<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0" copyright="Copyright (c) Microsoft Corporation. All Rights Reserved." xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <assemblyIdentity name="Microsoft-Windows-Security-Netlogon" version="10.0.26100.8521" processorArchitecture="amd64" language="neutral" buildType="release" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" />
  <dependency discoverable="no" resourceType="Resources">
    <dependentAssembly>
      <assemblyIdentity name="Microsoft-Windows-Security-Netlogon.Resources" version="10.0.26100.8521" processorArchitecture="amd64" language="*" buildType="release" publicKeyToken="31bf3856ad364e35" />
    </dependentAssembly>
  </dependency>
  <file name="netlogon.dll" destinationPath="$(runtime.system32)\" sourceName="netlogon.dll" importPath="$(build.nttree)\" sourcePath=".\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
      <dsig:Transforms>
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue>QS8k3RK2E3CiTfWFn+WHK1FEQl3mfqqcJKGSLgLVoWg=</dsig:DigestValue>
    </asmv2:hash>
  </file>
  <memberships>
    <categoryMembership>
      <id name="Microsoft.Windows.Categories.Services" version="10.0.26100.8521" publicKeyToken="31bf3856ad364e35" typeName="Service" />
      <categoryInstance subcategory="Netlogon">
        <serviceData name="Netlogon" displayName="@%SystemRoot%\System32\netlogon.dll,-102" errorControl="normal" start="demand" type="win32ShareProcess" description="@%SystemRoot%\System32\netlogon.dll,-103" dependOnService="LanmanWorkstation" group="MS_WindowsRemoteValidation" imagePath="%systemroot%\system32\lsass.exe" objectName="LocalSystem" />
      </categoryInstance>
    </categoryMembership>
    <categoryMembership>
      <id name="Microsoft.Windows.Categories" version="1.0.0.0" publicKeyToken="365143bb27e7ac8b" typeName="BootRecovery" />
    </categoryMembership>
  </memberships>
  <asmv3:configuration xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
    <asmv3:configurationSchema>
      <xsd:schema xmlns="Microsoft-Windows-Security-Netlogon" targetNamespace="Microsoft-Windows-Security-Netlogon">
        <xsd:element name="Pulse" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="Randomize" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="PulseMaximum" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="PulseConcurrency" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="PulseTimeout1" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="PulseTimeout2" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="MaximumMailslotMessages" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="MailslotMessageTimeout" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="MailslotDuplicateTimeout" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="ExpectedDialupDelay" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="ScavengeInterval" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="EventLogPeriodicity" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="WarningEventThreshold" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element default="30" name="MaximumPasswordAge" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="LdapSrvPriority" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="LdapSrvWeight" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="LdapSrvPort" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="LdapGcSrvPort" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="KdcSrvPort" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DnsTtl" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DnsRefreshInterval" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="CloseSiteTimeout" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="SiteNameTimeout" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DuplicateEventlogTimeout" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="MaxConcurrentApi" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="NegativeCachePeriod" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="BackgroundRetryInitialPeriod" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="BackgroundRetryMaximumPeriod" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="BackgroundRetryQuitTime" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="BackgroundSuccessfulRefreshPeriod" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="NonBackgroundSuccessfulRefreshPeriod" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DnsFailedDeregisterTimeout" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="MaxLdapServersPinged" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="MaxConcurrentDiscoveryOperations" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DCLocatorLdapConnectionCacheEnabled" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="SiteCoverageRefreshInterval" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="FtInfoUpdateInterval" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DBFlag" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="MaximumLogFileSize" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AddressTypeReturned" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="ForceRediscoveryInterval" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="RefusePasswordChange" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AvoidSamRepl" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AvoidLsaRepl" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="VulnerableChannelAllowList" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element