<?xml version="1.0" encoding="UTF-8"?>
<CeipAssistant>

	<FileAttributes>
		<Author>Microsoft Corporation</Author>
		<Version>4</Version>
	</FileAttributes>

	<ExecutionOptions>
		<GlobalTimeout>1800</GlobalTimeout>
		<QueryTimeout>10</QueryTimeout>
		<MaxRows>1000</MaxRows>
		<MaxErrors>2</MaxErrors>
		<ExecutionWindow>36</ExecutionWindow>
	</ExecutionOptions>

	<QueryGroups>
		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT AllowTSConnections FROM Win32_TerminalServiceSetting" QueryTimeout="20">
					<WmiDatapoints>
						<WmiDatapoint DataId="2539" DataType="Dword">
							<WmiPropertySelector PropertyName="AllowTSConnections" PropertyType="Dword" />
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2" Query="SELECT MediaType FROM Win32_DiskDrive WHERE MediaType='Fixed hard disk media'" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2517" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2" Query="SELECT Type FROM Win32_DiskPartition" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2520" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2" Query="SELECT Model, Size FROM Win32_DiskDrive" QueryTimeout="20">
					<WmiStreams>
						<WmiStream DataId="2918">
							<WmiStreamColumns>
								<WmiStreamColumn DataType="String">
									<WmiPropertySelector PropertyName="Model" PropertyType="String" />
								</WmiStreamColumn>
								<WmiStreamColumn DataType="Dword">
									<WmiPropertySelector PropertyName="Size" PropertyType="Qword">
										<Transforms>
											<ScaleTransform Divisor="1048576" />
										</Transforms>
									</WmiPropertySelector>
								</WmiStreamColumn>
							</WmiStreamColumns>
						</WmiStream>
					</WmiStreams>
				</WmiQuery>
				<RegistryQuery Hive="HKLM" Subkey="System\Setup">
					<RegistryAggregates>
						<RegistryAggregate DataId="3076" Function="Exists">
							<RegistryValueSelector ValueName="Upgrade" ValueType="Dword" />
						</RegistryAggregate>
					</RegistryAggregates>
				</RegistryQuery>
				<EventQuery Channel="System" Query="*[System/EventID=596]">
					<EventAggregates>
						<EventAggregate DataId="2534" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="System" Query="*[System/EventID=23]">
					<EventAggregates>
						<EventAggregate DataId="2538" Function="Count" />
					</EventAggregates>
				</EventQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<CustomQuery QueryId="11" />
				<CustomQuery QueryId="16" />
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<CustomQuery QueryId="14">
					<Arguments>
						<Argument>5071</Argument>
					</Arguments>
				</CustomQuery>
			</Queries>
		</QueryGroup>
		
