<!-- This is a silo definition file for cmdserver.exe -->

<container>
    <namespace>
        <ob shadow="false">
            <symlink name="FileSystem" path="\FileSystem" scope="Global" />
            <symlink name="PdcPort" path="\PdcPort" scope="Global" />
            <symlink name="SeRmCommandPort" path="\SeRmCommandPort" scope="Global" />
            <symlink name="Registry" path="\Registry" scope="Global" />
            <symlink name="Driver" path="\Driver" scope="Global" />
            <objdir name="BaseNamedObjects" clonesd="\BaseNamedObjects" shadow="false"/>
            <objdir name="GLOBAL??" clonesd="\GLOBAL??" shadow="false">
                <!-- Needed to map directories from the host -->
                <symlink name="ContainerMappedDirectories" path="\ContainerMappedDirectories" scope="Local" />

                <!-- Valid links to \Device -->
                <symlink name="WMIDataDevice" path="\Device\WMIDataDevice" scope="Local" />
                <symlink name="UNC" path="\Device\Mup" scope="Local" />
                <symlink name="Tcp" path="\Device\Tcp" scope="Local" />
                <symlink name="MountPointManager" path="\Device\MountPointManager" scope="Local" />
                <symlink name="Nsi" path="\Device\Nsi" scope="Local" />
                <symlink name="fsWrap" path="\Device\FsWrap" scope="Local" />
                <symlink name="NDIS" path="\Device\Ndis" scope="Local" />
            </objdir>
            <objdir name="Device" clonesd="\Device" shadow="false">
                <symlink name="Afd" path="\Device\Afd" scope="Global" />
                <symlink name="ahcache" path="\Device\ahcache" scope="Global" />
                <symlink name="CNG" path="\Device\CNG" scope="Global" />
                <symlink name="ConDrv" path="\Device\ConDrv" scope="Global" />
                <symlink name="DeviceApi" path="\Device\DeviceApi" scope="Global" />
                <symlink name="DfsClient" path="\Device\DfsClient" scope="Global" />
                <symlink name="DxgKrnl" path="\Device\DxgKrnl" scope="Global" />
                <symlink name="FsWrap" path="\Device\FsWrap" scope="Global" />
                <symlink name="Ip" path="\Device\Ip" scope="Global" />
                <symlink name="Ip6" path="\Device\Ip6" scope="Global" />
                <symlink name="KsecDD" path="\Device\KsecDD" scope="Global" />
                <symlink name="LanmanDatagramReceiver" path="\Device\LanmanDatagramReceiver" scope="Global" />
                <symlink name="LanmanRedirector" path="\Device\LanmanRedirector" scope="Global" />
                <symlink name="MailslotRedirector" path="\Device\MailslotRedirector" scope="Global" />
                <symlink name="Mup" path="\Device\Mup" scope="Global" />
                <symlink name="Ndis" path="\Device\Ndis" scope="Global" />
                <symlink name="Nsi" path="\Device\Nsi" scope="Global" />
                <symlink name="Null" path="\Device\Null" scope="Global" />
                <symlink name="PcwDrv" path="\Device\PcwDrv" scope="Global" />
                <symlink name="RawIp" path="\Device\RawIp" scope="Global" />
                <symlink name="RawIp6" path="\Device\RawIp6" scope="Global" />
                <symlink name="Tcp" path="\Device\Tcp" scope="Global" />
                <symlink name="Tcp6" path="\Device\Tcp6" scope="Global" />
                <symlink name="Tdx" path="\Device\Tdx" scope="Global" />
                <symlink name="Udp" path="\Device\Udp" scope="Global" />
                <symlink name="Udp6" path="\Device\Udp6" scope="Global" />
                <symlink name="VolumesSafeForWriteAccess" path="\Device\VolumesSafeForWriteAccess" scope="Global" />
                <symlink name="WMIDataDevice" path="\Device\WMIDataDevice" scope="Global" />
            </objdir>
            <objdir name="KnownDlls" clonesd="\KnownDlls" shadow="false">
                <symlink name="KnownDllPath" path="C:\Windows\System32" scope="Local" />
            </objdir>
            <objdir name="KnownDlls32" clonesd="\KnownDlls" shadow="false">
                <symlink name="KnownDllPath" path="C:\Windows\SysWoW64" scope="Local" />
            </objdir>
            <objdir name="NLS" clonesd="\NLS" shadow="false"/>
            <symlink name="SystemRoot" path="\GLOBAL??\C:\Windows" scope="Local" />
        </ob>
        <setup>
        </setup>
        <mountmgr>
        </mountmgr>
        <registry>
            <load
                key="$SiloHivesRoot$\Silo$TopLayerName$Software_Base"
                path="$TopLayerPath$\Hives\Software_Base"
                ReadOnly="true"
                />
            <load
                key="$SiloHivesRoot$\Silo$SiloName$Software_Delta"
                path="$SandboxPath$\Hives\Software_Delta"
                TransactionsDisabled="true"
                />

