates to true if Autogrowth failure/Long duration messages are encountered for sql 2000 instance.
						
				        -->
                  <Object Type="Group" Name="Error Log related checks" LogText="Processing Error Logs for auto-growth related issues" RuleId="RID3006" Requirement="ModifiedSAP">
                    <Object
                      Type="SQL"
                      Key1="%CONNSTR%"
                      Key2="exec sp_enumerrorlogs"
                      Key4="true">
                      <Setting Key1="Archive #" Substitution="LOGNUM"/>
                      <Object
                        Type="If"
                        Key1="%Sql2005Check%">
                        <Object 
                          Type="SQL" 
                          GroupingClass="True" 
                          Class="%SRVNAME%"
                          Name="ReadErrorLog"
                          Key1="%CONNSTR%" 
                          Key2="DECLARE @szError5144 AS NVARCHAR(500)
                                SET @szERROR5144 = 'Autogrow of file % in database % was cancelled by user or timed out after % milliseconds.  Use ALTER DATABASE to set a smaller FILEGROWTH value for this file or to explicitly set a new file size.%'

                                DECLARE @szError5145 AS NVARCHAR(500)
                                SET @szError5145 = 'Autogrow of file % in database % took % milliseconds.  Consider using ALTER DATABASE to set a smaller FILEGROWTH for this file.%'

                                DECLARE @ErrorLog%LOGNUM% Table
                                (
	                                LogDate DATETIME,
	                                ProcessInfo NVARCHAR(200),
	                                ErrorText NVARCHAR (4000)
                                )

                                INSERT INTO @ErrorLog%LOGNUM% EXEC sp_readerrorlog %LOGNUM%

                                SELECT 
	                                ErrorText 
                                FROM 
	                                @ErrorLog%LOGNUM% 
                                WHERE
	                                ErrorText LIKE @szERROR5144 OR ErrorText LIKE @szError5145"
                          Key4="true" 
                           Display="Hide">
                          <Setting Key1="ErrorText">
                            <Rule
                              Name="autoGrowthFailedOrLongTime2005"
                              GUID="8315c956-94f4-45f5-9999-d4c21ea2f231" 
                              Text="Server [{0}] - {1}"
                              Error="Error"
                              Title="Autogrowth Failed or took a long time on Server [{0}]"
                              RuleId="RID3006"
                              S0="%SRVNAME%"
                              P1="$.">
                            </Rule>
                          </Setting>
                        </Object>
                      </Object>
                      <Object
                          Type="If"
                          Key1="%Sql2000Check%">
                        <Object 
                          Type="SQL" 
                          GroupingClass="True" 
                          Class="%SRVNAME%"
                          Name="ReadErrorLog"
                          Key1="%CONNSTR%" 
                          Key2="DECLARE @szError5144 AS NVARCHAR(500)
                                SET @szERROR5144 = '% % % Autogrow of file % in database % was cancelled by user or timed out after % milliseconds.  Use ALTER DATABASE to set a smaller FILEGROWTH value for this file or to explicitly set a new file size.%'

                                DECLARE @szError5145 AS NVARCHAR(500)
                                SET @szError5145 = '% % % Autogrow of file % in database % took % milliseconds.  Consider using ALTER DATABASE to set a smaller FILEGROWTH for this file.%'

                                CREATE TABLE #ErrorLog%LOGNUM%
                                (
                                    ErrorText NVARCHAR (4000),
                                    ContinuationRow INT
                                )

                                INSERT INTO #ErrorLog%LOGNUM% EXEC sp_readerrorlog %LOGNUM%
                                
                                SELECT 
                                    ErrorText
                                FROM 
                                    #ErrorLog%LOGNUM%
                                WHERE
                                    ErrorText LIKE @szERROR5144 OR ErrorText LIKE @szError5145

                                DROP TABLE #ErrorLog%LOGNUM%"
                          Key4="true" 
                           Display="Hide">
                          <Setting Key1="ErrorText" Substitution="ERRORLOGTEXT" SubstitutionFormat="^[^ ]* [^ ]* [^ ]* *([^ ].*)$----$1">
                            <Rule
                                Name="autoGrowthFailedOrLongTime2000"
                                Text="Server [{0}] - {1}"
                                Error="Error"
                                GUID="8315c956-94f4-45f5-9999-d4c21ea2f231"
                                Title="Autogrowth failed or took a long time on Server [{0}]"
                                RuleId="RID3006"
                                S0="%SRVNAME%"
                                S1="%ERRORLOGTEXT%">
                            </Rule>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
					        RuleId: RID3009
        					
					        Rule Name: Upgrade to Baseline Build 1007
        					
					        Applies To: SQL2000
        					
					        Inputs:
						        %CONNSTR% - The connection string to use
						        %Sql2000Check% - The check for SQL 2000
						        %SRVNAME% - SQL 2000 server instance
        					
					        Logic:
						        If the SQLBUILD substitution variable is <= 760 then fire {cBuild760}
        						
					        Rules:
						        $cBuild760 - This rule is fired if the build number of SQL Server 2000 instance <= 760.
                -->
                  <Object Type="If" Name="UpgradetoBaselineBuild1007PreCondition" LogText="Processing Upgrade to Baseline Build 1007" Key1="%Sql2000Check% and (%SQLBuild% &lt;= 760)" RuleId="RID3009" Requirement="ModifiedSAP" GroupingClass="True" Class="%SRVNAME%">
                    <Setting Key1="Build">
                      <Rule 
                        Name="cBuild760" 
                        Error="BestPractice"
                        GUID="132aa01e-639a-4668-8b9f-9046f1a4619b" 
                        Sev="1"
                        Title="Required upgrade to Baseline Build 1007 on Server [{0}]"
                        Text="SQL Server 2000 instance [{0}] has build number [{1}]. We recommend upgrading this server instance to baseline build 8.00.1007 or to SP4."
                        P0="'%SRVNAME%'"
                        S1="%SQLBuild%"/>
                    </Setting>
                  </Object>

                  <!-- 
					        RuleId: RID3013
        					
					        Rule Name: Older SQL Server 2000 version installed on IA-64 Machine
        					
					        Applies To: SQL2000

					        Logic:
						        1. Get the version of the current sql server instance from SQLBUILD substitution variable
						        2. Get the architecture of machine hosting the instance using dbo.xp_msver
						        3. Fire the rule {sqlversionOnIA64} if following are true:
							        A. SQL server version is lower than 8.00.2187
							        B. Machine hosting the SQL server is an IA64 machine

					        Inputs:
						        %CONNSTR% - The connection string to use
						        %SRVNAME% - The name of the SQL Server instance 
						        %SQLProductVersion% - The Product Version of SQL Server
        						
					        Rules:
						        $sqlversionOnIA64 - This rule is fired if SQL server instance with version 
											        lower than 8.00.2187 is installed on IA64 machine.
                -->
                  <Object Type ="If" Name="SQL2000VersionOnIA64PreCondition" Key1="%Sql2000Check%" LogText="Processing SQL2000 Version on IA64 Rule" RuleId="RID3013" Requirement="NonSAP" GroupingClass="True" Class="%SRVNAME%">
                    <!--Assumption: PLATFORM = 'NT INTEL IA64' like 'NT INTEL X86'-->
                    <Setting Key1="%PLATFORMINFO%">
                      <Rule 
                          Name="sqlversionOnIA64"
                          GUID="bf2b82d2-66e6-47b1-8f6f-f0536a8bb34e" 
                          Query="'%PLATFORMINFO%'='IA64' and (%SQLBuild% &lt; 2187)" 
                          Error="Warning" 
                          Title="SQL Server Versions on Itanium-based Computers For Server [{0}]"
                          Text="Server [{0}] is hosted on an IA-64 machine and has version [{1}]. Upgrade it to 8.00.2187 or later." 
                          S0="%SRVNAME%"
                          S1="%SQLBuild%"/>
                    </Setting>
                  </Object>

                  <!--
				          RuleId: RID3020
        					
				          Rule Name: CSS_STABILITY_53: Check for read-retry issues - EventID 825
        					
				          Applies To: SQL2000, SQL2005

				          Logic:					
					          Check for read-retry issues - EventID 825 in Windows Event Log

				          Intermediate Rules:
					          $eventlogEntryMessage - This stores the actual message from event log for default instance.
					          $eventlogEntryMessageNamedInstance - This stores the actual message from event log for named instance.
        						
				          Inputs:
					          %HOSTNAME% - The name of the host of this instance
					          %INSTANCENAME% - The name of the instance              
        					
				          Rules:
					          $eventlogEntryDateTime - This rule is fired if entry with event-id 825 is found for default instance.
					          $eventlogEntryDateTimeNamedInstance - This rule is fired if entry with event-id 825 is found for named instance.
                -->
                  <Object Type="Group" Name="Read-Retry Issue" LogText="Processing Read-Retry Issue" RuleId="RID3020" Level="Detailed" Requirement="SAP">
                    <!--
                    We need to look at the SQL service that logged the event and retrieve logs for the eventids generated by the 
                    current instance against which the rules are being run.
                    If it's the default instance, then source is MSSQLSERVER,
                    Else it is MSSQL$INSTANCENAME
                  -->
                    <!--Look for records written by the service in the default instance-->
                    <Object Type="If" Key1="'%INSTANCENAME%'=''">
                      <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="SourceName='MSSQLSERVER' and EventCode=825 and Logfile='Application'" Display="Hide"  GroupingClass="True" Class="%SRVNAME%">
                        <Setting Key1="Message">
                          <Rule Name="eventlogEntryMessage" Query="$."/>
                        </Setting>
                        <Setting Key1="TimeGenerated" Substitution="LOGDATETIME" SubstitutionFormat="System.DateTime">
                          <Rule Name="eventlogEntryDateTime" Text="{0} {1}" Title="Check Disk I/O Subsystem for Read Retry Problems On Host [{3}]" GUID="cedf4097-5b73-4964-9935-74a101847019" Error="Error" Sev="1" S0="%LOGDATETIME%" P1="$eventlogEntryMessage" S2="%SRVNAME%" S3="%HOSTNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                    <!--Look for records written by the service in the named instance-->
                    <Object Type="If" Key1="'%INSTANCENAME%'!=''">
                      <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="SourceName='MSSQL$%INSTANCENAME%' and EventCode=825 and Logfile='Application'" Display="Hide"  GroupingClass="True" Class="%SRVNAME%">
                        <Setting Key1="Message">
                          <Rule Name="eventlogEntryMessageNamedInstance" Query="$."/>
                        </Setting>
                        <Setting Key1="TimeGenerated" Substitution="LOGDATETIME" SubstitutionFormat="System.DateTime">
                          <Rule Name="eventlogEntryDateTimeNamedInstance" Query="%LOGDATETIME%" Text="{0} {1}" Title="Check Disk I/O Subsystem for Read Retry Problems On Host [{3}]" GUID="cedf4097-5b73-4964-9935-74a101847019" Error="Error" Sev="1" S0="%LOGDATETIME%" P1="$eventlogEntryMessageNamedInstance" S2="%SRVNAME%" S3="%HOSTNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!--
                  RuleId: RID3021
                   
                  Rule Name: CSS_STABILITY_53: I/O delay warning - Eventid 833
                   
                  Applies To: SQL 2000, SQL 2005

                  Logic:
                    Check for I/O delay warning - Eventid 833 in Windows Event Log
                  
                  Intermediate Rules:
					          $eventlogEntryMessageIOdelay - This stores the actual message from event log for default instance.
					          $eventlogEntryMessageIOdelayNamedInstance - This stores the actual message from event log for named instance.
                   
                  Inputs:
                      %HOSTNAME% - The name of the host of this instance
                      %INSTANCENAME% - The name of the instance
                      
                  Rules:
					          $eventlogEntryDateTimeIOdelay - This rule is fired if entry with event-id 833 is found for default instance.
					          $eventlogEntryDateTimeIOdelayNamedInstance - This rule is fired if entry with event-id 833 is found for named instance.  
                -->
                  <Object Type="Group" Name="I/O delay warning" LogText="Processing I/O delay warning" RuleId="RID3021" Level="Detailed" Requirement="SAP">
                    <!--
                    We need to look at the SQL service that logged the event and retrieve logs for the eventids generated by the current
                    instance against which the rules are being run.
                    If it's the default instance, then source is MSSQLSERVER,
                    Else it is MSSQL$INSTANCENAME
                  -->
                    <!--Look for records written by the service in case of a default instance-->
                    <Object Type="If" Key1="'%INSTANCENAME%'=''">
                      <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="SourceName='MSSQLSERVER' and EventCode=833 and Logfile='Application'" Display="Hide"  GroupingClass="True" Class="%SRVNAME%">
                        <Setting Key1="Message">
                          <Rule Name="eventlogEntryMessageIOdelay" Query="$."/>
                        </Setting>
                        <Setting Key1="TimeGenerated" Substitution="LOGDATETIME" SubstitutionFormat="System.DateTime">
                          <Rule Name="eventlogEntryDateTimeIOdelay" Text="{0} {1}" Title="Check Disk I/O Subsystem for I/O delay Problems For Host [{3}]" GUID="23863340-d8e0-48d6-928b-462745885d37" Error="Error" Sev="1" S0="%LOGDATETIME%" P1="$eventlogEntryMessageIOdelay" S2="%SRVNAME%" S3="%HOSTNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                    <!--Look for records written by the service in case of a named instance-->
                    <Object Type="If" Key1="'%INSTANCENAME%'!=''">
                      <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="SourceName='MSSQL$%INSTANCENAME%' and EventCode=833 and Logfile='Application'" Display="Hide"  GroupingClass="True" Class="%SRVNAME%">
                        <Setting Key1="Message">
                          <Rule Name="eventlogEntryMessageIOdelayNamedInstance" Query="$."/>
                        </Setting>
                        <Setting Key1="TimeGenerated" Substitution="LOGDATETIME" SubstitutionFormat="System.DateTime">
                          <Rule Name="eventlogEntryDateTimeIOdelayNamedInstance" Text="{0} {1} " Title="Check Disk I/O Subsystem for I/O delay Problems For Host [{3}]" GUID="23863340-d8e0-48d6-928b-462745885d37"  Error="Error" Sev="1" S0="%LOGDATETIME%" P1="$eventlogEntryMessageIOdelayNamedInstance" S2="%SRVNAME%" S3="%HOSTNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                  RuleID:RID3077
                  
                  Rule Name: Stalled IO
                  
                  Applies To: SQL 2000 and SQL 2005
                  
                  Logic:
                    Check for entry of long IO requests in SQL Server error log
                    
                  Inputs:
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The name of the SQL Server Instance 
                    
                  Rules:
					          $stalledIOForDB2005 - This rule is fired if messages for long IO requests are present in SQL 2005 instance error log.
					          $stalledIOForDB2000 - This rule is fired if messages for long IO requests are present in SQL 2000 instance error log.
                -->
                  <Object Type="Group" Name="Stalled IO" LogText="Processing Stalled I/O check" RuleId="RID3077" Requirement="SAP">
                    <!-- Retrieve list of all error logs for this instance-->
                    <Object Type="SQL" Key1="%CONNSTR%" Key2="exec sp_enumerrorlogs" Key4="true">
                      <Setting Key1="Archive #" Substitution="LOGNUM"/>
                      <!-- Check sql 2005 error log-->
                      <Object Type="If" Key1="%Sql2005Check%">
                        <Object 
                          Type="SQL" 
                          GroupingClass="True" 
                          Class="%SRVNAME%"
                          Name="ReadErrorLog"
                          Key1="%CONNSTR%" 
                          Key2="DECLARE @szError833 AS NVARCHAR(500)
                                SET @szError833 = '%SQL Server has encountered % occurrence(s) of I/O requests taking longer than % seconds to complete on file % in database [[]%] [(]%). The OS file handle is %. The offset of the latest long I/O is: %'

                                DECLARE @szError833Right AS NVARCHAR(100)
                                SET @szError833Right = '%database %[[]%] [(]%). The OS file handle is %. The offset of the latest long I/O is: %'

                                DECLARE @ErrorLog%LOGNUM% Table
                                (
                                    LogDate DATETIME,
                                    ProcessInfo NVARCHAR(200),
                                    ErrorText NVARCHAR (4000)
                                )

                                INSERT INTO @ErrorLog%LOGNUM% EXEC sp_readerrorlog %LOGNUM%

                                DECLARE @Error833%LOGNUM% TABLE
                                (
	                                ErrorText NVARCHAR (4000)
                                )

                                INSERT INTO @Error833%LOGNUM%
	                                SELECT 
		                                SUBSTRING(ErrorText, PATINDEX(@szError833Right, ErrorText), LEN(ErrorText))
	                                FROM 
		                                @ErrorLog%LOGNUM% 
	                                WHERE
		                                ErrorText LIKE @szError833

                                UPDATE @Error833%LOGNUM%
	                                SET ErrorText = SUBSTRING(ErrorText, 0, CHARINDEX('(', ErrorText))

                                SELECT DISTINCT ErrorText AS DB_With_Stalled_IO FROM @Error833%LOGNUM%"
                          Key4="true" 
                           Display="Hide">
                          <Setting Key1="DB_With_Stalled_IO">
                            <Rule Name="stalledIOForDB2005" Title ="Stalled I/O" Text="The {0} on SQL Server [{1}] has one or more reports of stalled I/O. There may be a performance problem with I/O subsystem." GUID="91012ad8-ed01-4f68-879d-c43f71d10bf9" P0="$." S1="%SRVNAME%" Error="Warning" />
                          </Setting>
                        </Object>
                      </Object>
                      <!-- Check sql 2000 error log-->
                      <Object Type="If" Key1="%Sql2000Check%">
                        <Object 
                          Type="SQL" 
                          GroupingClass="True" Class="%SRVNAME%"
                          Name="ReadErrorLog"
                          Key1="%CONNSTR%" 
                          Key2="DECLARE @szError833 AS NVARCHAR(500)
                                SET @szError833 = '% % % SQL Server has encountered % occurrence(s) of I/O requests taking longer than % seconds to complete on file % in database [[]%] [(]%)%'

                                DECLARE @szError833Right AS NVARCHAR(100)
                                SET @szError833Right = '%database %[[]%] [(]%)%'

                                CREATE TABLE #ErrorLog%LOGNUM%
                                (
                                    ErrorText NVARCHAR (4000),
                                    ContinuationRow INT
                                )

                                INSERT INTO #ErrorLog%LOGNUM% EXEC sp_readerrorlog %LOGNUM%

                                CREATE TABLE #Error833%LOGNUM%
                                (
                                    ErrorText NVARCHAR (4000)
                                )

                                INSERT INTO #Error833%LOGNUM%
                                    SELECT 
                                        SUBSTRING(ErrorText, PATINDEX(@szError833Right, ErrorText), LEN(ErrorText))
                                    FROM 
                                        #ErrorLog%LOGNUM% 
                                    WHERE
                                        ErrorText LIKE @szError833

                                UPDATE #Error833%LOGNUM%
                                    SET ErrorText = SUBSTRING(ErrorText, 0, CHARINDEX('(', ErrorText))

                                SELECT DISTINCT ErrorText AS DB_With_Stalled_IO FROM #Error833%LOGNUM%

                                DROP TABLE #ErrorLog%LOGNUM%
                                DROP TABLE #Error833%LOGNUM%"
                          Key4="true" 
                           Display="Hide">
                          <Setting Key1="DB_With_Stalled_IO">
                            <Rule Name="stalledIOForDB2000" Title ="Stalled I/O" Text="The {0} on SQL Server [{1}] has one or more reports of stalled I/O. There may be a performance problem with I/O subsystem." GUID="91012ad8-ed01-4f68-879d-c43f71d10bf9" P0="$." S1="%SRVNAME%" Error="Warning" />
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3023
                 
                 Rule Name: Unexpected System Failures on a machine hosting SQL Server instances
                 
                 Applies To: SQL 2000, SQL 2005
                 
                 Logic:
                  Checks if the event log for the machine hosting current SQL instance has event with eventid=6008 in the system event log folder.
                 
                 Intermediate Rules:
					          $unexpectedFailures - This stores generation time of a system failure message.
                    
                 Inputs:
                    %HOSTNAME% - The name of the host of this instance
                    %SRVNAME% - The name of the SQL Server instance 
                 Rules:
                    $pUnExpectedFailures - Checks if the machine hosting current SQL server experienced unexpected system failures in the past.
                -->
                  <Object Type="Group" Name="UnexpectedSystemFailure" LogText="Processing Unexpected System Failure Rule" RuleId="RID3023" Level="Detailed" Requirement="SAP">
                    <Object GroupingClass="True" Class="%SRVNAME%" Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="EventCode=6008 and Logfile='System'" Display="Hide">
                      <Setting Key1="TimeGenerated">
                        <Rule Name="unexpectedFailures" Query="$."/>
                      </Setting>
                      <Rule Name="pUnExpectedFailures" Query="count($_/../Instance) &gt; 0" Title="Unexpected System Failures On Host [{1}]" GUID="1679bf9e-a2ef-4f90-8907-a002f7341a7d" Text="Machine [{1}] hosting SQL Server [{0}] has experienced unexpected system failures in the past. We recommend you to move this server instance to another machine." Error="Warning" S0="%SRVNAME%" S1="%HOSTNAME%"/>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3012
                 
                 Rule Name: BULK INSERT may not yield the UMS
                 
                 Applies To: SQL 2000
                 
                 Logic:
                  Checks if an SQL 2000 instance version lies between build 1014 and 2038 or 2162 and 2186.
                 
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %SQLBuild%     - SQL 2000 build number
                    %SRVNAME%      - The name of the SQL Server instance 
                 
                 Rules:
                    $cBUG473650 - Evaluates to true if the build number lies between 1014 and 2038 or between 2162 and 2186.
                -->
                  <Object Type="If" Name="BULK INSERT may not yield the UMS" LogText="Processing BULK INSERT may not yield the UMS" Key1="%Sql2000Check% and ((%SQLBuild% &gt;= 1014 and %SQLBuild% &lt;= 2038) or (%SQLBuild% &gt;= 2162 and %SQLBuild% &lt;= 2186))" RuleId="RID3012" Requirement="NonSAP" GroupingClass="True" Class="%SRVNAME%">
                    <Setting Key1="cBUG473650">
                      <Rule Name="cBUG473650" Error="Warning" GUID="c5766b38-e8e6-4be6-9b64-406b7630af1c" Sev="2" Title="BULK INSERT Might Compromise the Lock Manager" Text="Server [{0}] has product version as [{1}]. For this version any BULK INSERT command can leave the worker in preemptive state and destabilizes the lock manager and other parts of the engine. We recommend you to apply SP4 and 8.00.2187 to this server." P0="'%SRVNAME%'" P1="$."/>
                    </Setting>
                  </Object>

                  <!--
                  RuleId: RID3025, RID3035, RID3038, RID3039
                  
                  Rule Name: CSS_REPL_TRAN_LATENCY_06 - Replication Timeout Alert, RuleId: RID3025
                             CSS_REPL_TRAN_OUTOFSYNC_01 - Replication Pub and Sub are out of synch, RuleId: RID3035
                             CSS_REPL_TRAN_OUTOFSYNC_02 - Replication Pub and Sub are out of sync(Constraint Violation), RuleId: RID3038
                             Skipped transaction entries, RuleId: RID3039
                             
                  Applies To: SQL 2000, SQL2005
                  
                  Logic:
                   Checks for replication related errors messages in replication tables of target sql server instance
                  
                  Inputs:
                     %CONNSTR%      - The connection string to use
                     %Sql2000Check% - The check for SQL 2000
                     %Sql2005Check% - The check for SQL 2005
                     %SRVNAME%      - The name of the SQL Server instance 
                     
                  Outputs:
                    Info on alerts in msdb.dbo.sysreplication table.
                    Note: For SQL 2000, relies on category!= 0 to determine if the table was system generated or user created.
                    
