Citrix Systems Citrix MetaFrame Application for Windows 1.8 User Manual
Page 142
0HWD)UDPH $GPLQLVWUDWRUªV *XLGH
If no arguments are specified, query acl checks all local drives and then checks
the HKEY_LOCAL_MACHINE portion of the system registry.
Any files or registry keys that non-administrator users can write to are reported in
the following format:
P7E@8UÃÃDIC@SDUÃ688PVIUÃÃÃÃÃÃÃADG@
fffffffÃfffffffÃfffffffffffffÃfffffffffffffffffffffffffffffffffffffff
9XYQPÃÃÃÃÃÃÃÃÃÃÃc@r
rÃÃÃÃÃ8)c6rrpih
YÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃc@r
rÃÃÃÃÃ8)civv
9XYQPÃÃÃÃÃÃÃÃÃÃÃc@r
rÃÃÃÃÃ8)c8svt
YÃÃÃÃÃÃÃYÃÃÃÃÃÃÃc@r
rÃÃÃÃÃ8)cX
Query acl also audits the MetaFrame execute list (created and maintained by the
Application Security utility) to verify that no executable files in the execute list are
writable by users.