diff --git a/oval-schemas/windows-definitions-schema.xsd b/oval-schemas/windows-definitions-schema.xsd index 3dc708a..e437a48 100644 --- a/oval-schemas/windows-definitions-schema.xsd +++ b/oval-schemas/windows-definitions-schema.xsd @@ -4084,6 +4084,12 @@ For more information, refer to https://learn.microsoft.com/en-us/troubleshoot/windows-server/support-tools/scripts-to-retrieve-profile-age + + + The user_has_signed_into_explorer element describes if the user account has ever run Windows Explorer. This is a practical indicator of accounts using interactive (desktop/GUI) sessions and is not set by non-interactive logon methods such as WinRM or SSH. Content authors may use this element to exclude non-interactive users from user policy checks. + This can be determined by gathering the Software\Microsoft\Windows\CurrentVersion\Explorer\UserSigned value for the given ntuser.dat profile, 1 = true and 0 = false. + + The enabled element describes if the user account is enabled or disabled. diff --git a/oval-schemas/windows-system-characteristics-schema.xsd b/oval-schemas/windows-system-characteristics-schema.xsd index 963c5cc..c5b4170 100644 --- a/oval-schemas/windows-system-characteristics-schema.xsd +++ b/oval-schemas/windows-system-characteristics-schema.xsd @@ -1690,7 +1690,13 @@ The last_logon data which can be obtained from the LocalProfileLoadTimeHigh and LocalProfileLoadTimeLow registry values from HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\<SID>, converted to days and then rounded down to the nearest integer (floor function). If the account is determined to be currently logged in, this date should be reported as 0. For more information, refer to https://learn.microsoft.com/en-us/troubleshoot/windows-server/support-tools/scripts-to-retrieve-profile-age - + + + + The user_has_signed_into_explorer element describes if the user account has ever run Windows Explorer. This is a practical indicator of accounts using interactive (desktop/GUI) sessions and is not set by non-interactive logon methods such as WinRM or SSH. Content authors may use this element to exclude non-interactive users from user policy checks. + This can be determined by gathering the Software\Microsoft\Windows\CurrentVersion\Explorer\UserSigned value for the given ntuser.dat profile, 1 = true and 0 = false. + + The enabled element describes if the user account is enabled or disabled.