Private/AzStackHci.Defender.Helpers.ps1
|
function New-OsConfigAsrObservation { # ASR action meanings (read-only interpretation): https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure [CmdletBinding()] param($Value, [bool]$Collected = $false, $Present = $null, [string]$Message = '') $observation = [pscustomobject]@{ Collected = $Collected; Present = $Present; Value = $Value; Action = $null; Message = $Message } if (-not $Collected) { return $observation } if ($Present -eq $false) { $observation.Action = 'Not configured'; return $observation } $numericValue = 0 if ($null -eq $Value -or $Value -is [bool] -or -not [int]::TryParse([string]$Value, [ref]$numericValue) -or $numericValue -notin @(0, 1, 2, 5, 6)) { $observation.Collected = $false $observation.Action = 'Unknown' $observation.Message = 'ASR action is missing or unsupported; no Disabled value inferred.' return $observation } $observation.Value = $numericValue $observation.Action = @{ 0 = 'Disabled'; 1 = 'Block'; 2 = 'Audit'; 5 = 'Not configured'; 6 = 'Warn' }[$numericValue] return $observation } function Invoke-OsConfigDefenderQuery { [CmdletBinding()] param([ValidateSet('Preferences', 'RuntimeStatus', 'OSConfig', 'RSoPSettings', 'RSoPGpos')][string]$Kind) switch ($Kind) { 'Preferences' { Get-MpPreference -ErrorAction Stop } 'RuntimeStatus' { Get-MpComputerStatus -ErrorAction Stop | Select-Object AMRunningMode, AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, IsTamperProtected, AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated } 'OSConfig' { if (-not (Get-Command Get-OSConfigDesiredConfiguration -ErrorAction SilentlyContinue)) { if (-not (Get-Command Import-ASOSConfigModule -ErrorAction SilentlyContinue)) { throw 'Existing Azure Local OSConfig commands unavailable; no module installed.' } Import-ASOSConfigModule -ErrorAction Stop | Out-Null } Get-OSConfigDesiredConfiguration -Scenario Defender/Antivirus -ErrorAction Stop | Where-Object { $_.Name -like 'ASR*' } | Select-Object Name, Value, Default } 'RSoPSettings' { Get-CimInstance -Namespace 'root\RSOP\Computer' -ClassName RSOP_RegistryPolicySetting -OperationTimeoutSec 30 -ErrorAction Stop | Select-Object @{Name='KeyName';Expression={$_.registryKey}}, ValueName, ValueType, Value, Deleted, GPOID, Precedence, SOMID } 'RSoPGpos' { Get-CimInstance -Namespace 'root\RSOP\Computer' -ClassName RSOP_GPO -OperationTimeoutSec 30 -ErrorAction Stop | Select-Object Id, GuidName, Name } } } function Get-OsConfigDefenderEvidence { [CmdletBinding()] param() $evidence = @{} foreach ($kind in @('Preferences', 'RuntimeStatus', 'OSConfig', 'RSoPSettings', 'RSoPGpos')) { $source = [pscustomobject]@{ Collected = $false; Rows = @(); Message = '' } try { $source.Rows = @(Invoke-OsConfigDefenderQuery -Kind $kind -ErrorAction Stop) if ($kind -in @('Preferences', 'RuntimeStatus') -and ($source.Rows.Count -ne 1 -or $null -eq $source.Rows[0])) { throw "$kind returned no unique observation." } $source.Collected = $true } catch { $source.Rows = @(); $source.Message = $_.Exception.Message } $evidence[$kind] = $source } return $evidence } function Get-OsConfigAsrGpoEvidence { [CmdletBinding()] param([string]$RuleId, [System.Collections.IDictionary]$Evidence) $result = Get-OsConfigRegistryPolicyEvidence -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules' -Name $RuleId -Evidence $Evidence foreach ($assignment in $result.Assignments) { Add-Member -InputObject $assignment -NotePropertyName RuleId -NotePropertyValue $RuleId } return $result } function Invoke-OsConfigDefenderAssessment { [CmdletBinding()] param([string]$Node, [string]$OutputPath, $BaselineAssessment) $path = Join-Path (Join-Path $OutputPath $Node) "$Node-Defender.json" Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue $evidence = Get-OsConfigDefenderEvidence $errors = New-Object 'System.Collections.Generic.List[object]' foreach ($source in @('Preferences', 'RuntimeStatus', 'OSConfig', 'RSoPSettings', 'RSoPGpos')) { if (-not $evidence[$source].Collected) { $errors.Add([pscustomobject]@{ Source = $source; Message = $evidence[$source].Message }) } } $preferences = @{} if ($evidence.Preferences.Collected) { try { $preference = [pscustomobject]$evidence.Preferences.Rows[0] if (-not $preference.PSObject.Properties['AttackSurfaceReductionRules_Ids'] -or -not $preference.PSObject.Properties['AttackSurfaceReductionRules_Actions']) { throw 'Defender ASR preference arrays unavailable.' } $identifiers = @() $actions = @() if ($null -ne $preference.AttackSurfaceReductionRules_Ids) { $identifiers = @($preference.AttackSurfaceReductionRules_Ids) } if ($null -ne $preference.AttackSurfaceReductionRules_Actions) { $actions = @($preference.AttackSurfaceReductionRules_Actions) } if ($identifiers.Count -ne $actions.Count) { throw 'Defender ASR identifier/action array lengths disagree.' } for ($index = 0; $index -lt $identifiers.Count; $index++) { $identifier = [string]$identifiers[$index] if ($identifier -notmatch '^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$' -or $preferences.ContainsKey($identifier)) { throw 'Invalid or duplicate Defender ASR identifier.' } $preferences[$identifier] = $actions[$index] } } catch { $preferences = @{} $evidence.Preferences.Collected = $false $evidence.Preferences.Message = $_.Exception.Message $errors.Add([pscustomobject]@{ Source = 'Preferences'; Message = $_.Exception.Message }) } } $catalog = @{} if ($null -ne $BaselineAssessment) { foreach ($setting in $BaselineAssessment.Settings) { if ($setting.Name -like 'ASR*' -and $setting.RegistryValue -match '^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$') { if ($catalog.ContainsKey([string]$setting.RegistryValue)) { throw 'Duplicate baseline ASR identifier.' } $catalog[[string]$setting.RegistryValue] = $setting } } } $expectedAvailable = $catalog.Count -gt 0 if (-not $expectedAvailable) { $errors.Add([pscustomobject]@{ Source = 'Baseline'; Message = 'Applicable baseline ASR expectations unavailable; reported values are evidence only.' }) } foreach ($identifier in $preferences.Keys) { if (-not $catalog.ContainsKey($identifier)) { $catalog[$identifier] = [pscustomobject]@{ Name = "UnmappedASR:$identifier"; RegistryValue = $identifier; Expected = $null; Severity = $null } } } $rows = New-Object 'System.Collections.Generic.List[object]' $counts = [ordered]@{ Total = 0; Pass = 0; Warning = 0; Skipped = 0 } foreach ($identifier in @($catalog.Keys | Sort-Object)) { $setting = $catalog[$identifier] $sources = [ordered]@{} $sources.DefenderReported = New-OsConfigAsrObservation -Collected $evidence.Preferences.Collected -Present ($evidence.Preferences.Collected -and $preferences.ContainsKey($identifier)) -Value $preferences[$identifier] -Message $evidence.Preferences.Message $osSettings = @($evidence.OSConfig.Rows | Where-Object { $_.Name -eq $setting.Name }) $osValue = $null $osDefault = $null if ($osSettings.Count -eq 1) { $osValue = $osSettings[0].Value; $osDefault = $osSettings[0].Default } $sources.OSConfig = New-OsConfigAsrObservation -Collected ($evidence.OSConfig.Collected -and $osSettings.Count -le 1) -Present ($osSettings.Count -eq 1 -and $null -ne $osValue) -Value $osValue -Message $evidence.OSConfig.Message foreach ($registrySource in @('PolicyRegistry', 'LocalRegistry')) { $registryPath = if ($registrySource -eq 'PolicyRegistry') { 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules' } else { 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules' } $registry = Get-OsConfigBaselineRegistryValue -Path $registryPath -Name $identifier $sources[$registrySource] = New-OsConfigAsrObservation -Collected $registry.Collected -Present $registry.Present -Value $registry.Value -Message $registry.Error Add-Member -InputObject $sources[$registrySource] -NotePropertyName ValueType -NotePropertyValue $registry.Type } foreach ($source in @($sources.Keys)) { $observation = $sources[$source] $outcome = 'SKIPPED' if ([string]::IsNullOrWhiteSpace([string]$setting.Expected)) { $observation.Message = 'No validated baseline expectation for this ASR identifier.' } elseif (-not $observation.Collected) { if (-not $observation.Message) { $observation.Message = 'Source observation unavailable or ambiguous.' } } elseif (-not $observation.Present) { $observation.Message = 'ASR setting not reported by this source; no Disabled value or deviation inferred.' } elseif ($observation.Value -eq 5) { $observation.Message = 'Source explicitly reports NotConfigured (5); no Disabled value or deviation inferred.' } else { $evaluation = Test-OsConfigBaselineRule -Rule $setting.Expected -Observed $observation.Value -Present $observation.Present if (-not $evaluation.Supported) { $observation.Message = $evaluation.Reason } elseif ($source -in @('PolicyRegistry', 'LocalRegistry') -and $observation.Present -and $observation.ValueType -ne 'DWord') { $outcome = 'WARNING'; $observation.Message = 'ASR registry value type differs from expected REG_DWORD.' } else { $outcome = if ($evaluation.Matches) { 'PASS' } else { 'WARNING' } $observation.Message = if ($evaluation.Matches) { 'Matches baseline expected value.' } else { 'Differs from baseline expected value; not an automatic deployment blocker.' } } } Add-Member -InputObject $observation -NotePropertyName Result -NotePropertyValue $outcome if (-not $observation.Collected) { $observation.Present = $null } } $outcomes = @($sources.Values | ForEach-Object { $_.Result }) $complete = $outcomes -notcontains 'SKIPPED' $result = if ($outcomes -contains 'WARNING') { 'WARNING' } elseif ($outcomes -contains 'PASS') { 'PASS' } else { 'SKIPPED' } $values = @($sources.Values | Where-Object { $_.Collected -and $_.Present -and $_.Value -ne 5 } | Select-Object -ExpandProperty Value -Unique) $severity = switch ([string]$setting.Severity) { 'Critical' { 'High' }; 'Important' { 'High' }; 'Informational' { 'Low' }; default { 'Medium' } } $rows.Add([pscustomobject]@{ CheckId = [string]$setting.Name; RuleId = $identifier; Severity = $severity; BaselineSeverity = $setting.Severity Expected = $setting.Expected; OSConfigDefault = $osDefault; Result = $result; EvidenceComplete = $complete Sources = [pscustomobject]$sources; SourceDisagreement = $values.Count -gt 1 GpoEvidence = Get-OsConfigAsrGpoEvidence -RuleId $identifier -Evidence $evidence }) switch ($result) { 'PASS' { $counts.Pass++ } 'WARNING' { $counts.Warning++ } 'SKIPPED' { $counts.Skipped++ } } } $counts.Total = $rows.Count $complete = $expectedAvailable -and $rows.Count -gt 0 -and @($rows.ToArray() | Where-Object { -not $_.EvidenceComplete }).Count -eq 0 $report = [ordered]@{ SchemaVersion = '1.0'; Node = $Node; CapturedAtUtc = [datetime]::UtcNow.ToString('o') CheckId = 'DefenderAsr'; Severity = 'High' Result = $(if ($counts.Warning) { 'WARNING' } elseif ($counts.Total -gt 0 -and $counts.Skipped -eq 0) { 'PASS' } else { 'SKIPPED' }) EvidenceComplete = $complete; Counts = $counts; Profile = $null; Source = $null; Snapshot = $null; Sha256 = $null Message = 'ASR configured-source comparison only; Defender-reported preferences and RSoP assignments do not prove runtime enforcement or policy authorship.' RuntimeStatus = $(if ($evidence.RuntimeStatus.Collected) { $evidence.RuntimeStatus.Rows[0] } else { $null }) CollectionErrors = $errors.ToArray(); Settings = $rows.ToArray() } if ($null -ne $BaselineAssessment) { foreach ($field in @('Profile', 'Source', 'Snapshot', 'Sha256')) { $report[$field] = $BaselineAssessment.