		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<CustomQuery QueryId="18">
					<Arguments>
						<Argument>6705</Argument>
					</Arguments>
				</CustomQuery>
				<RegistryQuery Hive="HKLM" Subkey="Software\Policies\Microsoft\SQMClient\Windows">
					<RegistryAggregates>
						<RegistryAggregate DataId="6707" Function="Exists">
							<RegistryValueSelector ValueName="CEIPEnable" ValueType="Dword" />
						</RegistryAggregate>
					</RegistryAggregates>
				</RegistryQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="10" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<EventQuery Channel="System" Query="*[System/EventID=8225]">
					<EventAggregates>
						<EventAggregate DataId="2536" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="System" Query="*[System/EventID=8226]">
					<EventAggregates>
						<EventAggregate DataId="2535" Function="Count" />
					</EventAggregates>
				</EventQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup MaxErrors="7">
			<Applicability>
				<Expression JoinOperator="And">
					<QueryTest>
						<WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_Service WHERE Name = 'ClusSvc' AND State = 'Running'">
							<WmiAggregates>
								<WmiAggregate DataId="4294967295" Function="Exists" />
							</WmiAggregates>
						</WmiQuery>
						<ValueTest Operator="Equals" DataType="Dword" Comparand="1" />
					</QueryTest>
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\MSCluster" Query="SELECT * from MSCluster_Node">
					<WmiAggregates>
						<WmiAggregate DataId="2551" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MSCluster" Query="SELECT QuorumTypeValue from MSCluster_Cluster" QueryTimeout="20" MaxRows="1">
					<WmiDatapoints>
						<WmiDatapoint DataId="2553" DataType="Dword">
							<WmiPropertySelector PropertyName="QuorumTypeValue" PropertyType="Dword" />
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\MSCluster" Query="associators of {MSCluster_Cluster.Name='.'} Where AssocClass=MSCluster_ClusterToQuorumResource" MaxRows="1">
					<WmiDatapoints>
						<WmiDatapoint DataId="2566" DataType="Dword">
							<WmiPropertySelector PropertyName="Type" PropertyType="String">
								<Transforms>
									<EnumTransform DefaultValue="0">
										<Enum Name="Physical Disk" Value="1" />
										<Enum Name="File Share Witness" Value="2" />
									</EnumTransform>
								</Transforms>
							</WmiPropertySelector>
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\MSCluster" Query="SELECT Type from MSCluster_Resource" QueryTimeout="30">
					<WmiAggregates>
						<WmiAggregate DataId="2554" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="File Server" />
						</WmiAggregate>
						<WmiAggregate DataId="2555" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="DHCP Service" />
						</WmiAggregate>
						<WmiAggregate DataId="2556" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Distributed Transaction Coordinator" />
						</WmiAggregate>
						<WmiAggregate DataId="2557" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Generic Application" />
						</WmiAggregate>
						<WmiAggregate DataId="2558" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Generic Service" />
						</WmiAggregate>
						<WmiAggregate DataId="2559" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Generic Script" />
						</WmiAggregate>
						<WmiAggregate DataId="2560" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Microsoft iSNS" />
						</WmiAggregate>
						<WmiAggregate DataId="2561" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="MSMQ" />
						</WmiAggregate>
						<WmiAggregate DataId="2562" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="NFS Share" />
						</WmiAggregate>
						<WmiAggregate DataId="2563" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Print Spooler" />
						</WmiAggregate>
						<WmiAggregate DataId="2564" Function="Exists">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="WINS Service" />
						</WmiAggregate>
						<WmiAggregate DataId="2565" Function="Count">
							<WmiPropertySelector PropertyName="Type" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Physical Disk" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MSCluster" Query="SELECT Type from MSCluster_Resource WHERE Type='Virtual Machine' OR Type='Virtual Machine Configuration'" QueryTimeout="30">
					<WmiAggregates>
						<WmiAggregate DataId="5895" Function="Exists" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MSCluster" Query="SELECT Type from MSCluster_Resource WHERE Type='SQL Server' OR Type='SQL Server Agent'" QueryTimeout="30">
					<WmiAggregates>
						<WmiAggregate DataId="5890" Function="Exists" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MSCluster" Query="SELECT EnableSharedVolumes FROM MSCluster_Cluster WHERE EnableSharedVolumes=1" QueryTimeout="30">
					<WmiAggregates>
						<WmiAggregate DataId="5887" Function="Exists" />
					</WmiAggregates>
				</WmiQuery>
				<RegistryQuery Hive="HKLM" Subkey="System\CurrentControlSet\Services\Clussvc\Parameters">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="2552" DataType="Dword">
							<RegistryValueSelector ValueName="InstanceHash" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="34" RequiredState="Installed" />
					<QueryTest>
						<WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT Name FROM MicrosoftNLB_Cluster" QueryTimeout="20">
							<WmiAggregates>
								<WmiAggregate DataId="4294967295" Function="Exists" />
							</WmiAggregates>
						</WmiQuery>
						<ValueTest Operator="Equals" DataType="Dword" Comparand="1" />
					</QueryTest>
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT Name FROM MicrosoftNLB_Cluster" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="4143" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT Name FROM MicrosoftNLB_Node" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="4555" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT MulticastSupportEnabled, BDATeamActive FROM MicrosoftNLB_ClusterSetting" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="4556" Function="Count">
							<WmiPropertySelector PropertyName="MulticastSupportEnabled" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="False" />
						</WmiAggregate>
						<WmiAggregate DataId="4546" Function="Exists">
							<WmiPropertySelector PropertyName="BDATeamActive" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="True" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT MulticastSupportEnabled FROM MicrosoftNLB_ClusterSetting WHERE MulticastSupportEnabled=TRUE AND IgmpSupport=FALSE" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="4553" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT MulticastSupportEnabled FROM MicrosoftNLB_ClusterSetting WHERE MulticastSupportEnabled=TRUE AND IgmpSupport=TRUE" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="4552" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT ClusterIPAddress FROM MicrosoftNLB_ClusterSetting WHERE ClusterIPAddress LIKE '%:%'" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="4547" Function="Exists" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\MicrosoftNLB" Query="SELECT Affinity, EqualLoad, FilteringMode, Protocol, ClientStickinessTimeout FROM MicrosoftNLB_PortRuleEx" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="4557" Function="Count" />
						<WmiAggregate DataId="4558" Function="Count">
							<WmiPropertySelector PropertyName="Affinity" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="0" />
						</WmiAggregate>
						<WmiAggregate DataId="4559" Function="Count">
							<WmiPropertySelector PropertyName="Affinity" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="1" />
						</WmiAggregate>
						<WmiAggregate DataId="4560" Function="Count">
							<WmiPropertySelector PropertyName="Affinity" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="2" />
						</WmiAggregate>
						<WmiAggregate DataId="4551" Function="Count">
							<WmiPropertySelector PropertyName="EqualLoad" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="True" />
						</WmiAggregate>
						<WmiAggregate DataId="4561" Function="Count">
							<WmiPropertySelector PropertyName="EqualLoad" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="False" />
						</WmiAggregate>
						<WmiAggregate DataId="4562" Function="Count">
							<WmiPropertySelector PropertyName="FilteringMode" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="1" />
						</WmiAggregate>
						<WmiAggregate DataId="4554" Function="Count">
							<WmiPropertySelector PropertyName="FilteringMode" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="2" />
						</WmiAggregate>
						<WmiAggregate DataId="4550" Function="Count">
							<WmiPropertySelector PropertyName="FilteringMode" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="3" />
						</WmiAggregate>
						<WmiAggregate DataId="4563" Function="Count">
							<WmiPropertySelector PropertyName="Protocol" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="1" />
						</WmiAggregate>
						<WmiAggregate DataId="4564" Function="Count">
							<WmiPropertySelector PropertyName="Protocol" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="2" />
						</WmiAggregate>
						<WmiAggregate DataId="4548" Function="Count">
							<WmiPropertySelector PropertyName="Protocol" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="3" />
						</WmiAggregate>
						<WmiAggregate DataId="4549" Function="Count">
							<WmiPropertySelector PropertyName="ClientStickinessTimeout" PropertyType="Dword" />
							<ValueTest Operator="GreaterThan" DataType="Dword" Comparand="0" />
						</WmiAggregate>
						<WmiAggregate DataId="4565" Function="Count">
							<WmiPropertySelector PropertyName="ClientStickinessTimeout" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="0" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<RegistryQuery Hive="HKLM" Subkey="SYSTEM\CurrentControlSet\Services\WLBS\Parameters">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="4142" DataType="Dword">
							<RegistryValueSelector ValueName="InstanceHash" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup MaxErrors="5">
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="140" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='W3SVC'" QueryTimeout="20" MaxRows="1">
					<WmiDatapoints>
						<WmiDatapoint DataId="2452" DataType="Dword">
							<WmiPropertySelector PropertyName="State" PropertyType="String">
								<Transforms>
									<EnumTransform DefaultValue="0">
										<Enum Name="Stopped" Value="1" />
										<Enum Name="Start Pending" Value="2" />
										<Enum Name="Stop Pending" Value="3" />
										<Enum Name="Running" Value="4" />
										<Enum Name="Continue Pending" Value="5" />
										<Enum Name="Pause Pending" Value="6" />
										<Enum Name="Paused" Value="7" />
									</EnumTransform>
								</Transforms>
							</WmiPropertySelector>
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='WAS'" MaxRows="1">
					<WmiDatapoints>
						<WmiDatapoint DataId="2454" DataType="Dword">
							<WmiPropertySelector PropertyName="State" PropertyType="String">
								<Transforms>
									<EnumTransform DefaultValue="0">
										<Enum Name="Stopped" Value="1" />
										<Enum Name="Start Pending" Value="2" />
										<Enum Name="Stop Pending" Value="3" />
										<Enum Name="Running" Value="4" />
										<Enum Name="Continue Pending" Value="5" />
										<Enum Name="Pause Pending" Value="6" />
										<Enum Name="Paused" Value="7" />
									</EnumTransform>
								</Transforms>
							</WmiPropertySelector>
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_SystemDriver WHERE Name='HTTP'" MaxRows="1">
					<WmiDatapoints>
						<WmiDatapoint DataId="2455" DataType="Dword">
							<WmiPropertySelector PropertyName="State" PropertyType="String">
								<Transforms>
									<EnumTransform DefaultValue="0">
										<Enum Name="Stopped" Value="1" />
										<Enum Name="Start Pending" Value="2" />
										<Enum Name="Stop Pending" Value="3" />
										<Enum Name="Running" Value="4" />
										<Enum Name="Continue Pending" Value="5" />
										<Enum Name="Pause Pending" Value="6" />
										<Enum Name="Paused" Value="7" />
									</EnumTransform>
								</Transforms>
							</WmiPropertySelector>
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<EventQuery Channel="System" Query="*[System[(EventID=5009) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2322" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5010) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2323" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5011) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2331" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5012) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2451" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5013) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2332" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5014) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2334" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5127) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2333" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5137) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2457" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5138) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2458" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5139) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2459" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5158) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2460" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=5002) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2461" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<EventQuery Channel="System" Query="*[System[(EventID=2003) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="2462" Function="Count" />
					</EventAggregates>
				</EventQuery>