                  Rules:
                    $ReplicationTimeoutSqlRule (RID3025) - Evaluates to true if replication time out alerts entries are present
                    $ReplicationPubSubSyncRule35 (RID3035) - Evaluates to true if publisher and subscriber are out of sync
                    $ReplicationPubSubSyncRule38 (RID3038) - Evaluates to true if there are any constraint violations on publisher/subscriber
                    $skippedTransactionsRule (RID3039) - Evaluates to true if there are skipped transaction entries
                -->
                  <Object Type="Group" Name="Replication based Checks" LogText="Processing Replication based Checks" RuleId="RID3025,RID3035,RID3038,RID3039">
                    <!--Initialise this member. This will tell if the sysreplication table exists-->
                    <Object Type="Cache" Name="SQL ServerCache" Key1="Delete" Key2="sysReplicationAlertsExists" />
                    <!-- Check for SQL 2000-->
                    <Object Type="If" Name="VersionTest" Key1="%Sql2000Check%" Display="Hide" LogText="Checking If SQL 2000.">
                      <!--Check if the table has been created for SQL 2000. Table does not always exist.-->
                      <Object Type="SQL" Name="sysReplicationAlertsCheckSql2000" Description="This checks for the existence of table msdb.dbo.sysreplicationalerts." Key1="%CONNSTR%" Key2="SELECT [name] FROM msdb.dbo.sysobjects WHERE [name] ='sysreplicationalerts' AND [uid]=USER_ID('dbo');" Key4="true" Display="Hide">
                        <Object Type="Cache" Name="SQL ServerCache" Key1="Add" Key2="sysReplicationAlertsExists" Key3="1"/>
                      </Object>
                    </Object>
                    <!-- Check for SQL 2005-->
                    <Object Type="If" Name="VersionTest" Key1="%Sql2005Check%" Display="Hide" LogText="Checking If SQL 2005.">
                      <!--Check if the table has been created for SQL 2005. Table does not always exist.-->
                      <Object Type="SQL" Name="sysReplicationAlertsCheckSql2005" Description="This checks for the existence of table msdb.dbo.sysreplicationalerts." Key1="%CONNSTR%" Key2="SELECT [name] FROM msdb.sys.objects WHERE [name] = 'sysreplicationalerts' AND [schema_id] = USER_ID('dbo') AND [is_ms_shipped] = 1;" Key4="true" Display="Hide">
                        <Object Type="Cache" Name="SQL ServerCache" Key1="Add" Key2="sysReplicationAlertsExists" Key3="1"/>
                      </Object>
                    </Object>
                    <!--If the cache has the key 'sysReplicationAlertsExists', then evaluate the rule-->
                    <Object Type="Cache" Name="SQL ServerCache" Key1="Dump" Key2="sysReplicationAlertsExists">
                      <!--  Check the table to find out if there is a matching alert registered in it
                      CSS_REPL_TRAN_LATENCY_06 - Replication Timeout Alert-->
                      <Object Type="SQL" Name="sysReplicationAlertsTimeoutCheckSql" Description="This check determines whether the sysreplication alerts has any entries that match the warning condition." LogText="Processing Replication Timeout Alert" Key1="%CONNSTR%" Key2="SELECT [agent_type], [agent_id], [time], [publisher], [publication], [subscriber], [destination_object], [alert_error_text] FROM msdb.dbo.sysreplicationalerts WHERE [alert_error_code] = 14152 AND [agent_type] IN (1,2,3) AND (DATEDIFF(DAY, [time], GETDATE()) &lt; 3 ) AND [alert_error_text] LIKE '%timeout expired%';" Key4="true" Display="Hide" RuleId="RID3025" Requirement="NonSAP" GroupingClass="True" Class="%SRVNAME%_ReplicationTimeoutAlert">
                        <Setting Key1="agent_type">
                          <Rule Name="agent_type" Query="$."/>
                        </Setting>
                        <Setting Key1="agent_id">
                          <Rule Name="agent_id" Query="$."/>
                        </Setting>
                        <Setting Key1="time">
                          <Rule Name="alertTime" Query="$."/>
                        </Setting>
                        <Setting Key1="publisher">
                          <Rule Name="publisher" Query="$."/>
                        </Setting>
                        <Setting Key1="publication">
                          <Rule Name="publication" Query="$."/>
                        </Setting>
                        <Setting Key1="subscriber">
                          <Rule Name="subscriber" Query="$."/>
                        </Setting>
                        <Setting Key1="destination_object">
                          <Rule Name="destination_object" Query="$."/>
                        </Setting>
                        <Setting Key1="alert_error_text">
                          <Rule Name="alertErrorText" Query="$."/>
                          <Rule Name="ReplicationTimeoutSqlRule" GUID="61184cca-d619-4d07-84cc-9814f68aafa4" Error="Warning" Text="SQL Server [{0}] has a replication alert. Agent ID:{1} Agent Type:{2} Publisher:{3} Publication:{4} Subscriber:{5} Destination Object:{6} Time:{7} Alert Text:{8}" Title="Replication Timeout Alert On Server [{0}]" S0= "%SRVNAME%" P1="$agent_id" P2= "$agent_type" P3 ="$publisher" P4 ="$publication" P5 ="$subscriber" P6 ="$destination_object" P7="$alertTime" P8="$alertErrorText"/>
                        </Setting>
                      </Object>
                      <!-- Check the table to find out if there is a matching alert registered in it
                      CSS_REPL_TRAN_OUTOFSYNC_01 - Replication Pub and Sub are out of sync-->
                      <Object Type="SQL" Name="sysReplicationPubSub" Description="This check determines whether the sysreplication alerts has any entries that match the warning condition." LogText="Processing Replication Pub and Sub out of synch (SQLBPA)" Key1="%CONNSTR%" Key2="SELECT * FROM msdb.dbo.sysreplicationalerts WHERE [alert_error_code] = 20574 AND [agent_type] = 3;" Key4="true" Display="Hide" RuleId="RID3035" Requirement="NonSAP" GroupingClass="True" Class="%SRVNAME%_PubSubOutOfSync">
                        <Setting Key1="agent_type">
                          <Rule Name="agent_type_pubSub" Query="$."/>
                        </Setting>
                        <Setting Key1="agent_id">
                          <Rule Name="agent_id_pubSub" Query="$."/>
                        </Setting>
                        <Setting Key1="time">
                          <Rule Name="alertTime_pubSub" Query="$."/>
                        </Setting>
                        <Setting Key1="publisher">
                          <Rule Name="publisher_pubSub" Query="$."/>
                        </Setting>
                        <Setting Key1="publication">
                          <Rule Name="publication_pubSub" Query="$."/>
                        </Setting>
                        <Setting Key1="subscriber">
                          <Rule Name="subscriber_pubSub" Query="$."/>
                        </Setting>
                        <Setting Key1="destination_object">
                          <Rule Name="destination_object_pubSub" Query="$."/>
                        </Setting>
                        <Setting Key1="alert_error_text">
                          <Rule Name="alertErrorText_pubSub" Query="$."/>
                          <Rule Name="ReplicationPubSubSyncRule35" GUID="952486b7-f71f-4ac1-98fa-8885f03809c9" Error="Warning" Text="SQL Server [{0}] has a replication alert. Agent ID:{1} Agent Type:{2} Publisher:{3} Publication:{4} Subscriber:{5} Destination Object:{6} Time:{7} Alert Text:{8}" Title="Replication Publisher and Subscriber Out Of Sync On Server [{0}]"  S0= "%SRVNAME%" P1="$agent_id_pubSub" P2= "$agent_type_pubSub" P3 ="$publisher_pubSub" P4 ="$publication_pubSub" P5 ="$subscriber_pubSub" P6 ="$destination_object_pubSub" P7="$alertTime_pubSub" P8="$alertErrorText_pubSub" />
                        </Setting>
                      </Object>
                      <!-- Check the table to find out if there is a matching alert registered in it
                     CSS_REPL_TRAN_OUTOFSYNC_02 - Replication Pub and Sub are out of sync(Constraint Violation) -->
                      <Object Type="SQL" Name="sysReplicationPubSub" Description="This check determines whether the sysreplication alerts has any entries that match the warning condition." LogText="Processing Replication Pub and Sub out of synch (Constraint Violation)" Key1="%CONNSTR%" Key2="SELECT * FROM msdb.dbo.sysreplicationalerts WHERE [agent_type] = 3 AND [alert_error_code] = 14151 AND [alert_error_text] LIKE '%constraint%' and [alert_error_text] LIKE '%violation%';" Key4="true" Display="Hide" RuleId="RID3038" Requirement="NonSAP" GroupingClass="True" Class="%SRVNAME%_PubSubOutOfSync_ConstraintViolation">
                        <Setting Key1="agent_type">
                          <Rule Name="agent_type_constraintViolation" Query="$."/>
                        </Setting>
                        <Setting Key1="agent_id">
                          <Rule Name="agent_id_constraintViolation" Query="$."/>
                        </Setting>
                        <Setting Key1="time">
                          <Rule Name="alertTime_constraintViolation" Query="$."/>
                        </Setting>
                        <Setting Key1="publisher">
                          <Rule Name="publisher_constraintViolation" Query="$."/>
                        </Setting>
                        <Setting Key1="publication">
                          <Rule Name="publication_constraintViolation" Query="$."/>
                        </Setting>
                        <Setting Key1="subscriber">
                          <Rule Name="subscriber_constraintViolation" Query="$."/>
                        </Setting>
                        <Setting Key1="destination_object">
                          <Rule Name="destination_object_constraintViolation" Query="$."/>
                        </Setting>
                        <Setting Key1="alert_error_text">
                          <Rule Name="alertErrorText_constraintViolation" Query="$."/>
                          <Rule Name="ReplicationPubSubSyncRule38" GUID="c86e262e-34a7-4914-b79f-bf8b66a9b77f" Error="Warning" Text="SQL Server [{0}] has a replication alert.  Agent ID:{1} Agent Type:{2} Publisher:{3} Publication:{4} Subscriber:{5} Destination Object:{6} Time:{7} Alert Text:{8}" Title="Replication Publisher and Subscriber Out Of Sync On Server [{0}] (Constraint Violation)" S0= "%SRVNAME%" P1="$agent_id_constraintViolation" P2= "$agent_type_constraintViolation" P3 ="$publisher_constraintViolation" P4 ="$publication_constraintViolation" P5 ="$subscriber_constraintViolation" P6 ="$destination_object_constraintViolation" P7="$alertTime_constraintViolation" P8="$alertErrorText_constraintViolation" />
                        </Setting>
                      </Object>
                      <!--End of If the cache has the key 'sysReplicationAlertsExists', then evaluate the rule-->
                    </Object>
                    <Object Type="SQL" Key1="%CONNSTR%" Key2="exec sp_helpdistributiondb" Key4="true" Name="Pub Sub out of sync(Skipped Transactions)" Description="This check finds the skipped transactions and alerts customer that pub and sub are out of sync." LogText="Processing Pub Sub out of sync(Skipped Transactions)" RuleId="RID3039" Requirement="NonSAP">
                      <Setting Key1="name" Substitution="DBName"/>
                      <Object Type="If" Key1="'%DBName%'='distribution'">
                        <Object GroupingClass="True" Class="%SRVNAME%_PubSubOutOfSync_SkippedTransactions" Type="SQL" Key1="%CONNSTR%" Key2="SELECT * FROM distribution.dbo.MSdistribution_history WHERE [comments] LIKE '%skipped%' AND [comments] LIKE '%applying transactions%';" Key4="true">
                          <Setting Key1="agent_id">
                            <Rule Name="agent_id39"  Query="$." />
                          </Setting>
                          <Setting Key1="runstatus">
                            <Rule Name="runstatus"  Query="$." />
                          </Setting>
                          <Setting Key1="start_time">
                            <Rule Name="start_time"  Query="$." />
                          </Setting>
                          <Setting Key1="time">
                            <Rule Name="time"  Query="$." />
                          </Setting>
                          <Setting Key1="duration">
                            <Rule Name="duration"  Query="$." />
                          </Setting>
                          <Setting Key1="comments">
                            <Rule Name="comments"  Query="$." />
                            <Rule Name="skippedTransactionsRule" GUID="6658e317-e360-4c80-80c1-612987e14b42" Error="Warning" Title="Replication Publisher and Subscriber Out Of Sync On Server [{0}] (Skipped Transactions)" Text="SQL Server [{0}] has a replication alert(Skipped Transactions). Agent ID:{1} Run Status: {2} Start Time:{3} Time:{4} Duration:{5} Comments:{6}. For further information check the distribution.dbo.MSdistribution_history" S0="%SRVNAME%" P1="$agent_id39" P2="$runstatus" P3="$start_time" P4="$time" P5="$duration" P6="$comments">
                            </Rule>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>

                    <!--End of Group, Sysreplicationalerts based Replication Checks-->
                  </Object>

                  <!-- 
                  RuleId: RID3041
                 
                  Rule Name: Blocked process threshold < 5
                 
                  Applies To: SQL 2005
                  
                  Logic:
                   Checks 'blocked process threshold' setting from sys.configurations
                  
                  Inputs:
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The target sql server 2005 instance
                    %Sql2005Check% - The check for SQL 2005

                  Rules:
                    cBlockedProcessThresholdLessThanFive - Evaluates to true if Blocked Process Threshold option is less than 5.
                -->
                  <Object Type="If" Name="VersionTest" Key1="%Sql2005Check%" LogText="Processing Blocked Process Threshold Check" Display="Hide" RuleId="RID3041" Requirement="SAP">
                    <!--Get the Blocked Process Threshold-->
                    <Object GroupingClass="True" Class="%SRVNAME%" Type="SQL" Key1="%CONNSTR%" Key2="SELECT [value_in_use] FROM sys.configurations WHERE [name] = N'blocked process threshold';" Key4="true">
                      <Setting Key1="value_in_use">
                        <Rule Name="cBlockedProcessThresholdLessThanFive" GUID="71db8ef6-341b-4465-99db-5c63e48d4c7d" Query="$. &lt; 5 and $. != 0" Error="Warning" Sev="2" Title="Increase Blocked Process Threshold On Server [{0}]" Text="Server [{0}] has 'blocked process threshold' set to [{1}]. The blocked process threshold should never be lower than the value of 5 since it can cause lock monitor to constantly run. This should only be done under troubleshooting needs and never long term or in production without CSS assistance." S0="%SRVNAME%" P1="$."/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3042
                 
                 Rule Name: Replication Latency Threshold violations
                 
                 Applies To: SQL 2005
                 
                 Logic:
                   Checks if distribution database is available. If yes, checks for latency threshold violations
                   
                 Inputs:
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The target sql server 2005 instance
                    %Sql2005Check% - The check for SQL 2005
                 
                 Rules:
                    $pubThresholdViolated - Evaluates to true if publication exceeds the latency threshold configured for it. 
                    $subThresholdViolated - Evaluates to true if subscriber exceeds the latency threshold configured for it.
                 -->
                  <Object Type="If" Name="VersionTest" Key1="%Sql2005Check%" LogText="Processing Replication Latency Threshold Violations Check" Display="Hide" RuleId="RID3042" Requirement="NonSAP" GroupingClass="True" Class="%SRVNAME%">
                    <Object Type="Group" Name="Replication Latency Threshold violations" LogText="Processing Replication Latency Threshold Violation Rule">
                      <Object Type="SQL" Key1="%CONNSTR%" Key2="exec sp_helpdistributiondb" Key4="true">
                        <Setting Key1="name" Substitution="DBName"/>
                        <Object Type="If" Key1="'%DBName%'='distribution'">
                          <Object Type="SQL" Key1="%CONNSTR%" Key2="USE [distribution];exec sp_replmonitorhelppublication @publisher = null, @refreshpolicy = 2" Key4="true"/>
                          <Object
                              Type="SQL" 
                              GroupingClass="True" 
                              Class="%SRVNAME%_pubThresholdViolated" 
                              Key1="%CONNSTR%"
                              Key2="USE [distribution];DECLARE @tmpHelpPublication  AS TABLE(
                              publisher_db sysname null,
                              publication sysname null,
                              publication_id int null,
                              publication_type int null,
                              status int null,
                              warning  int null,
                              worst_latency int null,
                              best_latency int null,
                              average_latency int null,
                              last_distsync datetime null,
                              retention int null,
                              latencythreshold int null,
                              expirationthreshold int null,
                              agentnotrunningthreshold int null,
                              subscriptioncount int null,
                              runningdistagentcount int null,
                              snapshot_agentname sysname null,
                              logreader_agentname sysname null,
                              qreader_agentname sysname null,
                              worst_runspeedPerf int null,
                              best_runspeedPerf int null,
                              average_runspeedPerf int null,
                              retention_period_unit int null
                              );
                              insert into @tmpHelpPublication exec('sp_replmonitorhelppublication @publisher = null');
                              select publication,latencythreshold from @tmpHelpPublication where (warning &amp; 2) = 1"
                            Key4="true">
                            <Setting Key1="publication">
                              <Rule Name="publication_replLatency" Query="$." />
                            </Setting>
                            <Setting Key1="latencythreshold">
                              <Rule Name="pubThresholdViolated" Error="Warning" Title="Publication Latency Exceeds Threshold On Server [{1}]" Text="Publication [{0}] on server [{1}] has exceeded the latency threshold [{2}] configured for this publication" P0="$publication_replLatency" S1="%SRVNAME%" P2="$." />
                            </Setting>
                          </Object>
                          <Object Type="SQL" Key1="%CONNSTR%" Key2="USE [distribution];exec sp_replmonitorhelpsubscription @publisher=null,@publication_type=0,@refreshpolicy=2;" Key4="true"/>
                          <Object
                            Type="SQL" 
                            GroupingClass="True" 
                            Class="%SRVNAME%_subThresholdViolated" 
                            Key1="%CONNSTR%"
                            Key2="USE [distribution];DECLARE @temp_subscription_results AS TABLE
                                  (
                                   status int
                                  ,warning int
                                  ,subscriber sysname null
                                  ,subscriber_db sysname
                                  ,publisher_db sysname
                                  ,publication sysname
                                  ,publication_type int
                                  ,subtype int
                                  ,latency int
                                  ,latencythreshold int
                                  ,agentnotrunning int
                                  ,agentnotrunningthreshold int
                                  ,timetoexpiration int
                                  ,expirationthreshold int
                                  ,last_distsync datetime
                                  ,distribution_agentname sysname null
                                  ,mergeagentname sysname null
                                  ,mergesubscriptionfriendlyname sysname null
                                  ,mergeagentlocation sysname null
                                  ,mergeconnectiontype int null
                                  ,mergePerformance int null
                                  ,mergerunspeed float null --latest running session
                                  ,mergerunduration int null --latest running session
                                  ,monitorranking int
                                  ,distributionagentjobid  binary(16) null
                                  ,mergeagentjobid binary(16) null
                                  ,distributionagentid int null
                                  ,distributionagentprofileid int null
                                  ,mergeagentid int null
                                  ,mergeagentprofileid int null
                                  ,logreaderagentname sysname null);
                                  
                                  insert into @temp_subscription_results
                                  exec sp_replmonitorhelpsubscription @publisher=null,@publication_type=0;

                                  select subscriber,publication,latencythreshold from @temp_subscription_results where (warning &amp; 2) = 1"
                            Key4="true">
                            <Setting Key1="publication">
                              <Rule Name="publication_sub" Query="$." />
                            </Setting>
                            <Setting Key1="subscriber">
                              <Rule Name="subscriber_sub" Query="$." />
                            </Setting>
                            <Setting Key1="latencythreshold">
                              <Rule Name="subThresholdViolated" GUID="3f68cdbd-6821-4eaf-b158-3e6cbcfc080d" Error="Warning" Title="subscription Latency Exceeds Threshold On Server [{3}]" Text="Subscriber '{0}' on publication '{1}' has exceeded the latency threshold {2} configured for this publication" P0="$subscriber_sub" P1="$publication_sub" P2="$." S3="%SRVNAME%"/>
                            </Setting>
                          </Object>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3044
                 
                 Rule Name: Network Packet Size Can Cause MemToLeave Pressure
                 
                 Applies To: SQL 2000, SQL 2005
                 
                 Inputs:
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The target sql server instance
                 
                 Rules:
                    cNetworkPacketSizeCanCauseMemToLeavePressure - Evaluates to true if Network Packet Size > 8060.
                -->
                  <Object Type="Group" Name="Network Packet Size Can Cause MemToLeave Pressure" LogText="Processing Network Packet Size Check" RuleId="RID3044" Requirement="NonSAP">
                    <!--Get the Blocked Process Threshold-->
                    <Object GroupingClass="True" Class="%SRVNAME%" Type="SQL" Key1="%CONNSTR%" Key2="SELECT [value] FROM master.dbo.sysconfigures WHERE [config] = 505;" Key4="true">
                      <Setting Key1="value">
                        <Rule Name="cNetworkPacketSizeCanCauseMemToLeavePressure" GUID="86db5da1-afe4-4fbb-8bf8-33cedc7e4361" Query="$. > 8060" Error="Warning" Sev="2" Title="Network Packet Size Should Not Exceed 8060 Bytes On Server [{0}]" Text="Server [{0}] has 'Network Packet Size' set to [{1}]. Packet size equal to or exceeding [8192] can cause MemToLeave pressure. We recommend that this value should be 8060 or less." S0="%SRVNAME%" P1="$."/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3045,RID3050
                 
                 Rule Name: SQL Server Log Related Checks
                 
                 Applies To: SQL 2000, SQL 2005
                 
                 Logic:
                   Uses WMI queries to retrieve log folder compression setting and size of current errorlog file
                 
                 Inputs:
                    %HOSTNAME% - Target machine name hosting the server instance
                    %SVRNAME%  -  The target sql server instance
                    'SQL Server Cache' with the value for 'SQLPath'
                 
                 Rules:
                    logFolderCompressed - Evaluates to true if the LOG folder is Compressed
                    errorLogSize - Evaluates to true if the size is above the threshold (5 MB).
                -->
                  <Object Type="Group" Name="SQL LOG Related Checks" LogText="Processing SQL Server Log Related Checks" RuleId="RID3045,RID3050">
                    <Object Type="Cache" Name="SQL Server Cache" Key1="Dump" Key2="SQLPath">
                      <!--We need to replace the '\' in the path with a '\\' to be valid for use in a WMI query -->
                      <Setting Key1="SQLPath" Substitution="SQLPathDisplay"/>
                      <Setting Key1="SQLPath" Substitution="SQLPath" SubstitutionFormat="\\----\\"/>
                      <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_Directory" Key4="Name='%SQLPath%\\LOG'" Display="Hide" RuleId="RID3045" Requirement="SAP" GroupingClass="True" Class="%SRVNAME%_LogCompressed">
                        <Setting Key1="Compressed">
                          <Rule Name="logFolderCompressed" Query="$. = 'True'" GUID="644afab4-beab-426d-bd3f-ba1272ab7ecc" Text="The LOG folder ({0}) of the the instance [{1}] is compressed. We recommend against it for better performance." Title="Place Log Files on an Uncompressed Drive For Server [{1}]" Error="Warning" S0="%SQLPathDisplay%\LOG" S1="%SRVNAME%"/>
                        </Setting>
                      </Object>
                      <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="CIM_DataFile" Key4="Name='%SQLPath%\\LOG\\Errorlog'" Display="Hide" RuleId="RID3050" Requirement="NonSAP" GroupingClass="True" Class="%SRVNAME%_LogFilesize">
                        <Setting Key1="FileSize">
                          <Rule Name="errorLogSize" Query="$. > 5242880" GUID="3f3e8db5-7e38-4fe7-bb15-bf0db004ded0" Text="The error log file ({0}) of the instance [{1}] is too big({2} MB) . We recommend the logs to be cycled periodically and increasing the number of logs(if you wish to retain a longer history)." Title="SQL Error Log Too Big For Server [{1}]" Error="Warning" S0="%SQLPathDisplay%\LOG\Errorlog" S1="%SRVNAME%" P2="$. div 1048576"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3026
                 
                 Rule Name: MAXDOP Not Optimized
                 
                 Applies To: SQL 2000, SQL 2005
                 Inputs:
                    %CONNSTR% - The connection string to use
                    %SVRNAME%  -  The target sql server instance
                 
                 Rules:
                    cMAXDOPNotOptimized - Evaluates to true if the MAX DEGREE OF PARALLELISM is greater than 8.
                -->
                  <Object Type="Group" Name="MAXDOP Not Optimized" LogText="Processing MAX DEGREE OF PARALLELISM Check" RuleId="RID3026" Requirement="ModifiedSAP">
                    <!--Get the MAXDOP-->
                    <Object GroupingClass="True" Class="%SRVNAME%" Type="SQL" Key1="%CONNSTR%" Key2="SELECT [value] FROM master.dbo.syscurconfigs WHERE [config]= 1539;" Key4="true" Display="Hide">
                      <Setting Key1="value">
                        <Rule 
                          Name="cMAXDOPNotOptimized" 
                          GUID="ec908006-67ae-4674-9a61-25ea741d6197" 
                          Query="$. &gt; 8"
                          Error="BestPractice"
                          Sev="2"
                          Title="Set Max Degree of Parallelism Option for Optimal Performance On Server [{0}]"
                          Text="Server [{0}] has Maximum Degree of Parallelism as [{1}]. We recommend that this value should not go beyond 8."
                          S0="%SRVNAME%"
                          P1="$."/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3031
                 
                 Rule Name: Open Objects Configuration Not Dynamic
                 
                 Applies To: SQL 2000
                 
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The target sql server 2000 instance
                    
                 Rules:
                    cOpenObjectsNotDynamic - Evaluates to true if the 'Open Objects' configuration is not set to 0.
                -->
                  <Object Type="If" Name="VersionTest" Key1="%Sql2000Check%" LogText="Processing Open Objects Configuration Rule" Display="Hide" RuleId="RID3031" Requirement="SAP">
                    <!--Get the Open Objects Configuration-->
                    <Object
                      Type="SQL" 
                      GroupingClass="True" 
                      Class="%SRVNAME%"
                      Key1="%CONNSTR%"
                      Key2="SELECT [value],[config],[comment],[status] FROM master.dbo.sysconfigures WHERE [config] = 107;"
                      Key4="true"
                      Display="Hide">
                      <Setting Key1="value">
                        <Rule 
                          Name="cOpenObjectsNotDynamic" 
                          GUID="4141ff3b-c93c-4460-bcf7-ee815984a1d7" 
                          Query="$. != 0"
                          Error="BestPractice"
                          Sev="2"
                          Title="Set Open Objects Option to Zero On Server [{0}]"
                          Text="Server [{0}] has 'open objects' configuration set to [{1}]. We recommend setting it to '0' that allows SQL Server to dynamically increase or decrease the total number of objects that can be open at the same time in order to obtain the best overall performance of the server."
                          S0="%SRVNAME%"
                          P1="$."/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3032
                 
                 Rule Name: Locks Configuration Not Dynamic
                 
                 Applies To: SQL 2000, SQL 2005
                 
                 Inputs:
                    %CONNSTR% - The connection string to use.
                    %SRVNAME% - The target sql server instance.
                 