$field } } $report | ConvertTo-Json -Depth 14 | Out-File -LiteralPath $path -Encoding utf8 -Force -ErrorAction Stop return [pscustomobject]$report } function Get-OsConfigDefenderHealthSummary { [CmdletBinding()] param([string]$ExportPath, [string[]]$Nodes) $details = New-Object 'System.Collections.Generic.List[object]' $evaluated = New-Object 'System.Collections.Generic.List[string]' $missing = New-Object 'System.Collections.Generic.List[string]' $counts = [ordered]@{ Total = 0; Pass = 0; Warning = 0; Skipped = 0 } foreach ($node in $Nodes) { try { $detail = Get-Content -LiteralPath (Join-Path (Join-Path $ExportPath $node) "$node-Defender.json") -Raw -ErrorAction Stop | ConvertFrom-Json -ErrorAction Stop if ($detail.SchemaVersion -ne '1.0' -or $detail.Node -ne $node -or $detail.CheckId -ne 'DefenderAsr' -or $detail.Settings -isnot [array] -or $detail.CollectionErrors -isnot [array] -or $detail.EvidenceComplete -isnot [bool]) { throw 'Invalid Defender assessment identity or shape.' } $rowCounts = @{ Total = $detail.Settings.Count; Pass = 0; Warning = 0; Skipped = 0 } $identifiers = @{} foreach ($setting in $detail.Settings) { if ($setting.Result -notin @('PASS', 'WARNING', 'SKIPPED') -or [string]::IsNullOrWhiteSpace([string]$setting.CheckId) -or $setting.RuleId -notmatch '^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$' -or $identifiers.ContainsKey([string]$setting.RuleId)) { throw 'Invalid or duplicate Defender rule.' } $identifiers[[string]$setting.RuleId] = $true $outcomes = @() foreach ($source in @('OSConfig', 'DefenderReported', 'PolicyRegistry', 'LocalRegistry')) { if (-not $setting.Sources.PSObject.Properties[$source] -or $setting.Sources.$source.Result -notin @('PASS', 'WARNING', 'SKIPPED')) { throw 'Invalid Defender source comparison.' } $observation = $setting.Sources.$source if ($observation.Collected -isnot [bool] -or ($null -ne $observation.Present -and $observation.Present -isnot [bool]) -or -not $observation.PSObject.Properties['Value']) { throw 'Invalid Defender source observation.' } if ($observation.Result -ne 'SKIPPED' -and (-not $observation.Collected -or $null -eq $observation.Present -or [string]::IsNullOrWhiteSpace([string]$setting.Expected))) { throw 'Defender comparison lacks collected evidence or an expectation.' } $outcomes += $setting.Sources.$source.Result } if ($setting.GpoEvidence.Collected -isnot [bool] -or $setting.GpoEvidence.Assignments -isnot [array]) { throw 'Invalid Defender RSoP evidence shape.' } $expectedResult = if ($outcomes -contains 'WARNING') { 'WARNING' } elseif ($outcomes -contains 'PASS') { 'PASS' } else { 'SKIPPED' } if ($setting.Result -ne $expectedResult -or $setting.EvidenceComplete -isnot [bool] -or $setting.EvidenceComplete -ne ($outcomes -notcontains 'SKIPPED')) { throw 'Defender rule result disagrees with source comparisons.' } $rowCounts[[string]$setting.Result]++ } foreach ($field in @('Total', 'Pass', 'Warning', 'Skipped')) { if (-not $detail.Counts.PSObject.Properties[$field] -or $null -eq $detail.Counts.$field -or [string]$detail.Counts.$field -cne [string]$rowCounts[$field]) { throw 'Invalid Defender assessment counts.' } } $complete = $detail.Settings.Count -gt 0 -and @($detail.Settings | Where-Object { -not $_.EvidenceComplete }).Count -eq 0 $expectedResult = if ($rowCounts.Warning) { 'WARNING' } elseif ($rowCounts.Total -gt 0 -and $rowCounts.Skipped -eq 0) { 'PASS' } else { 'SKIPPED' } if ($detail.Result -ne $expectedResult -or $detail.EvidenceComplete -ne $complete) { throw 'Defender assessment outcome disagrees with evidence.' } } catch { $detail = [pscustomobject]@{ Node = $node; CheckId = 'DefenderAsr'; Severity = 'High'; Result = 'SKIPPED'; EvidenceComplete = $false Message = 'Defender evidence unavailable or invalid.'; CapturedAtUtc = $null Profile = $null; Source = $null; Snapshot = $null; Sha256 = $null Counts = [pscustomobject]@{ Total = 0; Pass = 0; Warning = 0; Skipped = 0 } RuntimeStatus = $null; Settings = @(); CollectionErrors = @([pscustomobject]@{ Source = 'Assessment'; Message = $_.Exception.Message }) } } foreach ($field in @($counts.Keys)) { $counts[$field] += $detail.Counts.