<ObjectCollector xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <!-- ** Type file for the Microsoft Exchange Server Best Practices Analyzer Tool (ExBPA) - Errors/Additions/Comments, please e-mail EXBPAFB@MICROSOFT.COM ** -->

  <!-- *********************************************************************  -->
  <!--  Copyright (C) 2004-2009 Microsoft Corporation. All Rights Reserved.   -->
  <!-- *********************************************************************  -->

  <_locDefinition>
    <_locDefault _loc="locNone"/>
    <_locTag _loc="locNone" _locAttrData="ChangeDescription">Configuration</_locTag>
    <_locTag _loc="locNone" _locAttrData="Text,Title,Class,LogText">Object</_locTag>
    <_locTag _loc="locNone" _locAttrData="Text,Title,NotText,NotTitle">Rule</_locTag>
    <_locTag _loc="locNone" _locAttrData="Text,Title">Template</_locTag>
    <_locTag _loc="locNone" _locAttrData="Name">Baseline</_locTag>
    <_locTag _loc="locNone" _locAttrData="Text,Title">RestrictionType</_locTag>
    <_locTag _loc="locNone" _locAttrData="Text,Title">Option</_locTag>
    <_locTag _loc="locNone" _locAttrData="Text,Title">Setting</_locTag>
  </_locDefinition>

  <Configuration ConfigVersion="14.0.1.2" ConfigName="Exchange Server 2010 Pre-Deployment Analyzer Readiness Checks" ChangeDescription="The changes made in this version are minor modifications to trigger rules that previously didn't fire."/>

  <Type Name="Ex2010RC">
    <!-- // This type retrieves various properties from an existing Exchange topology to verify that a transition to Exchange 2010 is possible -->
    <!-- // EXTERNAL DEPENDENCIES: -->
    <!-- //     None -->

    <Object Type="Group" Name="Exchange Server 2010 Pre-Deployment Analyzer" Task="Ex2010Readiness" SecurityContext="ADLOGON">

      <!-- // Statistics -->
      <Object Type="Group" Name="Pre-Deployment Summary">
        <Setting Key1="Processed">
          <Rule Name="iStatSummaryADTrees" Query="count($szADTree)+1" Error="None" Text="Found  {9}  Active Directory tree(s) in the forest." P9="count($szADTree)+1" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryADDomains" Query="count($szADDomain)" Error="None" Text="Found  {9}  Active Directory domain(s) in the forest." P9="count($szADDomain)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryExDomains" Query="count($szCacheExchangeDomain)" Error="None" Text="Found  {9}  Active Directory domain(s) containing Exchange servers: {1}." P1="join('; ', $szCacheExchangeDomain)" P9="count($szCacheExchangeDomain)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryExDNSDomains" Query="count($szCacheExchangeDNSDomain)" Error="None" Text="Found  {9}  DNS domain(s) containing Exchange servers: {1}." P1="join('; ', $szCacheExchangeDNSDomain)" P9="count($szCacheExchangeDNSDomain)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryADSites" Query="count($szADSite)" Error="None" Text="Found  {9}  Active Directory site(s) in the forest." P9="count($szADSite)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryExSites" Query="count($szCacheExchangeSite)" Error="None" Text="Found  {9}  Active Directory site(s) containing Exchange servers: {1}." P1="join('; ', $szCacheExchangeSite)" P9="count($szCacheExchangeSite)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryAdminGroups" Query="count($szAdminGroup)" Error="None" Text="Found  {9}  administrative group(s) in the organization." P9="count($szAdminGroup)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryRoutingGroups" Query="count($szRoutingGroup)" Error="None" Text="Found  {9}  routing group(s) in the organization." P9="count($szRoutingGroup)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummary55Servers" Query="count($fExchange55)" Error="None" Text="Found  {9}  server(s) running Exchange Server 5.5." P9="count($fExchange55)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummary2000Servers" Query="count($fExchange2000)" Error="None" Text="Found  {9}  server(s) running Exchange 2000 Server." P9="count($fExchange2000)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummary2003Servers" Query="count($fExchange2003)" Error="None" Text="Found  {9}  server(s) running Exchange Server 2003." P9="count($fExchange2003)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummary2007Servers" Query="count($fExchange2007)" Error="None" Text="Found  {9}  server(s) running Exchange Server 2007." P9="count($fExchange2007)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummary2010Servers" Query="count($fExchange2010)" Error="None" Text="Found  {9}  server(s) running Exchange Server 2010." P9="count($fExchange2010)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryTotalMailboxes" Query="sum($iStatTotalMailboxes)" Error="None" Text="Found  {9}  pre-Exchange 2010 mailboxes in the organization." P9="sum($iStatTotalMailboxes)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryAD2000Servers" Query="count($fWin2000ADServer)" Error="None" Text="Found  {9}  Active Directory server(s) running Windows 2000 Server." P9="count($fWin2000ADServer)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryAD2003RTMServers" Query="count($fWin2003RTMADServer)" Error="None" Text="Found  {9}  Active Directory server(s) running Windows Server 2003 (original release)." P9="count($fWin2003RTMADServer)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryAD2003SP1Servers" Query="count($fWin2003SP1ADServer)" Error="None" Text="Found  {9}  Active Directory server(s) running Windows Server 2003 Service Pack 1." P9="count($fWin2003SP1ADServer)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryAD2003SP2Servers" Query="count($fWin2003SP2ADServer)" Error="None" Text="Found  {9}  Active Directory server(s) running Windows Server 2003 Service Pack 2." P9="count($fWin2003SP2ADServer)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryAD2008Servers" Query="count($fWin2008ADServer)" Error="None" Text="Found  {9}  Active Directory server(s) running Windows Server 2008." P9="count($fWin2008ADServer)" AlwaysEvaluate="True"/>
          <Rule Name="iStatSummaryAD2008R2Servers" Query="count($fWin2008R2ADServer)" Error="None" Text="Found  {9}  Active Directory server(s) running Windows Server 2008 R2." P9="count($fWin2008R2ADServer)" AlwaysEvaluate="True"/>
        </Setting>