                 Rules:
                    cLocksNotDynamic - Evaluates to true if the 'Locks' configuration is not set to 0.
                -->
                  <Object Type="Group" Name="Locks Configuration Not Dynamic" LogText="Processing Locks Configuration Rule" RuleId="RID3032" Requirement="SAP">
                    <!--Get the Locks Configuration-->
                    <Object
                      Type="SQL" 
                      GroupingClass="True" 
                      Class="%SRVNAME%"
                      Key1="%CONNSTR%"
                      Key2="SELECT [value],[config],[comment],[status] FROM master.dbo.sysconfigures WHERE [config] = 106;"
                      Key4="true"
                      Display="Hide">
                      <Setting Key1="value">
                        <Rule 
                          Name="cLocksNotDynamic" 
                          GUID="f214f05b-5f0b-4786-b2ad-b8b4b6e58d72" 
                          Query="$. != 0"
                          Error="BestPractice"
                          Sev="3"
                          Title="Locks Configuration Not Dynamic On Server [{0}]"
                          Text="Server [{0}] has 'locks' configuration set to [{1}]. We recommend that this value should be set to '0'. This allows the Database Engine to allocate and deallocate lock structures dynamically, based on changing system requirements."
                          S0="%SRVNAME%"
                          P1="$."/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3033
                 
                 Rule Name: Default Trace Log Files Disabled
                 
                 Applies To: SQL 2005
                 
                 Inputs:
                    %Sql2005Check% - Check for SQL 2005
                    %CONNSTR% - The connection string to use.
                    %SRVNAME% - The target sql server 2005 instance.
                 
                 Rules:
                    cDefaultTraceLogFilesDisabled - Evaluates to true if the 'default trace enabled' configuration is set to 0.
                -->
                  <Object Type="If" Name="VersionTest" Key1="%Sql2005Check%" LogText="Processing Default Trace Log Files Check" Display="Hide" RuleId="RID3033" Requirement="SAP">
                    <!--Get the 'default trace enabled' Configuration-->
                    <Object
                      Type="SQL" 
                      GroupingClass="True" 
                      Class="%SRVNAME%"
                      Key1="%CONNSTR%"
                      Key2="SELECT [value],[value_in_use],[name],[description] FROM sys.configurations WHERE [name] = N'default trace enabled';"
                      Key4="true"
                      Display="Hide">
                      <Setting Key1="value_in_use">
                        <Rule 
                          Name="cDefaultTraceLogFilesDisabled" 
                          GUID="c27761e6-75ed-4ee4-a236-0cbc42e500a1" 
                          Query="$. = 0"
                          Error="Warning"
                          Sev="2"
                          Title="Default Trace Log Files Disabled On Server [{0}]"
                          Text="Server [{0}] has 'default trace enabled' configuration set to [{1}]. The default trace functionality provides a rich, persistent log of activity and changes primarily related to the configuration options and we recommend that this value should be set to '1'."
                          S0="%SRVNAME%"
                          P1="$."/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3034
                 
                 Rule Name: Affinity Mask And Affinity IO Mask Overlap
                                  
                 Applies To: SQL 2005
                 
                 Inputs:
                    %Sql2005Check% - Check for SQL 2005
                    %CONNSTR% - The connection string to use.
                    %SRVNAME% - The target sql server 2005 instance.
                 Outputs:
                 Rules:
                    cAffinityMaskAndAffinityIOMaskOverlap - Evaluates to true if any of the bits in affinity mask and affinity I/O mask overlap.
                -->
                  <Object Type="If" Name="VersionTest" Key1="%Sql2005Check%" LogText="Processing Affinity Mask And Affinity I/O Mask Overlap Check" Display="Hide" RuleId="RID3034" Requirement="SAP">
                    <!--Get the affinity mask, affinity I/O mask and their overlapping status-->
                    <Object
                      Type="SQL" 
                      GroupingClass="True" 
                      Class="%SRVNAME%"
                      Key1="%CONNSTR%"
                      Key2="SELECT a.[value] AS [affinity_mask], b.[value] AS [affinity_io_mask], CASE CAST(a.[value] AS int) &amp; cast(b.[value] AS int) WHEN 0 THEN 0 ELSE 1 END AS [isoverlapping] FROM sys.configurations a,sys.configurations b WHERE a.[name]=N'affinity mask' AND b.[name]=N'affinity I/O mask';"
                      Key4="true">
                      <Setting Key1="affinity_mask">
                        <Rule Name="iAffinityMask" Query="$."/>
                      </Setting>
                      <Setting Key1="affinity_io_mask">
                        <Rule Name="iAffinityIOMask" Query="$."/>
                      </Setting>
                      <Setting Key1="isoverlapping">
                        <Rule 
                          Name="cAffinityMaskAndAffinityIOMaskOverlap" 
                          GUID="1a0da6df-57ff-4f3f-aae9-2fbc4897508c" 
                          Query="$. = 1"
                          Error="Warning"
                          Sev="2"
                          Title="Correct Affinity Mask And Affinity IO Mask Overlap On Server [{0}]"
                          Text="Server [{0}] has 'affinity mask' set to [{1}] and 'affinity I/O mask' set to [{2}]. These values have overlapping bits and we do not recommend enabling the same CPU in both the affinity I/O mask switch and the affinity mask option."
                          S0="%SRVNAME%"
                          P1="$iAffinityMask"
                          P2="$iAffinityIOMask"/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3027
                 
                 Rule Name: Linked Server On IA64 Not Patched
                 
                 Applies To: SQL 2000
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %CONNSTR% - The connection string to use.
                 Outputs:
                 Rules:
                    cBUG277_LinkedServerOnIA64NotPatched - Evaluates to true if the sql server version is IA64, 
                    linked servers are configured and version is earlier than 8.00.2180.
                -->
                  <Object Type="If" Name="VersionTest" Key1="%Sql2000Check%">
                    <Object Type="Group" Name="Linked Server On IA64 Not Patched" LogText="Processing Linked Server Rule" Display="Hide" RuleId="RID3027" Requirement="NonSAP">
                      <!--Get the Version and Platform information.-->
                      <!--See if the processor is IA64-->
                      <Setting Key1="%PLATFORMINFO%">
                        <Rule Name="iIsIA64" Query="contains(upper-case('%PLATFORMINFO%'),'IA64')"/>
                      </Setting>
                      <!--Get the Linked Servers count.-->
                      <Object
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%"
                        Key2="CREATE TABLE #LinkedServer(SRV_NAME nvarchar(128),SRV_PROVIDERNAME nvarchar(128),SRV_PRODUCT nvarchar(128),SRV_DATASOURCE nvarchar(2048),SRV_PROVIDERSTRING nvarchar(2048),SRV_LOCATION nvarchar(2048),SRV_CAT nvarchar(128));INSERT #LinkedServer EXEC master.dbo.sp_linkedservers;SELECT COUNT(1) AS [LinkedServerCount] FROM #LinkedServer;DROP TABLE #LinkedServer;"
                        Key4="true"
                        Display="Hide">
                        <!--Get the linked server count.-->
                        <Setting Key1="LinkedServerCount">
                          <Rule 
                              Name="cBUG277_LinkedServerOnIA64NotPatched" 
                              GUID="f9d919f0-35e6-4f11-9190-2e680c667ecd" 
                              Query="$iIsIA64 and ($. > 0) and (%SQLBuild% &lt; 2180)"
                              Error="Warning"
                              Sev="2"
                              Title="Apply Software Update to IA64-based Server [{0}]"
                              Text="Server [{0}] (version [{1}]) is using an Itanium 64-bit version of SQL Server with linked servers configured. We recommend that this server be upgraded to build 8.00.2180. Refer KB-913684 for more details."
                              S0="%SRVNAME%"
                              P1="'%SQLProductVersion%'"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!-- Common Red Flag Errors related to SQL data integrity 
                   RuleId: RID3017
                   Applies To: SQL 2000, SQL 2005
                   
                   Checks if the event log has any of the following:
                      1. EventId - 9 : I/O time-out has occurred within the storage system, 
                                       as detected from the driver for the controller.
                                       (http://support.microsoft.com/?id=259237)  
                                       (http://support.microsoft.com/?id=154690)
                      
                      2. EventId - 11: More serious error than an I/O time-out. 
                                       This error could be a result of a bad or corrupted device driver, 
                                       a hardware problem, a malfunctioning device, poor cabling, or 
                                       termination issues. This is an error occurring within the driver 
                                       or hardware itself, not the cluster software. 
                                       (http://support.microsoft.com/?id=259237)
                                       (http://support.microsoft.com/?id=154690)
                      
                      3. EventId - 15: Event ID 15 indicates that the device is not ready. 
                                       This can be the result of SCSI host adapter configuration issues 
                                       or other problems. 
                                       (http://support.microsoft.com/?id=259237)
                                       (http://support.microsoft.com/?id=154690)
                      
                      4. EventId - 51: Disk related: I/O Error during hard page fault
                                       (http://support.microsoft.com/?id=304415)
                                       (http://support.microsoft.com/?id=305547)
                   
                      5. EventId-1066: This can be the result of SCSI host adapter 
                                       configuration issues or a malfunctioning device.
                                       (http://support.microsoft.com/?id=311081)
                                       
                      6. EventId - 55: When the Windows 2000 Disk Defragmenter tool cannot 
                                       move a particular data element, the move is stopped, 
                                       an error is logged in the system Event log, and Chkdsk.exe is scheduled. 
                                       There is no loss of data, and in this particular condition, 
                                       the integrity of the data is alright. The errors are a FALSE POSITIVE 
                                       FOR DATA CORRUPTION. 
                                       (http://support.microsoft.com/?id=320866)
                                       
                      7. EventId - 50: Indicates a failed I/O request.  Could be anything from a firmware bug 
                                       to faulty SCSI cables.
                                       (http://support.microsoft.com/?id=311081)
                                       
                   Inputs:
                      %CONNSTR% - The connection string to use
                      %SRVNAME% - The name of the SQL Server Instance 
                      %SQLProductVersion% - The Product Version of SQL Server.
                   Rules:
                      $dbRecoveryModel2000 - Checks if the sql server is standard/enterprise 
                                             edition and if any database is in SIMPLE recovery 
                                             model and a not readonly database (SQL2000).
                      $dbRecoveryModel2005 - Checks if the sql server is standard/enterprise 
                                             edition and if any database is in SIMPLE recovery 
                                             model and a not readonly database (SQL2005).
                -->
                  <Object Type="Group" Name="CommonRedFlagErrors" RuleId="RID3017" LogText="Processing Common Red Flag Errors Rule" Level="Detailed" Requirement="SAP" GroupingClass="True" Class="%HOSTNAME%">

                    <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="EventCode=9 and Logfile='System'" Display="Hide" GroupingClass="True" Class="%HOSTNAME%_9">
                      <Setting Key1="TimeGenerated">
                        <Rule Name="ioTimeOutEventId9" Query="$."/>
                      </Setting>
                      <Rule Name="pioTimeOutEventId9" Error="Warning" GUID="32c1f147-be9d-4541-9e3d-0a045da6f7f8" Query="count($_/../Instance) &gt; 0" Title="Resolve Serious Errors In Event Log For Server [{0}] On Host [{1}]" Text="Machine [{1}] hosting SQL Server [{0}] has experienced I/O timeouts in the storage system." S0="%SRVNAME%" S1="%HOSTNAME%"/>
                    </Object>

                    <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="EventCode=11 and Logfile='System'" Display="Hide" GroupingClass="True" Class="%HOSTNAME%_11">
                      <Setting Key1="TimeGenerated">
                        <Rule Name="ioControllerErrorEventId11" Query="$."/>
                      </Setting>
                      <Rule Name="pioControllerErrorEventId11" Error="Warning" GUID="32c1f147-be9d-4541-9e3d-0a045da6f7f8" Query="count($_/../Instance) &gt; 0" Title="Resolve Serious Errors In Event Log For Server [{0}] On Host [{1}]" Text="Machine [{1}] hosting SQL Server [{0}] has experienced I/O controller errors in the past." S0="%SRVNAME%" S1="%HOSTNAME%"/>
                    </Object>

                    <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="EventCode=15 and Logfile='System'" Display="Hide" GroupingClass="True" Class="%HOSTNAME%_15">
                      <Setting Key1="TimeGenerated">
                        <Rule Name="ioDeviceNotReadyEventId15" Query="$."/>
                      </Setting>
                      <Rule Name="pioDeviceNotReadyEventId15" Error="Warning" GUID="32c1f147-be9d-4541-9e3d-0a045da6f7f8" Query="count($_/../Instance) &gt; 0" Title="Resolve Serious Errors In Event Log For Server [{0}] On Host [{1}]" Text="Machine [{1}] hosting SQL Server [{0}] has experienced I/O device errors in the past." S0="%SRVNAME%" S1="%HOSTNAME%"/>
                    </Object>

                    <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="EventCode=51 and Logfile='System'" Display="Hide" GroupingClass="True" Class="%HOSTNAME%_51">
                      <Setting Key1="TimeGenerated">
                        <Rule Name="ioErrorInPageFaultEventId51" Query="$."/>
                      </Setting>
                      <Rule Name="pioErrorInPageFaultEventId51" Error="Warning" GUID="32c1f147-be9d-4541-9e3d-0a045da6f7f8" Query="count($_/../Instance) &gt; 0" Title="Resolve Serious Errors In Event Log For Server [{0}] On Host [{1}]" Text="Machine [{1}] hosting SQL Server [{0}] has experienced I/O errors during page faults in the past." S0="%SRVNAME%" S1="%HOSTNAME%"/>
                    </Object>

                    <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="EventCode=1066 and Logfile='System'" Display="Hide" GroupingClass="True" Class="%HOSTNAME%_1066">
                      <Setting Key1="TimeGenerated">
                        <Rule Name="clusterDiskCorruptEventId1066" Query="$."/>
                      </Setting>
                      <Rule Name="pclusterDiskCorruptEventId1066" Error="Warning" GUID="32c1f147-be9d-4541-9e3d-0a045da6f7f8" Query="count($_/../Instance) &gt; 0" Title="Resolve Serious Errors In Event Log For Server [{0}] On Host [{1}]" Text="Machine [{1}] hosting SQL Server [{0}] has experienced corruption errors on cluster disks in the past." S0="%SRVNAME%" S1="%HOSTNAME%"/>
                    </Object>

                    <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="EventCode=55 and Logfile='System'" Display="Hide" GroupingClass="True" Class="%HOSTNAME%_55">
                      <Setting Key1="TimeGenerated">
                        <Rule Name="diskDefragFalseEventId55" Query="$."/>
                      </Setting>
                      <Rule Name="pdiskDefragFalseEventId55" Error="Warning" GUID="32c1f147-be9d-4541-9e3d-0a045da6f7f8" Query="count($_/../Instance) &gt; 0" Title="Resolve Serious Errors In Event Log For Server [{0}] On Host [{1}]" Text="Machine [{1}] hosting SQL Server [{0}] might have experienced corruption due to disk defragmentation in the past." S0="%SRVNAME%" S1="%HOSTNAME%"/>
                    </Object>

                    <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_NTLogEvent" Key4="EventCode=50 and Logfile='System'" Display="Hide" GroupingClass="True" Class="%HOSTNAME%_50">
                      <Setting Key1="TimeGenerated">
                        <Rule Name="failedIORequestEventId50" Query="$."/>
                      </Setting>
                      <Rule Name="pfailedIORequestEventId50" Error="Warning" GUID="32c1f147-be9d-4541-9e3d-0a045da6f7f8" Query="count($_/../Instance) &gt; 0" Title="Resolve Serious Errors In Event Log For Server [{0}] On Host [{1}]" Text="Machine [{1}] hosting SQL Server [{0}] has experienced failed I/O requests in the past." S0="%SRVNAME%" S1="%HOSTNAME%"/>
                    </Object>

                  </Object>

                  <!-- 
                 RuleId: RID3036
                 
                 Rule Name: Memory scribbler issue in SQL 2000 before SP4
                 
                 Applies To: SQL 2000
                 
                 Checks if the server has 26 or more shared drives and has 
                 service pack version < SP4 (8.00.2039). This qualifies that
                 the server is susceptible to memory scribbler issue.
                 
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %SQLBuild% - SQL build number
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The name of the SQL Server Instance 

                 Rules:
                    $memoryScribbler2000 - Checks if the SQL 2000 server is susceptible
                                           to memory scribbler issue.
                -->
                  <Object Type="If" Key1="%Sql2000Check%" Display="Hide">
                    <Object Type="Group" Name="SQL2000MemoryScribbler" LogText="Processing SQL 2000 Memory Scribbler Rule" RuleId="RID3036" Requirement="SAP" GroupingClass="True" Class="%SRVNAME%">

                      <Object Type="If" Key1="%SQLBuild% &gt; 2038">

                        <Object
                          Type="SQL" 
                          GroupingClass="True" 
                          Class="%SRVNAME%"
                          Key1="%CONNSTR%"
                          Key2="USE [master];
                              DECLARE @mount_points as INT
                              SET @mount_points =(select count(1) from fn_servershareddrives())
                              IF(@mount_points &gt;= 26)
                                BEGIN 
                                  select 1 as [HasMemoryScribblerIssue]
                                END"
                          Key4="true"
                          Display="Hide">

                          <Setting Key1="HasMemoryScribblerIssue" />

                          <Rule 
                            Name="memoryScribbler2000" 
                            GUID="9dbbd204-b0e4-427c-94da-a7ae8a8eb6e1"
                            Error="Warning"
                            Title="Memory Scribbler Issue in SQL Server 2000 Before SP4 On Server [{0}]"
                            Text="SQL 2000 server [{0}] (build [{1}]) is susceptible to memory scribbler problem."
                            S0="%SVRNAME%"
                            S1="%SQLBuild%"/>

                        </Object>

                      </Object>

                    </Object>

                  </Object>

                  <!-- 
                 RuleId: RID3037
                 
                 Rule Name: Max worker threads setting
                 
                 Applies To: SQL 2000, SQL 2005
                 
                 Checks for following max worker threads setting
                 X86 >= 255 and <=512,  
                 X64 >= 255 and <= 2000.
                 IA64 >= 255 and <= 2000.
                 
                 Inputs:
                    %CONNSTR% - The connection string to use
                    %Sql2000Check% - Check for SQL 2000
                    %Sql2005Check% - Check for SQL 2005
                    %SRVNAME% - The name of the SQL Server Instance 
                    %SQLProductVersion% - The Product Version of SQL Server.
                    
                 Rules:
                    $maxWorkerThreads86_2000 - Checks if the max worker threads setting is 
                                               configured correctly for SQL server 2000 with X86.
                    $maxWorkerThreads64_2000 - Checks if the max worker threads setting is 
                                               configured correctly for SQL server 2000 with X64
                                               or IA64.
                    $maxWorkerThreads_2005 - Checks if the max worker threads setting is 
                                               configured correctly for SQL server 2005.
                -->
                  <Object Type="Group" Name="MaxWorkerThreadsSetting" LogText="Processing Max Worker Threads Rule"  RuleId="RID3037" Requirement="ModifiedSAP">
                    <Object Type="If" Key1="%Sql2000Check%" Display="Hide">
                      <Object
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%"
                        Key2="USE [master];
                              SELECT
                                [value] as [config_value]
                              FROM
                                sysconfigures
                              WHERE
                                LOWER(comment) = LOWER('Maximum worker threads')"
                        Key4="true"
                        Display="Hide">
                        <Setting Key1="config_value" Substitution="MAX_THREADS">
                          <Rule 
                            Name="maxWorkerThreads86_2000"
                            GUID="2d94adfd-3ba1-493a-b29a-b436f9d583df" 
                            Query="('%PLATFORMNUM%'='86') and ('%MAX_THREADS%' &lt; 255 or '%MAX_THREADS%' &gt; 512)" 
                            Error="Warning"
                            Title="Verify Max Worker Threads Setting On Server [{0}]"
                            Text="Server [{0}] ({1}) has non optimal setting for max worker threads. It should be between 255 and 512"
                            S0="%SRVNAME%"
                            S1="%PLATFORMINFO%"/>
                          <Rule 
                            Name="maxWorkerThreads64_2000" 
                            GUID="2d94adfd-3ba1-493a-b29a-b436f9d583df" 
                            Query="('%PLATFORMNUM%'='64') and ('%MAX_THREADS%' &lt; 255 or '%MAX_THREADS%' &gt; 2000)"
                            Error="Warning"
                            Title="Verify Max Worker Threads Setting On Server [{0}]"
                            Text="Server [{0}] ({1}) has non optimal setting for max worker threads. It should be between 255 and 2000"
                            S0="%SRVNAME%"
                            S1="%PLATFORMINFO%"/>
                        </Setting>
                      </Object>
                    </Object>
                    <Object Type="If" Key1="%Sql2005Check%" Display="Hide">
                      <Object
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%"
                        Key2="USE [master];
                              SELECT
	                              [value] as [config_value]
                              FROM
	                              sys.configurations
                              WHERE
	                              LOWER([name]) = LOWER('max worker threads')"
                        Key4="true"
                        Display="Hide">
                        <Setting Key1="config_value">
                          <Rule 
                            Name="maxWorkerThreads_2005"                       
                            GUID="2d94adfd-3ba1-493a-b29a-b436f9d583df" 
                            Query="$. != 0" 
                            Error="Warning"
                            Title="Verify Max Worker Threads Setting On Server [{0}]"
                            Text="Server [{0}] ({1}) has non optimal setting for max worker threads. We recommend setting this value to 0."
                            S0="%SRVNAME%"
                            S1="%PLATFORMINFO%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!--
                 RuleId: RID3051
                 
                 Rule Name: 498 is a QFE fix.  The bug exists from SQL 2000 RTM Release to 2189.  
                 
