﻿<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0" copyright="Copyright (c) Microsoft Corporation. All Rights Reserved.">
  <assemblyIdentity name="Microsoft-Windows-IE-ESC" version="11.0.10586.63" processorArchitecture="amd64" language="neutral" buildType="release" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" />
  <file name="EscMigPlugin.dll" destinationPath="$(runtime.system32)\" sourceName="EscMigPlugin.dll" sourcePath=".\" importPath="$(build.nttree)\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2">
      <dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">bDngT65ljdGRMTqtrjikNTYCEX2/ZPktJofkbbr/WdM=</dsig:DigestValue>
    </asmv2:hash>
  </file>
  <file name="escUnattend.exe" destinationPath="$(runtime.system32)\" sourceName="escUnattend.exe" sourcePath=".\" importPath="$(build.nttree)\">
    <securityDescriptor name="WRP_FILE_DEFAULT_SDDL" />
    <asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2">
      <dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
      </dsig:Transforms>
      <dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" />
      <dsig:DigestValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">IMFAyi/e3/cq2DNRK54c2nfYa0k9OSgX15VeatkGUcU=</dsig:DigestValue>
    </asmv2:hash>
  </file>
  <registryKeys>
    <registryKey keyName="HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}">
      <registryValue name="" valueType="REG_SZ" value="Applying Enhanced Security Configuration" />
      <registryValue name="ComponentID" valueType="REG_SZ" value="IEHardenAdmin" />
      <registryValue name="Locale" valueType="REG_SZ" value="en" />
      <registryValue name="Dontask" valueType="REG_DWORD" value="0x00000002" />
      <registryValue name="StubPath" valueType="REG_SZ" value="&quot;$(runtime.system32)\rundll32.exe&quot; &quot;$(runtime.system32)\iesetup.dll&quot;,IEHardenAdmin" />
      <registryValue name="Version" valueType="REG_SZ" value="11,63,10586,0" />
      <registryValue name="LocalizedName" valueType="REG_SZ" value="@$(runtime.system32)\iesetup.dll,-3010" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}">
      <registryValue name="" valueType="REG_SZ" value="Applying Enhanced Security Configuration" />
      <registryValue name="ComponentID" valueType="REG_SZ" value="IEHardenUser" />
      <registryValue name="Locale" valueType="REG_SZ" value="en" />
      <registryValue name="Dontask" valueType="REG_DWORD" value="0x00000002" />
      <registryValue name="StubPath" valueType="REG_SZ" value="&quot;$(runtime.system32)\rundll32.exe&quot; &quot;$(runtime.system32)\iesetup.dll&quot;,IEHardenUser" />
      <registryValue name="Version" valueType="REG_SZ" value="11,63,10586,0" />
      <registryValue name="LocalizedName" valueType="REG_SZ" value="@$(runtime.system32)\iesetup.dll,-3011" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\ESCHomePages">
      <registryValue name="HardAdmin" valueType="REG_SZ" value="res://iesetup.dll/HardAdmin.htm" />
      <registryValue name="SoftAdmin" valueType="REG_SZ" value="res://iesetup.dll/SoftAdmin.htm" />
      <registryValue name="HardUser" valueType="REG_SZ" value="res://iesetup.dll/HardUser.htm" />
    </registryKey>
  </registryKeys>
  <trustInfo>
    <security>
      <accessControl>
        <securityDescriptorDefinitions>
          <securityDescriptorDefinition name="WRP_FILE_DEFAULT_SDDL" sddl="O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)(A;;GRGX;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)S:(AU;FASA;0x000D0116;;;WD)" operationHint="replace" description="Default SDDL for Windows Resource Protected file" />
          <securityDescriptorDefinition name="WRP_REGKEY_DEFAULT_SDDL" sddl="O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464D:P(A;CI;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;CI;GR;;;SY)(A;CI;GR;;;BA)(A;CI;GR;;;BU)(A;CI;GR;;;S-1-15-2-1)" operationHint="replace" />
        </securityDescriptorDefinitions>
      </accessControl>
    </security>
  </trustInfo>
  <localization>
    <resources culture="en-US">
      <stringTable>
        <string id="description" value="Describe ESC here" />
        <string id="displayName" value="Internet Explorer Enhanced security configuration" />
        <string id="HardenAdminDescription" value="Choose 1 to enable or 0 to disable ESC on for all users in administrators group" />
        <string id="HardenAdminDisplayName" value="IEHardenAdmin specifies whether Internet Explorer® Enhanced Security Configuration (ESC) is enabled for all administrators on the computer. When Internet Explorer ESC is enabled, it reduces the exposure of your server to potential security attacks from Web pages that do not belong to the Local Intranet zone or the Trusted Sites zone." />
        <string id="HardenUserDescription" value="Choose 1 to enable or 0 to disable ESC on for all users not in administrators group" />