        <Setting Key1="Global">
          <Rule Name="fNoE12Servers" Query="count($fExchange2007)=0 and count($fExchange2010)=0" Error="Warning" Title="Exchange Server 2007 compatibility" Text="There are no Exchange 2007 servers in the organization. If you prepare the Active Directory with Exchange Server 2010, you will not be able to subsequently install Exchange Server 2007." GUID="b8bb6d61-4f46-4109-a0f2-7050b485e3e1" AlwaysEvaluate="True"/>
          <Rule Name="fNoFEServers" Query="count($fExchange2007)=0 and count($fExchange2003) &gt;0 and count($fMailboxRoleInstalled) &gt;0 and count($fClientAccessRoleInstalled)=0" Error="Warning" Title="Front end server required" Text="No front end servers were detected. This Exchange Server 2003 role is required to correctly redirect Outlook Web Access traffic when Exchange Server 2010 is installed." GUID="bda8a6b9-cf3f-4742-a933-759710275595" AlwaysEvaluate="True"/>
        </Setting>

      </Object>

      <!-- // Get basic directory naming context information -->
      <Object Type="Directory" Name="cn" Class="Forest" GroupingClass="True">
        <Setting Key1="rootDomainNamingContext" Substitution="ROOTDN"/>
        <Setting Key1="configurationNamingContext" Substitution="CONFIGDN"/>
        <Setting Key1="schemaNamingContext" Substitution="SCHEMADN"/>

        <!-- // Find out if the Active Directory schema has already been upgraded -->
        <Object Type="Group" Name="Active Directory Schema">
          <Object Type="Directory" Key2="cn=ms-Exch-Schema-Version-Pt,%SCHEMADN%">
            <Setting Key1="rangeUpper">
              <Rule Name="fSchemaVersionPtTi12" Query="$. &lt;14622" Error="BestPractice" Sev="3" Title="Active Directory schema upgrade required" Text="The Active Directory schema will need to be upgraded (via the /PrepareSchema switch of Exchange Server 2010 setup) before Exchange 2010 servers can be installed into the organization."/>
              <Rule Name="fSchemaVersion2010RTM" Query="$.=14622" Error="None" Title="Exchange 2010 Active Directory schema extensions present" Text="The Active Directory schema supports Exchange Server 2010 servers."/>
            </Setting>
          </Object>

          <!-- Establish whether the forest is at the correct functionality level -->
          <Object Type="Directory" Key2="cn=Partitions,%CONFIGDN%">
            <Setting Key1="msDS-Behavior-Version">
              <Rule Name="fForestLevelNotWin2003Native" Query="$. &lt; 2" Error="Error" Title="Windows Server 2003 Forest Functional Mode or higher is required" Text="The forest functional level of the Active Directory forest is not Windows Server 2003 native or later. To install Exchange Server 2010, the forest functional level must be at least Windows Server 2003 native." Role="Global" GUID="bda8a6b9-cf3f-4742-a933-759710275595"/>
            </Setting>
          </Object>

          <!-- // Find out more about this forest and what is installed -->
          <!-- // The following object will exist in the schema if Identity Integration Server is installed -->
          <Object Type="Directory" Key2="cn=MS-MIIS-PCNS-Target,%SCHEMADN%">
            <Setting Key1="cn">
              <Rule Name="fMIISPresent" Query="$.!=''" Error="None" Title="Microsoft Identity Integration Server is present" Text="Microsoft Identity Integration Server has extended the Active Directory schema."/>
            </Setting>
          </Object>

          <!-- // The following object will exist in the root domain if High Volume Exchange is installed -->
          <Object Type="Directory" Key2="cn=MPS Server Config Entity,cn=System,%ROOTDN%">
            <Setting Key1="cn">
              <Rule Name="fHostedExchange" Query="$.!=''" Error="None" Title="Active Directory supports hosted Exchange" Text="This Active Directory forest supports the Microsoft Hosted Messaging and Collaboration (HMC) platform."/>
            </Setting>
          </Object>