				<CustomQuery QueryId="17">
					<Arguments>
						<Argument>\Web Service(_Total)\Get Requests/sec;Dword;100000</Argument>
						<Argument>\Web Service(_Total)\Service Uptime;Dword;100001</Argument>
						<Argument>\Web Service(_Total)\Total Get Requests;Dword;100002</Argument>
						<Argument>\Web Service Cache\URI Cache Hits;Dword;100003</Argument>
						<Argument>\Web Service Cache\Kernel: URI Cache Hits;Dword;100004</Argument>
						<Argument>\ASP.NET Apps v2.0.50727(__Total__)\Requests Total;Dword;100005</Argument>
						<Argument>\ASP.NET Apps v2.0.50727(__Total__)\Compilations Total;Dword;100006</Argument>
					</Arguments>
				</CustomQuery>

			</Queries>

			<Metrics>
				<MetricsDatapoints>

					<MetricsDatapoint DataId="2447" DataType="Dword">
						<DataSelector SourceDataId="100000" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2279" DataType="Dword">
						<DataSelector SourceDataId="100001" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2278" DataType="Dword">
						<DataSelector SourceDataId="100002" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2280" DataType="Dword">
						<DataSelector SourceDataId="100003" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2281" DataType="Dword">
						<DataSelector SourceDataId="100004" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2448" DataType="Dword">
						<DataSelector SourceDataId="100005" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2449" DataType="Dword">
						<DataSelector SourceDataId="100006" />
					</MetricsDatapoint>

				</MetricsDatapoints>

			</Metrics>

		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="150" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<CustomQuery QueryId="17">
					<Arguments>
						<Argument>\Active Server Pages\Requests Total;Dword;110000</Argument>
					</Arguments>
				</CustomQuery>
			</Queries>

			<Metrics>
				<MetricsDatapoints>

					<MetricsDatapoint DataId="2282" DataType="Dword">
						<DataSelector SourceDataId="110000" />
					</MetricsDatapoint>

				</MetricsDatapoints>

			</Metrics>

		</QueryGroup>

		<QueryGroup MaxErrors="5">
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="176" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM Site" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2317" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\WebAdministration" Query="SELECT Enable32BitAppOnWin64 FROM ApplicationPool" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2318" Function="Count" />
						<WmiAggregate DataId="5127" Function="Count">