default="1" name="SignSecureChannel" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element default="1" name="SealSecureChannel" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element default="1" name="RequireSignOrSeal" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element default="1" name="RequireStrongKey" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="UseDynamicDns" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="RegisterDnsARecords" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AvoidPdcOnWan" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AutoSiteCoverage" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AvoidDnsDeregOnShutdown" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DnsUpdateOnAllAdapters" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="Nt4Emulator" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="RestrictNTLMInDomain" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DCAllowedNTLMServers" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AuditNTLMInDomain" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="EnableChainSetClientAttributes" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element default="0" name="DisablePasswordChange" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="NeutralizeNt4Emulator" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AllowSingleLabelDnsDomain" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AllowDnsSearchSuffix" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AllowExclusiveSysvolShareAccess" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AllowExclusiveScriptsShareAccess" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AvoidLocatorAccountLookup" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="NeverPing" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="RegisterSiteSpecificDnsRecordsOnly" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="TryNextClosestSite" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DisableNTLMOnServer" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="AllowNT4Crypto" type="xsd:integer" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="RpcDacl" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="SiteName" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DynamicSiteName" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="SiteCoverage" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="GcSiteCoverage" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="NdncSiteCoverage" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
        <xsd:element name="DnsAvoidRegisterRecords" type="xsd:string" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters')" wcm:scope="allUsers" wcm:subScope="machineIndependent" />
      </xsd:schema>
    </asmv3:configurationSchema>
  </asmv3:configuration>
  <migration ignoreConfigurationSection="Yes" settingsVersion="0">
    <machineSpecific>
      <migXml xmlns="">
        <rules context="System">
          <include>
            <objectSet>
              <pattern type="File">%windir%\system32\config [netlogon.dns]</pattern>
              <pattern type="File">%windir%\system32\config [netlogon.dnb]</pattern>
              <pattern type="File">%windir%\system32\config [netlogon.ftl]</pattern>
              <pattern type="File">%windir%\system32\config [netlogon.ftj]</pattern>
              <pattern type="File">%windir%\system32\config [dclocadminmappings.log]</pattern>
              <pattern type="File">%windir%\system32\config [dclocscanmappings.log]</pattern>
              <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\* [*]</pattern>
              <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon [Start]</pattern>
              <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon [DependOnService]</pattern>
            </objectSet>
          </include>
          <merge script="MigXmlHelper.SourcePriority()">
            <objectSet>
              <pattern type="File">%windir%\system32\config [netlogon.dns]</pattern>
              <pattern type="File">%windir%\system32\config [netlogon.dnb]</pattern>
              <pattern type="File">%windir%\system32\config [netlogon.ftl]</pattern>
              <pattern type="File">%windir%\system32\config [netlogon.ftj]</pattern>
              <pattern type="File">%windir%\system32\config [dclocadminmappings.log]</pattern>
              <pattern type="File">%windir%\system32\config [dclocscanmappings.log]</pattern>
              <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\* [*]</pattern>
              <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon [Start]</pattern>
              <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon [DependOnService]</pattern>
            </objectSet>
          </merge>