            <load
                key="$SiloHivesRoot$\Silo$TopLayerName$System_Base"
                path="$TopLayerPath$\Hives\System_Base"
                ReadOnly="true"
                />
            <load
                key="$SiloHivesRoot$\Silo$SiloName$System_Delta"
                path="$SandboxPath$\Hives\System_Delta"
                TransactionsDisabled="true">

                <mkkey
                    name="ControlSet001"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001"
                    />
                <mkkey
                    name="ControlSet001\Control"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001\Control"
                    />
                <mkkey
                    name="ControlSet001\Control\Nsi"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001\Control\Nsi"
                    />
                <mkkey
                    name="ControlSet001\Services"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001\Services"
                    />
                <mkkey
                    name="ControlSet001\Services\Tcpip"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001\Services\Tcpip"
                    />
                <mkkey
                    name="ControlSet001\Hardware Profiles"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001\Hardware Profiles"
                    />
                <mkkey
                    name="ControlSet001\Services\Tcpip\Parameters"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001\Services\Tcpip\Parameters"
                    />
                <mkkey
                    name="ControlSet001\Services\Tcpip\Parameters\Adapters"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Adapters"
                    />
                <mkkey
                    name="ControlSet001\Services\Tcpip\Parameters\Interfaces"
                    clonesd="\REGISTRY\Machine\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces"
                    />
            </load>

            <load
                key="$SiloHivesRoot$\Silo$TopLayerName$Sam_Base"
                path="$TopLayerPath$\Hives\Sam_Base"
                ReadOnly="true"
                />
            <load
                key="$SiloHivesRoot$\Silo$SiloName$Sam_Delta"
                path="$SandboxPath$\Hives\Sam_Delta"
                TransactionsDisabled="true"
                />

            <load
                key="$SiloHivesRoot$\Silo$TopLayerName$Security_Base"
                path="$TopLayerPath$\Hives\Security_Base"
                ReadOnly="true"
                />
            <load
                key="$SiloHivesRoot$\Silo$SiloName$Security_Delta"
                path="$SandboxPath$\Hives\Security_Delta"
                TransactionsDisabled="true"
                />

            <load
                key="$SiloHivesRoot$\Silo$TopLayerName$DefaultUser_Base"
                path="$TopLayerPath$\Hives\DefaultUser_Base"
                ReadOnly="true"
                />
            <load
                key="$SiloHivesRoot$\Silo$SiloName$DefaultUser_Delta"
                path="$SandboxPath$\Hives\DefaultUser_Delta"
                TransactionsDisabled="true"
                />

            <load
                key="$SiloHivesRoot$\Silo$SiloName$Machine_Temp"
                path="%MachineUserHive%"
                readonly="true"
                />

            <load
                key="$SiloHivesRoot$\Silo$SiloName$User_Temp"
                path="%MachineUserHive%"
                readonly="true"
                />

            <!-- Create symlinks that would have been created in nt!CmpFinishSystemHivesLoad -->
            <symlink
                key="$SiloHivesRoot$\Silo$SiloName$Security_Delta\SAM"
                target="\Registry\Machine\SAM\SAM"
                />

            <symlink
                key="$SiloHivesRoot$\Silo$SiloName$User_Temp\S-1-5-18"
                target="\Registry\User\.Default"
                />

            <!-- Use ControlSet001 for CurrentControlSet (normally done in nt!CmInitSystem1) -->
            <symlink
                key="$SiloHivesRoot$\Silo$SiloName$System_Delta\CurrentControlSet"
                target="\Registry\Machine\SYSTEM\ControlSet001"
                />