							<WmiPropertySelector PropertyName="Enable32BitAppOnWin64" PropertyType="Boolean" />
							<ValueTest Operator="NotEquals" DataType="Boolean" Comparand="False" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\WebAdministration" Query="SELECT ManagedPipelineMode FROM ApplicationPool WHERE ManagedPipelineMode=0" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="5119" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\WebAdministration" Query="SELECT ManagedPipelineMode FROM ApplicationPool WHERE ManagedPipelineMode!=0" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="5120" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\WebAdministration" Query="SELECT Enabled FROM ConfigurationRedirectionSection" QueryTimeout="20">
					<WmiDatapoints>
						<WmiDatapoint DataId="5121" DataType="Dword">
							<WmiPropertySelector PropertyName="Enabled" PropertyType="Boolean"/>
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM Application" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2319" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM WorkerProcess" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2320" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\WebAdministration" Query="SELECT * FROM AppDomain" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2321" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\IIS Extensions\MSDeploy\1">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="5122" DataType="Dword">
							<RegistryValueSelector ValueName="Install" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\INETSTP\Components">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="5123" DataType="Dword">
							<RegistryValueSelector ValueName="FTPSvc" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5124" DataType="Dword">
							<RegistryValueSelector ValueName="FTPExtensibility" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5125" DataType="Dword">
							<RegistryValueSelector ValueName="WebDAV" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5126" DataType="Dword">
							<RegistryValueSelector ValueName="PowerShellProvider" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="184" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='FTPSVC'" QueryTimeout="20" MaxRows="1">
					<WmiDatapoints>
						<WmiDatapoint DataId="2453" DataType="Dword">
							<WmiPropertySelector PropertyName="State" PropertyType="String">
								<Transforms>
									<EnumTransform DefaultValue="0">
										<Enum Name="Stopped" Value="1" />
										<Enum Name="Start Pending" Value="2" />
										<Enum Name="Stop Pending" Value="3" />
										<Enum Name="Running" Value="4" />
										<Enum Name="Continue Pending" Value="5" />
										<Enum Name="Pause Pending" Value="6" />
										<Enum Name="Paused" Value="7" />
									</EnumTransform>
								</Transforms>
							</WmiPropertySelector>
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<CustomQuery QueryId="17">
					<Arguments>
						<Argument>\Microsoft FTP Service(_Total)\Microsoft FTP Service Uptime;Dword;120000</Argument>
						<Argument>\Microsoft FTP Service(_Total)\Total Connection Attempts;Dword;120001</Argument>
					</Arguments>
				</CustomQuery>
			</Queries>

			<Metrics>
				<MetricsDatapoints>

					<MetricsDatapoint DataId="2291" DataType="Dword">
						<DataSelector SourceDataId="120000" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2292" DataType="Dword">
						<DataSelector SourceDataId="120001" />
					</MetricsDatapoint>