                 Applies To: SQL 2000
                 
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %SQLBuild% - SQL build number
                    %SRVNAME% - The name of the SQL Server Instance 
                    
                 Rules:
                    $sqlRTMto2189Rule - Evaluates to true if build number lies between 194 and 2189
                -->
                  <Object Type="If" Key1="%Sql2000Check%" Display="Hide">
                    <Object Type="Group" Name="SQL 2000 version and multiprocessor check" LogText="Processing QFE(498) Fix Rule" RuleId="RID3051" Requirement="NonSAP">
                      <Object
                        Type="If"
                        Key1="%SQLBuild% &lt;=2189 and %SQLBuild% >= 194">
                        <Object 
                          Type="SQL" 
                          GroupingClass="True" 
                          Class="%SRVNAME%"
                          Key1="%CONNSTR%" 
                          Key2="master.dbo.xp_msver ProcessorCount"
                          Key4="true" 
                          Display="Hide">

                          <Setting Key1="Internal_Value">
                            <Rule
                              Name="sqlRTMto2189Rule"
                              GUID="fc8ae7ea-4d85-41b8-ac51-7137c2575e89" 
                              Query="$. > 1"
                              Title="SQL Server 2000 Version 194 to 2189 And Multi-Processor Issue On Server [{0}]"
                              Text="SQL Server 2000 (server [{0}], version [{1}]) with multiple schedulers is a known issue. We recommend setting ‘max degree of parallelism’ to 1 as a short term workaround. This issue has been resolved fixed in SQL Server 2000 Service Pack 3 hotfixes 8.00.1034 and above, SQL Server 2000 Service Pack 4 hotfixes 8.00.2189 and above."
                              S0="%SRVNAME%" 
                              S1="%SQLProductVersion%" 
                              Error="Warning">
                            </Rule>
                          </Setting>

                        </Object>

                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3059

                 Rule Name: Parallel Query Scribbler Bug

                 Applies To: SQL 2000
                 
                 Checks if the currently running SQL 2000 server instance has following specs.:
                    1. Multi-CPU/scheduler machine
                    2. MaxDOP != 1
                    3. version < 8.00.997
                 
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %CONNSTR% - The connection string to use
                    %SQLBuild% - SQL build number
                    %SRVNAME% - The name of the SQL Server Instance 

                 Rules:
                    $parallelMemScribbler2000 - Checks if the server instance is susceptible
                                                to 'Parallel Query Scribbler Bug - 469993'
                                                (SQL 2000)
                -->
                  <Object Type="If" Key1="%Sql2000Check%" Display="Hide">
                    <Object Type="Group" Name="ParallelMemoryScribblerBug" LogText="Processing SQL 2000 Parallel Query Scribbler Rule" RuleId="RID3059" Requirement="SAP">
                      <!--Multi-CPU machine?-->
                      <Object 
                          Type="SQL" 
                          Key1="%CONNSTR%" 
                          Key2="master.dbo.xp_msver ProcessorCount"
                          Key4="true" 
                          Display="Hide">
                        <Setting Key1="Internal_Value" Substitution="CPU_COUNT"/>
                        <Object Type="If" Key1="%CPU_COUNT% > 1">
                          <!--Product Version prior to 8.00.997-->
                          <Object Type="If" Key1="%SQLBuild% &lt; 997">
                            <Object
                              Type="SQL" 
                              GroupingClass="True" Class="%SRVNAME%"
                              Key1="%CONNSTR%"
                              Key2="USE [master];
                                    SELECT
                                      [value] as [config_value]
                                    FROM
                                      sysconfigures
                                    WHERE
                                      LOWER(comment) = LOWER('maximum degree of parallelism')"
                              Key4="true"
                              Display="Hide">
                              <Setting Key1="config_value">
                                <Rule 
                                  Name="parallelMemScribbler2000" 
                                  GUID="19c28f68-c0fe-4257-94a8-98cf45b36ff9" 
                                  Query="$. != 1"
                                  Error="Warning"
                                  Title="Upgrade SQL Server Version to Avoid Parallel Query Bug On Server [{0}]"
                                  Text="Server [{0}] is susceptible to a bug that can cause a query with parallel query plan to write beyond the bounds of an allocated buffer. We recommend using a SQL Server version 8.00.997 or higher, or upgrade to SP4."
                                  S0="%SRVNAME%"/>
                              </Setting>
                            </Object>
                          </Object>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3061
                 
                 Rule Name: W32.Slammer Vulnerability
                 
                 Applies To: SQL 2000
                 
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %SRVNAME% - SQL 2000 server instance.
                 
                 Rules:
                    cSlammerVulnerability - Evaluates to true if the build number of ssnetlib.dll is earlier than 8.00.679.
                -->
                  <Object Type="If" Name="VersionTest" Key1="%Sql2000Check%" Display="Hide">
                    <Object Type="Group" Name="W32.Slammer Vulnerability" LogText="Processing W32.Slammer Vulnerability Rule" RuleId="RID3061" Requirement="SAP">
                      <Object
                        Type="Cache"
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Name="SQL Server Cache"
                        Key1="Dump"
                        Key2="SQLPath">
                        <Setting Key1="SQLPath" Substitution="SQLPath"/>
                        <Object
                          Type="File"
                          Key1="%HOSTNAME%"
                          Key2="%SQLPath%\Binn\ssnetlib.dll">
                          <Setting Key1="Version" Substitution="SSNETLIBVERSION" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\.([0-9]+).*)?$----$3">
                            <Rule 
                              Name="cSlammerVulnerability"                       
                              GUID="8f21189d-0f9b-4397-9465-bcfebf71fd78" 
                              Query="%SSNETLIBVERSION% &lt; 679"
                              Error="Error"
                              Sev="1"
                              Title="W32.Slammer Vulnerability On Server [{0}]"
                              Text="Server [{0}] is vulnerable to W32.Slammer worm. We strongly recommend upgrading this server to SP3 and applying hotfix 8.00.1007. Refer Microsoft Technet article http://www.microsoft.com/technet/security/alerts/slammer.mspx."
                              S0="%SRVNAME%"/>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3080
                 
                 Rule Name: MaintenancePlanTasks dll issue
                 
                 Applies To: SQL 2005
                 
                 Inputs:
                    %Sql2000Check% - Check for SQL 2005
                    %SRVNAME% - SQL 2005 server instance.
                 
                 Rules:
                    pMaintenancePlanTasksDllIssue - Evaluates to true if the version of Microsoft.SqlServer.MaintenancePlanTasks.dll is 3042.
                -->
                  <Object Type="If" Name="VersionTest" Key1="%Sql2005Check%" Display="Hide">
                    <Object Type="Group" Name="MaintenancePlanTasks dll issue" LogText="Checking version of Microsoft.SqlServer.MaintenancePlanTasks.dll" RuleId="RID3080" Requirement="SAP,NonSAP">
                      <Object
                          Type="Registry"
                          Key1="%HOSTNAME%" 
                          Key2="HKEY_LOCAL_MACHINE"
                          Key3="SOFTWARE\Microsoft\Microsoft SQL Server\90\DTS\Setup"
                          Key5="Base"
                          Display="Hide">
                        <Setting Key1="SQLPath" Substitution="DllPath"/>
                        <Object
                          Type="File"
                          Key1="%HOSTNAME%"
                          Key2="%DllPath%\Tasks\Microsoft.SqlServer.MaintenancePlanTasks.dll">
                          <Setting Key1="Version" Substitution="MPTVERSION" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\.([0-9]+).*)?$----$3">
                            <Rule 
                              Name="pMaintenancePlanTasksDllIssue"                       
                              GUID="4fe418cf-454d-49eb-beb2-4d8d946e6c8c" 
                              Query="%MPTVERSION% = 3042"
                              Error="Error"
                              Sev="1"
                              Title="Microsoft SQL Server 2005 Service Pack 2 issue (KB933508) detected on Server [{0}]"
                              Text="Microsoft SQL Server 2005 Service Pack 2 issue detected on Server [{0}]: Cleanup tasks run at different intervals than intended."
                              S0="%SRVNAME%"/>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!--
                  RuleId: RID3081

                  Rule Name: Dell machine hardware corruption issue
                  
                  Applies To: Windows 2000, Windows Server 2003
                
                  Inputs:
                  %HOSTNAME% - The network name of the client hosting the SQL Server services.
                                                       
                  Rules:
                    $pDellMachineLSI_SASVersionIssue -  This rule is fired if 
                    1. Machine is Dell machine
                    2. Win2k or Win2k3 OS
                    3. System memory > 4GB
                    4. <Windows Directory >\SYSTEM32\DRIVERS\LSI_SAS.SYS. file has version < 1.21.26.01
                    5. Dell OpenManage Server Administrator Storage Management Software (OMSS) is running.

                -->
                  <Object Type="Group" Name="Dell hardware issue" LogText="Checking Dell hardware issue" RuleId="RID3081" Requirement="SAP,NonSAP">
                    <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_ComputerSystem" Display="Hide">
                      <Setting Key1="Manufacturer" Substitution ="MANUFACTURER" SubstitutionFormat="^(.+?)\ (.+?)(\..+)?$----$1"/>
                      <Setting Key1="TotalPhysicalMemory" Substitution ="TOTALPHYSICALMEMORY"/>
                      <Object Type="If" Name="Check for Dell machine and Physical memory" Key1="upper-case('%MANUFACTURER%')= 'DELL' and %TOTALPHYSICALMEMORY% &gt; 4294967296">
                        <!--Check For DSM SA Shared Service-->
                        <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_Service" Key4="Name = 'omsad'" Display="Hide">
                          <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\CIMV2" Key3="Win32_OperatingSystem" Display="Hide">
                            <Setting Key1="Version" Substitution="MAJOR" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\..+)?$----$1"/>
                            <Setting Key1="Version" Substitution="MINOR" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)(\..+)?$----$2"/>
                            <Setting Key1="SystemDirectory" Substitution="SYSTEMDIRECTORY"/>
                            <Object Type="If" Name="Check for Windows 2K\2K3" Key1="%MAJOR% = 5 and (%MINOR% = 0 or %MINOR% = 2)">
                              <Object Type="File" Key1="%HOSTNAME%" Key2="%SYSTEMDIRECTORY%\DRIVERS\LSI_SAS.SYS">
                                <Setting Key1="Version" Substitution="FV1" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)\.(.+?)(\..+)?$----$1"/>
                                <Setting Key1="Version" Substitution="FV2" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)\.(.+?)(\..+)?$----$2"/>
                                <Setting Key1="Version" Substitution="FV3" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)\.(.+?)(\..+)?$----$3"/>
                                <Setting Key1="Version" Substitution="FV4" SubstitutionFormat="^(.+?)\.(.+?)\.(.+?)\.(.+?)(\..+)?$----$4">
                                  <Rule 
                                  Name="pDellMachineLSI_SASVersionIssue" 
                                  Query="%FV1% = 1 or (%FV1% = 1 and %FV2% &lt; 21) or (%FV1% = 1  and %FV2% = 21 and %FV3% &lt; 26) or (%FV1% = 1  and %FV2% = 21 and %FV3% = 26 and %FV4% &lt; 1)" 
                                  Error="Warning"
                                  GUID=""
                                  Sev="2"
                                  Title="Dell machine hardware corruption issue on Server [{0}]"
                                  Text ="Dell machine [{0}] has LSI_SAS.SYS with fileversion less than 1.21.26.01. Contact Dell to get updated drivers for the SAS 5x Adapters.  View the readme for more information."
                                  P0="'%HOSTNAME%'"/>
                                </Setting>
                              </Object>
                            </Object>
                          </Object>
                        </Object>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3066
                 
                 Rule Name: SQL Server 2000 version - Bulk Insert Corruption(CSS_CORRUPTON_11)
                 
                 Applies To: SQL 2000
                 
                 Checks if 
                   SQL version < 8.00.2187 AND
                   SQL version > 8.00.2039 OR
                   SQL version > 8.00.1.14
                              
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %SQLBuild% - SQL build number
                    %SRVNAME% - The name of the SQL Server Instance 

                 Rules:
                    $sqlVersion2000BulkInsert - Checks if the server has version < 8.00.2187 AND
                                      SQL version > 8.00.2039 OR SQL version > 8.00.1.14
                -->
                  <Object Type="If" Key1="%Sql2000Check%" Display="Hide">
                    <Object Type="Group" Name="SQL2000VersionBulkInsertCorruption" LogText="Processing SQL 2000 Bulk Insert Corruption Rule" RuleId="RID3066" Requirement="NonSAP">
                      <Object Type="If" Key1="(%SQLBuild% &lt; 2187) and (%SQLBuild% &gt; 1013)" GroupingClass="True" Class="%SRVNAME%">
                        <Rule 
                          Name="sqlVersion2000BulkInsert"
                          GUID="443f6ee2-ced2-4d78-9ed6-1d3b7320f99c" 
                          Error="Warning"
                          Title="SQL 2000 Version Bulk Insert Corruption On Server [{0}]"
                          Text="Bulk inserts on server [{0}] can cause data corruption and destabilization of the server. We recommend upgrading to latest known good build (this issue is fixed in build 8.00.2187 or later)."
                          S0="%SRVNAME%"/>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3067
                 
                 Rule Name: SQL Server 2000 version - Automatic Checkpoints 
                 
                 Applies To: SQL 2000
                 
                 Checks if 
                   SQL version < 8.00.2171
                              
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %SQLBuild% - The Build of SQL Server.
                    %SRVNAME% - The name of the SQL Server Instance 

                 Rules:
                    $sqlVersion2000AutoCheckpoint - Checks if the server has version < 8.00.2171
                -->
                  <Object Type="If" Key1="%Sql2000Check%" Display="Hide">
                    <Object Type="Group" Name="SQL2000VersionAutoCheckpoints" LogText="Processing Automatic Checkpoints Rule" RuleId="RID3067" Requirement="NonSAP">
                      <Object Type="If" Key1="%SQLBuild% &lt; 2171" Display="Hide" GroupingClass="True" Class="%SRVNAME%">
                        <Rule 
                            Name="sqlVersion2000AutoCheckpoint"
                            GUID="4bad8e42-5188-49f8-bb7c-d8a83053fdcc" 
                            Error="Warning"
                            Title="SQL Server 2000 Version Automatic Checkpoints Issue On Server [{0}]"
                            Text="Automatic checkpoints on server [{0}] might have stopped running. We recommend upgrading to latest known good build (this issue is fixed in build 8.00.2187 or later)."
                            S0="%SRVNAME%"/>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3010

                 Rule Name: SQL Server 2005 - Security, elevation of privs issue
                
                 Applies To: SQL 2005
                 
                 Checks if 
                   SQL Build < 1518 
                              
                 Inputs:
                    %Sql2005Check% - Check for SQL 2005
                    %SRVNAME% - The name of the SQL Server Instance 
                    %SQLBuild% - The Build of SQL Server.

                 Rules:
                    $sqlVersion2005Build1518 - Checks if the server has version < 9.00.1518.00
                -->
                  <Object Type="If" Key1="%Sql2005Check%" Display="Hide">
                    <Object Type="Group" Name="SQL2005VersionBuild1518Check" LogText="Processing Elevation Of Privileges Rule" RuleId="RID3010" Requirement="ModifiedSAP">
                      <Object Type="If" Name="Build1518Check" Key1="%SQLBuild% &lt; 1518" Display="Hide" GroupingClass="True" Class="%SRVNAME%">
                        <Setting Key1="RuleNode">
                          <Rule 
                              Name="sqlVersion2005Build1518"
                              Error="Warning"
                              GUID="43eacf36-c51d-4afc-a7b2-cd4be24173e0" 
                              Title="Elevation of Privileges Issue On Server [{0}]"
                              Text="Version of server [{0}] is {1}. We recommend upgrading this server to build 9.00.1518.00 or later."
                              S0="%SRVNAME%"
                              S1="%SQLProductVersion%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3011
                 
                 Rule Name: SQL Server 2000 - Build 2039 check
                 
                 Applies To: SQL 2000
                 
                 Checks if 
                   SQL version = 8.00.2039
                              
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %SQLBuild% - The Build of SQL Server.
                    %SRVNAME% - The name of the SQL Server Instance 
                    
                 Rules:
                    $sqlVersion2000Build2039 - Checks if the server has version = 8.00.2039
                -->
                  <Object Type="If" Key1="%Sql2000Check%" Display="Hide">
                    <Object Type="Group" Name="SQL2000VersionBuild2039Check" LogText="Processing Build 2039 Check" RuleId="RID3011" Requirement="NonSAP">
                      <Object GroupingClass="True" Class="%SRVNAME%" Type="If" Name="Build2039Check" Key1="%SQLBuild% = 2039" Display="Hide">
                        <Setting Key1="RuleNode">
                          <Rule 
                              Name="sqlVersion2000Build2039"
                              Error="Warning"
                              GUID="15271eee-43b2-4698-82bf-90d7f36178d2" 
                              Title="SQL Server 2000 Build 2039 On Server [{0}]"
                              Text="Version of server [{0}] is 8.00.2039. We recommend upgrading this server to build 8.00.2187 or later."
                              S0="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3068

                 Rule Name: LightWeight thread pooling should be disabled

                 Applies To: SQL 2000, SQL 2005
                 
                 Checks if the SQL server has light weight pooling enabled and
                 recommends disabling it.
                              
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %Sql2005Check% - Check for SQL 2005
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The name of the SQL Server Instance 
                    
                 Rules:
                    $lightWtPooling2000 - Checks if the server has lightweight pooling enabled (SQL2000)
                    $lightWtPooling2005 - Checks if the server has lightweight pooling enabled (SQL2005)
                -->
                  <Object Type="Group" Name="LightWeightPooling" LogText="Processing LightWeight Pooling Rule" RuleId="RID3068" Requirement="SAP">
                    <Object Type="If" Key1="%Sql2000Check%" Display="Hide">
                      <Object
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%"
                        Key2="USE [master];
                              SELECT
                                [value] as [config_value]
                              FROM
                                sysconfigures
                              WHERE
                                LOWER(comment) = LOWER('user mode scheduler uses lightweight pooling')"
                        Key4="true"
                        Display="Hide">
                        <Setting Key1="config_value">
                          <Rule 
                            Name="lightWtPooling2000"
                            GUID="481bb43d-6fe5-497c-9096-971fb6bf733b" 
                            Query="$. != 0"
                            Error="BestPractice"
                            Sev="3"
                            Title="Disable Lightweight Pooling On Server [{0}]"
                            Text="Lightweight Pooling is enabled on server [{0}]. We recommend disabling it."
                            S0="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                    <Object Type="If" Key1="%Sql2005Check%" Display="Hide">
                      <Object
                        Type="SQL"
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%"
                        Key2="USE [master];
                              SELECT 
                                [value] as [config_value]
                              FROM
                                sys.configurations
                              WHERE
                                LOWER([name]) = LOWER('lightweight pooling')"
                        Key4="true"
                        Display="Hide">
                        <Setting Key1="config_value">
                          <Rule 
                            Name="lightWtPooling2005"
                            GUID="481bb43d-6fe5-497c-9096-971fb6bf733b" 
                            Query="$. != 0"
                            Error="BestPractice"
                            Sev="3"
                            Title="Disable Lightweight Pooling On Server [{0}]"
                            Text="Lightweight Pooling is enabled on server [{0}]. We recommend disabling it."
                            S0="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3064
                 
                 Rule Name: CLR enabled and SQL 2005 version
                 
                 Applies To: SQL 2005
                 
                 If CLR enabled on the system customer should have build 9.00.2052 or later 
                 installed or they can experience a memory leak.
                
                 Inputs:
                    %Sql2005Check% - Check for SQL 2005
                    %CONNSTR% - The connection string to use
                    %SQLBuild% - The Build of SQL Server.
                    %SRVNAME% - The name of the SQL Server Instance 
                    
                 Rules:                
                    $clrEnabled2005 - Checks if the server has clr enabled and has build prior 
                                      to 9.00.2052
                -->
                  <Object Type="If" Key1="%Sql2005Check%" Display="Hide">
                    <Object Type="Group" Name="CLREnabledOnOld2005Build" LogText="Processing CLR enabled on SQL 2005 Rule" RuleId="RID3064" Requirement="SAP">
                      <Object
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%"
                        Key2="USE [master];
                              SELECT 
                                [value] as [config_value]
                              FROM
                                sys.configurations
                              WHERE
                                LOWER([name]) = LOWER('clr enabled')"
                        Key4="true"
                        Display="Hide">
                        <Setting Key1="config_value">
                          <Rule 
                            Name="clrEnabled2005"    
                            GUID="c62b143c-b6ce-47fb-900c-e15662e6d386" 
                            Query="(%SQLBuild% &lt; 2052) and ($. != 0)" 
                            Error="Warning"
                            Title="SQLCLR enabled on old version of SQL 2005 On Server [{0}]"
                            Text="Server [{0}] with build older than 9.00.2052 has SQLCLR setting enabled. It can cause memory leaks. We recommend installing the latest known good build (this is fixed in 9.00.2052 or later)."
                            S0="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3075
                 
                 Rule Name: Sql Server on Primary Domain Controller/ Backup Domain Controller
                 
                 Applies To: SQL 2000, SQL 2005
                 
                 Inputs:
                    %HOSTNAME% - Machine hosting the SQL Server server instance.
                    %SRVNAME% - The name of the SQL Server Instance.
                 
                 Rules:
                    $cSqlServerOnPrimaryDomainController - Evaluates to true if there are instances of sql server present on this host, host machine is not small business server and is a Primary Domain Controller(PDC).
                    $cSqlServerOnBackupDomainController - Evaluates to true if there are instances of sql server present on this host,host machine is not small business server and is a Backup Domain Controller (BDC). 
                -->
                  <Object Type="Group" Name="Sql Server on PDC/BDC" DisplayName="Sql Server on PDC/BDC" Description="Checks whether SQL Server Instance is running on primary/backup domain controller." LogText="Processing Domain Controller Check" RuleId="RID3075" VulnerabilityID="RID3075" Requirement="SAP">
                    <Object
                    GroupingClass="True" 
                    Class="%SRVNAME%"
                    Type="Registry"
                    Key1="%HOSTNAME%" 
                    Key2="HKEY_LOCAL_MACHINE"
                    Key3="SYSTEM\CurrentControlSet\Control\ProductOptions">
                      <Setting Key1="ProductSuite">
                        <Rule Name="iSmallBusinessServer" Query="count(../Value[contains(upper-case(text()),'SMALL')])!=0" />
                      </Setting>
                      <Setting Key1="ProductType">
                        <Rule 
                          Name="cSqlServerOnPrimaryDomainController" 
                          GUID="e68fb1e0-d4ae-451c-adb9-b1277e794017" 
                          Query="not($iSmallBusinessServer) and (upper-case($.) = 'LANMANNT')"
                          Title="SQL Server [{0}] on Primary Domain Controller "
                          Text="SQL Server instance [{0}] is being hosted by machine [{1}] that is configured as primary domain controller. It is advised not to have SQL Server installed on this machine."
                          Error="Warning"
                          Score="Medium" 
                          S0="%SRVNAME%"
                          S1="%HOSTNAME%"/>
                        <Rule 
                          Name="cSqlServerOnBackupDomainController" 
                          Query="not($iSmallBusinessServer) and (upper-case($.) = 'LANSECNT')"
                          Title="SQL Server [{0}] on Backup Domain Controller"
                          Text="SQL Server instance [{0}] is being hosted by machine [{1}] that is configured as backup domain controller. It is advised not to have SQL Server installed on this machine."
                          Error="Warning"
                          Score="Medium" 
                          S0="%SRVNAME%"
                          S1="%HOSTNAME%"/>
                      </Setting>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3054
                 
                 Rule Name: Sessions with high tempdb space usage
                 
                 Applies To: SQL 2005
                 
                 Checks if any of the sessions has a high space usage in tempdb database             
                    session space usage > 5% tempdb data file size
                    session space usage > 500MB

                 Inputs:
                    %Sql2005Check% - Check for SQL 2005
                    %CONNSTR% - The connection string to use
                    %SRVNAME% - The name of the SQL Server Instance 
                    
                 Rules:
                    $highTempDbUsage2005 - Checks if a session has high space usage on
                                           tempdb database (SQL2005)
                -->
                  <Object Type="If" Key1="%Sql2005Check%" LogText="Processing Sessions With High TEMPDB Space Usage Rule" Display="Hide" RuleId="RID3054" Requirement="SAP">
                    <Object Type="Group" Name="HighTempDbUsageSessions">
                      <Object
                        Type="SQL" 
                        GroupingClass="True" 
                        Class="%SRVNAME%"
                        Key1="%CONNSTR%"
                        Key2="USE [master];
                              SELECT  
	                              t1.session_id,
	                              login_name
                              FROM 
	                              sys.dm_exec_sessions [sessions],
	                              (
		                              SELECT 
			                              session_id, 
			                              SUM(internal_objects_alloc_page_count + user_objects_alloc_page_count) AS task_alloc
		                              FROM
			                              sys.dm_db_task_space_usage 
		                              GROUP BY 
			                              session_id
	                              ) AS t1	
                              WHERE 
                                sessions.session_id = t1.session_id AND 
                                t1.session_id > 50 AND 
                                ((task_alloc * 8) / 1024) > 500 AND -- (((#pages * 8192) / (1024 * 0124)) > 500)
                                ((task_alloc * 8) / 1024) > 
                                (
	                              SELECT  
		                              ((sum([size]) * 8 * 5) / (1024 * 100)) -- (5% of [(#pages * 8192) / (1024 * 1024)])
	                              FROM  
		                              sys.sysaltfiles [files]
	                              where 
		                              groupid = 1 AND 
		                              db_name([files].[dbid]) = 'tempdb'
                                 )"
                        Key4="true"
                        Display="Hide">
                        <Setting Key1="session_id" Substitution="SESSION_ID"/>
                        <Setting Key1="login_name">
                          <Rule 
                            Name="highTempDbUsage2005"    
                            GUID="436a5c96-7036-48e7-aefb-9991b3131cd6" 
                            Error="Warning"
                            Title="Check User Session with High tempdb Space Usage On Server [{2}]"
                            Text="Session [{0}] by login [{1}] on server [{2}] has high TempDb space usage. This might cause performance problems on the server."
                            S0="%SESSION_ID%"
                            P1="$."
                            S2="%SRVNAME%"/>
                        </Setting>
                      </Object>
                    </Object>
                  </Object>