        </rules>
      </migXml>
    </machineSpecific>
    <supportedComponents>
      <supportedComponent>
        <assemblyIdentity name="_" version="1.0.0.0" />
        <supportedComponentIdentity buildType="release" language="neutral" name="Microsoft-Windows-Security-Netlogon" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" settingsVersionRange="0" versionScope="nonSxS" xmlns="urn:schemas-microsoft-com:asm.v3" />
        <machineSpecific>
          <migXml xmlns="">
            <rules context="System">
              <merge script="MigXmlHelper.SourcePriority()">
                <objectSet>
                  <pattern type="File">%windir%\system32\config [netlogon.dns]</pattern>
                  <pattern type="File">%windir%\system32\config [netlogon.dnb]</pattern>
                  <pattern type="File">%windir%\system32\config [netlogon.ftl]</pattern>
                  <pattern type="File">%windir%\system32\config [netlogon.ftj]</pattern>
                  <pattern type="File">%windir%\system32\config [dclocadminmappings.log]</pattern>
                  <pattern type="File">%windir%\system32\config [dclocscanmappings.log]</pattern>
                  <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\* [*]</pattern>
                  <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon [Start]</pattern>
                  <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon [DependOnService]</pattern>
                </objectSet>
              </merge>
            </rules>
          </migXml>
        </machineSpecific>
      </supportedComponent>
      <supportedComponent>
        <assemblyIdentity name="_" version="1.0.0.0" />
        <supportedComponentIdentity buildType="release" language="*" name="Microsoft-Windows-Security-Netlogon-DL" processorArchitecture="*" publicKeyToken="31bf3856ad364e35" settingsVersionRange="0" versionScope="nonSxS" xmlns="urn:schemas-microsoft-com:asm.v3" />
        <machineSpecific>
          <migXml xmlns="">
            <rules context="System">
              <merge script="MigXmlHelper.SourcePriority()">
                <objectSet>
                  <pattern type="File">%windir%\system32\config [netlogon.dns]</pattern>
                  <pattern type="File">%windir%\system32\config [netlogon.dnb]</pattern>
                  <pattern type="File">%windir%\system32\config [netlogon.ftl]</pattern>
                  <pattern type="File">%windir%\system32\config [netlogon.ftj]</pattern>
                  <pattern type="File">%windir%\system32\config [dclocadminmappings.log]</pattern>
                  <pattern type="File">%windir%\system32\config [dclocscanmappings.log]</pattern>
                  <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\* [*]</pattern>
                  <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon [Start]</pattern>
                  <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\Netlogon [DependOnService]</pattern>
                </objectSet>
              </merge>
            </rules>
          </migXml>
        </machineSpecific>
      </supportedComponent>
    </supportedComponents>
  </migration>
  <registryKeys>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon">
      <overridable name="Start" scope="Microsoft" type="REG_DWORD" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters">
      <registryValue name="ServiceDll" valueType="REG_EXPAND_SZ" value="%SystemRoot%\system32\netlogon.dll" />
      <registryValue name="Update" valueType="REG_SZ" value="no" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService">
      <registryValue name="68" valueType="REG_SZ" value="netlogon.dll" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup">
      <registryValue name="Netlogon" valueType="REG_MULTI_SZ" value="%SystemRoot%\netlogon.chg" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Netlogon">
      <registryValue name="EventMessageFile" valueType="REG_EXPAND_SZ" value="%SystemRoot%\System32\netmsg.dll" />
      <registryValue name="ParameterMessageFile" valueType="REG_EXPAND_SZ" value="%SystemRoot%\System32\kernel32.dll" />
      <registryValue name="TypesSupported" valueType="REG_DWORD" value="0x00000007" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DCLocator\Tracing" />
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Microsoft-Windows-Security-Netlogon">
      <registryValue name="providerGuid" valueType="REG_SZ" value="{E5BA83F6-07D0-46b1-8BC7-7E669A1D31DC}" />
    </registryKey>
  </registryKeys>
  <instrumentation xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">
    <counters xmlns="http://schemas.microsoft.com/win/2005/12/counters" schemaVersion="2.0">
      <provider applicationIdentity="NetLogon.dll" callback="custom" providerGuid="{420a6c98-914e-40fc-9a0f-80c7db801780}" providerType="userMode" symbol="hDataSource_PerfCntr_1">
        <counterSet description="Counters for measuring the performance of Netlogon." descriptionID="2002" guid="{a44a45c2-664d-476c-b68c-6b123eccc31f}" instances="multiple" name="Netlogon" nameID="2000" symbol="CtrSet_PerfCntr_1_1" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0">