				</MetricsDatapoints>

			</Metrics>

		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="20" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\virtualization" Query="SELECT Name FROM Msvm_ComputerSystem WHERE Name!='%computername%' AND (EnabledState=2 OR EnabledState=32768 OR EnabledState=32770 OR EnabledState=32777)">
					<WmiAggregates>
						<WmiAggregate DataId="3772" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT SystemName FROM Msvm_Processor">
					<WmiAggregates>
						<WmiAggregate DataId="3771" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT Name FROM Msvm_ComputerSystem WHERE Name!='%computername%'">
					<WmiAggregates>
						<WmiAggregate DataId="3773" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT Name FROM Msvm_ComputerSystem WHERE Name!='%computername%' AND EnabledState=2">
					<WmiAggregates>
						<WmiAggregate DataId="4264" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT SystemName FROM Msvm_SyntheticEthernetPort">
					<WmiAggregates>
						<WmiAggregate DataId="3774" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT SystemName FROM Msvm_EmulatedEthernetPort">
					<WmiAggregates>
						<WmiAggregate DataId="3775" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT Address FROM Msvm_ResourceAllocationSettingData WHERE ResourceSubType='Microsoft Physical Disk Drive' and Address IS NOT NULL">
					<WmiAggregates>
						<WmiAggregate DataId="3776" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT SystemName FROM Msvm_SCSIProtocolController">
					<WmiAggregates>
						<WmiAggregate DataId="3777" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT SettingType FROM Msvm_VirtualSystemSettingData WHERE SettingType=5">
					<WmiAggregates>
						<WmiAggregate DataId="3778" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT VirtualQuantity FROM Msvm_MemorySettingData WHERE InstanceID LIKE 'Microsoft:___[^i][^n][^i][^t][^i][^o][^n]%'">
					<WmiAggregates>
						<WmiAggregate DataId="3769" Function="Sum">
							<WmiPropertySelector PropertyName="VirtualQuantity" PropertyType="Qword" />
						</WmiAggregate>
						<WmiAggregate DataId="4265" Function="Max">
							<WmiPropertySelector PropertyName="VirtualQuantity" PropertyType="Qword" />
						</WmiAggregate>
						<WmiAggregate DataId="4266" Function="Min">
							<WmiPropertySelector PropertyName="VirtualQuantity" PropertyType="Qword" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="Select NumberOfBlocks from Msvm_Memory">
					<WmiAggregates>
						<WmiAggregate DataId="3770" Function="Sum">
							<WmiPropertySelector PropertyName="NumberOfBlocks" PropertyType="Qword" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT Caption FROM Msvm_VirtualSwitch">
					<WmiAggregates>
						<WmiAggregate DataId="4271" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\virtualization" Query="SELECT VirtualQuantity FROM Msvm_ProcessorSettingData WHERE InstanceID LIKE 'Microsoft:___[^i][^n][^i][^t][^i][^o][^n]%'">
					<WmiAggregates>
						<WmiAggregate DataId="4267" Function="Count">
							<WmiPropertySelector PropertyName="VirtualQuantity" PropertyType="Qword" />
							<ValueTest Operator="Equals" DataType="Qword" Comparand="1" />
						</WmiAggregate>
						<WmiAggregate DataId="4268" Function="Count">
							<WmiPropertySelector PropertyName="VirtualQuantity" PropertyType="Qword" />
							<ValueTest Operator="Equals" DataType="Qword" Comparand="2" />
						</WmiAggregate>
						<WmiAggregate DataId="4269" Function="Count">
							<WmiPropertySelector PropertyName="VirtualQuantity" PropertyType="Qword" />
							<ValueTest Operator="Equals" DataType="Qword" Comparand="4" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<EventQuery Channel="System" Query="*[System[(EventID=41) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4290" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="System" Query="*[System[(EventID=42) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4291" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="System" Query="*[System[(EventID=44) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4292" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="System" Query="*[System[(EventID=29) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4293" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="system" Query="*[System[(EventID=48) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4294" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="System" Query="*[System[(EventID=38) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4295" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-VMMS-Admin" Query="*[System[(EventID=19510) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5364" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<CustomQuery QueryId="12" />
				<CustomQuery QueryId="15" />
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="20" RequiredState="Installed" />
					<RoleTest RoleId="33" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<CustomQuery QueryId="20">
          				<Arguments>
            					<Argument>20</Argument>
          				</Arguments>
				</CustomQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22501) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5355" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22502) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5356" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22503) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5357" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22504) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5358" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22505) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5359" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22506) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5360" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22507) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5361" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22508) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5362" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-Hyper-V-High-Availability-Admin" Query="*[System[(EventID=22509) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="5363" Function="Count" />
					</EventAggregates>
				</EventQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="7" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\cimv2" Query="SELECT LanguagesSupported, DefaultLanguage FROM Win32_Printer WHERE Local='True'" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2378" Function="Count" />
						<WmiAggregate DataId="2490" Function="Count" >
							<WmiPropertySelector PropertyName="DefaultLanguage" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="XPS" />
						</WmiAggregate>
						<WmiAggregate DataId="2488" Function="Count" >
							<WmiPropertySelector PropertyName="LanguagesSupported" PropertyType="String" IsArray="1" StartElement="0" MaxElements="100"/>
							<ValueTest Operator="Equals" DataType="String" Comparand="XPS" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2" Query="SELECT PortName FROM Win32_Printer WHERE Local='True' AND PortName LIKE 'XPS%'" QueryTimeout="20" MaxRows="1">
					<WmiAggregates>
						<WmiAggregate DataId="2489" Function="Exists" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2" Query="SELECT SupportedPlatform FROM Win32_PrinterDriver">
					<WmiAggregates>
						<WmiAggregate DataId="2379" Function="Count" />
						<WmiAggregate DataId="2380" Function="Count" >
							<WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Windows x64" />
						</WmiAggregate>
						<WmiAggregate DataId="2381" Function="Count" >
							<WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Windows IA64" />
						</WmiAggregate>
						<WmiAggregate DataId="2382" Function="Count" >
							<WmiPropertySelector PropertyName="SupportedPlatform" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="Windows NT x86" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2" Query="SELECT State FROM Win32_Service WHERE Name='SPOOLER'" MaxRows="1">
					<WmiDatapoints>
						<WmiDatapoint DataId="2481" DataType="Dword">
							<WmiPropertySelector PropertyName="State" PropertyType="String">
								<Transforms>
									<EnumTransform DefaultValue="0">
										<Enum Name="Stopped" Value="1" />
										<Enum Name="Start Pending" Value="2" />
										<Enum Name="Stop Pending" Value="3" />
										<Enum Name="Running" Value="4" />
										<Enum Name="Continue Pending" Value="5" />
										<Enum Name="Pause Pending" Value="6" />
										<Enum Name="Paused" Value="7" />
									</EnumTransform>
								</Transforms>
							</WmiPropertySelector>
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<CustomQuery QueryId="17">
					<Arguments>
						<Argument>\Server\Server Sessions;Dword;130000</Argument>
						<Argument>\Server\Files Open;Dword;130001</Argument>
						<Argument>\Process(spoolsv)\Thread Count;Dword;130002</Argument>
						<Argument>\Process(spoolsv)\Handle Count;Dword;130003</Argument>
						<Argument>\Print Queue(_Total)\Total Jobs Printed;Dword;130004</Argument>
						<Argument>\Print Queue(_Total)\Max Jobs Spooling;Dword;130005</Argument>
						<Argument>\Print Queue(_Total)\Max References;Dword;130006</Argument>
					</Arguments>
				</CustomQuery>
			</Queries>

			<Metrics>
				<MetricsDatapoints>

					<MetricsDatapoint DataId="2482" DataType="Dword">
						<DataSelector SourceDataId="130000" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2484" DataType="Dword">
						<DataSelector SourceDataId="130001" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2485" DataType="Dword">
						<DataSelector SourceDataId="130002" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2486" DataType="Dword">
						<DataSelector SourceDataId="130003" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2491" DataType="Dword">
						<DataSelector SourceDataId="130004" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2483" DataType="Dword">
						<DataSelector SourceDataId="130005" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2487" DataType="Dword">
						<DataSelector SourceDataId="130006" />
					</MetricsDatapoint>

				</MetricsDatapoints>

			</Metrics>

		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\cimv2" Query="SELECT Name, Instances FROM Win32_PerfFormattedData_ServiceModelService3000_ServiceModelService3000" QueryTimeout="20">
					<WmiAggregates>
						<WmiAggregate DataId="2973" Function="Count" />
						<WmiAggregate DataId="3095" Function="Sum" >
							<WmiPropertySelector PropertyName="Instances" PropertyType="Dword" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<CustomQuery QueryId="17">
					<Arguments>
						<Argument>\Windows Workflow Foundation(_global_)\Workflows In Memory;Dword;140000</Argument>
					</Arguments>
				</CustomQuery>
			</Queries>