          <!-- // Locate the Schema FSMO and find out if it is Windows 2003 SP1 or above -->
          <Object Type="Directory" Key2="%SCHEMADN%">
            <Setting Key1="fSMORoleOwner" Substitution="FSMOROLESCHEMA" SubstitutionFormat="CN=NTDS Settings,CN=(.*?),.*----$1">
              <Rule Name="szFSMORoleSchemaDN" Query="$."/>
            </Setting>
            <Object Type="Directory" Key2="cn=Sites,%CONFIGDN%" Key3="(&amp;(objectClass=server)(cn=%FSMOROLESCHEMA%))">
              <Setting Key1="distinguishedName" Substitution="SCHEMASERVERDN"/>
              <Setting Key1="dNSHostName" Substitution="SCHEMASERVER"/>
              <Setting Key1="serverReference" Substitution="SCHEMASERVERREF"/>
              <Object Type="Directory" Key2="%SCHEMASERVERREF%">
                <Setting Key1="operatingSystemVersion">
                  <Rule Name="fWin2003SPnSchemaFSMO" Query="substring($.,1,3) &lt;5.2 or (substring($.,1,3)=5.2 and not($fSPnSchemaFSMO))" Error="Error" Sev="1" Title="Schema Master is not Windows Server 2003 Service Pack 1 or later" Text="The Schema Master role '{2}' is not running Windows Server 2003 Service Pack 1 or later. Exchange Server 2010 requires this minimum version to support new permission structures." S2="%SCHEMASERVER%" AlwaysEvaluate="True" GUID="8067537b-4a5b-4abd-8736-09635f785bc7"/>
                </Setting>

                <!-- // The following value is not localized, so it is safe to test the string -->
                <Setting Key1="operatingSystemServicePack">
                  <Rule Name="fSPnSchemaFSMO" Query="starts-with($., 'Service Pack')"/>
                </Setting>
              </Object>
            </Object>
          </Object>
        </Object>

        <Object Type="Group" Name="Active Directory Domains">
          <!-- // Enumerate all domains within the forest. Get the data from the configuration naming context -->
          <Object Type="Directory" Key2="cn=Partitions,%CONFIGDN%" Key3="(systemFlags=3)" Key4="OneLevel" Class="Domain" GroupingClass="True">
            <Setting Key1="dnsRoot" Substitution="DNSROOT">
              <Rule Name="fDNSDomainSingleLabel" Query="$fDomainPrep and not(contains($., '.'))" Error="None" Title="Single-labeled DNS domain name detected" Text="A single-labeled DNS domain prepared for Exchange was detected. DNS domain name: {1}." P1="$."/>
            </Setting>
            <Setting Key1="nCName" Substitution="NCNAME">
              <Rule Name="szADDomain" Query="$."/>
              <Rule Name="fRootDomain" Query="$.='%ROOTDN%'" Error="None" Title="Root domain: {3}" Text="Active Directory domain '{3}' is the root domain in the forest." S3="%NCNAME%"/>
            </Setting>
            <Setting Key1="nETBIOSName" Substitution="NETBIOSNAME">
              <Rule Name="fRootNetBIOSNameMismatch" Query="not(starts-with(lower-case('%DNSROOT%'),concat(lower-case($.),'.')))" Error="None" Title="NetBIOS and DNS domain name mismatch" Text="Active Directory domain '{3}' has a NetBIOS name of '{1}' and a DNS name of '{4}'." S1="%NETBIOSNAME%" S3="%NCNAME%" S4="%DNSROOT%"/>
            </Setting>

            <!-- // The rootTrust attribute will be set for top-level domains that are siblings of the root domain -->
            <Setting Key1="rootTrust">
              <Rule Name="szADTree" Query="$." Error="None" Title="Disjoint Active Directory namespace: {3}" Text="Active Directory domain '{3}' is in a different tree than the root domain." S3="%NCNAME%"/>
            </Setting>

            <!-- // The trustParent attribute will be set for all child domains. For immediate children, trustParent will reference the top-level domain. For grandchild domains, the trust is with the immediate parent, which is also a child -->
            <Setting Key1="trustParent">
              <Rule Name="szChildDomain" Query="$." Error="None" Title="Child domain: {3}" Text="Active Directory domain '{3}' is a child domain in the forest." S3="%NCNAME%"/>
            </Setting>

            <!-- // Now bind directly to the domain object -->
            <Object Type="Directory" Key2="%NCNAME%">
              <Setting Key1="msDS-AllowedDnsSuffixes">
                <Rule Name="szAllowedDnsSuffixes" Query="$." Error="None" Title="Allowed DNS suffixes parameter is set" Text="Active Directory domain '{3}' has an allowed DNS suffix list of '{1}'." P1="join(';',$.)" S3="%NCNAME%"/>
              </Setting>

              <!-- // Find out if this domain is domainprep'd -->
              <Object Type="Directory" Key2="cn=Microsoft Exchange System Objects,%NCNAME%">
                <Setting Key1="objectVersion">
                  <Rule Name="fDomainPrep" Query="true()"/>
                </Setting>
                <Setting Key1="cn">
                  <Rule Name="fRUSMissing" Query="count($fExchange2003) &gt;0 and count($szRUSName)=0" Error="Warning" Title="Recipient Update Service is missing" Text="Cannot find the Recipient Update Service responsible for domain '{3}'. New and existing users may not be properly Exchange-enabled." S3="%NCNAME%" AlwaysEvaluate="True" GUID="3bc93fba-92fb-4bf6-94c3-3fcf17171cb0"/>
                  <Rule Name="fNoValidDCForPrepareLegPerms" Query="$fEESGroupExists and $fEDSGroupExists and count($szDomainValidDC)=0" Error="Error" Title="Domain controller version" Text="Active Directory domain '{3}' does not contain at least one domain controller running Windows Server 2003 Service Pack 1 or later. This is required for the '{1}' task when updating existing domains that have been previously prepared for Exchange Server." S1="/PrepareLegacyExchangePermissions" S3="%NCNAME%" GUID="bda8a6b9-cf3f-4742-a933-759710275595" AlwaysEvaluate="True"/>
                </Setting>