          <counter description="Number of thread currently waiting to acquire the semaphore." descriptionID="2006" detailLevel="standard" id="0" name="Semaphore Waiters" nameID="2004" type="perf_counter_rawcount" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0.Waiters" />
          <counter description="Number of thread currently holding the semaphore." descriptionID="2010" detailLevel="standard" id="1" name="Semaphore Holders" nameID="2008" type="perf_counter_rawcount" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0.Holders" />
          <counter description="The total number of times the semaphore has been acquired over the lifetime of the Secure Channel connection (or since system boot for _Total)." descriptionID="2014" detailLevel="standard" id="2" name="Semaphore Acquires" nameID="2012" type="perf_counter_large_rawcount" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0.Acquires" />
          <counter description="The total number of times a thread has timed out waiting for the semaphore over the lifetime of the Secure Channel connection (or since system boot for _Total)." descriptionID="2018" detailLevel="standard" id="3" name="Semaphore Timeouts" nameID="2016" type="perf_counter_large_rawcount" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0.Timeouts" />
          <counter baseID="5" description="The average amount of time the semaphore is held over the last sample." descriptionID="2022" detailLevel="standard" id="4" name="Average Semaphore Hold Time" nameID="2020" type="perf_average_timer" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0.HoldTime" />
          <counter description="The base value used to calculate the average semaphore hold time." descriptionID="2026" detailLevel="standard" id="5" name="Semaphore Hold Time Base" nameID="2024" type="perf_average_base" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0.HoldBase">
            <counterAttributes>
              <counterAttribute name="noDisplay" />
            </counterAttributes>
          </counter>
          <counter baseID="7" description="How long, in milliseconds, the last successful NTLM authentication took." descriptionID="2030" detailLevel="standard" id="6" name="Last Authentication Time" nameID="2028" type="perf_average_timer" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0.AuthTime" />
          <counter description="The base value used to calculate Last Authentication Time." descriptionID="2034" detailLevel="standard" id="7" name="Authentication base time" nameID="2032" type="perf_average_base" uri="Microsoft.Windows.System.PerfCounters.NetLogonCounterSet0.AuthBase">
            <counterAttributes>
              <counterAttribute name="noDisplay" />
            </counterAttributes>
          </counter>
        </counterSet>
        <counterSet description="Counters for monitoring DC location functionality. These counters are only supported on domain-joined machines." descriptionID="3002" guid="{24875672-0f90-47e0-a7c1-a29395c8afde}" instances="multiple" name="DC Locator (Netlogon)" nameID="3000" symbol="CtrSet_DCLocator_0" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0">
          <counter description="Number of successful DC locator requests per second." descriptionID="3006" detailLevel="standard" id="0" name="Requests: Successes/sec" nameID="3004" symbol="PCID_SUCCESSFULREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.SuccessfulRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of failed DC locator requests per second." descriptionID="3010" detailLevel="standard" id="1" name="Requests: Failures/sec" nameID="3008" symbol="PCID_FAILEDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.FailedRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of currently active DC locator requests." descriptionID="3014" detailLevel="standard" id="2" name="Requests: Total Active" nameID="3012" symbol="PCID_ACTIVEREQUESTS" type="perf_counter_rawcount" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.ActiveRequests">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter baseID="4" description="Average latency of successful requests in seconds." descriptionID="3018" detailLevel="standard" id="3" name="Requests: Average Success Latency (secs)" nameID="3016" symbol="PCID_AVERAGESUCCESSLATENCY" type="perf_average_timer" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.AverageSuccessLatency">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="The base value used to calculate average success latency." descriptionID="3022" detailLevel="standard" id="4" name="Average success latency Base" nameID="3020" symbol="PCID_AVERAGESUCCESSLATENCYBASE" type="perf_average_base" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.AverageSuccessLatencyBase">
            <counterAttributes>
              <counterAttribute name="reference" />
              <counterAttribute name="noDisplay" />
            </counterAttributes>
          </counter>