			<Metrics>
				<MetricsDatapoints>

					<MetricsDatapoint DataId="3094" DataType="Dword">
						<DataSelector SourceDataId="140000" />
					</MetricsDatapoint>

				</MetricsDatapoints>

			</Metrics>

		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="13" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\cimv2" Query="SELECT Version From CIM_DataFile Where Name='%windir%\System32\dns.exe'">
					<WmiDatapoints>
						<WmiDatapoint DataId="2988" DataType="String">
							<WmiPropertySelector PropertyName="Version" PropertyType="String" />
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\MicrosoftDNS" Query="SELECT Name, DsIntegrated FROM MicrosoftDNS_Zone">
					<WmiAggregates>
						<WmiAggregate DataId="3000" Function="Exists">
							<WmiPropertySelector PropertyName="Name" PropertyType="String" />
							<ValueTest Operator="Equals" DataType="String" Comparand="GlobalNames" />
						</WmiAggregate>
						<WmiAggregate DataId="3001" Function="Count">
							<WmiPropertySelector PropertyName="DsIntegrated" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="True" />
						</WmiAggregate>
						<WmiAggregate DataId="3005" Function="Count">
							<WmiPropertySelector PropertyName="DsIntegrated" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="False" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<EventQuery Channel="DNS Server" Query="*[System[(EventID=4015) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3003" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DNS Server" Query="*[System[(EventID=4011) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3004" Function="Count" />
					</EventAggregates>
				</EventQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="125" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\AccountPartner">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="3007" DataType="Dword">
							<RegistryValueSelector ValueName="Count" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\ResourcePartner">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="3008" DataType="Dword">
							<RegistryValueSelector ValueName="WithForestTrustCount" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="3009" DataType="Dword">
							<RegistryValueSelector ValueName="WithoutForestTrustCount" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\Applications">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="3012" DataType="Dword">
							<RegistryValueSelector ValueName="NtTokenAppCount" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="3013" DataType="Dword">
							<RegistryValueSelector ValueName="ClaimsAppCount" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData\Claims">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="3014" DataType="Dword">
							<RegistryValueSelector ValueName="OrganizationalClaimCount" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="3010" DataType="Dword">
							<RegistryValueSelector ValueName="CustomClaimsTransformExists" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="3011" DataType="Dword">
							<RegistryValueSelector ValueName="AverageClaimsPerPartner" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\ADFS\SQMData">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="2989" DataType="Dword">
							<RegistryValueSelector ValueName="KerberosSigningUsed" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="3006" DataType="Dword">
							<RegistryValueSelector ValueName="ADAMStoreCount" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="102" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2202) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4970" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2206) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4971" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2208) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4972" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2212) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4973" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2214) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4974" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2216) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4977" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2104) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4975" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2106) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4976" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=2102) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4978" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=4502) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4979" Function="Exists" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=4412) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4980" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=4402) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4981" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=4406) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4982" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=8019) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4983" Function="Exists" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=8028) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4984" Function="Exists" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=8029) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4985" Function="Exists" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=8023) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4986" Function="Exists" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="DFS Replication" Query="*[System[(EventID=8025) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="4987" Function="Exists" />
					</EventAggregates>
				</EventQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\cimv2" Query="SELECT HardwareAssisted, NoWriters, Count, ClientAccessible FROM Win32_ShadowCopy">
					<WmiAggregates>
						<WmiAggregate DataId="5062" Function="Count">
							<WmiPropertySelector PropertyName="HardwareAssisted" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="True" />
						</WmiAggregate>
						<WmiAggregate DataId="5063" Function="Count">
							<WmiPropertySelector PropertyName="NoWriters" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="False" />
						</WmiAggregate>
						<WmiAggregate DataId="5064" Function="Max">
							<WmiPropertySelector PropertyName="Count" PropertyType="Dword" />
						</WmiAggregate>
						<WmiAggregate DataId="5066" Function="Count">
							<WmiPropertySelector PropertyName="ClientAccessible" PropertyType="Boolean" />
							<ValueTest Operator="Equals" DataType="Boolean" Comparand="True" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="Or">
					<RoleTest RoleId="62" RequiredState="Installed" />
					<RoleTest RoleId="105" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\msnfs" Query="SELECT UnmappedUserAccessMode FROM MSNFS_Export">
					<WmiAggregates>
						<WmiAggregate DataId="5109" Function="Count" />
						<WmiAggregate DataId="5113" Function="Count">