            <!-- Create a hardware profile symlink to enable HKEY_CURRENT_CONFIG -->
            <symlink
                key="$SiloHivesRoot$\Silo$SiloName$System_Delta\ControlSet001\Hardware Profiles\Current"
                target="\Registry\Machine\System\ControlSet001\Hardware Profiles\0001"
                />

            <!-- Provide read only access to these keys -->
            <key
                name="MACHINE"
                access_mask="0x83020019"
                flags="0x00000100"
                >
                <merge
                    path="$SiloHivesRoot$\Silo$SiloName$Machine_Temp"
                    DeleteSemantics="Enabled"
                    access_mask="0xffffffff"
                    />

                <key
                    name="Hardware"
                    access_mask="0x83020019"
                    flags="0x00000001"
                    junction="\Registry\Machine\Hardware"
                    >
                </key> <!-- Hardware -->

                <key
                    name="SOFTWARE"
                    access_mask="0x83020019"
                    flags="0x00000001"
                    junction="$SiloHivesRoot$\Silo$TopLayerName$Software_Base"
                    >
                    <merge
                        path="$SiloHivesRoot$\Silo$SiloName$Software_Delta"
                        DeleteSemantics="Enabled"
                        access_mask="0xffffffff"
                        />
                </key> <!-- SOFTWARE -->

                <key
                    name="SYSTEM"
                    access_mask="0x83020019"
                    flags="0x00000001"
                    junction="$SiloHivesRoot$\Silo$TopLayerName$System_Base"
                    >
                    <merge
                        path="$SiloHivesRoot$\Silo$SiloName$System_Delta"
                        DeleteSemantics="Enabled"
                        access_mask="0xffffffff"
                        />

                    <key
                        name="ControlSet001"
                        access_mask="0x83020019"
                        flags="0x00000001"
                        junction="$SiloHivesRoot$\Silo$TopLayerName$System_Base\ControlSet001"
                        >
                        <merge
                            path="$SiloHivesRoot$\Silo$SiloName$System_Delta\ControlSet001"
                            DeleteSemantics="Enabled"
                            access_mask="0xffffffff"
                            />

                        <key
                            name="Control"
                            access_mask="0x83020019"
                            flags="0x00000001"
                            junction="$SiloHivesRoot$\Silo$TopLayerName$System_Base\ControlSet001\Control"
                            >
                            <merge
                                path="$SiloHivesRoot$\Silo$SiloName$System_Delta\ControlSet001\Control"
                                DeleteSemantics="Enabled"
                                access_mask="0xffffffff"
                                />

                            <!-- The container needs to be able to see the
                                 host's NSI tree, so leak that through here, but
                                 capture changes in the delta.
                            -->
                            <key
                                name="Nsi"
                                access_mask="0x83020019"
                                flags="0x00000001"
                                junction="\Registry\Machine\System\ControlSet001\Control\Nsi"
                                >
                                <merge
                                    path="\Registry\Machine\System\ControlSet001\Control\Nsi"
                                    DeleteSemantics="Disabled"
                                    access_mask="0xffffffff"
                                    />
                            </key> <!-- Nsi -->
                        </key> <!-- Control -->

                        <key
                            name="Services"
                            access_mask="0x83020019"
                            flags="0x00000001"
                            junction="$SiloHivesRoot$\Silo$TopLayerName$System_Base\ControlSet001\Services"
                            >
                            <merge
                                path="$SiloHivesRoot$\Silo$SiloName$System_Delta\ControlSet001\Services"
                                DeleteSemantics="Enabled"
                                access_mask="0xffffffff"
                                />

                            <key
                                name="Tcpip"
                                access_mask="0x83020019"
                                flags="0x00000001"
                                junction="$SiloHivesRoot$\Silo$TopLayerName$System_Base\ControlSet001\Services\Tcpip"
                                >
                                <merge
                                    path="$SiloHivesRoot$\Silo$SiloName$System_Delta\ControlSet001\Services\Tcpip"
                                    DeleteSemantics="Enabled"
                                    access_mask="0xffffffff"
                                    />

                                <key
                                    name="Parameters"
                                    access_mask="0x83020019"
                                    flags="0x00000001"
                                    junction="$SiloHivesRoot$\Silo$TopLayerName$System_Base\ControlSet001\Services\Tcpip\Parameters"
                                    >
                                    <merge
                                        path="$SiloHivesRoot$\Silo$SiloName$System_Delta\ControlSet001\Services\Tcpip\Parameters"
                                        DeleteSemantics="Enabled"
                                        access_mask="0xffffffff"
                                        />

