PC World Komputer 2010 April/PCWorld0410.iso/WindowsServerTrial/server.iso/sources/install.wim/1/Windows/System32/ceipdata.xml

Extensible Markup Language | 2008-01-19 | 68KB | 1,319 lines

<?xml version="1.0" encoding="UTF-8"?>
<CeipAssistant>

    <FileAttributes>
        <Author>Microsoft Corporation</Author>
        <Version>4</Version>
    </FileAttributes>

    <ExecutionOptions>
        <GlobalTimeout>1800</GlobalTimeout>
        <QueryTimeout>10</QueryTimeout>
        <MaxRows>1000</MaxRows>
        <MaxErrors>2</MaxErrors>
    </ExecutionOptions>

    <QueryGroups>

    <QueryGroup>
        <Applicability>
        <Global />
        </Applicability>
        <Queries>
        <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement" Query="SELECT ServiceName FROM SqlService WHERE SQLServiceType=1 AND ServiceName!='MSSQL$MICROSOFT##SSEE'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1000">
                                            <Enum Name="MSSQLSERVER" Value="1000" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="MSSQLSERVER" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement" Query="SELECT ServiceName FROM SQLServiceAdvancedProperty WHERE SqlServiceType=1 AND PropertyName='SKUNAME' AND PropertyStrValue!='Express Edition' AND ServiceName!='MSSQL$MICROSOFT##SSEE'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1001">
                                            <Enum Name="MSSQLSERVER" Value="1001" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="MSSQLSERVER" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>

        <WmiQuery Namespace="root\microsoft\sqlserver\computermanagement" Query="SELECT ServiceName FROM SQLServiceAdvancedProperty WHERE SqlServiceType=1 AND PropertyName='SKUNAME' AND PropertyStrValue='Express Edition'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1002">
                                            <Enum Name="MSSQL$SQLEXPRESS" Value="1002" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="ServiceName" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="MSSQL$SQLEXPRESS" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        </Queries>
    </QueryGroup>

    <QueryGroup>
        <Applicability>
        <Global />
        </Applicability>
        <Queries>
        <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeSA' OR Name='MSExchangeTransport' OR Name='MSExchangeADTopology' OR Name='MSExchangeIMAP4' OR Name='ADAM_MSExchange' OR Name='MSExchangeUM'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1500">
                                            <Enum Name="MSExchangeSA" Value="1500" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="MSExchangeSA" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeSA'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1501">
                                            <Enum Name="MSExchangeSA" Value="1501" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="MSExchangeSA" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeTransport' OR Name='MSExchangeADTopology'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1502">
                                            <Enum Name="MSExchangeTransport" Value="1502" />
                        <Enum Name="MSExchangeADTopology" Value="1502" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="MSExchangeTransport" Value="1" />
                        <Enum Name="MSExchangeADTopology" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeIMAP4'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1503">
                                            <Enum Name="MSExchangeIMAP4" Value="1503" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="MSExchangeIMAP4" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='ADAM_MSExchange'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1504">
                                            <Enum Name="ADAM_MSExchange" Value="1504" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="ADAM_MSExchange" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        <WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name='MSExchangeUM'" MaxRows="1">
            <WmiStreams>
            <WmiStream DataId="1452" MaxStreamRows="1">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1505">
                                            <Enum Name="MSExchangeUM" Value="1505" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Name" PropertyType="String">
                                    <Transforms>
                                            <EnumTransform DefaultValue="1">
                                            <Enum Name="MSExchangeUM" Value="1" />
                                            </EnumTransform>
                                    </Transforms>
                    </WmiPropertySelector>
                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        </Queries>
    </QueryGroup>