                <!-- // Find out if there is at least one Windows 2003 SP1 or later domain controller in the domain. This is necessary for /PrepareLegacyExchangePermissions to function -->
                <!-- // NOTE: It is possible to move DCs out of the (non-localized) 'Domain Controllers' OU which means that our search won't pick them up -->
                <!-- // NOTE: However, a domain-wide search with this LDAP filter is almost sure to time-out -->
                <Object Type="Directory" Key2="ou=Domain Controllers,%NCNAME%" Key3="(&amp;(objectClass=computer)(serverReferenceBL=*)(|(&amp;(operatingSystemVersion=5.2*)(operatingSystemServicePack=*))(operatingSystemVersion=6.*)))">
                  <Setting Key1="cn">
                    <Rule Name="szDomainValidDC" Query="$."/>
                  </Setting>
                  <Setting Key1="operatingSystemVersion"/>
                  <Setting Key1="operatingSystemServicePack"/>
                </Object>

                <!-- // Find out if there is a RUS configured for this domain -->
                <Object Type="Directory" Key2="cn=Microsoft Exchange,cn=Services,%CONFIGDN%" Key3="(&amp;(objectClass=msExchAddressListService)(msExchDomainLink=%NCNAME%))" Key4="Subtree">
                  <Setting Key1="cn">
                    <Rule Name="szRUSName" Query="$."/>
                  </Setting>
                </Object>

                <!-- // Verify that the EES/EDS groups exist. Initialize-ExchangeLegacyPermissions skips domains where these groups don't exist -->
                <Object Type="Directory" Key2="cn=Exchange Enterprise Servers,cn=Users,%NCNAME%">
                  <Setting Key1="objectGuid">
                    <Rule Name="fEESGroupExists" Query="count($.) &gt;0"/>
                  </Setting>
                </Object>
                <Object Type="Directory" Key2="cn=Exchange Domain Servers,cn=Users,%NCNAME%">
                  <Setting Key1="objectGuid">
                    <Rule Name="fEDSGroupExists" Query="count($.) &gt;0"/>
                  </Setting>
                </Object>

              </Object>
            </Object>
          </Object>
        </Object>

        <!-- // Enumerate all Active Directory Sites -->
        <Object Type="Group" Name="Active Directory Sites">
          <Object Type="Directory" Key2="cn=Sites,%CONFIGDN%" Key3="(objectClass=site)" Async="5" Class="Site" GroupingClass="True">
            <Setting Key1="distinguishedName" Substitution="DN"/>
            <Setting Key1="cn">
              <Rule Name="szADSite" Query="$."/>
              <Rule Name="fSiteCannotSupportEx2010" Query="count($szSiteDomainController) &gt;0 and count($fWin2003SPxGCInSite)=0 and count($fWin2008GCInSite)=0 and count($fWin2008R2GCInSite)=0" Error="Error" Sev="3" Title="Site '{3}' cannot support Exchange 2010 servers" Text="Active Directory site '{3}' does not contain any global catalog servers running Windows Server 2003 Service Pack 1 or later. This will prevent Exchange 2010 servers from being installed into site '{3}'." P3="$." GUID="5787111b-38c7-4e7d-9e07-93890189a561" AlwaysEvaluate="True"/>
            </Setting>

            <!-- // Enumerate all legacy Active Directory Connector servers -->
            <Object Type="Directory" Key2="%DN%" Key3="(objectClass=msExchActiveDirectoryConnector)" Key4="Subtree">
              <Setting Key1="cn">
                <Rule Name="fADCPresent" Query="$." Error="Error" Sev="1" Title="Active Directory Connector found" Text="Active Directory Connector '{1}' was found in the forest. This must be decommissioned before Exchange Server 2010 can be installed." P1="$." GUID="bee744c9-dcf7-46a2-9a71-ab0236fa7732"/>
              </Setting>
            </Object>

            <!-- // Enumerate all domain controllers (and global catalogs) in the site -->
            <Object Type="Directory" Key2="%DN%" Key3="(&amp;(objectClass=server)(dNSHostName=*))" Key4="Subtree">
              <Setting Key1="distinguishedName" Substitution="ADSERVERDN"/>
              <Setting Key1="dNSHostName" Substitution="ADSERVER">
                <Rule Name="szSiteDomainController" Query="$."/>
                <Rule Name="fWin2003SPxGCInSite" Query="$fWin2003SPxADServer and $fIsGC"/>
                <Rule Name="fWin2008GCInSite" Query="$fWin2008ADServer and $fIsGC"/>
                <Rule Name="fWin2008R2GCInSite" Query="$fWin2008R2ADServer and $fIsGC"/>
              </Setting>
              <Setting Key1="serverReference" Substitution="ADSERVERREF"/>