$field } if (($detail.Counts.Pass + $detail.Counts.Warning) -gt 0) { $evaluated.Add($node) } if (-not $detail.EvidenceComplete) { $missing.Add($node) } $details.Add($detail) } $complete = $Nodes.Count -gt 0 -and $missing.Count -eq 0 return [ordered]@{ CheckId = 'DefenderAsr'; Severity = 'High'; Result = $(if ($counts.Warning) { 'WARNING' } elseif ($Nodes.Count -gt 0 -and @($details.ToArray() | Where-Object { $_.Result -ne 'PASS' }).Count -eq 0) { 'PASS' } else { 'SKIPPED' }) EvidenceComplete = $complete; Counts = $counts; EvaluatedNodes = $evaluated.ToArray(); MissingNodes = $missing.ToArray() Message = "$($counts.Warning) ASR rule(s) with configured deviations; $($missing.Count) node(s) with incomplete comparisons. Configuration is not proof of runtime enforcement." Details = $details.ToArray() } } function ConvertTo-OsConfigDefenderHtml { [CmdletBinding()] param($Detail, [string]$RelativePrefix = '') $html = New-Object Text.StringBuilder $badge = switch ($Detail.Result) { 'WARNING' { 'badge-warn' }; 'PASS' { 'badge-ok' }; default { 'badge-na' } } [void]$html.Append("<h3>Defender / ASR</h3><p><span class=`"badge $badge`">$([Net.WebUtility]::HtmlEncode([string]$Detail.Result))</span> $([Net.WebUtility]::HtmlEncode([string]$Detail.Message))</p>") [void]$html.Append("<p>Profile: $([Net.WebUtility]::HtmlEncode([string]$Detail.Profile)) | Captured UTC: $([Net.WebUtility]::HtmlEncode([string]$Detail.CapturedAtUtc)) | Rules: $($Detail.Counts.Total) | Passed: $($Detail.Counts.Pass) | Warnings: $($Detail.Counts.Warning) | Skipped: $($Detail.Counts.Skipped)</p>") [void]$html.Append("<p>Source coverage: $(if ($Detail.EvidenceComplete) { 'Complete' } else { 'Incomplete; some source comparisons are unavailable or not configured.' })</p>") [void]$html.Append("<p style=`"overflow-wrap:anywhere`">Baseline source: $([Net.WebUtility]::HtmlEncode([string]$Detail.Source))<br>Snapshot: $([Net.WebUtility]::HtmlEncode([string]$Detail.Snapshot))<br>SHA-256: $([Net.WebUtility]::HtmlEncode([string]$Detail.Sha256))</p>") if ($null -ne $Detail.CapturedAtUtc) { $artifactLink = $RelativePrefix + [uri]::EscapeDataString([string]$Detail.Node) + '/' + [uri]::EscapeDataString("$($Detail.Node)-Defender.json") [void]$html.Append("<p><a href=`"$([Net.WebUtility]::HtmlEncode($artifactLink))`">Defender JSON evidence</a></p>") } [void]$html.Append('<h4>ASR Source Comparison</h4><div class="table-wrapper"><table><tr><th>Setting / Rule ID</th><th>Result</th><th>Baseline Expected</th><th>OSConfig Reported</th><th>Defender Reported</th><th>Policy Registry</th><th>Local Registry</th></tr>') foreach ($setting in $Detail.Settings) { $rowClass = if ($setting.Result -eq 'WARNING') { 'asr-warning' } else { 'asr-policy' } $resultBadge = switch ($setting.Result) { 'WARNING' { 'badge-warn' }; 'PASS' { 'badge-ok' }; default { 'badge-na' } } [void]$html.Append("<tr class=`"$rowClass`"><td style=`"overflow-wrap:anywhere`">$([Net.WebUtility]::HtmlEncode([string]$setting.CheckId))<br>$([Net.WebUtility]::HtmlEncode([string]$setting.RuleId))</td><td><span class=`"badge $resultBadge`">$([Net.WebUtility]::HtmlEncode([string]$setting.Result))</span></td><td>$([Net.WebUtility]::HtmlEncode([string]$setting.Expected))</td>") foreach ($source in @('OSConfig', 'DefenderReported', 'PolicyRegistry', 'LocalRegistry')) { $observation = $setting.Sources.