          <counter baseID="6" description="Average latency of failed requests in seconds." descriptionID="3026" detailLevel="standard" id="5" name="Requests: Average Failure Latency (secs)" nameID="3024" symbol="PCID_AVERAGEFAILURELATENCY" type="perf_average_timer" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.AverageFailureLatency">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="The base value used to calculate average failure latency." descriptionID="3030" detailLevel="standard" id="6" name="Average failure latency Base" nameID="3028" symbol="PCID_AVERAGEFAILURELATENCYBASE" type="perf_average_base" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.AverageFailureLatencyBase">
            <counterAttributes>
              <counterAttribute name="reference" />
              <counterAttribute name="noDisplay" />
            </counterAttributes>
          </counter>
          <counter description="Number of DC locator cache hits per second." descriptionID="3034" detailLevel="standard" id="7" name="Cache: Hits/sec" nameID="3032" symbol="PCID_CACHEHITSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.CacheHitsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of DC locator cache misses per second." descriptionID="3038" detailLevel="standard" id="8" name="Cache: Misses/sec" nameID="3036" symbol="PCID_CACHEMISSESPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.CacheMissesPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of PDC-required DC locator requests per second. Corresponds to the DS_PDC_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3042" detailLevel="standard" id="9" name="Flags: PDC Required Requests/sec" nameID="3040" symbol="PCID_PDCREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.PDCRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of writable-required DC locator requests per second. Corresponds to the DS_WRITABLE_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3046" detailLevel="standard" id="10" name="Flags: Writable Required Requests/sec" nameID="3044" symbol="PCID_WRITABLEREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.WRITABLERequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of force-required (cache-bypass) DC locator requests per second. Corresponds to the DS_FORCE_REDISCOVERY flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3050" detailLevel="standard" id="11" name="Flags: Force Rediscovery Requests/sec" nameID="3048" symbol="PCID_FORCEREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.FORCERequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of excess DC locator requests rejected per second." descriptionID="3054" detailLevel="standard" id="12" name="Requests: Rejected/sec" nameID="3052" symbol="PCID_EXCESSREJECTEDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.ExcessRejectedRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of LDAP UDP pings sent per second." descriptionID="3058" detailLevel="standard" id="13" name="Pings: UDP Pings Sent/sec" nameID="3056" symbol="PCID_UDPPINGSSENTPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.UDPPingsSentPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of mailslot pings sent per second." descriptionID="3062" detailLevel="standard" id="14" name="Pings: Mailslot Pings Sent/sec" nameID="3060" symbol="PCID_MAILSLOTPINGSSENTPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.MailslotPingsSentPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of UDP ports currently opened by DC locator." descriptionID="3066" detailLevel="standard" id="15" name="UDP Ports Opened" nameID="3064" symbol="PCID_UDPPORTSOPENED" type="perf_counter_rawcount" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.UDPPORTSOPENED">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of DNS query failures per second." descriptionID="3070" detailLevel="standard" id="16" name="DNS Query Failures/sec" nameID="3068" symbol="PCID_DNSQUERYFAILURESPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.DNSQueryFailuresPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of KDC-required DC locator requests per second. Corresponds to the DS_KDC_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3074" detailLevel="standard" id="17" name="Flags: KDC Required Requests/sec" nameID="3072" symbol="PCID_KDCREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.KDCRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of GC-required DC locator requests per second. Corresponds to the DS_GC_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3078" detailLevel="standard" id="18" name="Flags: GC Required Requests/sec" nameID="3076" symbol="PCID_GCREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.GCRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of time-server-required DC locator requests per second. Corresponds to the DS_TIMESERV_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3082" detailLevel="standard" id="19" name="Flags: Time Server Required Requests/sec" nameID="3080" symbol="PCID_TIMESERVERREQUIREDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.TIMESERVERREQUIREDRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of DS-required (Windows 2000 or higher) DC locator requests per second. Corresponds to the DS_DIRECTORY_SERVICE_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3086" detailLevel="standard" id="20" name="Flags: DS Required (W2K+) Requests/sec" nameID="3084" symbol="PCID_DSREQUIREDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.DSREQUIREDRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of DS-required (Windows 2008 or higher) DC locator requests per second. Corresponds to the DS_DIRECTORY_SERVICE_6_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3090" detailLevel="standard" id="21" name="Flags: DS Required (WS2008+) Requests/sec" nameID="3088" symbol="PCID_DS6REQUIREDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.DS6REQUIREDRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of DS-required (Windows 2012 or higher) DC locator requests per second. Corresponds to the DS_DIRECTORY_SERVICE_8_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3094" detailLevel="standard" id="22" name="Flags: DS Required (WS2012+) Requests/sec" nameID="3092" symbol="PCID_DS8REQUIREDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.DS8REQUIREDRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of DS-required (Windows 2012 R2 or higher) DC locator requests per second. Corresponds to the DS_DIRECTORY_SERVICE_9_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3098" detailLevel="standard" id="23" name="Flags: DS Required (WS2012 R2+) Requests/sec" nameID="3096" symbol="PCID_DS9REQUIREDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.DS9REQUIREDRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of DS-required (Windows 2016 or higher) DC locator requests per second. Corresponds to the DS_DIRECTORY_SERVICE_10_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3102" detailLevel="standard" id="24" name="Flags: DS Required (WS2016+) Requests/sec" nameID="3100" symbol="PCID_DS10REQUIREDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.DS10REQUIREDRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of try-next-closest-site DC locator requests per second. Corresponds to the DS_TRY_NEXTCLOSEST_SITE flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3106" detailLevel="standard" id="25" name="Flags: TryNextClosestSite Requests/sec" nameID="3104" symbol="PCID_TRYNEXTCLOSESTSITEREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.TryNextClosestSiteRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of KeyList-support-required DC locator requests per second. Corresponds to the DS_KEY_LIST_SUPPORT_REQUIRED flag of the DsGetDcName api. Note that a single request may specify multiple flags." descriptionID="3110" detailLevel="standard" id="26" name="Flags: KeyList Support Required Requests/sec" nameID="3108" symbol="PCID_KEYLISTSUPPORTREQUIREDREQUESTSPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet0.KeyListSupportRequiredRequestsPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
        </counterSet>
        <counterSet description="Counters for monitoring DC locator ping performance on domain controllers." descriptionID="4002" guid="{2f908cef-e771-4bbb-be79-f608ce36839b}" instances="single" name="DC Locator (DC)" nameID="4000" symbol="CtrSet_DCLocator_1" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1">
          <counter description="Number of UDP LDAP pings currently being processed." descriptionID="4006" detailLevel="standard" id="0" name="Pings: Active UDP LDAP Pings" nameID="4004" symbol="PCID_DCPING_ACTIVELDAPPINGS" type="perf_counter_rawcount" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1.ActiveLdapPings">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of UDP LDAP pings received per second." descriptionID="4010" detailLevel="standard" id="1" name="Pings: UDP LDAP Pings Received/sec" nameID="4008" symbol="PCID_DCPING_LDAPPINGSRECEIVEDPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1.LdapPingsReceivedPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter baseID="3" description="Average latency of UDP LDAP ping processing times in seconds." descriptionID="4014" detailLevel="standard" id="2" name="Pings: Average UDP LDAP Ping Latency (secs)" nameID="4012" symbol="PCID_DCPING_AVERAGELDAPPINGLATENCY" type="perf_average_timer" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1.AverageLdapPingLatency">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="The base value used to calculate average UDP LDAP ping latency." descriptionID="4018" detailLevel="standard" id="3" name="Average UDP LDAP ping latency Base" nameID="4016" symbol="PCID_DCPING_AVERAGELDAPPINGLATENCYBASE" type="perf_average_base" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1.AverageLdapPingLatencyBase">
            <counterAttributes>
              <counterAttribute name="reference" />
              <counterAttribute name="noDisplay" />
            </counterAttributes>
          </counter>
