+
+ <directories check_all="yes">%WINDIR%/SysNative/at.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/attrib.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/cacls.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/cmd.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/drivers/etc</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/eventcreate.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/ftp.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/lsass.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/net.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/net1.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/netsh.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/reg.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/regedt32.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/regsvr32.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/runas.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/sc.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/schtasks.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/sethc.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/subst.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/wbem/WMIC.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/WindowsPowerShell\v1.0\powershell.exe</directories>
+ <directories check_all="yes">%WINDIR%/SysNative/winrm.vbs</directories>
+