    <QueryGroup>
        <Applicability>
        <Global />
        </Applicability>
        <Queries>
        <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT AllowTSConnections FROM Win32_TerminalServiceSetting" QueryTimeout="20">
            <WmiDatapoints>
            <WmiDatapoint DataId="2539" DataType="Dword">
                <WmiPropertySelector PropertyName="AllowTSConnections" PropertyType="Dword" />
            </WmiDatapoint>
            </WmiDatapoints>
        </WmiQuery>
        <WmiQuery Namespace="root\cimv2" Query="SELECT MediaType FROM Win32_DiskDrive WHERE MediaType='Fixed hard disk media'" QueryTimeout="20">
            <WmiAggregates>
            <WmiAggregate DataId="2517" Function="Count" />
            </WmiAggregates>
        </WmiQuery>
        <WmiQuery Namespace="root\cimv2" Query="SELECT Type FROM Win32_DiskPartition" QueryTimeout="20">
            <WmiAggregates>
            <WmiAggregate DataId="2520" Function="Count" />
            </WmiAggregates>
        </WmiQuery>
        <WmiQuery Namespace="root\cimv2" Query="SELECT Model, Size FROM Win32_DiskDrive" QueryTimeout="20">
            <WmiStreams>
            <WmiStream DataId="2918">
                <WmiStreamColumns>
                <WmiStreamColumn DataType="String">
                    <WmiPropertySelector PropertyName="Model" PropertyType="String" />


                </WmiStreamColumn>
                <WmiStreamColumn DataType="Dword">
                    <WmiPropertySelector PropertyName="Size" PropertyType="Qword">
                    <Transforms>
                                            <ScaleTransform Divisor="1048576" />
                                    </Transforms>
                    </WmiPropertySelector>

                </WmiStreamColumn>
                </WmiStreamColumns>
            </WmiStream>
            </WmiStreams>
        </WmiQuery>
        <RegistryQuery Hive="HKLM" Subkey="System\Setup">
            <RegistryAggregates>
            <RegistryAggregate DataId="3076" Function="Exists">
                <RegistryValueSelector ValueName="Upgrade" ValueType="Dword" />
            </RegistryAggregate>
            </RegistryAggregates>
        </RegistryQuery>
            <EventQuery Channel="System" Query="*[System/EventID=596]">
                <EventAggregates>
                <EventAggregate DataId="2534" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="System" Query="*[System/EventID=23]">
                <EventAggregates>
                <EventAggregate DataId="2538" Function="Count" />
            </EventAggregates>
            </EventQuery>
        </Queries>
    </QueryGroup>

    <QueryGroup>
        <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="10" RequiredState="Installed" />
                </Expression>
        </Applicability>
        <Queries>
            <EventQuery Channel="System" Query="*[System/EventID=8225]">
                <EventAggregates>
                <EventAggregate DataId="2536" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="System" Query="*[System/EventID=8226]">
                <EventAggregates>
                <EventAggregate DataId="2535" Function="Count" />
            </EventAggregates>
            </EventQuery>
        </Queries>
    </QueryGroup>

        <QueryGroup>
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="33" RequiredState="Running" />
                </Expression>
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\MSCluster" Query="SELECT * from MSCluster_Node">
                    <WmiAggregates>
                        <WmiAggregate DataId="2551" Function="Count" />
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\MSCluster" Query="SELECT QuorumType from MSCluster_Cluster" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2553" DataType="Dword">
                <WmiPropertySelector PropertyName="QuorumType" PropertyType="String">
                <Transforms>
                                    <EnumTransform DefaultValue="0">
                                        <Enum Name="Majority" Value="1" />
                                        <Enum Name="Legacy Disk" Value="2" />
                                    </EnumTransform>
                                </Transforms>
                            </WmiPropertySelector>
            </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
        <WmiQuery Namespace="root\MSCluster" Query="associators of {MSCluster_Cluster.Name='.'} Where AssocClass=MSCluster_ClusterToQuorumResource" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2566" DataType="Dword">
                <WmiPropertySelector PropertyName="Type" PropertyType="String">
                <Transforms>
                                    <EnumTransform DefaultValue="0">
                                        <Enum Name="Physical Disk" Value="1" />
                                        <Enum Name="File Share Witness" Value="2" />
                                    </EnumTransform>
                                </Transforms>
                            </WmiPropertySelector>
            </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\MSCluster" Query="SELECT Type from MSCluster_Resource" QueryTimeout="30">
                    <WmiAggregates>
                        <WmiAggregate DataId="2554" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="File Server" />


            </WmiAggregate>
            <WmiAggregate DataId="2555" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="DHCP Service" />


            </WmiAggregate>
            <WmiAggregate DataId="2556" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Distributed Transaction Coordinator" />