        <string id="HardenUserDisplayName" value="IEHardenUser specifies whether Internet Explorer® Enhanced Security Configuration (ESC) is enabled for all users. When Internet Explorer ESC is enabled, it reduces the exposure of your server to potential security attacks from Web pages that do not belong to the Local Intranet zone or the Trusted Sites zone." />
      </stringTable>
    </resources>
  </localization>
  <migration scope="Upgrade,MigWiz,USMT" settingsVersion="0">
    <plugin file="$(runtime.system32)\EscMigPlugin.dll" classId="{196b9c00-9ecd-11db-af15-0014223890f3}" />
    <supportedComponents>
      <supportedComponent>
        <assemblyIdentity name="_" version="1.0.0.0" />
        <supportedComponentIdentity xmlns="urn:schemas-microsoft-com:asm.v3" language="*" name="Microsoft-Windows-IE-ESC" processorArchitecture="*" settingsVersionRange="0" />
      </supportedComponent>
      <supportedComponent>
        <assemblyIdentity name="_" version="1.0.0.0" />
        <supportedComponentIdentity xmlns="urn:schemas-microsoft-com:asm.v3" buildType="release" language="*" name="Microsoft-Windows-IE-ESC-DL" processorArchitecture="*" publicKeyToken="31bf3856ad364e35" settingsVersionRange="0" versionScope="nonSxS" />
      </supportedComponent>
    </supportedComponents>
  </migration>
  <configuration xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:app="Microsoft-Windows-IE-ESC" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
    <configurationSchema>
      <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" targetNamespace="Microsoft-Windows-IE-ESC">
        <xsd:element name="IEHardenAdmin" type="xsd:boolean" wcm:dataOnly="false" wcm:description="IEHardenAdmin specifies whether Internet Explorer® Enhanced Security Configuration (ESC) is enabled for all administrators on the computer. When Internet Explorer ESC is enabled, it reduces the exposure of your server to potential security attacks from Web pages that do not belong to the Local Intranet zone or the Trusted Sites zone." wcm:displayName="Choose 1 to enable or 0 to disable ESC on for all users in administrators group" wcm:handler="regkey('HKLM\Software\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Microsoft-Windows-IE-ESC')" wcm:legacyType="REG_DWORD" wcm:passes="specialize" wcm:scope="allUsers" wcm:visible="true" />
        <xsd:element name="IEHardenUser" type="xsd:boolean" wcm:dataOnly="false" wcm:description="IEHardenUser specifies whether Internet Explorer® Enhanced Security Configuration (ESC) is enabled for all users. When Internet Explorer ESC is enabled, it reduces the exposure of your server to potential security attacks from Web pages that do not belong to the Local Intranet zone or the Trusted Sites zone." wcm:displayName="Choose 1 to enable or 0 to disable ESC on for all users not in administrators group" wcm:handler="regkey('HKLM\Software\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Microsoft-Windows-IE-ESC')" wcm:legacyType="REG_DWORD" wcm:passes="specialize" wcm:scope="allUsers" wcm:visible="true" />
        <xsd:element default="true" name="MigIEHardenAdmin" type="xsd:boolean" wcm:description="IEHardenAdmin specifies whether Internet Explorer® Enhanced Security Configuration (ESC) is enabled for all administrators on the computer. When Internet Explorer ESC is enabled, it reduces the exposure of your server to potential security attacks from Web pages that do not belong to the Local Intranet zone or the Trusted Sites zone." wcm:displayName="Choose 1 to enable or 0 to disable ESC on for all users in administrators group" wcm:handler="regkey('HKLM\Software\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}')" wcm:legacyName="IsInstalled" wcm:legacyType="REG_DWORD" wcm:migrate="yes" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="true" name="MigIEHardenUser" type="xsd:boolean" wcm:description="IEHardenUser specifies whether Internet Explorer® Enhanced Security Configuration (ESC) is enabled for all users. When Internet Explorer ESC is enabled, it reduces the exposure of your server to potential security attacks from Web pages that do not belong to the Local Intranet zone or the Trusted Sites zone." wcm:displayName="Choose 1 to enable or 0 to disable ESC on for all users not in administrators