                  <!-- 
                 RuleId: RID3076
                 
                 Rule Name: SQL 2000 with AWE enabled
                 
                 Applies To: SQL Server 2000
                 
                 Inputs:
                    %Sql2000Check% - Check for SQL 2000
                    %CONNSTR% - The connection string to use
                    %SQLBuild% - SQL Server build number
                    %SRVNAME% - The name of the SQL Server Instance 
                    %SQLProductVersion% - SQL product version
                 
                 Rules:
                 sql2kAweEnabled - Evaluates to true if target Sql instance is SQL 2000 with version earlier than
                                   8.00.760 and AWE is enabled for the instance. 
                -->
                  <Object Type="If" Key1="%Sql2000Check%">
                    <Object Type="Group" Name="SQL 2000 with AWE enabled" LogText="Processing Rule - SQL 2000 with AWE enabled" RuleId="RID3076" Requirement="SAP">
                      <Object Type="If" Key1="%SQLBuild% &lt; 760">
                        <Object GroupingClass="True" Class="%SRVNAME%" Type="SQL" Name="SQL2000AWECheck" Key1="%CONNSTR%" Key2="SELECT [value] AS config_value FROM master.dbo.sysconfigures WHERE config = 1548" Key4="true" Display="Hide">
                          <Setting Key1="config_value">
                            <Rule Name="sql2kAweEnabled" GUID="9fdbb219-913c-4356-ad23-5c4c6e4b3871" Query="$.=1" Error="Warning" Sev="2" Title="SQL Server 2000 With AWE enabled On Server [{0}]" Text="AWE is enabled for SQL Server [{0}] (Sql 2000 instance - version [{1}]). If you wish to have AWE enabled, it is recommended to have a version later than 8.00.760." S0="%SRVNAME%" S1="%SQLProductVersion%">
                            </Rule>
                          </Setting>
                        </Object>
                      </Object>
                    </Object>
                  </Object>
                  <!--Get the databases for each SQL Server Service instances.-->
                  <Object
                    Type="Xml" 
                    Key1="%CONFIG_INPUT_SERVER%" 
                    Key2="%CONFIG_INPUT_FILEPATH%"
                    Key3="SQLBPA/Computer[@Name=&quot;%HOSTNAME%&quot;]/SqlServers/SqlServer[@Name=&quot;%SRVNAME%&quot;]/Databases/Database">
                    <Setting Key1="@Name" Substitution="DBNAME"/>
                    <Object Type="SQLESCAPE" Name="escapeme" Key1="%DBNAME%">

                      <Setting Key1="SQLIDENTIFIERTYPE" Substitution= "SQLIDENTIFIERDB"/>
                      <Setting Key1="SQLLITERALTYPE" Substitution= "SQLLITERALDB"/>
                      <Setting Key1="XPATHLITERALTYPE" Substitution= "XPATHLITERALDB"/>
                      <Setting Key1="LABELTEXT" Substitution= "LABELTEXTDB"/>

                      <!--Analyzing Database Level Rules-->
                      <Object Type="Group" Name="[%SRVNAME%] Analyzing SQL Server Database [%DBNAME%]" LogText="Processing rules for Database [%DBNAME%] On Server [%SRVNAME%]" TrackProgress="TrackProgress">
                        <Object Type="Group" GroupingClass="True" Class="%SRVNAME%.%DBNAME%">
                          <!--Select some common database properties.-->
                          <Object 
                            Type="SQL" 
                            Key1="%CONNSTR%"
                            Key2="SELECT (DATABASEPROPERTYEX('%SQLLITERALDB%','Status'))AS db_status, (SELECT SUM([size])*8 FROM master.dbo.sysaltfiles WHERE [dbid] = DB_ID('%SQLLITERALDB%')) AS database_size;"
                            Key4="true"
                            Name="Common Properties">
                            <Setting Key1="db_status" Substitution="DBSTATUS"/>
                            <Setting Key1="database_size" Substitution="DBSIZE"/>

                            <!--
                        RuleId: RID0016
                        
                        Rule Name: Trustworthy bit
                        
                        Applies To: SQL 2005
                        
                        Inputs:
                          %CONNSTR%       - The connection string to DB Engine
                          %Sql2005Check%  - SQL 2005 check
                          %DBSTATUS%      - Status for this database
                          %DBNAME%        - Database name
                          %SRVNAME%       - The name of the SQL Server instance
                        
                        Rules:
                          $cTrustworthyAndDBOIsSysadmin - Evaluates to true if the trustworthy bit is ON and also the dbo is a sysadmin.
                      -->
                            <Object Type="If" Name="TrustworthyBitPreCondition" DisplayName="Trustworthy bit" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE') and (upper-case('%XPATHLITERALDB%')!='MSDB')" Description="" LogText="Processing Trustworthy bit" RuleId="RID0016" VulnerabilityID="RID0016" Requirement="SAP">
                              <Object Type="Group" Name="Trustworthy bit">
                                <!--Generate instances only if this DB has trustworthy bit ON.-->
                                <Object
                                  Type="SQL"
                                  Key1="%CONNSTR%"
                                  Key2="SELECT 1 FROM [master].[sys].databases WHERE [name]= '%SQLLITERALDB%'AND [is_trustworthy_on] = 1;"
                                  Key4="true"
                                  Name="name"
                                  Display="Hide">
                                  <!--See if the dbo is also sysadmin.-->
                                  <Object
                                    Type="SQL"
                                    Key1="%CONNSTR%"
                                    GroupingClass="True" 
                                    Class="%SRVNAME%.%DBNAME%"
                                    Key2="USE [%SQLIDENTIFIERDB%]; DECLARE @sid varbinary(256),@userType nvarchar(128),@loginname nvarchar(256),@privilege nvarchar(128),@isSysAdmin bit; SELECT @loginname=SUSER_SNAME([sid]),@userType=[type_desc] FROM sys.database_principals WHERE [name] = 'dbo'; IF(@userType='SQL_USER') SELECT @isSysAdmin=IS_SRVROLEMEMBER('sysadmin',@loginname) ;IF(@userType='WINDOWS_USER') BEGIN 	DECLARE @loginInfo TABLE(account_name nvarchar(256), account_type nvarchar(128), privilege nvarchar(128), mapped_login_name nvarchar(256), permission_path nvarchar(2048));	INSERT INTO @loginInfo EXEC xp_logininfo @loginname,'all'; 	SELECT @isSysAdmin = CASE COUNT(1) WHEN 0 THEN NULL ELSE 'true' END FROM @loginInfo WHERE LOWER([privilege]) = 'admin';END;/*@isSysAdmin can assume NULL values in which case the following comparison would not succeed.*/IF(@isSysAdmin = 'TRUE') SELECT 'true' AS [is_dbo_sysadmin];"
                                    Key4="true"
                                    Name="is_dbo_sysadmin"
                                    Display="Hide">
                                    <Setting Key1="is_dbo_sysadmin">
                                      <Rule
                                        Name="cTrustworthyAndDBOIsSysadmin"
                                        GUID="3198188a-2b59-4865-9560-10f760934b8e" 
                                        Title="Trustworthy Bit In Database [{0}] On Server [{1}]"
                                        Text="Database [{2}] on server [{1}] has it's trustworthy bit ON and also the dbo is a sysadmin. Any database that matches these two conditions may allow escalation of privileges by privileged users on the DB, including becoming sysadmins and creating/executing unsafe assemblies that may compromise the system."
                                        Error="Warning"
                                        Score="High" 
                                        P0="'%DBNAME%'"
                                        P1="'%SRVNAME%'"
                                        S2="%LABELTEXTDB%"/>
                                    </Setting>
                                  </Object>
                                </Object>
                              </Object>
                            </Object>

                            <!--
                        RuleId: RID0019,RID0040
                        
                        Rule Name: Secret Keys
                        
                        Applies To: SQL 2005
                        
                        Inputs:
                          %CONNSTR%                   - The connection string to DB Engine
                          %Sql2005Check%              - SQL2005 Check
                          %DBSTATUS%                  - Status for this database
                          %DBNAME%                    - Database name
                          %SRVNAME%                   - The name of the SQL Server instance
                          
                        Outputs:
                          $iSymmetricKeyLength        - For each database, the key length for each violating symmetric key.
                          $iSymmetricAlgorithmDesc    - For each database, the key algorithm for each violating symmetric key.
                          $iAsymmetricKeyLength       - For each database, the key length for each violating asymmetric key.
                          $iAsymmetricAlgorithmDesc   - For each database, the key algorithm for each violating asymmetric key.
                        
                        Rules:
                          cSystemDBWithSymmetricKeys  - Evaluates to true if the the count of shipped databases having symmetric keys is > 0.
                          cSymmetricKey               - Evaluates to true if non system databases have symmetric keys that are using either RC2 or RC4 or having the key length < 128.
                          cAsymmetricKey              - Evaluates to true if non system databases have asymmetric keys having the key length < 1024. 
                      -->
                            <Object Type="If" Name="SecretKeysPreCondition" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide" LogText="Processing Secret Keys" RuleId="RID0019,RID0040">
                              <Object Type="Group" Name="Secret Keys">
                                <!--Check Symmetric Keys:
                                  There should only be ##MS_ServiceMasterKey## on database [Master] and no symmetric keys on databases [model], [msdb], [tempdb].
                                  For each non system database, get the symmetric keys that violate key_length and key_algorithm. -->
                                <Object 
                                  Type="SQL" 
                                  DisplayName="Symmetric Keys" 
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%"
                                  Key1="%CONNSTR%" 
                                  Key2="USE [%SQLIDENTIFIERDB%];IF(DB_NAME()='master')SELECT TOP(1) [name],[key_length],[algorithm_desc] FROM sys.symmetric_keys WHERE NAME &lt;&gt; '##MS_ServiceMasterKey##'ELSE IF(DB_NAME() IN (N'msdb',N'model',N'tempdb'))SELECT TOP(1) [name],[key_length],[algorithm_desc] FROM sys.symmetric_keys ELSE SELECT [name],[key_length],[algorithm_desc] FROM sys.symmetric_keys WHERE [key_length] &lt; 128 OR [algorithm_desc] = 'RC2' OR [algorithm_desc] = 'RC4' OR [algorithm_desc] = 'DESX';"
                                  Key4="true"  
                                  RuleId="RID0019" 
                                  Description="This checks for the presence of symmetric keys in system databases and for key strength violations in non system databases." 
                                  LogText="Processing Symmetric Keys"
                                  VulnerabilityID="RID0019" 
                                  Requirement="NonSAP">
                                  <Setting Key1="key_length">
                                    <Rule Name="iSymmetricKeyLength" Query="$."/>
                                  </Setting>
                                  <Setting Key1="algorithm_desc">
                                    <Rule Name="iSymmetricAlgorithmDesc" Query="$."/>
                                  </Setting>
                                  <Setting Key1="name">
                                    <!--Check system databases.-->
                                    <Rule 
                                      Name="cSystemDBWithSymmetricKeys" 
                                      Query="'%XPATHLITERALDB%'='master' or '%XPATHLITERALDB%'='model' or '%XPATHLITERALDB%'='msdb' or '%XPATHLITERALDB%'='tempdb'"
                                      GUID="ab88e7b9-c5c4-4ad3-a224-fb7229a4f640" 
                                      Title="Symmetric Keys in SQL Server Shipped Database [{0}] On Server [{1}]" 
                                      Text="Shipped database [{2}] on server [{1}] contains symmetric key(s). We recommend against creation of symmetric keys in SQL Server shipped databases." 
                                      Error="BestPractice" 
                                      Score="Medium" 
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                    <!--Non system databases.-->
                                    <Rule
                                      Name="cSymmetricKey" 
                                      GUID="ab88e7b9-c5c4-4ad3-a224-fb7229a4f640" 
                                      Query="not($cSystemDBWithSymmetricKeys)" 
                                      Title="Symmetric Key Algorithm Or Key Strength Violation In Database [{1}] On Server [{2}]" 
                                      Text="Symmetric key [{0}] in database [{5}] on server [{2}] has a length of [{3}] and is using algorithm [{4}]. We recommend using AES 128 bit or above to create symmetric keys for data encryption. If AES is not supported on your OS, use 3DES." 
                                      Error="Warning" 
                                      Score="High" 
                                      P0="$."
                                      S1="%DBNAME%"
                                      S2="%SRVNAME%"
                                      P3="$iSymmetricKeyLength"
                                      P4="$iSymmetricAlgorithmDesc"
                                      S5="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>

                                <!--Check Asymmetric Keys:
                            On Each Database, check if the key_length is < 1024. If so, then Warn:Use RSA 1024 bit and above to create asymmetric keys-->
                                <Object 
                                  Type="SQL"
                                  DisplayName="Asymmetric Keys" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%];SELECT [name],[key_length],[algorithm_desc] FROM sys.asymmetric_keys WHERE [key_length] &lt; 1024"
                                  Key4="true"  
                                  RuleId="RID0040" 
                                  Description="This checks for the key strength violations for asymmetric keys." 
                                  LogText="Processing Asymmetric Keys"
                                  VulnerabilityID="RID0040"
                                  Requirement="NonSAP">
                                  <Setting Key1="key_length">
                                    <Rule Name="iAsymmetricKeyLength" Query="$."/>
                                  </Setting>
                                  <Setting Key1="algorithm_desc">
                                    <Rule Name="iAsymmetricAlgorithmDesc" Query="$."/>
                                  </Setting>
                                  <Setting Key1="name">
                                    <Rule 
                                      Name="cAsymmetricKey" 
                                      GUID="ab88e7b9-c5c4-4ad3-a224-fb7229a4f640"
                                      Title="Asymmetric Key Strength Violation In Database[{1}] On Server [{2}]" 
                                      Text="Asymmetric Key [{0}] in database [{5}] on server [{2}] has a length of [{3}] and is using algorithm [{4}]. We recommend using RSA 1024 bit or above to create asymmetric keys." 
                                      Error="Warning" 
                                      Score="High" 
                                      P0="$."
                                      S1="%DBNAME%"
                                      S2="%SRVNAME%"
                                      P3="$iAsymmetricKeyLength"
                                      P4="$iAsymmetricAlgorithmDesc"
                                      S5="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!--
                        RuleId: RID0034
                        
                        Rule Name: SQL Server Guest Account
                        
                        Applies To: SQL 2000, SQL 2005
                        
                        Inputs:
                          %CONNSTR% - The connection string to use
                          %SRVNAME% - The name of the SQL Server instance 
                          %DBNAME%  - Database name.
                          %DBSTATUS%  - Database Status.
                        
                        Rules:
                          $fCSQLGuestHasAccess - Checks if Guest has db access. 
                      -->
                            <Object Type="If" Name="SQLServerGuestAccountPreCondition" DisplayName="SQL Server Guest Account" Key1="('%XPATHLITERALDB%'!='master') and ('%XPATHLITERALDB%'!='tempdb') and ('%XPATHLITERALDB%'!='msdb') and (upper-case('%DBSTATUS%')='ONLINE')" Description="This check determines whether the Microsoft® SQL Server™ Guest account has access to databases (excluding master, tempdb, and msdb)." LogText="Processing SQL Server Guest Account" RuleId="RID0034" VulnerabilityID="RID0034" Requirement="SAP">
                              <Object Type="Group" Name="SQL Server Guest Account">
                                <Object 
                                  Type="SQL" 
                                  Name="CSQLGuest" 
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%"
                                  Description="Check to see if Guest has db access." 
                                  Key1="%CONNSTR%" 
                                  Key2="USE [%SQLIDENTIFIERDB%];SELECT COUNT(1) AS [guestHasDbAccess] FROM [%SQLIDENTIFIERDB%].[dbo].sysusers WHERE Name='guest' AND hasdbaccess=1"
                                  Key4="true" 
                                  Display="Hide">
                                  <Setting Key1="guestHasDbAccess">
                                    <Rule 
                                      Name="fCSQLGuestHasAccess" 
                                      GUID="540f1c6d-df51-497e-958a-3a0f429d2920" 
                                      Query="$.!= 0" 
                                      Title="SQL Server Guest Account Enabled In Database [{1}] On Server [{0}]" 
                                      Text="Guest account is enabled in database [{2}] on server [{0}]. We recommend that guest account should be disabled." 
                                      Error="BestPractice" 
                                      Score="Medium" 
                                      S0="%SRVNAME%" 
                                      S1="%DBNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!--
                        RuleId: RID3040
                        
                        Rule Name: Database Mirroring Does Not Support Distributed Transactions 
                        
                        Applies To: SQL 2005
                        
                        Inputs:
                          %Sql2005Check%                - SQL 2005 check
                          %DBSTATUS%                    - Database status
                          %CONNSTR%                     - The connection string to use
                          %DBNAME%                      - Database name
                          %SRVNAME%                     - The name of the SQL Server instance
                        
                        Rules:
                          cDatabaseMirroring:
                            This check, for each database using database mirroring, warns the user that DTC is not supported.
                      -->
                            <Object Type="If" Name="Database Mirroring and Distributed Transactions" DisplayName="Database Mirroring and Distributed Transactions" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE')" Description="If a database is found to be using DBM then give a warning that distributed transactions are not supported on the database." LogText="Processing Database Mirroring and Distributed Transactions" RuleId="RID3040" Requirement="SAP">
                              <Object Type="Group" Name="Database Mirroring and Distributed Transactions">
                                <Object 
                                  Type="SQL" 
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%"
                                  Key1="%CONNSTR%"
                                  Key2="SELECT DISTINCT database_id FROM sys.database_mirroring WHERE [database_id]=DB_ID('%SQLLITERALDB%') AND [mirroring_guid] IS NOT NULL;"
                                  Key4="true">
                                  <Setting Key1="database_id">
                                    <Rule 
                                      Name="cDatabaseMirroring" 
                                      GUID="b79b63c6-54c2-4189-8958-e6e030316206" 
                                      Error="Warning" 
                                      Title="Distributed Transactions are not supported on Database [{0}] using Database Mirroring on Server [{1}]" 
                                      Text="Database mirroring is being used on database [{2}] on server [{1}]. Distributed transactions are not supported on databases using database mirroring." 
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!--
                        RuleId: RID3001
                        
                        Rule Name: Last Known Good DBCC CheckDB
                        
                        Applies To: SQL 2005
                        
                        Inputs:
                          %Sql2005Check%                - SQL 2005 checking query
                          %DBSTATUS%                    - Database status
                          %DBNAME%                      - Database name
                          %CONNSTR%                     - The connection string to use
                          %SRVNAME%                     - The name of the SQL Server instance
                        
                        Rules:
                          $cLastKnownGoodDBCCCheckDB1 - Evaluates to true if target database has been never checked for integrity 
                          $cLastKnownGoodDBCCCheckDB2 - Evaluates to true if target database has not been checked for integrity in past 14 days 
                      -->
                            <Object Type="If" Name="VersionTest" Key1="%Sql2005Check% and ('%XPATHLITERALDB%'!='tempdb') and (upper-case('%DBSTATUS%')='ONLINE')" RuleId="RID3001" Requirement="NonSAP">
                              <Object Type="Group" Name="Last Known Good DBCC CheckDB" Description="This checks, for all the databases, last good CHECKDB and if more than 14 days flag a best practice violation." LogText="Processing Last Known Good DBCC Rule">
                                <!--Skip the check on tempdb.-->
                                <Object Type="SQLESCAPE" Name="escapeme" Key1="%SQLLITERALDB%">
                                  <Setting Key1="SQLLITERALTYPE" Substitution= "SQLLITERALDOUBLEESCAPEDDB"/>
                                  <Object
                                    Type="SQL"
                                    GroupingClass="True" 
                                    Class="%SRVNAME%.%DBNAME%"
                                    Key1="%CONNSTR%"
                                    Key2="SET NOCOUNT ON;
                                  DECLARE @dbinfo TABLE(ParentObject varchar(255),Object varchar(255),Field varchar(255),Value varchar(255));
                                  INSERT INTO @dbinfo EXEC ('DBCC DBINFO ( ''%SQLLITERALDOUBLEESCAPEDDB%'' ) WITH TABLERESULTS ');

                                  DECLARE @DaysElapsedSinceLastKnownGoodCheckDB VARCHAR(255);
                                  SELECT @DaysElapsedSinceLastKnownGoodCheckDB = DATEDIFF(day,[Value],GETDATE())
                                  FROM @dbinfo 
                                  WHERE ParentObject = 'DBINFO STRUCTURE:' AND Field = 'dbi_dbccLastKnownGood';

                                  DECLARE @createDate VARCHAR(255);
                                  SELECT @createDate = create_date FROM sys.databases WHERE name = '%SQLLITERALDB%' 

                                  DECLARE @DaysElapsedSinceDatabaseCreated VARCHAR(255);
                                  SET @DaysElapsedSinceDatabaseCreated = DATEDIFF(day,@createDate,GETDATE())

                                  SELECT @DaysElapsedSinceLastKnownGoodCheckDB AS [DaysElapsedSinceLastKnownGoodCheckDB], @DaysElapsedSinceDatabaseCreated AS [DaysElapsedSinceDatabaseCreated]"
                                    Key4="true"
                                    Display="Hide">

                                    <Setting Key1="DaysElapsedSinceLastKnownGoodCheckDB" Substitution="DESKGC"/>
                                    <Setting Key1="DaysElapsedSinceDatabaseCreated" Substitution="DESDC">
                                      <Rule Name="iNotSingleDBCCEver" Query="%DESKGC% > %DESDC%"/>
                                    </Setting>

                                    <Setting Key1="DaysElapsedSinceLastKnownGoodCheckDB">
                                      <Rule Name="iNotSingleDBCCInLast14Days" Query="$. > 14"/>
                                      <Rule
                                            Name="cLastKnownGoodDBCCCheckDB1"
                                            GUID="39b709cd-5c1c-4eea-9a3b-b940f3ee0d0d" 
                                            Error="Warning"
                                            Query="$iNotSingleDBCCEver and $iNotSingleDBCCInLast14Days" 
                                            Sev="2"
                                            Title="Check database integrity at least every 14 days for Database [{1}] on Server [{2}]"
                                            Text="It's found that DBCC CheckDB for database [{3}] on server [{2}] has not executed ever since the database created. We recommend you to check the database for integrity at least once in 14 days."
                                            P0="$."
                                            S1="%DBNAME%"
                                            S2="%SRVNAME%"
                                            S3="%LABELTEXTDB%"/>

                                      <Rule
                                            Name="cLastKnownGoodDBCCCheckDB2"
                                            GUID="39b709cd-5c1c-4eea-9a3b-b940f3ee0d0d" 
                                            Error="Warning"
                                            Query="not($iNotSingleDBCCEver) and $iNotSingleDBCCInLast14Days" 
                                            Sev="2"
                                            Title="Check database integrity at least every 14 days for Database [{1}] on Server [{2}]"
                                            Text="It's been [{0}] days since the last known good DBCC CheckDB for database [{3}] on server [{2}]. We recommend you to check the database for integrity at least once in 14 days."
                                            S1="%DBNAME%"
                                            S2="%SRVNAME%"
                                            S3="%LABELTEXTDB%"/>
                                    </Setting>

                                  </Object>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                        RuleId: RID1004
                       
                        Rule Name: Database Files Location 
                       
                        Applies To: SQL 2000, SQL 2005
                       
                        Checks if a database has data and log file on same drive 
                       
                        Inputs:
                          %IsStandardEdition%           - Check for standard edition
                          %IsEnterpriseEdition%         - Check for enterprise edition
                          %DBSTATUS%                    - Database status
                          %DBNAME%                      - Database name
                          %DBSIZE%                      - Database size
                          %Sql2000Check%                - Check for SQL 2000
                          %Sql2005Check%                - Check for SQL 2005
                          %CONNSTR%                     - The connection string to use
                          %SRVNAME%                     - The name of the SQL Server Instance 
                          