            </WmiAggregate>
            <WmiAggregate DataId="2557" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Generic Application" />


            </WmiAggregate>
            <WmiAggregate DataId="2558" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Generic Service" />


            </WmiAggregate>
            <WmiAggregate DataId="2559" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Generic Script" />


            </WmiAggregate>
            <WmiAggregate DataId="2560" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Microsoft iSNS" />


            </WmiAggregate>
            <WmiAggregate DataId="2561" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="MSMQ" />


            </WmiAggregate>
            <WmiAggregate DataId="2562" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="NFS Share" />


            </WmiAggregate>
            <WmiAggregate DataId="2563" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Print Spooler" />


            </WmiAggregate>
            <WmiAggregate DataId="2564" Function="Exists">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="WINS Service" />


            </WmiAggregate>
            <WmiAggregate DataId="2565" Function="Count">
                <WmiPropertySelector PropertyName="Type" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Physical Disk" />


            </WmiAggregate>
                    </WmiAggregates>
                </WmiQuery>
        <RegistryQuery Hive="HKLM" Subkey="System\CurrentControlSet\Services\Clussvc\Parameters">
            <RegistryDatapoints>
            <RegistryDatapoint DataId="2552" DataType="Dword">
                <RegistryValueSelector ValueName="InstanceHash" ValueType="Dword" />
            </RegistryDatapoint>
            </RegistryDatapoints>
        </RegistryQuery>
            </Queries>
        </QueryGroup>


        <QueryGroup MaxErrors="5">
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="140" RequiredState="Installed" />
                </Expression>
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\cimv2" Query="SELECT TotalGetRequests, ServiceUptime, GetRequestsPerSec FROM Win32_PerfFormattedData_W3SVC_WebService WHERE Name='_Total'" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2278" DataType="Dword">
                            <WmiPropertySelector PropertyName="TotalGetRequests" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2279" DataType="Dword">
                            <WmiPropertySelector PropertyName="ServiceUptime" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2447" DataType="Dword">
                            <WmiPropertySelector PropertyName="GetRequestsPerSec" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT URICacheHits, KernelURICacheHits FROM Win32_PerfFormattedData_W3SVC_WebServiceCache" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2280" DataType="Dword">
                            <WmiPropertySelector PropertyName="URICacheHits" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2281" DataType="Dword">
                            <WmiPropertySelector PropertyName="KernelURICacheHits" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='W3SVC'" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2452" DataType="Dword">
                            <WmiPropertySelector PropertyName="State" PropertyType="String">
                                <Transforms>
                                    <EnumTransform DefaultValue="0">
                                        <Enum Name="Stopped" Value="1" />
                                        <Enum Name="Start Pending" Value="2" />
                                        <Enum Name="Stop Pending" Value="3" />
                                        <Enum Name="Running" Value="4" />
                                        <Enum Name="Continue Pending" Value="5" />
                                        <Enum Name="Pause Pending" Value="6" />
                                        <Enum Name="Paused" Value="7" />
                                    </EnumTransform>
                                </Transforms>
                            </WmiPropertySelector>
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='WAS'" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2454" DataType="Dword">
                            <WmiPropertySelector PropertyName="State" PropertyType="String">
                                <Transforms>
                                    <EnumTransform DefaultValue="0">
                                        <Enum Name="Stopped" Value="1" />
                                        <Enum Name="Start Pending" Value="2" />
                                        <Enum Name="Stop Pending" Value="3" />
                                        <Enum Name="Running" Value="4" />
                                        <Enum Name="Continue Pending" Value="5" />
                                        <Enum Name="Pause Pending" Value="6" />
                                        <Enum Name="Paused" Value="7" />
                                    </EnumTransform>
                                </Transforms>
                            </WmiPropertySelector>
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_SystemDriver WHERE Name='HTTP'" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2455" DataType="Dword">
                            <WmiPropertySelector PropertyName="State" PropertyType="String">
                                <Transforms>
                                    <EnumTransform DefaultValue="0">
                                        <Enum Name="Stopped" Value="1" />
                                        <Enum Name="Start Pending" Value="2" />
                                        <Enum Name="Stop Pending" Value="3" />
                                        <Enum Name="Running" Value="4" />
                                        <Enum Name="Continue Pending" Value="5" />
                                        <Enum Name="Pause Pending" Value="6" />
                                        <Enum Name="Paused" Value="7" />
                                    </EnumTransform>
                                </Transforms>
                            </WmiPropertySelector>
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT RequestsTotal, CompilationsTotal FROM Win32_PerfFormattedData_ASPNET2050727_ASPNETAppsv2050727 WHERE Name='__Total__'" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2448" DataType="Dword">
                            <WmiPropertySelector PropertyName="RequestsTotal" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2449" DataType="Dword">
                            <WmiPropertySelector PropertyName="CompilationsTotal" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT RequestsTotal FROM Win32_PerfFormattedData_ASP_ActiveServerPages" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2282" DataType="Dword">
                            <WmiPropertySelector PropertyName="RequestsTotal" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
        <EventQuery Channel="System" Query="*[System[(EventID=5009) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
             <EventAggregate DataId="2322" Function="Count" />
            </EventAggregates>
            </EventQuery>