              <!-- // Bind to the computer object in the directory to retrieve version information for the domain controller -->
              <Object Type="Directory" Key2="%ADSERVERDN%" Key3="(objectClass=nTDSDSA)" Key4="OneLevel">
                <Setting Key1="options">
                  <Rule Name="fIsGC" Query="bitwise-and($.,1)=1"/>
                </Setting>
                <Object Type="Directory" Key2="%ADSERVERREF%">
                  <Setting Key1="operatingSystemVersion">
                    <Rule Name="fWin2000ADServer" Query="starts-with($., '5.0')" Error="Warning" Sev="2" Title="Windows 2000 Server domain controller" Text="Domain controller '{2}' is running Windows 2000 Server. Exchange Server 2010 will only use domain controllers running Windows Server 2003 Service Pack 1 or later." S2="%ADSERVER%" GUID="bda8a6b9-cf3f-4742-a933-759710275595" AlwaysEvaluate="True"/>
                    <Rule Name="fWin2003RTMADServer" Query="starts-with($., '5.2') and not($fWinSPADServer)" Error="Warning" Sev="2" Title="Windows Server 2003 domain controller" Text="Domain controller '{2}' is running Windows Server 2003 (original release). Exchange Server 2010 will only use domain controllers running Windows Server 2003 Service Pack 1 or later." S2="%ADSERVER%" GUID="bda8a6b9-cf3f-4742-a933-759710275595" AlwaysEvaluate="True"/>
                    <Rule Name="fWin2003SP1ADServer" Query="starts-with($., '5.2') and $fWinSP1ADServer"/>
                    <Rule Name="fWin2003SP2ADServer" Query="starts-with($., '5.2') and $fWinSP2ADServer"/>
                    <Rule Name="fWin2003SPxADServer" Query="starts-with($., '5.2') and $fWinSPADServer"/>
                    <Rule Name="fWin2008ADServer" Query="starts-with($., '6.0')" Error="None" Title="Windows Server 2008 domain controller" Text="Domain controller '{2}' is running Windows Server 2008." S2="%ADSERVER%"/>
                    <Rule Name="fWin2008R2ADServer" Query="starts-with($., '6.1')" Error="None" Title="Windows Server 2008 R2 domain controller" Text="Domain controller '{2}' is running Windows Server 2008 R2." S2="%ADSERVER%"/>
                  </Setting>
                  <Setting Key1="operatingSystemServicePack">
                    <Rule Name="fWinSPADServer" Query="starts-with($., 'Service Pack')"/>
                    <Rule Name="fWinSP1ADServer" Query="starts-with($., 'Service Pack 1')"/>
                    <Rule Name="fWinSP2ADServer" Query="starts-with($., 'Service Pack 2')"/>
                  </Setting>
                </Object>
              </Object>
            </Object>
          </Object>

          <Object Type="Group" Name="Active Directory Site Links">
            <Setting Key1="Site links">
              <Rule Name="fSMTPSiteLinksFound" Query="count($szSMTPSiteLink)&gt;0" Error="Warning" Sev="2" Title="SMTP site link(s) found" Text="{9} SMTP site link(s) are defined in Active Directory. Exchange Server 2010 can only route messages using IP-based site links. Existing SMTP site links may need to be converted if Exchange Server 2010 is to be installed in multiple sites." P9="count($szSMTPSiteLink)" GUID="2e8893cf-5583-4919-8ed6-3f79f37817d2"/>
            </Setting>

            <!-- // Enumerate the IP-based site links in the directory. This is important for Exchange 2007/2010 routing topologies -->
            <Object Type="Group" Name="IP">
              <Object Type="Directory" Key2="cn=IP,cn=Inter-Site Transports,cn=Sites,%CONFIGDN%" Key3="objectClass=siteLink">
                <Setting Key1="cn"/>
                <Setting Key1="cost"/>
                <Setting Key1="siteList"/>
                <Setting Key1="replInterval"/>
              </Object>
            </Object>

            <!-- // Enumerate the SMTP-based site links in the directory. Exchange 2007/2010 cannot use these, so we need to know if any exists -->
            <Object Type="Group" Name="SMTP">
              <Object Type="Directory" Key2="cn=SMTP,cn=Inter-Site Transports,cn=Sites,%CONFIGDN%" Key3="objectClass=siteLink">
                <Setting Key1="cn">
                  <Rule Name="szSMTPSiteLink" Query="$."/>
                </Setting>
                <Setting Key1="cost"/>
                <Setting Key1="siteList"/>
                <Setting Key1="replInterval"/>
              </Object>
            </Object>
          </Object>

          <!-- // Enumerate the list of subnets -->
          <Object Type="Group" Name="Active Directory Subnets">
            <Object Type="Directory" Key2="cn=Subnets,cn=Sites,%CONFIGDN%" Key3="objectClass=subnet">
              <Setting Key1="cn"/>
              <Setting Key1="description"/>
              <Setting Key1="location"/>
              <Setting Key1="siteObject"/>
            </Object>
          </Object>
        </Object>