$source $label = if (-not $observation.Collected) { 'Unavailable' } elseif ($null -ne $observation.Value) { "$($observation.Action) ($($observation.Value))" } else { $observation.Action } $cellClass = switch ($observation.Result) { 'WARNING' { 'cell-warn' }; default { '' } } [void]$html.Append("<td class=`"$cellClass`">$([Net.WebUtility]::HtmlEncode([string]$label))<br><small>$([Net.WebUtility]::HtmlEncode([string]$observation.Message))</small></td>") } [void]$html.Append('</tr>') } [void]$html.Append('</table></div><h4>Defender Operating Status</h4>') if ($null -ne $Detail.RuntimeStatus) { [void]$html.Append('<div class="table-wrapper"><table><tr><th>Property</th><th>Reported Value</th></tr>') foreach ($property in $Detail.RuntimeStatus.PSObject.Properties) { $reportedValue = if ($null -eq $property.Value) { 'Not reported' } else { [string]$property.Value } [void]$html.Append("<tr><td>$([Net.WebUtility]::HtmlEncode($property.Name))</td><td>$([Net.WebUtility]::HtmlEncode($reportedValue))</td></tr>") } [void]$html.Append('</table></div>') } else { [void]$html.Append('<p>Defender operating status unavailable.</p>') } [void]$html.Append('<h4>RSoP Assignment Evidence</h4><p>Assignments do not prove which management channel supplied Defender-reported values.</p><div class="table-wrapper"><table><tr><th>Setting</th><th>GPO / ID</th><th>Assigned Value</th><th>Precedence</th><th>Scope / Evidence</th></tr>') foreach ($setting in ($Detail.Settings | Sort-Object @{ Expression = { $_.GpoEvidence.Assignments.Count -eq 0 } }, CheckId)) { if ($setting.GpoEvidence.Assignments.Count -eq 0) { $label = if ($setting.GpoEvidence.Collected) { 'No validated assignment' } else { 'Unavailable' } [void]$html.Append("<tr><td>$([Net.WebUtility]::HtmlEncode([string]$setting.CheckId))</td><td>$label</td><td></td><td></td><td>$([Net.WebUtility]::HtmlEncode([string]$setting.GpoEvidence.Message))</td></tr>") } else { foreach ($assignment in $setting.GpoEvidence.Assignments) { $assignedValue = if ($assignment.PSObject.Properties['Value'] -and $null -ne $assignment.Value) { $assignment.Value -join ', ' } else { 'Unavailable or deleted' } [void]$html.Append("<tr><td>$([Net.WebUtility]::HtmlEncode([string]$setting.CheckId))</td><td class=`"cell-warn`">$([Net.WebUtility]::HtmlEncode("$($assignment.GPOName) [$($assignment.GPOId)]"))</td><td>$([Net.WebUtility]::HtmlEncode($assignedValue))</td><td>$([Net.WebUtility]::HtmlEncode([string]$assignment.Precedence))</td><td>$([Net.WebUtility]::HtmlEncode([string]$assignment.Scope))</td></tr>") } } } [void]$html.Append('</table></div><h4>Collection Errors</h4>') foreach ($errorItem in $Detail.CollectionErrors) { [void]$html.Append("<p>$([Net.WebUtility]::HtmlEncode([string]$errorItem.Source)): $([Net.WebUtility]::HtmlEncode([string]$errorItem.Message))</p>") } if (-not $Detail.CollectionErrors.Count) { [void]$html.Append('<p>No source-query errors recorded. Skipped setting comparisons remain visible above.</p>') } return $html.ToString().Replace('<table>', '<table class="policy-sortable">') } # SIG # Begin signature block # MIInKAYJKoZIhvcNAQcCoIInGTCCJxUCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBFqft689j7Nh/3 # CoIEagjRSiTppSFuZF1Fa+Fdi1sC2aCCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghnEMIIZwAIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwLwYJ # KoZIhvcNAQkEMSIEIIXLcOauqhimnd5zfmE5qvN+31GcOX/HHofNYqvXWmJzMEIG # CisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEABqR13MXbDopdaz2V # MyMtplPxAluyiu0OXaUu87pcnqtYy6gEgYPmsxgL+MmbOX4mCGiVu634uC/aUN/x # wLL5OXIx7srIjfmR8pCHkWVd7yesIRYnr3XeilfOP1iEbxn7nufRelQMhtzW59Z3 # o6Y7xW50Y1rWomm1/6aqFw1m7EhYWuCiCJMcKIZ2Q6iwzvINs7DbIgBaH1q4496z # 5tFj2M/iTryY0E27yV4QOwtfLaCNmFanOj0f/b2WvKFQNoZiYXy8o/hLp9fx24cK # +Vn0lEMyiN1G9LKKvxR1agllN6M7BKgLhHgeNHHq2pcGaZgu5IorvF72fdHi4/Lu # osRaXKGCF5QwgheQBgorBgEEAYI3AwMBMYIXgDCCF3wGCSqGSIb3DQEHAqCCF20w # ghdpAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsqhkiG9w0BCRABBKCCAUEEggE9 # MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCAleXXrn2IbMmFP # oTo/eONFPn/lsIGuI4CoQV9DiCDLPgIGaqmqYbeOGBMyMDI2MDkyNTE3MTExMS42 # OTJaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScw # JQYDVQQLEx5uU2hpZWxkIFRTUyBFU046ODYwMy0wNUUwLUQ5NDcxJTAjBgNVBAMT # HE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WgghHqMIIHIDCCBQigAwIBAgIT # MwAAAiWAxzfGzap3SQABAAACJTANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGlt # ZS1TdGFtcCBQQ0EgMjAxMDAeFw0yNjAyMTkxOTQwMDFaFw0yNzA1MTcxOTQwMDFa # MIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQL # ExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxk # IFRTUyBFU046ODYwMy0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1l # LVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCm # 8RIP0eLA46VcCPovvmqsIlN6qkmz5IsHWmUU0neUqp8uGxadeo+SwWBCwQ5alZI/ # DNdpXfyiZLZR6XYgpRPFzepIl7OCDb4NtEskJCIZDkQMNwrH9YwUyu71GGigsLIx # eleHtA3utoVTeHjS1b8UnwORRtknKkyrUArT6ZpB2rodIcmcLcv3x3wwgYlOs0FE # g5EsVrZb7LNc/nd0bXDp+HTOWWui8eoTVwJeLxcVP869oF8li5SU81aa2tGJ6/Js # ejiz9JMW8SJXKBT2DCXMOUkCsGjonPZRqfvoMSIQZgtaOTyAJlrvsy0TZ78XrGqo # ygtQimQnbOAL4KNLSCuW5TZEQGTHLOQJGgggb3j5gKC778+RIPJA+n/hmHJ/x4qT # /HTTPoVeMCcuBKWrQXR1+/pYau3Fwe0tWIyG+LWzkRr/ZNPPupcA2Yci3qn8HR9R # wvQopqSNJwn2Ri6am8AQyfVVy/BBw0t6jpoRPjwKvuUjfCzpae6duOxQtQ1XDN9P # A2yl9sDko/+AXV/SOe8ea8QoQcv3s3ErkG+Lp6hnvw6OMPian4ggNkRtgtB7ro1O # iopOUXJn9Y5EO3JUAXNcuM9m+5My1VEuvGytgAH3uxmslTnW3YbrfazaySCSSnWk # haOZ33hgbuUQfH7n2NFEAUc/cFzfmCQUikWisnJYywIDAQABo4IBSTCCAUUwHQYD # VR0OBBYEFLE40qoXTuMHX3AfZUu1n8nx2h93MB8GA1UdIwQYMBaAFJ+nFV0AXmJd # g/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0El # MjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6 # Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGlt # ZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0l # AQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUA # A4ICAQAHnfc2yUyoHZbvvyVKFuXh5HxxHIvIaR9JWpIfITJlc/Ki03juR+vckzq3 # tp5fFH5LL7eIFXRIuoewMsvWeFrWufrrW4HhmhCwkqArfA1C0xk+HaYs2O48YSxM # X9lgS1kTTIb3YsfoFdFpKurPf2nc2Yd4wLg+FgwmkxkeyE3MUKVna8SZeVpEjnS5 # ucFck4srPwK2ORAf70I23GGyPhqgIKZphNXhSscTAQsyIqB5GwDMdRV5LK37NfU4 # YmxvCYh3TFYE/Gh01Q6yJvf9HxiEZpwW+oUk0gruHobg3sgIR5rfgUo8l30vUnaD # YMcPAClaFMC/QbHZSaUhWXZG1OOcMp0g9vYQNLDEqFX2jlquvzVSSwtHtm1KTldC # jRED+kdCybcPxbPalwJigXc1BsI9CitnTf0ljwb9NkZ/JVI8/D62rXXzhz4F3u0i # VGzwncGaxRxHG/Xv4nTrpkOeepoYbNBbMWS2G1qP3Xj7pVf0+4qRyAqJ0stjQjoV # OJImVPWRjz5PR3Dn6adQVMBJDM6gDrj1rZTFVgCtTijqGZSGzvXpGkF3vYsyE6ZD # ma/kGdiUe5saeI6lH66PiWWXgqxt7sy2Ezv0yIjSVv+eMOT2QMUiZ6WCc7gVtAmX # pfeIus+NmgFvM+Ic1X58e4I9EL4ZSAidSpWW0GZTLNC02mryLjCCB3EwggVZoAMC # AQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNV # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29m # dCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIy # NVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp # bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAw # ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9 # DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2 # Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N # 7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXc # ag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJ # j361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjk # lqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37Zy # L9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M # 269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLX # pyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLU # HMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode # 2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEA # ATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYE # FJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEB # MEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # RG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEE # AYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB # /zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEug # SaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9N # aWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsG # AQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jv # b0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt # 4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsP # MeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++ # Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9 # QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2 # wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aR # AfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5z # bcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nx # t67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3 # Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+AN # uOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/Z # cGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNNMIICNQIBATCB+aGB0aSBzjCB # yzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl # ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMc # TWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBU # U1MgRVNOOjg2MDMtMDVFMC1EOTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1T # dGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQBTb+bKOPAjCBflhzw5EXBuSWxe # DqCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # JjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMA0GCSqGSIb3 # DQEBCwUAAgUA7mCtizAiGA8yMDI2MDkyNTA4MjEzMVoYDzIwMjYwOTI2MDgyMTMx # WjB0MDoGCisGAQQBhFkKBAExLDAqMAoCBQDuYK2LAgEAMAcCAQACAh0RMAcCAQAC # AhLMMAoCBQDuYf8LAgEAMDYGCisGAQQBhFkKBAIxKDAmMAwGCisGAQQBhFkKAwKg # CjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZIhvcNAQELBQADggEBAFmtahBM # L6Dr/9wJzjSZXEJSyhC0n8yNE/5E0G9LhzkiGHKzN2OtTCYHTZMmIhfVdub4TZuQ # +JzBJMzq0N58ysO5MDlCH//ivBNOpl4zVNe6imA1Ydwz6xmhc8FgTx+b8AT34+UX # b0vC1KBZRvMo8V5gjJUYQA73ygDYDHQiq0Ofj0X3yr0g6E+LsspxCp0f+C81n8v1 # mG4JCcbVjxzINGqQKbw5/WUG8ScU1sbqtVXPupOVVwWpWXZvyhUAMoXhKamC7DHr # QDURyjqTYJgnnRNq3JtHVCm/VK/e8RzSVm7Mlc3MsLaj6sOZ/WzgbOgOE7oF5LLD # YsgDr6cAXp8OJ3gxggQNMIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEGA1UE # CBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9z # b2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQ # Q0EgMjAxMAITMwAAAiWAxzfGzap3SQABAAACJTANBglghkgBZQMEAgEFAKCCAUow # GgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCA7XNcO # KkZYX4lKmL+PjbWRkR3W0VB72wbj+tTOsrqCdzCB+gYLKoZIhvcNAQkQAi8xgeow # gecwgeQwgb0EIFYN7oh6ON3y92CmAl/lF0CYwrjWWQP6dCUxajPSHKEQMIGYMIGA # pH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT # B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE # AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIlgMc3xs2qd0kA # AQAAAiUwIgQgNbt381qU+Fy0zZS6Oxd77bZMO3xoIZ4/yeAa/2NgYdowDQYJKoZI # hvcNAQELBQAEggIAcTZq1IzabycBkHK9VvrYqqwoYjkbjlxjxvz4SXR26qd7eRij # iFZuuFAAApAV/66L9WjsUhQ5+uirIPmOGgNvTRsDEnZrb5YsQEz3ldpVpPWbkRax # nEwo6COQAjwPXlOIJgQG/6Jq6rt4Cp4r3Sbj5IfsiZX1cVF8gmW1QEWCxBmbXroO # hLNc1kAyPlRcEbIxSJ5CTtpt+pGzHdndYYQooIJbjIA6GGJglQiOyPuWxpBRsnY/ # vthjQ1ZIsJE3BpzDL8CNVm5CNBcSbxjfRfZMVO+8kM4jg9AvMPKJgh2uQmD4cNVk # CrV3Y1H7/52ofzw4d/EJOoVDMxKULZNm273KxmYu4ToaNmIIsUNeaWCGdVQOrlbb # aGpM4bJm9ILo39TskIRQMu1JLNLBXhF2xwLht1zYiTWRMtAsGN+w5G0AuCUjUfAj # DT7dhzG7jdEa2fMZxPAIadsluLoN5/ZFkg5bsE67/4rB7a3VkHfh31x/9pseaAef # unZIQBt8Yn2SODvHQKHG4Yy6M9ml0WA3jYAs4S1bmP2QLBIyV1ANUmpIo9xnp8xB # 0gMc/7BfVijdQeY/2RxyZDT3qaMLK5NFEcF0OTX8o1IO3ifSsbJkh1BApKTVgDbM # ZZ2CsHxxWkcThgsIvD3aI0CszraHr4wdzQ7oWY5Xd5K3uNvHlqmIeSt8luU= # SIG # End signature block |