        <EventQuery Channel="System" Query="*[System[(EventID=5010) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
            <EventAggregates>
                <EventAggregate DataId="2323" Function="Count" />
            </EventAggregates>
            </EventQuery>

        <EventQuery Channel="System" Query="*[System[(EventID=5011) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
            <EventAggregates>
                <EventAggregate DataId="2331" Function="Count" />
            </EventAggregates>
            </EventQuery>

        <EventQuery Channel="System" Query="*[System[(EventID=5012) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2451" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=5013) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2332" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=5014) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2334" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=5127) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2333" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=5137) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2457" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=5138) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2458" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=5139) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2459" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=5158) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2460" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=5002) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2461" Function="Count" />
            </EventAggregates>
            </EventQuery>

            <EventQuery Channel="System" Query="*[System[(EventID=2003) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="2462" Function="Count" />
            </EventAggregates>
            </EventQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup MaxErrors="5">
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="176" RequiredState="Installed" />
                </Expression>
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM Site" QueryTimeout="20">
                    <WmiAggregates>
                        <WmiAggregate DataId="2317" Function="Count" />
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM ApplicationPool" QueryTimeout="20">
                    <WmiAggregates>
                        <WmiAggregate DataId="2318" Function="Count" />
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM Application" QueryTimeout="20">
                    <WmiAggregates>
                        <WmiAggregate DataId="2319" Function="Count" />
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM WorkerProcess" QueryTimeout="20">
                    <WmiAggregates>
                        <WmiAggregate DataId="2320" Function="Count" />
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM AppDomain" QueryTimeout="20">
                    <WmiAggregates>
                        <WmiAggregate DataId="2321" Function="Count" />
                    </WmiAggregates>
                </WmiQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="183" RequiredState="Installed" />
                </Expression>
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\cimv2" Query="SELECT FtpServiceUptime, TotalConnectionAttemptsAllInstances FROM Win32_PerfFormattedData_MSFTPSVC_FtpService WHERE Name='_Total'" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2291" DataType="Dword">
                            <WmiPropertySelector PropertyName="FtpServiceUptime" PropertyType="Dword"/>
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2292" DataType="Dword">
                            <WmiPropertySelector PropertyName="TotalConnectionAttemptsAllInstances" PropertyType="Dword"/>
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='MSFTPSVC'" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2453" DataType="Dword">
                            <WmiPropertySelector PropertyName="State" PropertyType="String">
                                <Transforms>
                                    <EnumTransform DefaultValue="0">
                                        <Enum Name="Stopped" Value="1" />
                                        <Enum Name="Start Pending" Value="2" />
                                        <Enum Name="Stop Pending" Value="3" />
                                        <Enum Name="Running" Value="4" />
                                        <Enum Name="Continue Pending" Value="5" />
                                        <Enum Name="Pause Pending" Value="6" />
                                        <Enum Name="Paused" Value="7" />
                                    </EnumTransform>
                                </Transforms>
                            </WmiPropertySelector>
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="7" RequiredState="Installed" />
                </Expression>
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\cimv2" Query="SELECT LanguagesSupported, DefaultLanguage FROM Win32_Printer WHERE Local='True'" QueryTimeout="20">
                    <WmiAggregates>
                        <WmiAggregate DataId="2378" Function="Count" />
                        <WmiAggregate DataId="2490" Function="Count" >
                            <WmiPropertySelector PropertyName="DefaultLanguage" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="XPS" />
                        </WmiAggregate>
                        <WmiAggregate DataId="2488" Function="Count" >
                            <WmiPropertySelector PropertyName="LanguagesSupported" PropertyType="String" IsArray="1" StartElement="0" MaxElements="100"/>