        <!-- // Time to drill into the Exchange organization and its servers -->
        <Object Type="Directory" Key2="cn=Microsoft Exchange,cn=Services,%CONFIGDN%" SecurityContext="EXLOGON" Display="Hide">
          <Setting Key1="distinguishedName" Substitution="DN"/>
          <Object Type="Directory" Key2="%DN%" Key3="objectClass=msExchOrganizationContainer" Key4="OneLevel" Scope="Organization" Class="Organization" GroupingClass="True" LogText="Processing Exchange Organization...">
            <Setting Key1="distinguishedName" Substitution="DN"/>
            <Setting Key1="cn"/>
            <Setting Key1="msExchMixedMode">
              <Rule Name="fOrgModeMixed" Query="$.='True'" Error="Error" Sev="1" Title="Exchange organization is in mixed mode" Text="The Exchange organization is in mixed mode. Exchange Server 2010 can only be installed once the organization is in native mode." GUID="bda8a6b9-cf3f-4742-a933-759710275595"/>
            </Setting>
            <Setting Key1="objectVersion">
              <Rule Name="fOrgPrepared2010" Query="$.=12640" Error="None" Title="Organization is prepared for Exchange Server 2010" Text="The Exchange organization is already prepared for Exchange Server 2010."/>
            </Setting>

            <!-- // Enumerate all Recipient Policies -->
            <Object Type="Group" Name="Recipient Policies">
              <Object Type="Directory" Key2="cn=Recipient Policies,%DN%" Key3="(objectClass=msExchRecipientPolicy)" Key4="OneLevel">
                <Setting Key1="cn" Substitution="RECIPPOLICYNAME"/>
                <Setting Key1="gatewayProxy" Substitution="PROXY" SubstitutionFormat="$----!"/>
                <Setting Key1="msExchNonAuthoritativeDomains" Format="LowerCase" Substitution="NONAUTHDOMAINS" SubstitutionFormat="(^smtp:.*\@(?'domain'.*))?.*$----${domain};"/>
                <Setting Key1="disabledGatewayProxy" Format="LowerCase" Substitution="DISABLEDSMTPDOMAIN" SubstitutionFormat="(^smtp:.*\@(?'domain'.*))?.*$----${domain};"/>
                <Setting Key1="gatewayProxy" Format="LowerCase" Substitution="ENABLEDSMTPDOMAIN" SubstitutionFormat="(^smtp:.*\@(?'domain'.*))?.*$----${domain};"/>

                <!-- // The cache allows us to take the multi-values gatewayProxy attribute and test each value independently -->
                <!-- // An exclamation mark (bang) is used to separate each value in the cache -->
                <Object Type="Cache" Name="Proxy Addresses" Key1="Add" Key2="%RECIPPOLICYNAME%" Key3="%PROXY%" Key4="!" Display="Hide">
                  <Setting Key1="Proxy" Substitution="PROXY">
                    <Rule Name="fNonStandardProxy" Query="not(matches($.,'^(?i:(x400|smtp|ccmail|ms|notes|gwise))\:.*'))" Error="Warning" Sev="2" Title="Non-standard address space found" Text="A non-standard address space of '{1}' was found on recipient policy '{3}'. Contact your vendor to obtain a proxy address generator DLL that is compatible with Exchange Server 2010." S1="%PROXY%" S3="%RECIPPOLICYNAME%" GUID="ef8619b0-6234-470c-be8d-12bd4e8061c2"/>
                    <Rule Name="fSMTPAddressLiteral" Query="matches($., '^(?i:smtp)\:\@\[\d+\.\d+\.\d+\.\d+\]$')" Error="Error" Title="Unsupported SMTP address format" Text="Recipient policy '{3}' uses an unsupported SMTP addressing format ({1}). This must be changed before Exchange 2010 can be deployed." P1="$." S3="%RECIPPOLICYNAME%" GUID="df0bb92d-92f3-42e7-bc62-a82e40358776"/>
                  </Setting>
                  <Object Type="Cache" Name="Proxy Addresses" Key1="Delete" Key2="%RECIPPOLICYNAME%" Display="Hide"/>
                </Object>