                       Rules:
                          $dataFilesDriveOverlap2000 - Evaluates to true if data and log files for target SQL 2000 database exist on same drive
                          $dataFilesDriveOverlap2005 - Evaluates to true if data and log files for target SQL 2005 database exist on same drive
                      -->
                            <!--Check if Enterprise or Standard Edition. Also,Filter the system databases and the ones that are smaller than 5242880 (5GB) in size-->
                            <Object Type ="If" Name="DBFilesPreCondition" Key1="(%IsStandardEdition% or %IsEnterpriseEdition%) and ('%XPATHLITERALDB%' !='master' and '%XPATHLITERALDB%'!='msdb' and '%XPATHLITERALDB%'!='model' and '%XPATHLITERALDB%'!='tempdb') and (%DBSIZE% > 5242880) and (upper-case('%DBSTATUS%')='ONLINE')"  LogText="Processing Database Files Location" RuleId="RID1004" Requirement="SAP">
                              <Object Type="Group" Name="DB Files">
                                <Object Type ="If" Key1="%Sql2000Check%">
                                  <Object
                                    Type="SQL" 
                                    GroupingClass="True" 
                                    Class="%SRVNAME%.%DBNAME%"
                                    Name="DBLogFile"
                                    Key1="%CONNSTR%"
                                    Key2="USE [%SQLIDENTIFIERDB%];SELECT COUNT(1) AS [dataFilesDriveOverlapCount] FROM dbo.sysfiles WHERE FILEPROPERTY ( name , 'IsLogFile' ) = 0 AND SUBSTRING(filename,1,1) IN (SELECT DISTINCT SUBSTRING(filename,1,1) FROM dbo.sysfiles WHERE FILEPROPERTY ( name , 'IsLogFile' ) = 1)"
                                    Key4="true" 
                                    Display="Hide">
                                    <Setting Key1="dataFilesDriveOverlapCount">
                                      <Rule 
                                        Name="dataFilesDriveOverlap2000" 
                                        Query="$. != 0" 
                                        GUID="6cbedc27-4d77-44ad-bed2-c23b628475a7" 
                                        Error="Warning" 
                                        Title="Place Data and Log Files on Separate Drives For Database [{1}] On Server [{0}]"
                                        Text="Database [{2}] on server [{0}] has some data and log files on same drive." 
                                        S0="%SRVNAME%" 
                                        S1="%DBNAME%" 
                                        S2="%LABELTEXTDB%">
                                      </Rule>
                                    </Setting>
                                  </Object>
                                </Object>

                                <Object Type ="If" Key1="%Sql2005Check%">
                                  <Object
                                    Type="SQL" 
                                    GroupingClass="True" 
                                    Class="%SRVNAME%.%DBNAME%"
                                    Name="DBLogFile"
                                    Key1="%CONNSTR%"
                                    Key2="USE [%SQLIDENTIFIERDB%];SELECT COUNT(1) AS [dataFilesDriveOverlapCount] FROM sys.database_files WHERE type =  0 AND SUBSTRING(physical_name,1,1) IN (SELECT DISTINCT SUBSTRING(physical_name,1,1) FROM  sys.database_files WHERE type = 1)"
                                    Key4="true"
                                    Display="Hide">
                                    <Setting Key1="dataFilesDriveOverlapCount">
                                      <Rule 
                                        Name="dataFilesDriveOverlap2005" 
                                        Query="$. != 0" 
                                        GUID="6cbedc27-4d77-44ad-bed2-c23b628475a7"
                                        Error="Warning" 
                                        Title="Place Data and Log Files on Separate Drives For Database [{1}] On Server [{0}]"
                                        Text="Database [{2}] on server [{0}] has some data and log files on same drive." 
                                        S0="%SRVNAME%" 
                                        S1="%DBNAME%"
                                        S2="%LABELTEXTDB%">
                                      </Rule>
                                    </Setting>
                                  </Object>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3000
                       
                       Rule Name: No database backup for 1 days since last database backup date
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Checks if a database has been backed up in previous 1 days
                       
                       Inputs:
                          %Sql2000Check%                - Check for SQL 2000
                          %Sql2005Check%                - Check for SQL 2005
                          %DBSTATUS%                    - Database status
                          %DBNAME%                      - Database name
                          %CONNSTR%                     - The connection string to use
                          %SRVNAME%                     - The name of the SQL Server instance 
                          
                       Rules:
                          $pNoBackupInOneDays2000 - Checks if database has been backed up within 1 previous days for SQL 2000 Databases
                          $pNoBackupInOneDays2005 - Checks if database has been backed up within 1 previous days for SQL 2005 Databases
                      -->
                            <Object Type="Group" Name="Outdated Backup" LogText="Processing Outdated Backup Rule" RuleId="RID3000" Requirement="SAP">
                              <Object Type ="If" Key1="%Sql2000Check% and (upper-case('%DBSTATUS%')='ONLINE') and '%XPATHLITERALDB%'!='tempdb'">
                                <Object
                                  Type="SQL" 
                                  Name="LastBackup"                                
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%];
                                      SELECT '%SQLLITERALDB%' AS database_name FROM
                                      (
                                      SELECT 
                                        MAX([backup_finish_date]) AS LastBackUp
                                      FROM 
                                        msdb..backupset [backups],
                                        master..sysdatabases as [databases]
                                      WHERE 
                                        [backups].[database_name] = [databases].[name] AND
                                        ([databases].[status] &amp; 1024) = 0 AND
                                        [databases].[name] = '%SQLLITERALDB%' AND
                                        ([databases].[name] = 'master' OR DATEDIFF(second, [backups].[database_creation_date], [databases].[crdate]) = 0)
                                      ) T
                                      WHERE 
                                      DateDiff(day, T.LastBackUp, GetDate()) &gt; 1
                                      UNION
                                      (
                                      SELECT 
                                      '%SQLLITERALDB%' AS database_name
                                      FROM
                                      master..sysdatabases as [databases]
                                      WHERE
                                      ([databases].[status] &amp; 1024) = 0 AND
                                      [databases].[name] = '%SQLLITERALDB%' AND
                                      DateDiff(day, [databases].[crdate], GetDate()) &gt; 1 AND
                                      [databases].[name] NOT IN 
                                      (
                                        SELECT 
	                                        [databases].[name]
                                        FROM
	                                        master..sysdatabases as [databases] INNER JOIN msdb..backupset [backups] ON [backups].[database_name] = [databases].[name]
                                        WHERE
	                                        [databases].[name] = 'master' OR DATEDIFF(second, [backups].[database_creation_date], [databases].[crdate]) = 0
                                        GROUP BY 
	                                        [databases].[name]
                                      )
                                      )"
                                    Key4="true"
                                    Display="Hide">
                                  <Setting Key1="database_name">
                                    <Rule Name="pNoBackupInOneDays2000" Error="Warning" GUID="307a4ad0-675a-4f97-9a3c-cedd61bdfae5" Text="Database [{2}] on server [{0}] has old backup or has never been backed up." Title="Outdated Backup Of Database [{1}] On Server [{0}]" S0="%SRVNAME%" P1="$." S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>

                              <Object Type ="If" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE') and '%XPATHLITERALDB%'!='tempdb'">
                                <Object
                                  Type="SQL" 
                                  Name="LastBackup"
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%];
                                      SELECT '%SQLLITERALDB%' AS database_name FROM
                                      (
                                        SELECT 
                                          MAX([backup_finish_date]) AS LastBackUp
                                        FROM 
                                          msdb..backupset [backups],
                                          sys.databases as [databases],
                                          sys.database_mirroring [mirroring]
                                        WHERE 
                                          [backups].[database_name] = [databases].[name] AND
                                          [databases].[database_id] = [mirroring].[database_id] AND
                                          [mirroring].[mirroring_guid] IS NULL AND
                                          [databases].[is_read_only] = 0 AND
                                          [databases].[name] = '%SQLLITERALDB%' AND
                                          ([databases].[name] = 'master' OR DATEDIFF(second, [backups].[database_creation_date], [databases].[create_date]) = 0)
                                        ) T
                                      WHERE 
                                        DateDiff(day, T.LastBackUp, GetDate()) &gt; 1
                                      UNION
                                      (
                                      SELECT 
                                        '%SQLLITERALDB%' AS database_name
                                      FROM
                                        sys.databases as [databases],
                                        sys.database_mirroring [mirroring]
                                      WHERE
                                        [databases].[database_id] = [mirroring].[database_id] AND
                                        [mirroring].[mirroring_guid] IS NULL AND
                                        [databases].[is_read_only] = 0 AND
                                        [databases].[name] = '%SQLLITERALDB%' AND
                                        DateDiff(day, [databases].[create_date], GetDate()) &gt; 1 AND
                                        [databases].[name] NOT IN 
                                        (
                                          SELECT 
	                                          [databases].[name]
                                          FROM
	                                          sys.databases as [databases] INNER JOIN msdb..backupset [backups] ON [backups].[database_name] = [databases].[name]
                                          WHERE
	                                          [databases].[name] = 'master' OR DATEDIFF(second, [backups].[database_creation_date], [databases].[create_date]) = 0
                                          GROUP BY 
	                                          [databases].[name]
                                        )
                                      )
                                    "
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="database_name">
                                    <Rule Name="pNoBackupInOneDays2005" Error="Warning" GUID="307a4ad0-675a-4f97-9a3c-cedd61bdfae5" Text="Database [{2}] on server [{0}] has old backup or has never been backed up." Title="Outdated Backup Of Database [{1}] On Server [{0}]" S0="%SRVNAME%" P1="$." S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3002
                       
                       Rule Name: The PAGE_VERIFY setting for a database should have value set to 'CHECKSUM'
                       
                       Applies To: SQL 2005
                       
                       Checks if a database has value of PAGE_VERIFY setting for a database set to 'CHECKSUM'
                       
                       Inputs:
                          %Sql2005Check%                - Check for SQL 2005
                          %DBSTATUS%                    - Database status
                          %DBNAME%                      - Database name
                          %CONNSTR%                     - The connection string to use
                          %SRVNAME%                     - The name of the SQL Server instance 
                          
                       Rules:
                          $pageVerifyNotChecksum2005 - Checks if database has value of PAGE_VERIFY setting
                                                       equal to 'CHECKSUM' for SQL 2005 Databases
                      -->
                            <Object Type ="If" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE')">
                              <Object Type="Group" Name="Page_Verify_Checksum" LogText="Processing Page Verify Checksum Rule" RuleId="RID3002" Requirement="SAP">
                                <Object
                                  Type="SQL" 
                                  Name="PageVerifyOption"
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%];
                                      SELECT
                                        name as [database_name]  
                                      FROM
                                        sys.databases
                                      WHERE
                                        name not in ('tempdb')  AND 
                                        name = N'%SQLLITERALDB%' AND      -- specific db check
                                        page_verify_option != 2" 
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="database_name">
                                    <Rule Name="pageVerifyNotChecksum2005" Error="Warning" GUID="686b9a4a-ea61-4263-9ab8-f444a3077679" Text="Database [{2}] on server [{1}] does not have PAGE_VERIFY option set to 'CHECKSUM'. We recommend setting PAGE_VERIFY option to 'CHECKSUM'." Title="Set PAGE_VERIFY Option For Database [{0}] On Server [{1}] to CHECKSUM" P0="$." S1="%SRVNAME%" S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3005
                       
                       Rule Name: 'Instant File Initialization' should be enabled on WinXP/2003 or higher
                        for large data file (> 10GB)
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Logic:
                         If (SQL 2000)
                            If any data file has % growth and file size > 10GB -> Show Warning
                         
                         If (SQL 2005)
                            If(SQL Service account has SE_MANAGE_VOLUME privilege)
                                If(TRACE_1806_Enabled) i.e. [Inst.File.Init. is disabled]
                                    If any data file has % growth and file size > 10GB -> Show Warning
                            Else
                                If any data file has % growth and file size > 10GB -> Show Warning
                       
                       Inputs:
                          %Sql2000Check%                - Check for SQL 2000
                          %Sql2005Check%                - Check for SQL 2005
                          %DBSTATUS%                    - Database status
                          %DBNAME%                      - Database name
                          %CONNSTR%                     - The connection string to use
                          %SRVNAME%                     - The name of the SQL Server instance 
                          %HOSTNAME%                    - Machine hosting the SQL Server instance
                          
                       Rules:
                          $Perf_Large_Data_Files_2000 - Checks for % file growth and filesize > 10GB (SQL 2000)
                          $Perf_Large_Data_Files_2005 - Checks for % file growth and filesize > 10GB (SQL 2005)
                          $Perf_Large_Data_Files_2005_TraceFlag - Checks for TraceFlag 1806, % file growth and filesize > 10GB (SQL 2005)
                      -->
                            <Object Type="Group" Name="Perf_Large_Data_Files" LogText="Processing Performance for Large Data Files (Instant File Initialization) Rule" RuleId="RID3005" Requirement="NonSAP">
                              <Object Type ="If" Key1="%Sql2000Check% and (upper-case('%DBSTATUS%')='ONLINE')">
                                <!--For SQL 2000 Instant File Initialization does not matter-->
                                <Object
                                  Type="SQL" 
                                  Name="Perf_Large_Data_Files_2000"
                                  Key1="%CONNSTR%"
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key2="USE [%SQLIDENTIFIERDB%];
                                      SET NOCOUNT ON;
                                      SELECT
                                          db_name([files].[dbid]) as [database_name],
                                          [files].[filename] as [file_path]
                                      FROM
                                          master..sysaltfiles [files]
                                      WHERE 
                                          db_name([files].[dbid]) = N'%SQLLITERALDB%' AND             -- specific db check
                                          [files].[groupid] != 0 AND                             -- data files check
                                          [files].[size] >= 1310720 AND                         -- 10GB filesize check
                                          [files].[growth] > 0 AND [files].[growth] &lt;= 100   -- ensures that this is percentage growth (neither no growth nor fixed growth)"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="database_name">
                                    <Rule Name="perf_Large_Data_Files_2000_dbName" Query="$."/>
                                  </Setting>
                                  <Setting Key1="file_path">
                                    <Rule Name="Perf_Large_Data_Files_2000" Error="Warning" GUID="af206832-16a0-44d6-99e4-ce635a4a6f11" Text="Database [{3}] on server [{1}] has a large data file [{2}] (> 10GB) with file growth set in percentage and has autogrowth by percentage specified." Title="Use Instant File Initialization Or Fixed Data File Sizes For Database [{0}] On Server [{1}]" P0="$perf_Large_Data_Files_2000_dbName" S1="%SRVNAME%" P2="$." S3="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>

                              <Object Type ="If" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE')">
                                <Object Type="WMI" Key1="%HOSTNAME%" Key2="root\Microsoft\SqlServer\ComputerManagement" Key3="SqlService where SQLServiceType=1 and (ServiceName='MSSQLServer' or ServiceName='MSSQL$%INSTANCENAME%')">
                                  <Setting Key1="StartName" Substitution="SQL_SVC_NAME"/>
                                  <Object Type="LookupAccount" Name="Check_SeManageVolumePrivilege_2005" Key1="Name" Key2="%HOSTNAME%" Key3="%SQL_SVC_NAME%">
                                    <Setting Key1="Privilege" Key2="semanagevolumeprivilege" Key3="Present" Substitution="AccountPrivilege" />
                                    <Object Type="If" Key1="'%AccountPrivilege%'='True'">
                                      <Object
                                        Type="SQL" 
                                        Name="CheckTraceOff"
                                        GroupingClass="True" 
                                        Class="%SRVNAME%.%DBNAME%" 
                                        Key1="%CONNSTR%"
                                        Key2="USE [%SQLIDENTIFIERDB%];
                                            SET NOCOUNT ON; 

                                            DECLARE @dbinfo AS TABLE (TraceFlag int,Status int,Global int,Session int);
                                            INSERT INTO @dbinfo EXEC ('DBCC TRACESTATUS(1806)');

                                            SELECT
                                              db_name([files].[database_id]) as [database_name],
                                              [files].[physical_name] as [file_path]
                                            FROM
                                              sys.master_files [files],
                                              @dbinfo [traceflag1806]
                                            WHERE 
                            	                db_name([files].[database_id]) = N'%SQLLITERALDB%' AND -- specific db check
                                              [files].[type] = 0 AND						        -- data files check
                                              ([files].[size]) >= 1310720 AND	-- 10GB filesize check
                                              [files].growth != 0 AND						        -- autogrow enabled check
                                              [files].[is_percent_growth] = 1 AND			  -- percentage growth check
                                              [traceflag1806].[Status] = 1					    -- check Instant File Initialization (1=disabled)"
                                        Key4="true"
                                        Display="Hide">
                                        <Setting Key1="database_name">
                                          <Rule Name="perf_Large_Data_Files_2005_traceflag_dbName" Query="$."/>
                                        </Setting>
                                        <Setting Key1="file_path">
                                          <Rule Name="Perf_Large_Data_Files_2005_TraceFlag" Error="Warning" GUID="af206832-16a0-44d6-99e4-ce635a4a6f11" Text="Database [{3}] on server [{1}] has a large data file [{2}] (> 10GB) with file growth set in percentage and has Instant File Initialization disabled." Title="Use Instant File Initialization Or Fixed Data File Sizes For Database [{0}] On Server [{1}]" P0="$perf_Large_Data_Files_2005_traceflag_dbName" S1="%SRVNAME%" P2="$." S3="%LABELTEXTDB%"/>
                                        </Setting>
                                      </Object>
                                    </Object>

                                    <Object Type="If" Key1="'%AccountPrivilege%'='False'">
                                      <Object
                                        Type="SQL" 
                                        Name="CheckTraceOff"
                                        Key1="%CONNSTR%"
                                        GroupingClass="True" 
                                        Class="%SRVNAME%.%DBNAME%" 
                                        Key2="USE [%SQLIDENTIFIERDB%];
                                            SET NOCOUNT ON; 

                                            SELECT
                                              db_name([files].[database_id]) as [database_name],
                                              [files].[physical_name] as [file_path]
                                            FROM
                                              sys.master_files [files]
                                            WHERE 
                                              db_name([files].[database_id]) = N'%SQLLITERALDB%' AND -- specific db check
                                              [files].[type] = 0 AND                    -- data files check
                                              ([files].[size]) >= 1310720 AND           -- 10GB filesize check (10GB/8KB PAGES)
                                              [files].growth != 0 AND	                  -- autogrow enabled check
                                              [files].[is_percent_growth] = 1           -- percentage growth check"
                                        Key4="true"
                                        Display="Hide">
                                        <Setting Key1="database_name">
                                          <Rule Name="perf_Large_Data_Files_2005_dbName" Query="$."/>
                                        </Setting>
                                        <Setting Key1="file_path">
                                          <Rule Name="Perf_Large_Data_Files_2005" Error="Warning" GUID="af206832-16a0-44d6-99e4-ce635a4a6f11" Text="Database [{3}] on server [{1}] has a large data file [{2}] (> 10GB) with file growth set in percentage and has Instant File Initialization disabled." Title="Use Instant File Initialization Or Fixed Data File Sizes For Database [{0}] On Server [{1}]" P0="$perf_Large_Data_Files_2005_dbName" S1="%SRVNAME%" P2="$." S3="%LABELTEXTDB%"/>
                                        </Setting>
                                      </Object>
                                    </Object>
                                  </Object>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                        RuleID:RID3018
                        
                        Rule Name: Suspect Pages
                        
                        Applies To: SQL 2005
                        
                        Inputs:
                          %Sql2005Check%                - Check for SQL 2005
                          %DBSTATUS%                    - Database status
                          %DBNAME%                      - Database name
                          %CONNSTR%                     - The connection string to use
                          %SRVNAME%                     - The name of the SQL Server instance 
                      -->
                            <Object Type="If" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE')">
                              <Object Type="Group" Name="Suspect Pages" LogText="Processing Suspect Pages Rule" RuleId="RID3018" Requirement="SAP">
                                <Object Type="SQL" 
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%" Key2="USE [%SQLIDENTIFIERDB%];SELECT db_name(database_id) AS [Database_Name], COUNT(1) AS [Total_Suspect_Pages] FROM msdb.dbo.suspect_pages WHERE event_type IN (1,2,3) AND database_id = db_id(N'%SQLLITERALDB%') GROUP BY database_id" Key4="true" Display="Hide">
                                  <Setting Key1="Database_Name">
                                    <Rule Name="dbName" Query="$."/>
                                  </Setting>
                                  <Setting Key1="Total_Suspect_Pages">
                                    <Rule Name="suspectPages" Title ="Check Integrity of Database with Suspect Pages" Text="Database [{3}] on server [{1}] has {2} records of suspect pages." GUID="3b1ec9fe-f6c5-46f7-aa63-6e671be1572d" Error="Error" Sev="1" P0="$dbName" S1="%SRVNAME%" P2="$." S3="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3024
                       
                       Rule Name: Databases that have not had their statistics updated for long
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Checks if the statistics for databases are auto-updated or
                       they require manual updating based on the following formula
                       [500 + (20% of table size)] < [row modification counter].
                       
                       Size of table  = number of rows in the table
                       
                       Inputs:
                          %Sql2000Check%                - Check for SQL 2000
                          %Sql2005Check%                - Check for SQL 2005
                          %DBSTATUS%                    - Database status
                          %DBNAME%                      - Database name
                          %CONNSTR%                     - The connection string to use
                          %SRVNAME%                     - The name of the SQL Server instance 
                          
                       Rules:
                          $dbRequiresUpdateStats2000 - Checks if the database statistics require updating for SQL 2000
                          $dbRequiresUpdateStats2005 - Checks if the database statistics require updating for SQL 2005                                                
                      -->
                            <!--Need to compute rowmodctr for non-clustered indexes-->
                            <Object Type="Group" Name="UpdateStatisticsRequired" LogText="Processing Update Database Statistics Rule" RuleId="RID3024" Requirement="SAP">
                              <Object Type="If" Key1="%Sql2000Check% and (upper-case('%XPATHLITERALDB%')!='TEMPDB') and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <!--Get Databases with auto-update-stats=FALSE-->
                                <Object
                                  Type="SQL" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%];
                                      SELECT
                                        '%SQLLITERALDB%' as database_name
                                      WHERE
                                        CAST(DATABASEPROPERTYEX('%SQLLITERALDB%', 'IsAutoUpdateStatistics') AS bit) = 0"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="database_name" Substitution="MANUAL_UPDATESTATS_DB"/>
                                  <!--Get number of objects that match the 500+20% criterion-->
                                  <Object
                                    Type="SQL" 
                                    Key1="%CONNSTR%"
                                    GroupingClass="True" 
                                    Class="%SRVNAME%.%DBNAME%" 
                                    Key2="USE [%MANUAL_UPDATESTATS_DB%];
                                        SELECT 
                                          COUNT(1) as requires_update_stats
                                        FROM
                                          (
                                            (
	                                            SELECT
		                                            [objects].[name],
		                                            [indexes].[rowcnt],
		                                            [indexes].[rowmodctr]
	                                            from 
		                                            sysindexes [indexes],
		                                            sysobjects [objects]
	                                            where 
		                                            [objects].[type] IN (N'V', N'U') AND
		                                            [indexes].[id]=[objects].[id] AND				
		                                            ([indexes].[indid]=0 OR [indexes].[indid]=1)
                                            )
                                            UNION ALL
                                            (
	                                            SELECT
		                                            [objects].[name],
		                                            [indexes].[rowcnt],
		                                            [indexes].[rowmodctr] + 
		                                            (
			                                            select 
				                                            [tempindexes].[rowmodctr]
			                                            from 
				                                            sysindexes [tempindexes]
			                                            where
				                                            [tempindexes].[id]=[objects].[id] AND
				                                            ([tempindexes].[indid]=0 OR [tempindexes].[indid]=1)
		                                            ) AS row_mod_ctr	
	                                            from 
		                                            sysindexes [indexes],
		                                            sysobjects [objects]
	                                            where 
		                                            [objects].[type] IN ('V', 'U') AND
		                                            [indexes].[id]=[objects].[id] AND				
		                                            ([indexes].[indid] BETWEEN 2 AND 254)
                                            )
                                          ) AS index_stats
                                          WHERE
                                          (
                                            (rowcnt > 500 AND rowmodctr > 500 + (0.2*rowcnt)) OR
                                            (rowcnt= 1 AND rowmodctr > 0)
                                          )"
                                    Key4="true"
                                    Display="Hide">
                                    <Setting Key1="requires_update_stats">
                                      <Rule 
                                        Name="dbRequiresUpdateStats2000" 
                                        GUID="469e4c8b-902a-4b03-be24-fbf2277ec986" 
                                        Query="$. &gt; 0"
                                        Error="Warning"
                                        Title="Update Statistics Is Required For Database [{0}] On Server [{1}]"
                                        Text="Statistics need to be updated on database [{2}] on server [{1}]. Update the statistics manually or enable AUTO UPDATE STATISTICS."
                                        S0="%MANUAL_UPDATESTATS_DB%"
                                        S1="%SRVNAME%"
                                        S2="%LABELTEXTDB%"/>
                                    </Setting>
                                  </Object>
                                </Object>
                              </Object>
                              <Object Type="If" Key1="%Sql2005Check% and (upper-case('%XPATHLITERALDB%')!='TEMPDB') and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <!--Get Databases with auto-update-stats=FALSE-->
                                <Object
                                  Type="SQL" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%];
                                      SELECT
                                        dtb.name as database_name
                                      FROM
                                        sys.databases AS dtb
                                      WHERE	
                                        dtb.name = N'%SQLLITERALDB%' AND  -- specific db check
                                        is_auto_update_stats_on = 0"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="database_name" Substitution="MANUAL_UPDATESTATS_DB"/>
                                  <!--Get number of objects that match the 500+20% criterion-->
                                  <Object
                                    Type="SQL" 
                                    Key1="%CONNSTR%"
                                    GroupingClass="True" 
                                    Class="%SRVNAME%.%DBNAME%" 
                                    Key2="USE [%MANUAL_UPDATESTATS_DB%];
                                        SELECT 
                                          COUNT(1) as requires_update_stats
                                        FROM 
                                          sysobjects as [objects],
                                          sysindexes as [indexes]
                                        WHERE
                                          [objects].[id]=[indexes].[id] AND
                                          [objects].type IN (N'V', N'U') AND
                                          (
                                              ([indexes].[rows] > 500 AND [indexes].[rowmodctr] > 500 + (0.2*rowcnt)) OR
                                              ([indexes].[rows] = 1 AND [indexes].[rowmodctr] > 0)
                                          )"
                                    Key4="true"
                                    Display="Hide">
                                    <Setting Key1="requires_update_stats">
                                      <Rule 
                                        Name="dbRequiresUpdateStats2005" 
                                        GUID="469e4c8b-902a-4b03-be24-fbf2277ec986" 
                                        Query="$. &gt; 0"
                                        Error="Warning"
                                        Title="Update Statistics Is Required For Database [{0}] On Server [{1}]"
                                        Text="Statistics need to be updated on database [{2}] on server [{1}]. Update the statistics manually or enable AUTO UPDATE STATISTICS."
                                        S0="%MANUAL_UPDATESTATS_DB%"
                                        S1="%SRVNAME%"
                                        S2="%LABELTEXTDB%"/>
                                    </Setting>
                                  </Object>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3029
                       
                       Rule Name: Database Recovery Model on Standard/Enterprise SQL Servers
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Checks if the sql server is standard/enterprise edition and if any
                       database is in SIMPLE recovery model and a not readonly database.
                       