							<WmiPropertySelector PropertyName="UnmappedUserAccessMode" PropertyType="Dword" />
							<ValueTest Operator="Equals" DataType="Dword" Comparand="1" />
						</WmiAggregate>
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\msnfs" Query="SELECT UnmLookupEnabled, AdLookupEnabled FROM MSNFS_UserNameMapping">
					<WmiDatapoints>
						<WmiDatapoint DataId="5111" DataType="Dword">
							<WmiPropertySelector PropertyName="UnmLookupEnabled" PropertyType="Boolean" />
						</WmiDatapoint>
						<WmiDatapoint DataId="5112" DataType="Dword">
							<WmiPropertySelector PropertyName="AdLookupEnabled" PropertyType="Boolean" />
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\msnfs" Query="SELECT Netgroup FROM MSNFS_Server">
					<WmiDatapoints>
						<WmiDatapoint DataId="5114" DataType="Dword">
							<WmiPropertySelector PropertyName="Netgroup" PropertyType="Dword" />
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\msnfs" Query="SELECT GroupName FROM MSNFS_NetGroup">
					<WmiAggregates>
						<WmiAggregate DataId="5115" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<WmiQuery Namespace="root\msnfs" Query="SELECT GroupName FROM MSNFS_ClientGroup">
					<WmiAggregates>
						<WmiAggregate DataId="5117" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<QueryTest>
						<WmiQuery Namespace="root\cimv2" Query="SELECT Name FROM Win32_service WHERE Name = 'WMServer'">
							<WmiAggregates>
								<WmiAggregate DataId="4294967295" Function="Exists" />
							</WmiAggregates>
						</WmiQuery>
						<ValueTest Operator="Equals" DataType="Dword" Comparand="1" />
					</QueryTest>
				</Expression>
			</Applicability>
			<Queries>
				<CustomQuery QueryId="17">
					<Arguments>
						<Argument>\Windows Media Services\Total Server Uptime;Dword;150000</Argument>
						<Argument>\Windows Media Services\Current Streaming Players;Dword;150001</Argument>
						<Argument>\Windows Media Services\Current Streaming HTTP Players;Dword;150002</Argument>
						<Argument>\Windows Media Services\Current Streaming RTSP Players;Dword;150003</Argument>
						<Argument>\Windows Media Services\Peak Player Send Rate (Kbps);Dword;150004</Argument>
						<Argument>\Windows Media Services\Peak Streaming Players;Dword;150005</Argument>
						<Argument>\Windows Media Services\Peak Outgoing Distribution Connections;Dword;150006</Argument>
						<Argument>\Windows Media Services\Peak Outgoing Distribution Send Rate (Kbps);Dword;150007</Argument>
						<Argument>\Windows Media Services\Total Advertisements;Dword;150008</Argument>
					</Arguments>
				</CustomQuery>
			</Queries>

			<Metrics>
				<MetricsDatapoints>

					<MetricsDatapoint DataId="2417" DataType="Dword">
						<DataSelector SourceDataId="150000" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2418" DataType="Dword">
						<DataSelector SourceDataId="150001" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2419" DataType="Dword">
						<DataSelector SourceDataId="150002" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2420" DataType="Dword">
						<DataSelector SourceDataId="150003" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2421" DataType="Dword">
						<DataSelector SourceDataId="150004" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2422" DataType="Dword">
						<DataSelector SourceDataId="150005" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2423" DataType="Dword">
						<DataSelector SourceDataId="150006" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2424" DataType="Dword">
						<DataSelector SourceDataId="150007" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2425" DataType="Dword">
						<DataSelector SourceDataId="150008" />
					</MetricsDatapoint>