                            <ValueTest Operator="Equals" DataType="String" Comparand="XPS" />
                        </WmiAggregate>
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT PortName FROM Win32_Printer WHERE Local='True' AND PortName LIKE 'XPS%'" QueryTimeout="20" MaxRows="1">
                    <WmiAggregates>
                        <WmiAggregate DataId="2489" Function="Exists" />
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT SupportedPlatform FROM Win32_PrinterDriver">
                    <WmiAggregates>
                        <WmiAggregate DataId="2379" Function="Count" />
                        <WmiAggregate DataId="2380" Function="Count" >
                            <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Windows x64" />
                        </WmiAggregate>
                        <WmiAggregate DataId="2381" Function="Count" >
                            <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Windows IA64" />
                        </WmiAggregate>
                        <WmiAggregate DataId="2382" Function="Count" >
                            <WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
                            <ValueTest Operator="Equals" DataType="String" Comparand="Windows NT x86" />
                        </WmiAggregate>
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='SPOOLER'" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2481" DataType="Dword">
                            <WmiPropertySelector PropertyName="State" PropertyType="String">
                                <Transforms>
                                    <EnumTransform DefaultValue="0">
                                        <Enum Name="Stopped" Value="1" />
                                        <Enum Name="Start Pending" Value="2" />
                                        <Enum Name="Stop Pending" Value="3" />
                                        <Enum Name="Running" Value="4" />
                                        <Enum Name="Continue Pending" Value="5" />
                                        <Enum Name="Pause Pending" Value="6" />
                                        <Enum Name="Paused" Value="7" />
                                    </EnumTransform>
                                </Transforms>
                            </WmiPropertySelector>
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT ServerSessions, FilesOpen FROM Win32_PerfFormattedData_PerfNet_Server" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2482" DataType="Dword">
                            <WmiPropertySelector PropertyName="ServerSessions" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2484" DataType="Dword">
                            <WmiPropertySelector PropertyName="FilesOpen" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT ThreadCount, HandleCount FROM Win32_PerfFormattedData_PerfProc_Process where Name='spoolsv'" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2485" DataType="Dword">
                            <WmiPropertySelector PropertyName="ThreadCount" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2486" DataType="Dword">
                            <WmiPropertySelector PropertyName="HandleCount" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="SELECT TotalJobsPrinted, MaxJobsSpooling, MaxReferences FROM Win32_PerfFormattedData_Spooler_PrintQueue" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2491" DataType="Dword">
                            <WmiPropertySelector PropertyName="TotalJobsPrinted" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2483" DataType="Dword">
                            <WmiPropertySelector PropertyName="MaxJobsSpooling" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2487" DataType="Dword">
                            <WmiPropertySelector PropertyName="MaxReferences" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
                <Global />
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\cimv2" Query="SELECT Name, Instances FROM Win32_PerfFormattedData_ServiceModelService3000_ServiceModelService3000">
                    <WmiAggregates>
                        <WmiAggregate DataId="2973" Function="Count" />
                        <WmiAggregate DataId="3095" Function="Sum" >
                <WmiPropertySelector PropertyName="Instances" PropertyType="Dword" />
            </WmiAggregate>
                    </WmiAggregates>
                </WmiQuery>
                <WmiQuery Namespace="root\cimv2" Query="Select WorkflowsInMemory From Win32_PerfFormattedData_WindowsWorkflowFoundation3000_WindowsWorkflowFoundation" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="3094" DataType="Dword">
                <WmiPropertySelector PropertyName="WorkflowsInMemory" PropertyType="Dword" />
            </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="13" RequiredState="Installed" />
                </Expression>
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\cimv2" Query="SELECT Version From CIM_DataFile Where Name='%windir%\System32\dns.exe'">
            <WmiDatapoints>
                    <WmiDatapoint DataId="2988" DataType="String">
                            <WmiPropertySelector PropertyName="Version" PropertyType="String" />
                        </WmiDatapoint>
            </WmiDatapoints>
                </WmiQuery>
                <WmiQuery Namespace="root\MicrosoftDNS" Query="SELECT Name, DsIntegrated FROM MicrosoftDNS_Zone">
                    <WmiAggregates>
                        <WmiAggregate DataId="3000" Function="Exists">
                <WmiPropertySelector PropertyName="Name" PropertyType="String" />
                <ValueTest Operator="Equals" DataType="String" Comparand="GlobalNames" />