                       Inputs:
                        %IsStandardEdition%           - Check for standard edition
                        %IsEnterpriseEdition%         - Check for enterprise edition
                        %Sql2000Check%                - Check for SQL 2000
                        %Sql2005Check%                - Check for SQL 2005
                        %DBSTATUS%                    - Database status
                        %DBNAME%                      - Database name
                        %CONNSTR%                     - The connection string to use
                        %SRVNAME%                     - The name of the SQL Server instance 
                          
                       Rules:
                          $dbRecoveryModel2000 - Checks if the sql server is standard/enterprise 
                                                 edition and if any database is in SIMPLE recovery 
                                                 model and a not readonly database (SQL2000).
                          $dbRecoveryModel2005 - Checks if the sql server is standard/enterprise 
                                                 edition and if any database is in SIMPLE recovery 
                                                 model and a not readonly database (SQL2005).
                      -->
                            <Object Type="Group" Name="DbRecoveryModel" LogText="Processing Database Recovery Model Rule" RuleId="RID3029" Requirement="ModifiedSAP">
                              <Object Type ="If" Key1="%Sql2000Check% and (%IsStandardEdition% or %IsEnterpriseEdition%) and '%XPATHLITERALDB%' !='master' and '%XPATHLITERALDB%'!='msdb' and '%XPATHLITERALDB%'!='model' and '%XPATHLITERALDB%'!='tempdb' and (upper-case('%DBSTATUS%')='ONLINE')">
                                <Object
                                  Type="SQL" 
                                  Name="CheckDb2000"
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%];DECLARE @isReadOnly AS BIT;SELECT @isReadOnly = (status &amp; 1024) FROM master.dbo.sysdatabases WHERE db_id(N'%SQLLITERALDB%') = dbid;IF @isReadOnly = 0 AND (DATABASEPROPERTYEX(N'%SQLLITERALDB%','recovery') = 'simple') SELECT 1 AS [RecoveryModel]"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="RecoveryModel">
                                    <Rule 
                                      Name="dbRecoveryModel2000"
                                      GUID="fc8fcfa8-562a-46a3-a75c-72665dcaac83" 
                                      Error="Warning" 
                                      Title="Database Recovery Model For Database [{0}] On Server [{1}]"
                                      Text="Database [{2}] on server [{1}] with Standard/Enterprise Edition of SQL Server has recovery model 'SIMPLE'." 
                                      S0="%DBNAME%" 
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                              <Object Type ="If" Key1="%Sql2005Check% and (%IsStandardEdition% or %IsEnterpriseEdition%) and '%XPATHLITERALDB%' !='master' and '%XPATHLITERALDB%'!='msdb' and '%XPATHLITERALDB%'!='model' and '%XPATHLITERALDB%'!='tempdb' and (upper-case('%DBSTATUS%')='ONLINE')">
                                <Object
                                  Type="SQL" 
                                  Name="CheckDb2005"
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%]; SELECT 1 AS RecoveryModel FROM sys.databases AS databases WHERE [databases].[database_id] = DB_ID(N'%SQLLITERALDB%') AND [databases].[recovery_model]=3 AND [databases].[is_read_only]=0"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="RecoveryModel">
                                    <Rule 
                                      Name="dbRecoveryModel2005"
                                      GUID="fc8fcfa8-562a-46a3-a75c-72665dcaac83" 
                                      Error="Warning" 
                                      Title="Database Recovery Model For Database [{0}] On Server [{1}]"
                                      Text="Database [{2}] on server [{1}] with Standard/Enterprise Edition of SQL Server has recovery model 'SIMPLE'." 
                                      S0="%DBNAME%" 
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3047
                       
                       Rule Name: Databases that have collations different from master/model databases
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Checks if a database has collation setting different from master/model database.
                       
                       Inputs:
                        %Sql2000Check%                - Check for SQL 2000
                        %Sql2005Check%                - Check for SQL 2005
                        %DBSTATUS%                    - Database status
                        %DBNAME%                      - Database name
                        %CONNSTR%                     - The connection string to use
                        %SRVNAME%                     - The name of the SQL Server instance 
                        
                       Rules:
                          $dbCollation2000 - Evaluates to true if the database has different collation setting from master/model database (SQL2000)
                          $dbCollation2005 - Evaluates to true if the database has different collation setting from master/model database (SQL2005)
                      -->
                            <Object Type="Group" Name="DifferentCollations" LogText="Processing Database Collation Check" RuleId="RID3047" Requirement="NonSAP">
                              <Object Type="If" Key1="%Sql2000Check% and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <!--Get Databases with different collation settings-->
                                <Object
                                  Type="SQL" 
                                  Key1="%CONNSTR%"
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key2="USE [%SQLIDENTIFIERDB%];
                                      SELECT
                                        dtb.name AS [DatabaseName],
                                        CAST(DATABASEPROPERTYEX(dtb.name, 'Collation') AS sysname) AS [Collation]
                                      FROM
                                        master..sysdatabases AS dtb
                                      WHERE
                                        dtb.name NOT IN ('master', 'tempdb', 'model') AND
                                        dtb.name = N'%SQLLITERALDB%' AND  -- specific db check
                                        CAST(DATABASEPROPERTYEX(dtb.name, 'Collation') AS sysname) NOT IN
                                        (
	                                        SELECT DISTINCT
		                                        CAST(DATABASEPROPERTYEX(name, 'Collation') AS sysname) AS [Collation]
	                                        FROM
		                                        master..sysdatabases 
	                                        WHERE
		                                        name IN ('master', 'model')
                                        )"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="DatabaseName" Substitution="DBNAME">
                                    <Rule 
                                      Name="dbCollation2000" 
                                      GUID="c686446f-dae1-4b05-a3df-837b3422988d" 
                                      Error="Warning"
                                      Title="Set the Collation of User-defined Databases to match those of master and model Databases"
                                      Text="Database [{2}] on server [{1}] has collation setting different from 'master' or 'model' databases."
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                              <Object Type="If" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <!--Get Databases with auto-update-stats=FALSE-->
                                <Object
                                  Type="SQL" 
                                  Key1="%CONNSTR%"
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key2="USE [%SQLIDENTIFIERDB%];
                                      SELECT
                                        dtb.name AS [DatabaseName],
                                        dtb.collation_name AS [Collation]
                                      FROM
                                        master.sys.databases AS dtb
                                      WHERE
                                        dtb.name NOT IN ('master','tempdb', 'model') and
                                        dtb.name = N'%SQLLITERALDB%' AND  -- specific db check
                                        dtb.collation_name NOT IN
                                        (
	                                        SELECT DISTINCT
		                                        collation_name 
	                                        FROM
		                                        master.sys.databases 
	                                        WHERE
		                                        name IN ('master', 'model')
                                        )"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="DatabaseName" Substitution="DBNAME">
                                    <Rule 
                                      Name="dbCollation2005" 
                                      GUID="c686446f-dae1-4b05-a3df-837b3422988d" 
                                      Error="Warning"
                                      Title="Set the Collation of User-defined Databases to match those of [master] and [model] Databases"
                                      Text="Database [{2}] on server [{1}] has collation setting different from 'master' or 'model' databases. We recommend that User-defined databases to have collation matching [master] or [model] Databases."
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3049
                       
                       Rule Name: Databases with AutoShrink option SET
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Checks if a database has auto-shrink option SET
                       
                       Inputs:
                        %IsStandardEdition%           - Check for standard edition
                        %IsEnterpriseEdition%         - Check for enterprise edition
                        %Sql2000Check%                - Check for SQL 2000
                        %Sql2005Check%                - Check for SQL 2005
                        %DBSTATUS%                    - Database status
                        %DBNAME%                      - Database name
                        %CONNSTR%                     - The connection string to use
                        %SRVNAME%                     - The name of the SQL Server instance 
                        
                       Rules:
                          $autoShrink2000 - Evaluates to true if the database has auto-shrink option set (SQL2000)
                          $autoShrink2005 - Evaluates to true if the database has auto-shrink option set (SQL2005)
                      -->
                            <Object Type="Group" Name="AutoShrinkDatabase" LogText="Processing Database 'AutoShrink' option Rule" RuleId="RID3049" Requirement="SAP">
                              <Object Type="If" Key1="%Sql2000Check% and (%IsStandardEdition% or %IsEnterpriseEdition%) and '%XPATHLITERALDB%' !='master' and '%XPATHLITERALDB%'!='msdb' and '%XPATHLITERALDB%'!='model' and '%XPATHLITERALDB%'!='tempdb' and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <Object
                                  Type="SQL" 
                                  Key1="%CONNSTR%"
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key2="USE [%SQLIDENTIFIERDB%]; SELECT 1 AS AutoShrinkStatus FROM master..sysdatabases AS databases WHERE DB_ID(N'%SQLLITERALDB%') = dbid AND CAST(databases.status &amp; 4194304 AS BIT)=1"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="AutoShrinkStatus">
                                    <Rule 
                                      Name="autoShrink2000" 
                                      GUID="16403850-d745-4754-b84f-5f01aaecd24e" 
                                      Error="Warning"
                                      Title="Set the Auto_Shrink Database Option to OFF For Database [{0}] On Server [{1}]"
                                      Text="Database [{2}] on server [{1}] has auto-shrink option ON. We recommend setting this option OFF to avoid performance issues."
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                              <Object Type="If" Key1="%Sql2005Check% and (%IsStandardEdition% or %IsEnterpriseEdition%) and '%XPATHLITERALDB%' !='master' and '%XPATHLITERALDB%'!='msdb' and '%XPATHLITERALDB%'!='model' and '%XPATHLITERALDB%'!='tempdb' and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <Object
                                  Type="SQL" 
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%]; SELECT 1 AS AutoShrinkStatus FROM sys.databases WHERE [database_id] = DB_ID(N'%SQLLITERALDB%') AND [is_auto_shrink_on]=1"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="AutoShrinkStatus">
                                    <Rule 
                                      Name="autoShrink2005" 
                                      GUID="16403850-d745-4754-b84f-5f01aaecd24e" 
                                      Error="Warning"
                                      Title="Set the Auto_Shrink Database Option to OFF For Database [{0}] On Server [{1}]"
                                      Text="Database [{2}] on server [{1}] has auto-shrink option ON. We recommend setting this option OFF to avoid performance issues."
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3058
                       
                       Rule Name: Backups and DataFiles on same volume
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Checks if any of the databases has files and backups on same logical volume
                       
                       Inputs:
                        %DBSTATUS%                    - Database status
                        %DBNAME%                      - Database name
                        %CONNSTR%                     - The connection string to use
                        %SRVNAME%                     - The name of the SQL Server instance
                        %HOSTNAME%                    - Machine hosting SQL Server instance
                          
                       Rules:
                          $backupOnSameVolume - Evaluates to true if a database shares logical volume for backup and data files
                      -->
                            <Object Type="Group" Name="BackupsAndDataFilesOnSameVolume" LogText="Processing Backups And DataFiles On Same Volume Rule" RuleId="RID3058" Requirement="SAP">
                              <Object Type="If" Key1="upper-case('%DBSTATUS%')='ONLINE'" Display="Hide">
                                <Object
                                  Type="SQL" 
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%];
	                                SELECT DISTINCT
		                                UPPER(SUBSTRING([mediafamily].[physical_device_name],1,3)) as [backup_drive]
	                                FROM
		                                msdb.dbo.backupmediafamily [mediafamily],
		                                msdb.dbo.backupset [backupsets],
		                                master.dbo.sysaltfiles [dbfiles]
	                                WHERE
		                                db_name([dbfiles].[dbid])= N'%SQLLITERALDB%' AND
		                                [dbfiles].[groupid] != 0 AND
		                                [backupsets].[database_name]= db_name([dbfiles].[dbid]) AND
		                                [backupsets].[media_set_id]=[mediafamily].[media_set_id] AND
		                                LOWER(SUBSTRING([dbfiles].[filename],1,3)) = LOWER(SUBSTRING([mediafamily].[physical_device_name],1,3))"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="backup_drive">
                                    <Rule 
                                      Name="backupOnSameVolume" 
                                      GUID="7039bebb-1f25-4cf3-81f1-393dfb78da12" 
                                      Error="Warning"
                                      Title="Backups Must Be On Separate Volumes For Database [{0}] On Server [{1}]"
                                      Text="Database [{4}] on server [{1}] has logical volume [{2}] on machine [{3}] shared between it's backup and data files. We recommend backup and data files to be present on separate volumes."
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      P2="$."
                                      S3="%HOSTNAME%"
                                      S4="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3060
                       
                       Rule Name: Database AutoClose Performance Degradation
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Checks if any of the databases has auto-close setting = ON
                       
                       Inputs:
                        %IsStandardEdition%           - Check for standard edition
                        %IsEnterpriseEdition%         - Check for enterprise edition
                        %Sql2000Check%                - Check for SQL 2000
                        %Sql2005Check%                - Check for SQL 2005
                        %DBSTATUS%                    - Database status
                        %DBNAME%                      - Database name
                        %CONNSTR%                     - The connection string to use
                        %SRVNAME%                     - The name of the SQL Server instance 

                       Rules:
                          $autoCloseDb2000 - Evaluates to true if a database has auto-close setting = ON (SQL 2000)
                          $autoCloseDb2005 - Evaluates to true if a database has auto-close setting = ON (SQL 2005)
                      -->
                            <Object Type="Group" Name="AutoCloseDBPerformance" LogText="Processing Database AutoClose Performance Degradation Rule" RuleId="RID3060" Requirement="SAP">
                              <Object Type="If" Key1="%Sql2000Check% and (%IsStandardEdition% or %IsEnterpriseEdition%) and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <Object
                                  Type="SQL" 
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%]; SELECT 1 AS AutoCloseEnabled FROM master.dbo.sysdatabases as dtb WHERE dtb.dbid = DB_ID(N'%SQLLITERALDB%') AND CAST(dtb.status &amp; 1 AS bit) = 1"
                                  Key4="true"
                                  Display="Hide">
                                  <Setting Key1="AutoCloseEnabled">
                                    <Rule 
                                      Name="autoCloseDb2000" 
                                      GUID="e6b03364-263a-4ec4-9794-de9869d396ce" 
                                      Error="Warning"
                                      Title="Set the Auto_Close Database Option to OFF For Database [{0}] On Server [{1}]"
                                      Text="Database [{2}] on server [{1}] has AutoClose setting ON. This may result in performance degradation due to flushing of procedure cache."
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                              <Object Type="If" Key1="%Sql2005Check% and (%IsStandardEdition% or %IsEnterpriseEdition%) and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <Object
                                  Type="SQL" 
                                  GroupingClass="True" 
                                  Class="%SRVNAME%.%DBNAME%" 
                                  Key1="%CONNSTR%"
                                  Key2="USE [%SQLIDENTIFIERDB%]; SELECT 1 AS AutoCloseEnabled FROM sys.databases as dtb WHERE dtb.name = N'%SQLLITERALDB%' AND dtb.is_auto_close_on = 1"
                                  Key4="true" 
                                  Display="Hide">
                                  <Setting Key1="AutoCloseEnabled">
                                    <Rule 
                                      Name="autoCloseDb2005" 
                                      GUID="e6b03364-263a-4ec4-9794-de9869d396ce" 
                                      Error="Warning"
                                      Title="Set the Auto_Close Database Option to OFF For Database [{0}] On Server [{1}]"
                                      Text="Database [{2}] on server [{1}] has AutoClose setting ON. This may result in performance degradation due to flushing of procedure cache."
                                      S0="%DBNAME%"
                                      S1="%SRVNAME%"
                                      S2="%LABELTEXTDB%"/>
                                  </Setting>
                                </Object>
                              </Object>
                            </Object>

                            <!-- 
                       RuleId: RID3071
                       
                       Rule Name: Data and log files compressed without read-only attribute
                       
                       Applies To: SQL 2000, SQL 2005
                       
                       Checks if any of the data/log files have been compressed without Read-Only attribute
                       
                       Inputs:
                        %Sql2000Check%                - Check for SQL 2000
                        %Sql2005Check%                - Check for SQL 2005
                        %DBSTATUS%                    - Database status
                        %DBNAME%                      - Database name
                        %CONNSTR%                     - The connection string to use
                        %SRVNAME%                     - The name of the SQL Server instance 
                       
                       Rules:
                          $compressedWriteModeFiles2k - Evaluates to true if data/log file are compressed without read-only attribute (SQL 2000)
                          $compressedWriteModeFiles2k5 - Evaluates to true if data/log file are compressed without read-only attribute (SQL 2005)
                      -->
                            <Object Type="Group" Name="Data and log files compressed without read-only attribute" LogText="Processing Data And Log Files Compressed Attribute Rule" RuleId="RID3071" Requirement="SAP">
                              <Object Type ="If" Key1="%Sql2000Check% and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <Object
                                  Type="SQL" 
                                  Name="DBFiles"
                                  Key1="%CONNSTR%"
                                  Key2="USE [master];DECLARE @isReadOnly AS INT; SELECT @isReadOnly = COUNT(*) FROM sysdatabases AS [databases] WHERE ([databases].[status] &amp; 1024) &lt;&gt; 0 AND [databases].[name] = '%SQLLITERALDB%'; USE [%SQLIDENTIFIERDB%];IF(@isReadOnly > 0) SELECT rtrim(filename) AS FileName FROM dbo.sysfiles Else SELECT rtrim(filename) AS FileName FROM dbo.sysfiles files, sysfilegroups groups where files.groupid = groups.groupid and convert(bit, (groups.status &amp; 0x08)) = 1"
                                  Key4="true" 
                                  Display="Hide">
                                  <Setting Key1="FileName" Substitution="FILE_PATH" SubstitutionFormat="\\----\\"/>
                                  <Object
                                    Type="WMI"
                                    Key1="%HOSTNAME%"
                                    Key2="root\CIMV2"
                                    Key3="CIM_DataFile"
                                    GroupingClass="True" 
                                    Class="%SRVNAME%.%DBNAME%" 
                                    Key4="Name='%FILE_PATH%'"
                                    Display="Hide">
                                    <Setting Key1="Compressed" Substitution="CompressedState">
                                    </Setting>
                                    <Setting Key1="Writeable"  Substitution="WriteableState">
                                      <Rule 
                                        Name="compressedWriteModeFiles2k" 
                                        GUID="644afab4-beab-426d-bd3f-ba1272ab7ecc" 
                                        Query="'%CompressedState%' = 'True' and '%WriteableState%' = 'True'" 
                                        Error="Warning"
                                        Title="Place Log Files on an Uncompressed Drive For Database [{1}] On Server [{2}]"
                                        Text="File [{0}] is compressed and writeable. We recommend marking a compressed data or log file as read-only."
                                        S0="%FILE_PATH%"
                                        S1="%DBNAME%"
                                        S2="%SRVNAME%"/>
                                    </Setting>
                                  </Object>
                                </Object>
                              </Object>
                              <Object Type ="If" Key1="%Sql2005Check% and (upper-case('%DBSTATUS%')='ONLINE')" Display="Hide">
                                <Object
                                  Type="SQL" 
                                  Name="DBFiles"
                                  Key1="%CONNSTR%"
                                  Key2="USE [master]; DECLARE @isReadOnly AS INT; SELECT @isReadOnly = COUNT(*) FROM sys.databases AS [databases] WHERE [databases].[is_read_only] = 1 AND [databases].[name] = '%SQLLITERALDB%'; USE [%SQLIDENTIFIERDB%]; IF(@isReadOnly > 0) SELECT rtrim(physical_name) AS FileName FROM sys.database_files Else SELECT rtrim(physical_name) AS FileName FROM sys.database_files files, sys.filegroups groups where files.data_space_id = groups.data_space_id and groups.is_read_only = 1;"
                                  Key4="true" 
                                  Display="Hide">
                                  <Setting Key1="FileName" Substitution="FILE_PATH" SubstitutionFormat="\\----\\"/>
                                  <Object
                                    Type="WMI"
                                    GroupingClass="True" 
                                    Class="%SRVNAME%.%DBNAME%" 
                                    Key1="%HOSTNAME%"
                                    Key2="root\CIMV2"
                                    Key3="CIM_DataFile"
                                    Key4="Name='%FILE_PATH%'"
                                    Display="Hide">
                                    <Setting Key1="Compressed" Substitution="CompressedState">
                                    </Setting>
                                    <Setting Key1="Writeable"  Substitution="WriteableState">
                                      <Rule 
                                        Name="compressedWriteModeFiles2k5" 
                                        GUID="644afab4-beab-426d-bd3f-ba1272ab7ecc" 
                                        Query="'%CompressedState%' = 'True' and '%WriteableState%' = 'True'" 
                                        Error="Warning"
                                        Title="Place Log Files on an Uncompressed Drive For Database [{1}] On Server [{2}]"
                                        Text="File [{0}] is compressed and writeable. We recommend marking a compressed data or log file as read-only."
                                        S0="%FILE_PATH%"                                      
                                        S1="%DBNAME%"
                                        S2="%SRVNAME%"/>
                                    </Setting>
                                  </Object>
                                </Object>
                              </Object>
                            </Object>

                            <!--End of Select some common database properties.-->
                          </Object>

                        </Object>
                        <!--End of Analyzing Database Level Rules-->
                      </Object>
                    </Object>
                  </Object>
                </Object>

                <!--Unsupported SQL Server Version Check i.e. < SQL2000-->
                <Object Type="Group" Display="Hide">
                  <Rule Name="sqlUnsupportedVersion" Query="not(%Sql2005Check%) and not(%Sql2000Check%)" Error="None" Title="Skipping Scan For Host [%HOSTNAME%]" Text="Skipping scan for host [%HOSTNAME%]. Version of target sql server [%SQLProductVersion%] is not supported."/>
                </Object>

                <!--Inaccessible SQL Service Check-->
                <Rule Name="sqlServerNotAccessible" Query="count(../Instance) = 0" Error="None" Title="Skipping Scan" Text="Skipping Scan For SQL Server [%SRVNAME%]. Unable To Connect To Target Server."/>
                <!--End of Finding out SQL Server Version-->
              </Object>

            </Object>
            <!--End of Analyzing Server Instance Level Rules-->
          </Object>
          <!--End of Getting the SQL Server Database Engines for each machine-->
        </Object>
        <!--Get the SQL Server Analysis Services for each machine-->
        <Object
          Type="Xml" 
          Key1="%CONFIG_INPUT_SERVER%" 
          Key2="%CONFIG_INPUT_FILEPATH%"
          Key3="SQLBPA/Computer[@Name=&quot;%HOSTNAME%&quot;]/AnalysisServers/AnalysisServer">
          <Setting Key1="@Name" Substitution="ANALYSISSVR"/>
          <Setting Key1="@Name" Substitution="INSTANCENAME" SubstitutionFormat="^([^\\]+)(\\(.+))?$----$3"/>
          <Setting Key1="ConnectionString/text()" Substitution="CONNSTR"/>
          <!--Execute Server Level Rules-->
          <Object Type="Group" Name="[%ANALYSISSVR%] Analyzing SQL Server Analysis Services" TrackProgress="TrackProgress">

            <!--
              RuleId: RID0047
              
              Rule Name: SQL Server Analysis Services Recommended Account
              
              Applies to: SQL 2000,2005
            
              Analysis Service should run under NSA.
              
