<upd:Update xmlns:pub="http://schemas.microsoft.com/msus/2002/12/Publishing" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" xmlns:lar="http://schemas.microsoft.com/msus/2002/12/LogicalApplicabilityRules" xmlns:upd="http://schemas.microsoft.com/msus/2002/12/Update"><upd:UpdateIdentity UpdateID="ddf41f1c-23bb-48c8-8a76-71da0a6a9f4c" RevisionNumber="100" /><upd:Properties DefaultPropertiesLanguage="en" UpdateType="Detectoid" ExplicitlyDeployable="false" PerUser="false" IsPublic="false" DetectoidType="SKU or Feature" PublicationState="Published" CreationDate="2010-11-02T18:39:39.374Z" PublisherID="23c44e80-1e29-4bef-9d87-67959c8ce710"></upd:Properties><upd:LocalizedPropertiesCollection><upd:LocalizedProperties><upd:Language>en</upd:Language><upd:Title>MSEv2: NIS Enabled Detectoid</upd:Title><upd:Description>This detectoid returns true if NIS is enabled on a machine that has the Torino client installed.</upd:Description></upd:LocalizedProperties></upd:LocalizedPropertiesCollection><upd:Relationships><upd:Prerequisites><upd:UpdateIdentity UpdateID="6b9e8b26-8f50-44b9-94c6-7846084383ec" /></upd:Prerequisites></upd:Relationships><upd:ApplicabilityRules><upd:IsInstalled><lar:And xmlns:lar="http://schemas.microsoft.com/msus/2002/12/LogicalApplicabilityRules"><!-- NIS is supported by the AM product --><bar:RegKeyExists Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Microsoft Antimalware\NIS" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /><!-- NIS Service is installed --><bar:RegKeyExists Key="HKEY_LOCAL_MACHINE" Subkey="SYSTEM\CurrentControlSet\services\NisSrv" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /><!-- NIS Service is not disabled --><lar:Not><bar:RegDword Key="HKEY_LOCAL_MACHINE" Subkey="SYSTEM\CurrentControlSet\services\NisSrv" Value="Start" Comparison="EqualTo" Data="4" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /></lar:Not><!-- Must not be disabled in either user or policy
            Can be set using both disable RTP and disable NIS registry key values
            Disable from RTP overrides the enable option from NIS --><lar:Not><lar:Or><!-- Disabled in policy for RTP? --><bar:RegDword Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Real-Time Protection" Value="DisableRealtimeMonitoring" Comparison="GreaterThanOrEqualTo" Data="1" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /><!-- Disabled in policy for NIS? --><bar:RegDword Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Real-Time Protection" Value="DisableIntrusionPreventionSystem" Comparison="GreaterThanOrEqualTo" Data="1" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /><!-- Not disabled by the user for RTP? --><lar:And><!-- Policy value exists? --><lar:Not><bar:RegValueExists Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Real-Time Protection" Value="DisableRealtimeMonitoring" Type="REG_DWORD" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /></lar:Not><!-- Disabled in user store? --><bar:RegDword Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Microsoft Antimalware\Real-Time Protection" Value="DisableRealtimeMonitoring" Comparison="GreaterThanOrEqualTo" Data="1" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /></lar:And><!-- Not disabled by the user for NIS? --><lar:And><!-- Policy value exists? --><lar:Not><bar:RegValueExists Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Real-Time Protection" Value="DisableIntrusionPreventionSystem" Type="REG_DWORD" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /></lar:Not><!-- Disabled in user store? --><bar:RegDword Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Microsoft Antimalware\Real-Time Protection" Value="DisableIntrusionPreventionSystem" Comparison="GreaterThanOrEqualTo" Data="1" xmlns:bar="http://schemas.microsoft.com/msus/2002/12/BaseApplicabilityRules" /></lar:And></lar:Or></lar:Not></lar:And></upd:IsInstalled></upd:ApplicabilityRules></upd:Update>