            </WmiAggregate>
            <WmiAggregate DataId="3001" Function="Count">
                <WmiPropertySelector PropertyName="DsIntegrated" PropertyType="Boolean" />
                <ValueTest Operator="Equals" DataType="Boolean" Comparand="True" />

            </WmiAggregate>
            <WmiAggregate DataId="3005" Function="Count">
                <WmiPropertySelector PropertyName="DsIntegrated" PropertyType="Boolean" />
                <ValueTest Operator="Equals" DataType="Boolean" Comparand="False" />

            </WmiAggregate>
                    </WmiAggregates>
                </WmiQuery>
            <EventQuery Channel="DNS Server" Query="*[System[(EventID=4015) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3003" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="DNS Server" Query="*[System[(EventID=4011) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3004" Function="Count" />
            </EventAggregates>
            </EventQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="125" RequiredState="Installed" />
                </Expression>
            </Applicability>
            <Queries>
        <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\AccountPartner">
            <RegistryDatapoints>
            <RegistryDatapoint DataId="3007" DataType="Dword">
                <RegistryValueSelector ValueName="Count" ValueType="Dword" />
            </RegistryDatapoint>
            </RegistryDatapoints>
        </RegistryQuery>
        <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\ResourcePartner">
            <RegistryDatapoints>
            <RegistryDatapoint DataId="3008" DataType="Dword">
                <RegistryValueSelector ValueName="WithForestTrustCount" ValueType="Dword" />
            </RegistryDatapoint>
            <RegistryDatapoint DataId="3009" DataType="Dword">
                <RegistryValueSelector ValueName="WithoutForestTrustCount" ValueType="Dword" />
            </RegistryDatapoint>
            </RegistryDatapoints>
        </RegistryQuery>
        <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\Applications">
            <RegistryDatapoints>
            <RegistryDatapoint DataId="3012" DataType="Dword">
                <RegistryValueSelector ValueName="NtTokenAppCount" ValueType="Dword" />
            </RegistryDatapoint>
            <RegistryDatapoint DataId="3013" DataType="Dword">
                <RegistryValueSelector ValueName="ClaimsAppCount" ValueType="Dword" />
            </RegistryDatapoint>
            </RegistryDatapoints>
        </RegistryQuery>
        <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\Claims">
            <RegistryDatapoints>
            <RegistryDatapoint DataId="3014" DataType="Dword">
                <RegistryValueSelector ValueName="OrganizationalClaimCount" ValueType="Dword" />
            </RegistryDatapoint>
            <RegistryDatapoint DataId="3010" DataType="Dword">
                <RegistryValueSelector ValueName="CustomClaimsTransformExists" ValueType="Dword" />
            </RegistryDatapoint>
            <RegistryDatapoint DataId="3011" DataType="Dword">
                <RegistryValueSelector ValueName="AverageClaimsPerPartner" ValueType="Dword" />
            </RegistryDatapoint>
            </RegistryDatapoints>
        </RegistryQuery>
        <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData">
            <RegistryDatapoints>
            <RegistryDatapoint DataId="2989" DataType="Dword">
                <RegistryValueSelector ValueName="KerberosSigningUsed" ValueType="Dword" />
            </RegistryDatapoint>
            <RegistryDatapoint DataId="3006" DataType="Dword">
                <RegistryValueSelector ValueName="ADAMStoreCount" ValueType="Dword" />
            </RegistryDatapoint>
            </RegistryDatapoints>
        </RegistryQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="120" RequiredState="Running" />
                </Expression>
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\cimv2" Query="SELECT * FROM Win32_PerfFormattedData_WMServer_WindowsMediaServices" QueryTimeout="20" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2417" DataType="Dword">
                            <WmiPropertySelector PropertyName="TotalServerUptime" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2418" DataType="Dword">
                            <WmiPropertySelector PropertyName="CurrentStreamingPlayers" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2419" DataType="Dword">
                            <WmiPropertySelector PropertyName="CurrentStreamingHTTPPlayers" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2420" DataType="Dword">
                            <WmiPropertySelector PropertyName="CurrentStreamingRTSPPlayers" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2421" DataType="Dword">
                            <WmiPropertySelector PropertyName="PeakPlayerSendRateKbps" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2422" DataType="Dword">
                            <WmiPropertySelector PropertyName="PeakStreamingPlayers" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2423" DataType="Dword">
                            <WmiPropertySelector PropertyName="PeakOutgoingDistributionConnections" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2424" DataType="Dword">
                            <WmiPropertySelector PropertyName="PeakOutgoingDistributionSendRateKbps" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2425" DataType="Dword">
                            <WmiPropertySelector PropertyName="TotalAdvertisements" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
                <Expression JoinOperator="And">
                    <RoleTest RoleId="18" RequiredState="Installed" />
                </Expression>
            </Applicability>
            <Queries>
                <WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT LicensingType, DirectConnectLicenseServers, TerminalServerMode FROM Win32_TerminalServiceSetting" MaxRows="1">
                    <WmiDatapoints>
                        <WmiDatapoint DataId="2478" DataType="Dword">
                            <WmiPropertySelector PropertyName="LicensingType" PropertyType="Dword" />
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2479" DataType="Boolean">
                            <WmiPropertySelector PropertyName="DirectConnectLicenseServers" PropertyType="String" >
                                <Transforms>
                                    <LogicalTransform Operator="NotEquals" DataType="String" Comparand="" />
                                </Transforms>
                            </WmiPropertySelector>
                        </WmiDatapoint>
                        <WmiDatapoint DataId="2480" DataType="Dword">
                            <WmiPropertySelector PropertyName="TerminalServerMode" PropertyType="Dword" />
                        </WmiDatapoint>
                    </WmiDatapoints>
                </WmiQuery>
            </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
        <Global />
            </Applicability>