          <counter description="Number of mailslot pings currently being processed." descriptionID="4022" detailLevel="standard" id="4" name="Pings: Active Mailslot Pings" nameID="4020" symbol="PCID_DCPING_ACTIVEMAILSLOTPINGS" type="perf_counter_rawcount" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1.ActiveMailslotPings">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="Number of mailslot pings received per second." descriptionID="4026" detailLevel="standard" id="5" name="Pings: Mailslot Pings Received/sec" nameID="4024" symbol="PCID_DCPING_MAILSLOTPINGSRECEIVEDPERSECOND" type="perf_counter_counter" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1.MailslotPingsReceivedPerSecond">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter baseID="7" description="Average latency of mailslot ping processing times." descriptionID="4030" detailLevel="standard" id="6" name="Pings: Average Mailslot Ping Latency (secs)" nameID="4028" symbol="PCID_DCPING_AVERAGEMAILSLOTLATENCY" type="perf_average_timer" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1.AverageMailslotLatency">
            <counterAttributes>
              <counterAttribute name="reference" />
            </counterAttributes>
          </counter>
          <counter description="The base value used to calculate average mailslot ping latency." descriptionID="4034" detailLevel="standard" id="7" name="Average mailslot ping latency Base" nameID="4032" symbol="PCID_DCPING_AVERAGEMAILSLOTLATENCYBASE" type="perf_average_base" uri="Microsoft.Windows.System.PerfCounters.DCLocatorCounterSet1.AverageMailslotLatencyBase">
            <counterAttributes>
              <counterAttribute name="reference" />
              <counterAttribute name="noDisplay" />
            </counterAttributes>
          </counter>
        </counterSet>
      </provider>
    </counters>
    <events xmlns="http://schemas.microsoft.com/win/2004/08/events">
      <provider guid="{E5BA83F6-07D0-46b1-8BC7-7E669A1D31DC}" message="$(string.eventProviderName)" messageFileName="%SystemRoot%\System32\netlogon.dll" name="Microsoft-Windows-Security-Netlogon" resourceFileName="%SystemRoot%\System32\netlogon.dll" symbol="NetlogonEventProviderId">
        <channels>
          <importChannel chid="NTLM" name="Microsoft-Windows-NTLM/Operational" />
          <channel chid="Netlogon_Operational" enabled="true" isolation="System" name="Microsoft-Windows-Security-Netlogon/Operational" type="Operational" />
        </channels>
      </provider>
      <cmi />
    </events>
  </instrumentation>
  <localization>
    <resources culture="en-US">
      <stringTable>
        <string id="displayName1" value="Netlogon" />
        <string id="displayName" value="Netlogon" />
        <string id="description" value="Netlogon is required for domain joined machines.  Maintains a secure channel between this computer and the domain controller for authenticating users and services. If this component is not installed, the computer may not authenticate users and services and the domain controller cannot register DNS records." />
        <string id="description1" value="Maintains a secure channel between this computer and the domain controller for authenticating users and services. If this service is stopped, the computer may not authenticate users and services and the domain controller cannot register DNS records. If this service is disabled, any services that explicitly depend on it will fail to start." />
        <string id="task_CATEGORY_BLOCKNTLM" value="Blocking NTLM" />
        <string id="task_CATEGORY_AUDITNTLM" value="Auditing NTLM" />
        <string id="task_CATEGORY_MSA" value="MSA" />
        <string id="task_CATEGORY_LOCATOR" value="LOCATOR" />
        <string id="task_SECURE_CHANNEL_SETUP" value="Secure channel setup" />
        <string id="eventProviderName" value="Microsoft-Windows-Security-Netlogon" />
        <string id="NTLMDCBlocked" value="Domain Controller Blocked: NTLM authentication to this domain controller is blocked.%nSecure Channel name: %1%nUser name: %2%nDomain name: %3%nWorkstation name: %4%nSecure Channel type: %5%n%nNTLM authentication within the domain %3 is blocked.%n%nIf you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.%n%nIf you want to allow NTLM authentication requests only to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain as an exception to use NTLM authentication." />
        <string id="NTLMDCAudit" value="Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.%nSecure Channel name: %1%nUser name: %2%nDomain name: %3%nWorkstation name: %4%nSecure Channel type: %5%n%nAudit NTLM authentication requests within the domain %3 that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to any of the Deny options.%n%nIf you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.%n%nIf you want to allow NTLM authentication requests to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in the domain %3 to which clients are allowed to use NTLM authentication." />
        <string id="MSA_NETGETGROUPMSAPASSWORD" value="Netlogon failed to retrieve the password for account %1 in domain %2. %3" />
        <string id="MSA_NETADDSERVICEACCOUNT_MISMATCH_ENC_TYPES" value="The account %1 cannot be used as managed service account on the local machine because not all the supported encryption types of the account are supported by the local machine." />
        <string id="MSA_NETADDSERVICEACCOUNT_FAILURE" value="Netlogon failed to add %1 as a managed service account to this local machine. %2" />
        <string id="MSA_NETREMOVESERVICEACCOUNT_FAILURE" value="Netlogon failed to remove the managed service account %1 from this local machine. %2" />