                <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Add" Key2="AuthSmtpDomains" Key3="%DISABLEDSMTPDOMAIN%" Key4=";" Task="PrecheckInstall" Role="Global" Display="Hide"/>
                <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Add" Key2="AuthSmtpDomains" Key3="%ENABLEDSMTPDOMAIN%" Key4=";" Task="PrecheckInstall" Role="Global" Display="Hide"/>
                <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Add" Key2="AllNonAuthSmtpDomains" Key3="%NONAUTHDOMAINS%" Key4=";" Task="PrecheckInstall" Role="Global" Display="Hide"/>
                <Object Type="Cache" Name="Non-Authoritative SMTP Domain Name Cache" Key1="Show" Key3="%NONAUTHDOMAINS%" Key4=";" Task="PrecheckInstall" Role="Global" Display="Hide">
                  <Setting Key1="SmtpDomain" Substitution="SMTPDOMAIN"/>
                  <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Delete" Key2="AuthSmtpDomains" Key3="%SMTPDOMAIN%" Task="PrecheckInstall" Role="Global" Display="Hide"/>
                </Object>
                <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Dump" Key2="AuthSmtpDomains" Task="PrecheckInstall" Role="Global" Display="Hide">
                  <Setting Key1="SmtpDomain" Substitution="SMTPDOMAIN"/>
                  <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Add" Key2="AllAuthSmtpDomains" Key3="%SMTPDOMAIN%" Task="PrecheckInstall" Role="Global" Display="Hide"/>
                </Object>
                <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Delete" Key2="AuthSmtpDomains" Task="PrecheckInstall" Role="Global" Display="Hide"/>
                <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Dump" Key2="AllNonAuthSmtpDomains" Task="PrecheckInstall" Role="Global" Display="Hide">
                  <Setting Key1="SmtpDomain" Substitution="SMTPDOMAIN"/>
                  <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Delete" Key2="AllAuthSmtpDomains" Key3="%SMTPDOMAIN%" Task="PrecheckInstall" Role="Global" Display="Hide">
                    <Setting Key1="SmtpDomain">
                      <Rule Name="fInconsistentlyConfiguredDomain" Query="true()" Error="Error" Sev="2" Title="Ambiguously defined namespace configured in Recipient Policies" Text="The domain '{3}' is configured authoritative or non-authoritative inconsistently among multiple recipient policies." S3="%SMTPDOMAIN%" Task="PrecheckInstall" Role="Global" GUID="a3b3a99c-cf10-405f-b4d8-e2cdf674f049"/>
                    </Setting>
                  </Object>
                </Object>
                <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Delete" Key2="AllAuthSmtpDomains" Task="PrecheckInstall" Role="Global" Display="Hide"/>
                <Object Type="Cache" Name="SMTP Domain Name Cache" Key1="Delete" Key2="AllNonAuthSmtpDomains" Task="PrecheckInstall" Role="Global" Display="Hide"/>

              </Object>
            </Object>

            <!-- // Enumerate each Admin Group in the organization -->
            <Object Type="Group" Name="Admin Groups">
              <Object Type="Directory" Key2="cn=Administrative Groups,%DN%" Key3="(objectCategory=msExchAdminGroup)" Key4="OneLevel" Scope="AdminGroup" GroupingClass="True" Class="Admin Group" Async="%35">
                <Setting Key1="distinguishedName" Substitution="DN"/>
                <Setting Key1="cn" Substitution="AGNAME">
                  <Rule Name="szAdminGroup" Query="$." Error="None" Text="Found admininistrative group '{1}' in the directory." P1="$."/>
                </Setting>

                <!-- // Find out if there are any AppTLHs in existence -->
                <Object Type="Directory" Key2="cn=Folder Hierarchies,%DN%" Key3="objectClass=msExchPFTree" Key4="OneLevel">
                  <Setting Key1="distinguishedName" Substitution="DN"/>
                  <Setting Key1="cn" Substitution="PFTREENAME"/>
                  <Setting Key1="msExchPFTreeType">
                    <Rule Name="fAppTLH" Query="$.=0" Error="Warning" Sev="2" Title="Application public folder hierarchy present" Text="Application public folder hierarchy '{1}' was found in the organization. Exchange Server 2010 public folder services do not support application hierarchies. This hierarchy will need to remain on Exchange 2003 servers." S1="%PFTREENAME%" GUID="eefdceda-b820-4005-9a98-3e222e4f392e"/>
                  </Setting>
                  <Setting Key1="ntSecurityDescriptor" Format="SecurityDescriptor" NotForExport="True">
                    <Rule Name="fInhBlockPublicFolderTree" Query="boolean(bitwise-and(sdget('Control', $.),4096))" Error="Error" Title="Access Control List Inheritance is disabled on the Public Folder Tree" Text="Access control list (ACL) inheritance is blocked for the {1} object ({3}). Re-enable the inheritance and restart setup." S1="Public Folder tree" S3="%DN%" GUID="7bfa2aec-d01b-4b5f-9229-ba2cde424b43"/>
                  </Setting>
                </Object>

                <!-- // Enumerate each Routing Group in the current Admin Group -->
                <Object Type="Group" Name="Routing Groups">
                  <Object Type="Directory" Key2="cn=Routing Groups,%DN%" Key3="" Key4="OneLevel" Class="Routing Group" GroupingClass="True">
                    <Setting Key1="cn" Substitution="RGNAME">
                      <Rule Name="szRoutingGroup" Query="$." Error="None" Text="Found routing group '{1}' in the directory." P1="$."/>
                      <Rule Name="szADSiteMember" Query="$szADSiteMembership[1]"/>
                      <Rule Name="fRoutingGroupSpansSite" Query="count($fRGSiteMismatch)&gt;0 and count($fADSiteMembershipNull)=0" Error="Warning" Sev="3" Title="Routing and site alignment: {1}" Text="Routing group '{1}' contains Exchange servers that belong to different Active Directory sites. In Exchange Server 2010, all routing is based on Active Directory site boundaries." S1="%RGNAME%" AlwaysEvaluate="True"/>
                    </Setting>
                    <Setting Key1="distinguishedName" Substitution="DN"/>
                    <Setting Key1="msExchRoutingGroupMembersBL" Substitution="RGMEMBERS" SubstitutionFormat="$----;"/>

                    <!-- // Find out if any servers in the routing group span multiple Active Directory sites -->
                    <!-- // First of all, take the multi-valued msExchRoutingGroupMembersBL attribute and add each value to a cache -->
                    <Object Type="Cache" Name="Membership Cache" Key1="Add" Key2="%AGNAME%-%RGNAME%" Key3="%RGMEMBERS%" Key4=";" Display="Hide">
                      <Setting Key1="Member" Substitution="SERVERDN" Display="Hide"/>