        <Queries>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1602) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3027" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1610) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3028" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1611) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3029" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1612) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3030" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1613) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3031" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1614) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3032" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1615) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3033" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1616) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3034" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1617) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3035" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1618) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3036" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1619) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3037" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1620) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3038" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1621) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3039" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1622) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3040" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1623) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3041" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1624) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3077" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1625) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3078" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1630) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3042" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1631) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3043" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1632) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3044" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1633) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3045" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1634) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3046" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1635) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3047" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1636) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3048" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Setup" Query="*[System[(EventID=1637) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3049" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1651) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3051" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1652) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3052" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1653) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3053" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1654) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3054" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1655) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3055" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1656) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3056" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1657) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3057" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1658) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3058" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1659) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3059" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1660) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3060" Function="Count" />
            </EventAggregates>
            </EventQuery>
            <EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1661) and TimeCreated[timediff(@SystemTime) <= 259200000]]]">
                <EventAggregates>
                <EventAggregate DataId="3061" Function="Count" />
            </EventAggregates>
            </EventQuery>
        </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
        <Global />
            </Applicability>
        <Queries>
            <WmiQuery Namespace="root\cimv2" Query="SELECT * FROM Win32_PerfFormattedData_MSDTC_DistributedTransactionCoordinator" QueryTimeout="20" MaxRows="1">
                        <WmiDatapoints>
                            <WmiDatapoint DataId="2929" DataType="Dword">
                    <WmiPropertySelector PropertyName="CommittedTransactions" PropertyType="Dword" />
                </WmiDatapoint>
                            <WmiDatapoint DataId="2930" DataType="Dword">
                    <WmiPropertySelector PropertyName="AbortedTransactions" PropertyType="Dword" />
                </WmiDatapoint>
                            <WmiDatapoint DataId="2931" DataType="Dword">
                    <WmiPropertySelector PropertyName="ForceAbortedTransactions" PropertyType="Dword" />
                </WmiDatapoint>
                            <WmiDatapoint DataId="2932" DataType="Dword">
                    <WmiPropertySelector PropertyName="ForceCommittedTransactions" PropertyType="Dword" />
                </WmiDatapoint>
                            <WmiDatapoint DataId="2933" DataType="Dword">
                    <WmiPropertySelector PropertyName="ResponseTimeAverage" PropertyType="Dword" />
                </WmiDatapoint>
                        </WmiDatapoints>
                    </WmiQuery>
            <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\MSDTC\Security">
                <RegistryDatapoints>
                <RegistryDatapoint DataId="2919" DataType="Dword">
                    <RegistryValueSelector ValueName="NetworkDtcAccess" ValueType="Dword" />
                </RegistryDatapoint>
                <RegistryDatapoint DataId="2920" DataType="Dword">
                    <RegistryValueSelector ValueName="NetworkDtcAccessClients" ValueType="Dword" />
                </RegistryDatapoint>
                <RegistryDatapoint DataId="2921" DataType="Dword">
                    <RegistryValueSelector ValueName="NetworkDtcAccessAdmin" ValueType="Dword" />
                </RegistryDatapoint>
                <RegistryDatapoint DataId="2922" DataType="Dword">
                    <RegistryValueSelector ValueName="NetworkDtcAccessInbound" ValueType="Dword" />
                </RegistryDatapoint>
                <RegistryDatapoint DataId="2923" DataType="Dword">
                    <RegistryValueSelector ValueName="NetworkDtcAccessOutbound" ValueType="Dword" />
                </RegistryDatapoint>
                <RegistryDatapoint DataId="2927" DataType="Dword">
                    <RegistryValueSelector ValueName="NetworkDtcAccessTip" ValueType="Dword" />
                </RegistryDatapoint>
                <RegistryDatapoint DataId="2928" DataType="Dword">
                    <RegistryValueSelector ValueName="XATransactions" ValueType="Dword" />
                </RegistryDatapoint>
                </RegistryDatapoints>
            </RegistryQuery>
            <RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\MSDTC">
                <RegistryDatapoints>
                <RegistryDatapoint DataId="2924" DataType="Dword">
                    <RegistryValueSelector ValueName="AllowOnlySecureRpcCalls" ValueType="Dword" />
                </RegistryDatapoint>
                <RegistryDatapoint DataId="2925" DataType="Dword">
                    <RegistryValueSelector ValueName="FallbackToUnsecureRPCIfNecessary" ValueType="Dword" />
                </RegistryDatapoint>
                <RegistryDatapoint DataId="2926" DataType="Dword">
                    <RegistryValueSelector ValueName="TurnOffRpcSecurity" ValueType="Dword" />
                </RegistryDatapoint>
                </RegistryDatapoints>
            </RegistryQuery>
        </Queries>
        </QueryGroup>