                                    <key
                                        name="Adapters"
                                        access_mask="0x83020019"
                                        flags="0x00000001"
                                        junction="$SiloHivesRoot$\Silo$TopLayerName$System_Base\ControlSet001\Services\Tcpip\Parameters\Adapters"
                                      >
                                        <merge
                                            path="$SiloHivesRoot$\Silo$SiloName$System_Delta\ControlSet001\Services\Tcpip\Parameters\Adapters"
                                            DeleteSemantics="Disabled"
                                            access_mask="0xffffffff"
                                          />
                                    </key><!-- Adapters -->

                                    <key
                                        name="DNSRegisteredAdapters"
                                        access_mask="0x83020019"
                                        flags="0x00000001"
                                        junction="\Registry\Machine\System\ControlSet001\Services\Tcpip\Parameters\DNSRegisteredAdapters"
                                      >
                                      <merge
                                          path="\Registry\Machine\System\ControlSet001\Services\Tcpip\Parameters\DNSRegisteredAdapters"
                                          DeleteSemantics="Disabled"
                                          access_mask="0xffffffff"
                                          />
                                    </key><!-- DNSRegisteredAdapters -->

                                    <key
                                        name="Interfaces"
                                        access_mask="0x83020019"
                                        flags="0x00000001"
                                        junction="$SiloHivesRoot$\Silo$TopLayerName$System_Base\ControlSet001\Services\Tcpip\Parameters\Interfaces"
                                      >
                                        <merge
                                            path="$SiloHivesRoot$\Silo$SiloName$System_Delta\ControlSet001\Services\Tcpip\Parameters\Interfaces"
                                            DeleteSemantics="Disabled"
                                            access_mask="0xffffffff"
                                          />
                                    </key><!-- Interfaces -->

                                    <key
                                        name="NsiObjectSecurity"
                                        access_mask="0x83020019"
                                        flags="0x00000001"
                                        junction="\Registry\Machine\System\ControlSet001\Services\Tcpip\Parameters\NsiObjectSecurity"
                                      >
                                      <merge
                                          path="\Registry\Machine\System\ControlSet001\Services\Tcpip\Parameters\NsiObjectSecurity"
                                          DeleteSemantics="Disabled"
                                          access_mask="0xffffffff"
                                          />
                                    </key><!-- NsiObjectSecurity -->

                                    <key
                                        name="PersistentRoutes"
                                        access_mask="0x83020019"
                                        flags="0x00000001"
                                        junction="\Registry\Machine\System\ControlSet001\Services\Tcpip\Parameters\PersistentRoutes"
                                      >
                                      <merge
                                          path="\Registry\Machine\System\ControlSet001\Services\Tcpip\Parameters\PersistentRoutes"
                                          DeleteSemantics="Disabled"
                                          access_mask="0xffffffff"
                                          />
                                    </key><!-- PersistentRoutes -->

                                    <key
                                        name="Winsock"
                                        access_mask="0x83020019"
                                        flags="0x00000001"
                                        junction="\Registry\Machine\System\ControlSet001\Services\Tcpip\Parameters\Winsock"
                                      >
                                      <merge
                                          path="\Registry\Machine\System\ControlSet001\Services\Tcpip\Parameters\Winsock"
                                          DeleteSemantics="Disabled"
                                          access_mask="0xffffffff"
                                          />
                                    </key><!-- Winsock -->
                                </key><!-- Parameters -->
                            </key> <!-- Tcpip -->
                        </key> <!-- Services -->
                    </key> <!-- ControlSet001 -->
                </key> <!-- SYSTEM -->

                <key
                    name="SAM"
                    access_mask="0x83020019"
                    flags="0x00000001"
                    junction="$SiloHivesRoot$\Silo$TopLayerName$Sam_Base"
                    >
                    <merge
                        path="$SiloHivesRoot$\Silo$SiloName$Sam_Delta"
                        DeleteSemantics="Enabled"
                        access_mask="0xffffffff"
                        />
                </key> <!-- SAM -->
                <key
                    name="SECURITY"
                    access_mask="0x83020019"
                    flags="0x00000001"
                    junction="$SiloHivesRoot$\Silo$TopLayerName$Security_Base"
                    >
                    <merge
                        path="$SiloHivesRoot$\Silo$SiloName$Security_Delta"
                        DeleteSemantics="Enabled"
                        access_mask="0xffffffff"
                        />
                </key> <!-- SECURITY -->
            </key> <!-- MACHINE -->
            <key
                name="USER"
                access_mask="0x83020019"
                flags="0x00000100"
                >
                <merge
                    path="$SiloHivesRoot$\Silo$SiloName$User_Temp"
                    DeleteSemantics="Enabled"
                    access_mask="0xffffffff"
                    />