group" wcm:handler="regkey('HKLM\Software\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}')" wcm:legacyName="IsInstalled" wcm:legacyType="REG_DWORD" wcm:migrate="yes" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_allupdate_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_allupdate_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\*.update')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_allupdate_https" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_allupdate_https" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\*.update')" wcm:legacyName="https" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_update_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_update_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\update')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_update_https" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_update_https" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\update')" wcm:legacyName="https" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_allwindowsupdate_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_allwindowsupdate_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\*.windowsupdate')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_allwindowsupdate_https" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_allwindowsupdate_https" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\*.windowsupdate')" wcm:legacyName="https" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_windowsupdate_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_windowsupdate_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\windowsupdate')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_windowsupdate_https" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_windowsupdate_https" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\windowsupdate')" wcm:legacyName="https" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_oca_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_oca_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\oca')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_oca_https" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_oca_https" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\oca')" wcm:legacyName="https" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_www_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_www_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\www')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_go_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_go_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\go')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_support_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_support_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\support')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_msdn_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_msdn_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\msdn')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_all_technet_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_all_technet_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\*.technet')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_microsoft_com_technet_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_microsoft_com_technet_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\technet')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_windowsupdate_com_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_windowsupdate_com_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\windowsupdate.com')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="1" name="IEHardenDomain_localhost_http" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_localhost_http" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\localhost')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="1" name="IEHardenDomain_localhost_https" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_localhost_https" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\localhost')" wcm:legacyName="https" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="1" name="IEHardenDomain_system_hcp" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_system_hcp" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\//system')" wcm:legacyName="hcp" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="2" name="IEHardenDomain_msn_com_runonce" type="xsd:int" wcm:dataOnly="true" wcm:displayName="IEHardenDomain_msn_com_runonce" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\msn.com\runonce')" wcm:legacyName="http" wcm:migrate="no" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element default="1" name="HKLM_SMW_CV_IS_zonemap_IEHarden" type="xsd:int" wcm:dataOnly="true" wcm:displayName="HKLM_SMW_CV_IS_zonemap_IEHarden" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap')" wcm:legacyName="IEHarden" wcm:passes="offlineServicing" wcm:scope="allUsers" wcm:visible="false" />
        <xsd:element name="HKLM_SMW_CV_IS_zones_3_180b" type="xsd:int" wcm:dataOnly="true" wcm:handler="regkey('HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3')" wcm:legacyName="180B" wcm:passes="offlineServicing" wcm:scope="allUsers" wcm:visible="false" />
      </xsd:schema>
    </configurationSchema>
  </configuration>
  <unattendActions xmlns="urn:schemas-microsoft-com:asm.v3">
    <unattendAction executableName="$(runtime.system32)\escUnattend.exe" passes="specialize" />
  </unattendActions>
</assembly>