        <QueryGroup>
            <Applicability>
        <Global />
            </Applicability>
        <Queries>
        <EventQuery Channel="System" Query="*[System[(Level=1  or Level=2) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
                <TopEvents EventCount="10" MSSpecificEvents="1" />

            </EventQuery>
        <EventQuery Channel="System" Query="*[System[(Level=3) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
                <TopEvents EventCount="10" MSSpecificEvents="1" />

            </EventQuery>
        <EventQuery Channel="System" Query="*[System[(Level=0 or Level=4) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
                <TopEvents EventCount="10" MSSpecificEvents="1" />

            </EventQuery>
        <EventQuery Channel="Application" Query="*[System[(Level=1  or Level=2) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
                <TopEvents EventCount="10" MSSpecificEvents="1" />

            </EventQuery>
        <EventQuery Channel="Application" Query="*[System[(Level=3) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
                <TopEvents EventCount="10" MSSpecificEvents="1" />

            </EventQuery>
        <EventQuery Channel="Application" Query="*[System[(Level=0 or Level=4) and TimeCreated[timediff(@SystemTime) <= 259200000]]]" QueryTimeout="20">
                <TopEvents EventCount="10" MSSpecificEvents="1" />

            </EventQuery>
        </Queries>
        </QueryGroup>

    </QueryGroups>
</CeipAssistant>