                <key
                    name=".DEFAULT"
                    access_mask="0x83020019"
                    flags="0x00000001"
                    junction="$SiloHivesRoot$\Silo$TopLayerName$DefaultUser_Base"
                    >
                    <merge
                        path="$SiloHivesRoot$\Silo$SiloName$DefaultUser_Delta"
                        DeleteSemantics="Enabled"
                        access_mask="0xffffffff"
                        />
                </key> <!-- .DEFAULT -->
            </key><!-- USER -->
        </registry>

        <registry2>
            <symlink
                key="$SiloHivesRoot$\Silo_$SiloName$_Security\SAM"
                target="\Registry\Machine\SAM\SAM"
                />

            <symlink
                key="$SiloHivesRoot$\Silo_$SiloName$_User\S-1-5-18"
                target="\Registry\User\.Default"
                />

            <symlink
                key="$SiloHivesRoot$\Silo_$SiloName$_System\CurrentControlSet"
                target="\Registry\Machine\SYSTEM\ControlSet001"
                />

            <symlink
                key="$SiloHivesRoot$\Silo_$SiloName$_System\ControlSet001\Hardware Profiles\Current"
                target="\Registry\Machine\System\ControlSet001\Hardware Profiles\0001"
                />

            <hivestack hive="machine">
            </hivestack>

            <hivestack hive="security">
            </hivestack>

            <hivestack hive="system">
            </hivestack>

            <hivestack hive="software">
            </hivestack>

            <hivestack hive="sam">
            </hivestack>

            <hivestack hive="user">
            </hivestack>

            <hivestack hive="defaultuser">
            </hivestack>

            <RedirectionNode
                ContainerPath="\Registry"
                HostPath="\Registry"
                access_mask="0xffffffff"
                />

            <RedirectionNode
                ContainerPath="\Registry\MACHINE"
                HostPath="$SiloHivesRoot$\Silo_$SiloName$_Machine"
                access_mask="0xffffffff"
                />

            <RedirectionNode
                ContainerPath="\Registry\MACHINE\Hardware"
                HostPath="\Registry\MACHINE\Hardware"
                access_mask="0x83020019"
                TrustedHive="true"
                />

            <RedirectionNode
                ContainerPath="\Registry\MACHINE\SOFTWARE"
                HostPath="$SiloHivesRoot$\Silo_$SiloName$_Software"
                access_mask="0xffffffff"
                TrustedHive="true"
                />

            <RedirectionNode
                ContainerPath="\Registry\MACHINE\SYSTEM"
                HostPath="$SiloHivesRoot$\Silo_$SiloName$_System"
                access_mask="0xffffffff"
                TrustedHive="true"
                />

            <RedirectionNode
                ContainerPath="\Registry\MACHINE\SYSTEM\ControlSet001\Control\Nsi"
                HostPath="\Registry\MACHINE\SYSTEM\ControlSet001\Control\Nsi"
                access_mask="0x83020019"
                />

            <RedirectionNode
                ContainerPath="\Registry\MACHINE\SAM"
                HostPath="$SiloHivesRoot$\Silo_$SiloName$_Sam"
                access_mask="0xffffffff"
                TrustedHive="true"
                />

            <RedirectionNode
                ContainerPath="\Registry\MACHINE\Security"
                HostPath="$SiloHivesRoot$\Silo_$SiloName$_Security"
                access_mask="0xffffffff"
                TrustedHive="true"
                />

            <RedirectionNode
                ContainerPath="\Registry\USER"
                HostPath="$SiloHivesRoot$\Silo_$SiloName$_User"
                access_mask="0xffffffff"
                />

            <RedirectionNode
                ContainerPath="\Registry\USER\.DEFAULT"
                HostPath="$SiloHivesRoot$\Silo_$SiloName$_DefaultUser"
                access_mask="0xffffffff"
                />
        </registry2>
       <network compartment="%JobName%" />
    </namespace>
</container>