        <string id="LOCATOR_MAXCONCURRENTREQUESTS_EXCEEDED" value="A total of %1 DC locator queries were rejected since the last reported event because they would have exceeded the configured maximum on concurrent network discovery operations." />
        <string id="SECURE_CHANNEL_FALLBACK" value="Secure channel setup has failed with Kerberos: %1. Falling back to Netlogon." />
        <string id="SECURE_CHANNEL_FAILED" value="Secure channel setup has failed : %1. Protocol used: %2." />
        <string id="MailslotDiscoveryEnabled" value="Netlogon is currently configured to allow mailslot messages to be used when locating domain controllers. This mode is unsecure and will be deprecated and removed in a future release.%n%nSee https://aka.ms/dclocatornetbiosdeprecation for more information." />
        <string id="DCListeningOnMailslots" value="Netlogon is currently configured to listen for mailslot messages sent by clients during a domain controller location operation. This mode is unsecure and will be deprecated and removed in a future release.%n%nSee https://aka.ms/dclocatornetbiosdeprecation for more information." />
        <string id="DomainNameUnmapped" value="Netlogon was unable to find the domain name '%1' using any of the known domain name mapping sources. This may cause failures to locate domain controllers in that domain.%n%nSee https://aka.ms/dclocatornetbiosdeprecation for more information." />
        <string id="DCDiscoveryViaNetbios" value="Netlogon discovered a DC using the Netbios protocol. This mode is unsecure and will be deprecated and removed in a future release.%n%nDNS domain name:%1%nNetbios domain name:%2%n%nDC:%3%n%n%nSee https://aka.ms/dclocatornetbiosdeprecation for more information." />
        <string id="DCAdminMappingsUpdateSucceeded" value="Netlogon successfully downloaded the latest administrator-configured domain name mappings. Run 'nltest.exe /list_dclocmappings' to view the data.%n%nSee https://aka.ms/dclocatornetbiosdeprecation for more information." />
        <string id="DCAdminMappingsUpdateFailed" value="Netlogon failed to download the latest administrator-configured domain name mappings.%n%nSee https://aka.ms/dclocatornetbiosdeprecation for more information." />
        <string id="DCScannerMappingsUpdateSucceeded" value="Netlogon successfully downloaded the latest trusted-domain-based domain name mappings. Run 'nltest.exe /list_dclocmappings' to view the data.%n%nSee https://aka.ms/dclocatornetbiosdeprecation for more information." />
        <string id="DCScannerMappingsUpdateFailed" value="Netlogon failed to download the latest trusted-domain-based domain name mappings.%n%nSee https://aka.ms/dclocatornetbiosdeprecation for more information." />
        <string id="NTLMLessEnhancedDcAccountLogs" value="The DC %1 processed a network NTLM authentication involving an account from this domain.%n%nClient Information:%n%tClient Name: %2%n%tClient Domain: %3%n%tClient Machine: %4%n%nServer Information:%n%tServer Name: %5%n%tServer Domain: %6%n%nForwarded From:%n%tSecure Channel Type: %7%n%tFarside Name: %8%n%tFarside Domain: %9%n%tFarside IP: %10%n%nNTLM Security:%n%tNTLM Version: %11%n%tService Binding: %12%n%tTarget Machine: %13%n%tTarget Domain: %14%n%tMic Status: %15%n%tFlags values: %16%n%tFlags: %17%n%nStatus: %18%n%nFor more information, see aka.ms/ntlmlogandblock%n" />
        <string id="NTLMLessEnhancedDcServerLogs" value="The DC %1 processed a forwarded NTLM authentication request originating from this domain.%n%nClient Information:%n%tClient Name: %2%n%tClient Domain: %3%n%tClient Machine: %4%n%nServer Information:%n%tServer Name: %5%n%tServer Domain: %6%n%tServer IP: %7%n%tServer OS: %8%n%nNTLM Security:%n%tNTLM Version: %9%n%tService Binding: %10%n%tTarget Machine: %11%n%tTarget Domain: %12%n%tMic Status: %13%n%tFlags values: %14%n%tFlags: %15%n%nStatus: %16%nStatus Message: %17%n%nFor more information, see aka.ms/ntlmlogandblock%n" />
        <string id="DCLocatorRPCSecurityPolicyBlockedCall" value="Netlogon denied an RPC call. The policy is in enforce mode.%n%nClient Information:%n%tMethod name: %1%n%tMethod opnum: %2%n%tClient address: %3%n%tClient identity: %4%n%nFor more information, see https://aka.ms/dclocatorrpcpolicy%n" />
        <string id="DCLocatorRPCSecurityPolicyAllowedCallAuditMode" value="Netlogon allowed an RPC call that normally would have been denied. The policy is in audit mode.%n%nClient Information:%n%tMethod name: %1%n%tMethod opnum: %2%n%tClient address: %3%n%tClient identity: %4%n%nFor more information, see https://aka.ms/dclocatorrpcpolicy%n" />
      </stringTable>
    </resources>
  </localization>
  <trustInfo>
    <security>
      <accessControl>
        <securityDescriptorDefinitions>
          <securityDescriptorDefinition name="WRP_FILE_DEFAULT_SDDL" sddl="O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)(A;;GRGX;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)(A;;GRGX;;;S-1-15-2-2)S:(AU;FASA;0x000D0116;;;WD)" operationHint="replace" description="Default SDDL for Windows Resource Protected file" />
        </securityDescriptorDefinitions>
      </accessControl>
    </security>
  </trustInfo>
</assembly>