				</MetricsDatapoints>

			</Metrics>

		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Expression JoinOperator="And">
					<RoleTest RoleId="18" RequiredState="Installed" />
				</Expression>
			</Applicability>
			<Queries>
				<WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT LicensingType, DirectConnectLicenseServers, TerminalServerMode FROM Win32_TerminalServiceSetting" MaxRows="1">
					<WmiDatapoints>
						<WmiDatapoint DataId="2478" DataType="Dword">
							<WmiPropertySelector PropertyName="LicensingType" PropertyType="Dword" />
						</WmiDatapoint>
						<WmiDatapoint DataId="2479" DataType="Boolean">
							<WmiPropertySelector PropertyName="DirectConnectLicenseServers" PropertyType="String" >
								<Transforms>
									<LogicalTransform Operator="NotEquals" DataType="String" Comparand="" />
								</Transforms>
							</WmiPropertySelector>
						</WmiDatapoint>
						<WmiDatapoint DataId="2480" DataType="Dword">
							<WmiPropertySelector PropertyName="TerminalServerMode" PropertyType="Dword" />
						</WmiDatapoint>
					</WmiDatapoints>
				</WmiQuery>
				<WmiQuery Namespace="root\cimv2\TerminalServices" Query="SELECT * FROM Win32_TSPublishedApplication">
					<WmiAggregates>
						<WmiAggregate DataId="5846" Function="Count" />
					</WmiAggregates>
				</WmiQuery>
				<RegistryQuery Hive="HKLM" Subkey="SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="5844" DataType="Dword">
							<RegistryValueSelector ValueName="MaxXResolution" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5850" DataType="Dword">
							<RegistryValueSelector ValueName="MaxYResolution" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5845" DataType="Dword">
							<RegistryValueSelector ValueName="Maxmonitors" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5847" DataType="Dword">
							<RegistryValueSelector ValueName="fDisableCam" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5848" DataType="Dword">
							<RegistryValueSelector ValueName="fDisableAudioCapture" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5849" DataType="Dword">
							<RegistryValueSelector ValueName="AllowedAudioQualityMode" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
				<RegistryQuery Hive="HKLM" Subkey="SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="5844" DataType="Dword">
							<RegistryValueSelector ValueName="MaxXResolution" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5850" DataType="Dword">
							<RegistryValueSelector ValueName="MaxYResolution" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5845" DataType="Dword">
							<RegistryValueSelector ValueName="Maxmonitors" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5847" DataType="Dword">
							<RegistryValueSelector ValueName="fDisableCam" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5848" DataType="Dword">
							<RegistryValueSelector ValueName="fDisableAudioCapture" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="5849" DataType="Dword">
							<RegistryValueSelector ValueName="AllowedAudioQualityMode" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1602) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3027" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1610) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3028" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1611) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3029" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1612) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3030" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1613) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3031" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1614) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3032" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1615) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3033" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1616) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3034" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1617) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3035" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1618) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3036" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1619) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3037" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1620) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3038" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1621) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3039" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1622) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3040" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1623) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3041" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1624) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3077" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1625) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3078" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1630) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3042" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1631) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3043" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1632) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3044" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1633) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3045" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1634) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3046" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1635) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3047" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1636) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3048" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Setup" Query="*[System[(EventID=1637) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3049" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1651) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3051" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1652) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3052" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1653) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3053" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1654) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3054" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1655) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3055" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1656) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3056" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1657) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3057" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1658) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3058" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1659) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3059" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1660) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3060" Function="Count" />
					</EventAggregates>
				</EventQuery>
				<EventQuery Channel="Microsoft-Windows-ServerManager/Operational" Query="*[System[(EventID=1661) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]">
					<EventAggregates>
						<EventAggregate DataId="3061" Function="Count" />
					</EventAggregates>
				</EventQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\MSDTC\Security">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="2919" DataType="Dword">
							<RegistryValueSelector ValueName="NetworkDtcAccess" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="2920" DataType="Dword">
							<RegistryValueSelector ValueName="NetworkDtcAccessClients" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="2921" DataType="Dword">
							<RegistryValueSelector ValueName="NetworkDtcAccessAdmin" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="2922" DataType="Dword">
							<RegistryValueSelector ValueName="NetworkDtcAccessInbound" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="2923" DataType="Dword">
							<RegistryValueSelector ValueName="NetworkDtcAccessOutbound" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="2927" DataType="Dword">
							<RegistryValueSelector ValueName="NetworkDtcAccessTip" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="2928" DataType="Dword">
							<RegistryValueSelector ValueName="XATransactions" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
				<RegistryQuery Hive="HKLM" Subkey="Software\Microsoft\MSDTC">
					<RegistryDatapoints>
						<RegistryDatapoint DataId="2924" DataType="Dword">
							<RegistryValueSelector ValueName="AllowOnlySecureRpcCalls" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="2925" DataType="Dword">
							<RegistryValueSelector ValueName="FallbackToUnsecureRPCIfNecessary" ValueType="Dword" />
						</RegistryDatapoint>
						<RegistryDatapoint DataId="2926" DataType="Dword">
							<RegistryValueSelector ValueName="TurnOffRpcSecurity" ValueType="Dword" />
						</RegistryDatapoint>
					</RegistryDatapoints>
				</RegistryQuery>
				<CustomQuery QueryId="17">
					<Arguments>
						<Argument>\Distributed Transaction Coordinator\Committed Transactions;Dword;160000</Argument>
						<Argument>\Distributed Transaction Coordinator\Aborted Transactions;Dword;160001</Argument>
						<Argument>\Distributed Transaction Coordinator\Force Aborted Transactions;Dword;160002</Argument>
						<Argument>\Distributed Transaction Coordinator\Force Committed Transactions;Dword;160003</Argument>
						<Argument>\Distributed Transaction Coordinator\Response Time -- Average;Dword;160004</Argument>
					</Arguments>
				</CustomQuery>
			</Queries>

			<Metrics>
				<MetricsDatapoints>

					<MetricsDatapoint DataId="2929" DataType="Dword">
						<DataSelector SourceDataId="160000" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2930" DataType="Dword">
						<DataSelector SourceDataId="160001" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2931" DataType="Dword">
						<DataSelector SourceDataId="160002" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2932" DataType="Dword">
						<DataSelector SourceDataId="160003" />
					</MetricsDatapoint>

					<MetricsDatapoint DataId="2933" DataType="Dword">
						<DataSelector SourceDataId="160004" />
					</MetricsDatapoint>

				</MetricsDatapoints>

			</Metrics>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<EventQuery Channel="System" Query="*[System[Provider[@Name='Microsoft-Windows-WHEA-Logger'] and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]" QueryTimeout="20">
					<TopEvents DataId="5068" EventCount="40" MSSpecificEvents="1" />
				</EventQuery>
			</Queries>
		</QueryGroup>

		<QueryGroup>
			<Applicability>
				<Global />
			</Applicability>
			<Queries>
				<EventQuery Channel="System" Query="*[System[(Level=1  or Level=2) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]" QueryTimeout="20">
					<TopEvents EventCount="10" MSSpecificEvents="1" />
				</EventQuery>
				<EventQuery Channel="System" Query="*[System[(Level=3) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]" QueryTimeout="20">
					<TopEvents EventCount="10" MSSpecificEvents="1" />
				</EventQuery>
				<EventQuery Channel="System" Query="*[System[(Level=0 or Level=4) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]" QueryTimeout="20">
					<TopEvents EventCount="10" MSSpecificEvents="1" />
				</EventQuery>
				<EventQuery Channel="Application" Query="*[System[(Level=1  or Level=2) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]" QueryTimeout="20">
					<TopEvents EventCount="10" MSSpecificEvents="1" />
				</EventQuery>
				<EventQuery Channel="Application" Query="*[System[(Level=3) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]" QueryTimeout="20">
					<TopEvents EventCount="10" MSSpecificEvents="1" />
				</EventQuery>
				<EventQuery Channel="Application" Query="*[System[(Level=0 or Level=4) and TimeCreated[timediff(@SystemTime) &lt;= 129600000]]]" QueryTimeout="20">
					<TopEvents EventCount="10" MSSpecificEvents="1" />
				</EventQuery>
			</Queries>
		</QueryGroup>

	</QueryGroups>
</CeipAssistant>