              Inputs:
                %HOSTNAME%      - Machine hosting the SSIS Service.
              
              Rules:
            -->
            <Object Type="Group" GroupingClass="True" Class="%ANALYSISSVR%" Name="SQL Server Analysis Services Recommended Account" DisplayName="SQL Server Analysis Services Recommended Account" Description="This check determines if the Analysis service is running under Network Service account.Also, Analysis service should not be running under privileged account." LogText="Processing SQL Server Analysis Services Recommended Account Rule" RuleId="RID0047" VulnerabilityID="RID0047" Requirement="NonSAP">
              <!--Default Instance.-->
              <Object Type="If" Name="Default Instance Detection" Key1="'%INSTANCENAME%'=''">
                <Reference Type="CheckAnalysisServiceAccount" Name="DefaultInstance">
                  <Substitution Name="ANALYSISSERVICENAME">MSSQLServerOLAPService</Substitution>
                </Reference>
                <!--End of Default Instance.-->
              </Object>
              <!--Named Instances.-->
              <Object Type="If" Name="Named Instance Detection" Key1="'%INSTANCENAME%'!=''">
                <Reference Type="CheckAnalysisServiceAccount" Name="NamedInstance">
                  <Substitution Name="ANALYSISSERVICENAME">MSOLAP$%INSTANCENAME%</Substitution>
                </Reference>
                <!--End of Named Instance.-->
              </Object>
            </Object>
            <!--
              RuleId: RID2018
              
              Rule Name: Server Properties set to non-default values
              
              Applies To: SQL 2005
              
              Check determines if any of the server properties are set to non-default values
              
              Inputs:
                %ANALYSISSVR% - The name of Analysis Server instance.              
              
              Rules:
                $pszNonDefaultServerProperties: This lists the server properties that are set to non-default values
              -->
            <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%" Key1="%ANALYSISSVR%" Key3="non-default-server-properties"  Display="Hide" LogText="Processing Server Properties Rule" RuleId="RID2018" Requirement="NonSAP">
              <Setting>
                <Rule Name="pszNonDefaultServerProperties" Title="Server Configuration - Non-Default Values" GUID="e26c6927-3611-42d5-91dc-b4eeb123893c" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
              </Setting>
            </Object>
            <!-- 
              RuleId: RID2019
              
              Rule Name: MaxThreads Server Properties set non-optimal values
              
              Applies To: SQL 2005
              
              Check determines if any 
                1. ThreadPool\Process\MaxThreads = 10 * #CPUs
                2. ThreadPool\Query\MaxThreads = 2 * #CPUs
              
              Inputs:
                %ANALYSISSVR% - The name of Analysis Server instance.              
                              
              Rules:
                $pszNonOptimalMaxThreads: This lists the servers with non-optimal settings for MaxThreads Server Properties
              -->
            <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%" Key1="%ANALYSISSVR%" Key3="non-optimal-max-threads-server-properties"  Display="Hide" LogText="Processing MaxThreads Server Properties Rule" RuleId="RID2019" Requirement="NonSAP">
              <Setting>
                <Rule Name="pszNonOptimalMaxThreads" Title="Server Configuration - Non-Optimal MaxThread Settings" GUID="58b2ba2a-2dbc-4394-ab55-7075858951b4" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
              </Setting>
            </Object>
          </Object>
          <!--Get the databases for each Analysis Service instances.-->
          <Object
            Type="Xml" 
            Key1="%CONFIG_INPUT_SERVER%" 
            Key2="%CONFIG_INPUT_FILEPATH%"
            Key3="SQLBPA/Computer[@Name=&quot;%HOSTNAME%&quot;]/AnalysisServers/AnalysisServer[@Name=&quot;%ANALYSISSVR%&quot;]/Databases/Database">
            <Setting Key1="@Name" Substitution="ANALYSISDB"/>
            <!--Analyzing Analysis Server Database-->
            <Object Type="Group" Name="[%ANALYSISSVR%] Analyzing SQL Server Analysis Services Database [%ANALYSISDB%]" TrackProgress="TrackProgress">
              <!-- 
                RuleId: RID2000                
                
                Rule Name: No hierarchies in dimension
                
                Applies To: SQL 2005
                                
                Check determines that the every dimension has atleast one hierarchy defined.
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pHierarchiesPresent: This lists the dimensions that do not have any hierarchies defined
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="no-hierarchies-in-dimension"  Display="Hide" LogText="Processing Dimension Hierarchy Rule" RuleId="RID2000" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pHierarchiesPresent" Title="No Hierarchies in Dimension" GUID="abda766d-ced2-4df7-8eb0-edeb6ff6a15d" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2001     
                
                Rule Name: Unrelated attributes in hierarchy
                
                Applies To: SQL 2005
                
                Check determines that the every attribute in a hierarchy is related to the key attribute either directly or indirectly.
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name             
                   
                Rules:
                  $pUnrelatedHierarchies: This lists the hierarchies that that have isolated attributes
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="unrelated-attributes-in-hierarchy"  Display="Hide" LogText="Processing Unrelated Attributes In Hierarchy Rule" RuleId="RID2001" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pUnrelatedHierarchies" Title="Unrelated Attributes in Hierarchy" GUID="b67403e0-265f-4165-a9f1-4cc07ac74609" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2002    
                
                Rule Name: Non aggregatable attributes in parent child dimensions
                
                Applies To: SQL 2005
                
                Check determines that there are no parent-child dimensions that have non-aggregatable regular attributes 
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name    
                
                Rules:
                  $pszNonAggrAttribs: This lists the parent-child dimensions that have non-aggregatable regular attributes
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="non-aggregatable-attributes-in-parent-child-dimensions"  Display="Hide" LogText="Processing Non-Aggregatable Attributes In Parent-Child Dimensions Rule" RuleId="RID2002" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszNonAggrAttribs" Title="Non-Aggregatable Attributes in Parent-Child Dimension" GUID="008f593e-ef87-40b0-b104-966383690329" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2003                
                
                Rule Name: Explicit default members for non aggregatable attributes 
                
                Applies To: SQL 2005
                
                Check determines that the non-aggregatable attributes in dimensions have default members defined
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name   
                
                Rules:
                  $pszExplicitDefaultMembers: This lists the attributes and dimensions that have non-aggregatable attributes with no default 
                                             members defined.
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="explicit-default-members-for-non-aggregatable-attributes"  Display="Hide" LogText="Processing Explicit Default Members For Non-Aggregatable Attributes Rule" RuleId="RID2003" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszExplicitDefaultMembers" GUID="90f8e394-39d6-4e6d-866f-f6e2416b409a" Title="Explicit Default Members required for Non-Aggregatable Attributes" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2004
                
                Rule Name: Number of non aggregatable attributes  
                
                Applies To: SQL 2005
                
                Check determines that there should not be more than single non-aggregatable attributes in a dimension
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name 
                
                Rules:
                  $pszNumNonAggrAttribs: This lists the dimensions that have more than one non-aggregatable attributes
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="number-of-non-aggregatable-attributes"  Display="Hide" LogText="Processing Non-Aggregatable Attributes Count Rule" RuleId="RID2004" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszNumNonAggrAttribs" GUID="9c1af509-40cf-4a0f-a419-4b7379e613fa" Title="More than one Non-Aggregatable Attributes in Dimension" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2006         
                
                Rule Name: Key attribute hierarchy visible
                
                Applies To: SQL 2005
                
                Check suggests that attribute hierarchy for key attribute should not be marked visible.
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name 
                
                Rules:
                  $pszKeyAttributeHierarchyVisible: This lists the key attributes that have their attribute hierarchies marked visible.
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="key-attribute-hierarchy-visible"  Display="Hide" LogText="Processing Attribute Hierarchy Visibility Rule" RuleId="RID2006" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszKeyAttributeHierarchyVisible" Title="Attribute Hierarchy Visible for Key Attribute of Parent-Child Dimension" GUID="8f0983e7-c466-44ea-a1fe-7ccd67cdef71" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2007
                
                Rule Name: Ignore duplicate key error
                
                Applies To: SQL 2005
                
                Check suggests that duplicate key errors for dimensions should not be ignored.
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszDuplicateKeyError: This lists the dimensions that ignore the duplicate key errors.
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="ignore-duplicate-key-error"   Display="Hide" LogText="Processing Duplicate Key Error Rule" RuleId="RID2007" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszDuplicateKeyError" Title="Error Configuration - Duplicate Key Error Ignored" GUID="73f67634-a3b1-4a01-b232-564850d57438" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2010
                
                Rule Name: Single attribute dimensions
                
                Applies To: SQL 2005
                
                Check determines if there are more than 10 dimensions in a database with single attribute per dimension
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszSingleAttributeDimension: This lists the databases that have more than 10 dimensions with single attribute per dimension
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="single-attribute-dimensions"  Display="Hide" LogText="Processing Single Attribute Dimension Rule" RuleId="RID2010" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszSingleAttributeDimension" Title="Too many Dimensions with Single Attribute" GUID="0d1d5ecb-e928-4452-a19f-ed39a51813d1" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2011
                
                Rule Name: Maximum measure groups in cube
                
                Applies To: SQL 2005
                
                Check determines if there are more than 16 measure groups in a cube
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name           
                                
                Outputs:
                
                Rules:
                  $pszMaxMeasureGroups: This lists the cubes that have more than 16 measure groups
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="max-measure-groups-in-cube"  Display="Hide" LogText="Processing Cube Measure Groups Count Rule" RuleId="RID2011" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszMaxMeasureGroups" Title="Too many Measure Groups in a Cube" GUID="cc64f7b7-240e-4a66-a655-1708219ba66e" Query="$.!=''" Error="Error" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2012      
                
                Rule Name: Dimension with UnknownMember=Hidden
                
                Applies To: SQL 2005
                
                Check determines if there are dimensions with UnknownMember property set to HIDDEN
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name     
                
                Rules:
                  $pszUnknownMembers: This lists the dimension with UnknownMember property = HIDDEN
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="dimension-unknownmember-hidden"  Display="Hide" LogText="Processing Dimension With Hidden UnknownMember Rule" RuleId="RID2012" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszUnknownMembers" Title="Dimension Configuration - UnknownMember=HIDDEN" GUID="070e205b-b4fb-4355-bc16-ce23e6598d8e" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2013             
                
                Rule Name: No AggregationDesigns Defined
                
                Applies To: SQL 2005
                
                Check determines if there are MeasureGroups with no aggregation designs
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name    
                
                Rules:
                  $pszNoAggregationDesigns: This lists the measure groups that have no aggregation designs
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="no-aggregation-designs"  Display="Hide" LogText="Processing Aggregation Designs Defined Rule" RuleId="RID2013" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszNoAggregationDesigns" Title="Measure-Groups without Aggregation Designs" GUID="6a027dff-c1e7-4d49-b130-45cbcfade1fa" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2014 
                
                Rule Name: AggregationDesigns Not Applied
                
                Applies To: SQL 2005
                
                Check determines if there AggregationDesigns that are not applied to aggregations
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name   
                
                Rules:
                  $pszAggregationDesignsNotApplied: This lists the aggregation designs that have no aggregations
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="aggregation-designs-not-applied"  Display="Hide" LogText="Processing Aggregation Designs Applied Rule" RuleId="RID2014" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszAggregationDesignsNotApplied" Title="Aggregation Designs without Aggregations" GUID="9dc0958c-b2e6-4edf-8871-24579be4d910" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2015
                
                Rule Name: Large KeyAttributes should be Numeric
                
                Applies To: SQL 2005
                
                Check determines if there are large (> 1M members) key attributes with non-numeric columns
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszLargeNonNumericKeyAttributes: This lists the large non numeric key attributes 
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="large-keyattributes-should-be-numeric"  Display="Hide" LogText="Processing Large KeyAttributes Rule" RuleId="RID2015" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszLargeNonNumericKeyAttributes" Title="Non-numeric Large Keys" GUID="cf96e91a-1c2f-45b8-8a26-719f58f9f310" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2016
                
                Rule Name: Too many Aggregation Designs
                
                Applies To: SQL 2005
                
                Check determines the following for each Measure Group:
                  1. #Aggr.Designs > 2 && # Partitions < 10 OR
                  2. #Aggr.Designs > 3 && # Partitions < 50 OR
                  3. #Aggr.Designs > 4
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszTooManyAggregationDesigns: This lists the measure groups with too many aggregation designs
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="too-many-aggregation-designs"  Display="Hide" LogText="Processing Too many Aggregation Designs Rule" RuleId="RID2016" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszTooManyAggregationDesigns" Title="Too many Aggregation Designs" GUID="fd2137c2-b187-45f0-b566-ef3bc2ab4270" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!--
                RuleId: RID2017
                
                Rule Name: Single Dimension Cube
                
                Applies To: SQL 2005
                
                Check determines if any cube has a single dimension.
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszSingleDimensionCubes: This lists the cubes that have single dimensions
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="cube-with-single-dimension"  Display="Hide" LogText="Processing Single Dimension Cube Rule" RuleId="RID2017" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszSingleDimensionCubes" Title="Cube with only one Dimension" GUID="e7a77fc0-e29d-44b4-98c5-2628a233cfef" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2020
                
                Rule Name: Dimensions that can be switched to ROLAP mode
                
                Applies To: SQL 2005
                
                Check determines if any dimension has proactive caching latency less than silence interval / silence override interval
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszDimensionInROLAPMode: This lists the dimensions that can be switched to ROLAP mode
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="dimension-in-ROLAP-mode"  Display="Hide" LogText="Processing Dimensions Switchable To ROLAP Mode Rule" RuleId="RID2020" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszDimensionInROLAPMode" Title="Dimensions that can be switched to ROLAP mode" GUID="6c6b6831-f0c4-450b-b351-55d6881b8727" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2021
                
                Rule Name: List of spare aggregation designs
                
                Applies To: SQL 2005
                
                Check determines if any measure group has aggregation designs that are not used by any of the partitions
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszSpareAggregationDesigns: This lists the dimensions that can be switched to ROLAP mode
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="spare-aggregation-designs"  Display="Hide" LogText="Processing Spare Aggregation Designs Rule" RuleId="RID2021" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszSpareAggregationDesigns" Title="Aggregation Designs not used by any Partition (Spare Aggregation Designs)" GUID="03fea525-0013-43d4-909f-11d7a5286ccf" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2022
                
                Rule Name: List of partitions with extreme sizes
                
                Applies To: SQL 2005
                
                Check determines if any measure group has following
                1. Partition with more than 50M estimated rows
                2. More than 5 partitions with less than 2M estimated rows
                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszExtremePartitions: This lists the partitions with extreme sizes
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="extreme-partition-sizes"  Display="Hide" LogText="Processing Extreme Partition Sizes Rule" RuleId="RID2022" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszExtremePartitions" Title="Extreme Partition Sizes" GUID="10d1ce38-5379-4192-acfe-592e4936e120" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2023
                
                Rule Name: Measure with distinct count should be in separate measure group
                
                Applies To: SQL 2005
                
                Check determines if any measure group has more than one measures and has a measure with distinct count aggregation 
                function.If yes, then recommend the user to move the measure to a separate measure group.
                                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszDistinctCountMeasure: This lists the measure with distinct count aggregation function that appears alongwith other 
                                            measures in a measure group
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="separate-distinct-count-measure"  Display="Hide" LogText="Processing Measures Using Distinct Count Rule" RuleId="RID2023" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszDistinctCountMeasure" Title="Distinct Count Measures" GUID="0aab4bdb-ed67-40a7-92d4-ecadf1390be3" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!-- 
                RuleId: RID2024
                
                Rule Name: Natural Hierarchy with member attribute having AttributeHierarchyVisible=True
                
                Applies To: SQL 2005
                
                Check determines if any natural hierarchy has level whose source attribute has attribute hierarchy visible = True. 
                We recommend to set it to False.
                                
                Inputs:
                  %ANALYSISSVR% - The name of Analysis Server instance              
                  %ANALYSISDB%  - Database name
                
                Rules:
                  $pszAttributeHierarchyVisibleInNaturalHierarchy: This lists the natural hierarchies that have attributes with 
                                                                  AttributeHierarchyVisible = True
              -->
              <Object Type="SSAS" GroupingClass="True" Class="%ANALYSISSVR%.%ANALYSISDB%" Key1="%ANALYSISSVR%" Key2="%ANALYSISDB%" Key3="natural-hierarchy-with-visible-attribute-hierarchy"  Display="Hide" LogText="Processing Natural Hierarchy With Visible Attribute Hierarchy Rule" RuleId="RID2024" Requirement="NonSAP">
                <Setting>
                  <Rule Name="pszAttributeHierarchyVisibleInNaturalHierarchy" Title="Attribute Hierarchy Visible In Natural Hierarchy" Query="$.!=''" Error="Warning" Sev="3" Text="{0}" P0="$."/>
                </Setting>
              </Object>
              <!--End of Analyzing Analysis Server-->
            </Object>
            <!--End of Get the databases for each Analysis Service instances.-->
          </Object>
          <!--End of Get the SQL Server Analysis Services for each machine-->
        </Object>
        <!--Get the Integration Service for each machine-->
        <Object
          Type="Xml" 
          Key1="%CONFIG_INPUT_SERVER%" 
          Key2="%CONFIG_INPUT_FILEPATH%"
          Key3="SQLBPA/Computer[@Name=&quot;%HOSTNAME%&quot;]/SqlServerIntegrationService">
          <!--SQL Server Integration Services Recommended Account
            RuleId: RID0014
            Applies to: SQL 2005
          
            This check determines the Microsoft® SQL Server™ service accounts on the scanned computer.
            If the services are running under a high privilege account, make a recommendation to run them 
            under the recommended low privilege accounts 

            Type   Service                            Service Name            Recommended Account
            4      SQL Server Integration Services	  MsDtsServer 	          Network service account 
            
            Inputs:
            %HOSTNAME%      - Machine hosting the SSIS Service.
            
            Outputs:
            iDTSAccountName - SSIS service account name.
            
            Rules:
          -->
          <Object Type="Group" GroupingClass="True" Class="%HOSTNAME%"  Name="SQL Server Integration Services Recommended Account" DisplayName="SQL Server Integration Services Recommended Account" Description="This check determines if the SSIS service is running under Network Service account.Also, SSIS should not be running under privileged account." LogText="Processing SQL Server Integration Services Recommended Account Rule" RuleId="RID0014" VulnerabilityID="RID0014" Requirement="SAP">
            <!--Get Dts service details.-->
            <Object Type="WMI" Key1="%HOSTNAME%" Key3="Win32_Service" Key4="Name = 'MsDtsServer'" Display="Hide">
              <Setting Key1="StartName" Substitution="DTSACCOUNTNAME" SubstitutionFormat="\.\\----%HOSTNAME%\"/>
              <!--LocalSystemCheck-->
              <Object Type="If" Name="LocalSystemCheck" Key1="upper-case('%DTSACCOUNTNAME%')=upper-case('localsystem')">
                <Reference Type="CheckDTSAccount" Name="DTSInLS">
                  <Substitution Name="DTSACCOUNTNAME">LocalSystem</Substitution>
                  <Substitution Name="DTSACCOUNTSID">S-1-5-18</Substitution>
                </Reference>
                <!--End of LocalSystemCheck-->
              </Object>
              <!--NonLocalSystemCheck : service account name could be either <domainname>\<username> or <username>@<dnsforestname>.-->
              <Object Type="If" Name="NonLocalSystemCheck" Key1="upper-case('%DTSACCOUNTNAME%')!=upper-case('localsystem')">
                <Object Type="LookupAccount" Key1="Name" Key2="%HOSTNAME%" Key3="%DTSACCOUNTNAME%">
                  <Setting Key1="Sid" Substitution="DTSACCOUNTSID"/>
                  <Reference Type="CheckDTSAccount" Name="DTSNotInLS">
                    <Substitution Name="DTSACCOUNTNAME">%DTSACCOUNTNAME%</Substitution>
                    <Substitution Name="DTSACCOUNTSID">%DTSACCOUNTSID%</Substitution>
                  </Reference>
                </Object>
                <!--End of NonLocalSystemCheck-->
              </Object>
              <!--End of Get Dts service details-->
            </Object>
          </Object>
          <!--Get the packages.-->
          <Object
            Type="Xml" 
            Key1="%CONFIG_INPUT_SERVER%" 
            Key2="%CONFIG_INPUT_FILEPATH%"
            Key3="SQLBPA/Computer[@Name=&quot;%HOSTNAME%&quot;]/SqlServerIntegrationService/Packages/Package">
            <Setting Key1="PackageType/text()" Substitution="PackageType"/>
            <Setting Key1="PackagePath/text()" Substitution="PackagePath" />
            <Setting Key1="PackagePath/text()" Substitution="PackageName" SubstitutionFormat="^((.*)\\)([^\\ ]+)(\.dtsx)?$----$3"/>
            <!--Analyzing Integration Services-->
            <Object Type="Group" Name="[%HOSTNAME%] Analyzing Integration Services Package [%PackageName%]" TrackProgress="TrackProgress">
              <!--Invoke the Integration Services Rules.-->
              <Reference Type="IntegrationServicesRules" Name="AnalyzingDeployedPackage">
                <Substitution Name="PackageType">%PackageType%</Substitution>
                <Substitution Name="PackagePath">%PackagePath%</Substitution>
                <Substitution Name="HOSTNAME">%HOSTNAME%</Substitution>
              </Reference>
              <!--End of Analyzing Integration Services-->
            </Object>
            <!--End of Get the packages.-->
          </Object>
          <!--End of Get the Integration Service for each machine-->
        </Object>
        <!--Get the Files for each machine.-->
        <Object
          Type="Xml" 
          Key1="%CONFIG_INPUT_SERVER%" 
          Key2="%CONFIG_INPUT_FILEPATH%"
          Key3="SQLBPA/Computer[@Name=&quot;%HOSTNAME%&quot;]/Files/File">
          <Setting Key1="@Type" Substitution="FILETYPE"/>
          <Setting Key1="@Name" Substitution="FILENAME"/>
          <!--If the file is of Dtsx type, run the Integration Services rules.-->
          <Object Type="If" Name="DtsxCheck" Key1="'%FILETYPE%' = 'DtsxFile'">
            <Object Type="Group" Name="[%HOSTNAME%] Analyzing DTSX file [%FILENAME%]" TrackProgress="TrackProgress">
              <Reference Type="IntegrationServicesRules" Name="AnalyzingUndeployedPackage">
                <Substitution Name="PackageType">FileSystem</Substitution>
                <Substitution Name="PackagePath">%FILENAME%</Substitution>
                <Substitution Name="HOSTNAME">%HOSTNAME%</Substitution>
              </Reference>
            </Object>
          </Object>
          <!--End of Get the Files for each machine.-->
        </Object>
        <Rule Name="wmiNotAccessible" Query="count(../Instance) = 0" Error="None" Title="Skipping Scan" Text="Skipping scan for host [%HOSTNAME%]. Unable to connect to WMI service."/>
        <!--End of WMI Access Check.-->
      </Object>
      <Rule Name="registryNotAccessible" Query="count(../Instance) = 0" Error="None" Title="Skipping Scan" Text="Skipping scan for host [%HOSTNAME%]. Unable to connect to Registry."/>
      <!--End of Registry Access Check.-->
    </Object>
    <!--End of Get the machine names.-->
  </Object>
</ObjectCollector>