                      <!-- // Bind directly to the Exchange server object in the configuration naming context -->
                      <Object Type="Directory" Key2="%SERVERDN%" Display="Hide">
                        <Setting Key1="cn" Substitution="EXSRVNAME" Display="Hide"/>

                        <!-- // Retrieve the FQDN for the Exchange server -->
                        <Setting Key1="networkAddress" Substitution="SRVNAME" SubstitutionFormat="(^ncacn_ip_tcp:(?'tcpip'.*))?.*$----${tcpip}" Display="Hide"/>

                        <!-- // Resolve the NetBIOS and FQDN of the Exchange server, hopefully returning a valid FQDN -->
                        <Object Type="Resolve" Name="Server Name" Key1="%SRVNAME%,%EXSRVNAME%">
                          <Setting Key1="Dns" Substitution="SRVNAME" Format="^$----%EXSRVNAME%"/>

                          <!-- // Now find out which Active Directory site the server belongs to -->
                          <Object Type="DsGet" Key1="SiteName" Key2="%SRVNAME%">
                            <Setting Key1="SiteName" Substitution="SITE">
                              <Rule Name="szADSiteMembership" Query="$."/>
                              <Rule Name="fADSiteMembershipNull" Query="$.=''"/>
                              <Rule Name="fRGSiteMismatch" Query="$.!=$szADSiteMember"/>
                            </Setting>
                          </Object>
                        </Object>
                      </Object>
                    </Object>

                    <!-- // Collect data about all the Routing Group Connectors in existence in this Routing Group -->
                    <Object Type="Directory" Key2="%DN%" Key3="objectClass=msExchRoutingGroupConnector" Key4="Subtree">
                      <Setting Key1="cn" Substitution="RGCNAME"/>
                      <Setting Key1="activationStyle">
                        <Rule Name="fRGCScheduled" Query="$.!=2" Error="Warning" Sev="3" Title="Routing group connector is scheduled" Text="Routing group connector '{3}' in routing group '{1}' uses a custom activation schedule. This restriction is not supported or honored with Exchange Server 2010." S1="%RGNAME%" S3="%RGCNAME%"/>
                      </Setting>
                      <Setting Key1="authOrig">
                        <Rule Name="fRGCAuthOrig" Query="$." Error="Warning" Sev="3" Title="Routing group connector has custom permissions" Text="Routing group connector '{3}' in routing group '{1}' uses a message submission acceptance list. This restriction is not supported or honored with Exchange Server 2010." S1="%RGNAME%" S3="%RGCNAME%"/>
                      </Setting>
                      <Setting Key1="delivContLength">
                        <Rule Name="fRGCDelivContLength" Query="$. &gt;1" Error="Warning" Sev="3" Title="Routing group connector has a maximum message size" Text="Routing group connector '{3}' in routing group '{1}' uses a maximum message size restriction. This restriction is not supported or honored with Exchange Server 2010." S1="%RGNAME%" S3="%RGCNAME%"/>
                      </Setting>
                      <Setting Key1="heuristics">
                        <Rule Name="fRGCHeuristics" Query="$. &gt;0" Error="Warning" Sev="3" Title="Routing group connector has a message type restiction" Text="Routing group connector '{3}' in routing group '{1}' uses a message type restiction (e.g. system/non-system messages). This restriction is not supported or honored with Exchange Server 2010." S1="%RGNAME%" S3="%RGCNAME%"/>
                      </Setting>
                      <Setting Key1="msExchRoutingDisallowPriority">
                        <Rule Name="fRGCDisallowPriority" Query="$. &gt;0" Error="Warning" Sev="3" Title="Routing group connector has a priority restriction" Text="Routing group connector '{3}' in routing group '{1}' restricts messages based on priority. This restriction is not supported or honored with Exchange Server 2010." S1="%RGNAME%" S3="%RGCNAME%"/>
                      </Setting>
                      <Setting Key1="unauthOrig">
                        <Rule Name="fRGCUnauthOrig" Query="$." Error="Warning" Sev="3" Title="Routing group connector has custom permissions" Text="Routing group connector '{3}' in routing group '{1}' uses a message submission rejection list. This restriction is not supported or honored with Exchange Server 2010." S1="%RGNAME%" S3="%RGCNAME%"/>
                      </Setting>
                    </Object>

                    <!-- // Collect data about all the SMTP Connectors in existence in this Routing Group -->
                    <Object Type="Directory" Key2="%DN%" Key3="objectClass=msExchRoutingSMTPConnector" Key4="Subtree">
                      <Setting Key1="cn" Substitution="SMTPNAME"/>
                      <Setting Key1="connectionDomains">
                        <Rule Name="fSMTPConnectedDomains" Query="count($.) &gt;0"/>
                      </Setting>
                      <Setting Key1="routingList">
                        <Rule Name="fSMTPNonSMTPAddressSpace" Query="$fSMTPConnectedDomains and not($.[contains(., 'SMTP:')])" Error="Warning" Sev="2" Title="SMTP connector incompatibility" Text="SMTP connector '{3}' in routing group '{1}' has connected routing groups configured with a non-SMTP address space. This configuration is not supported or honored by Exchange Server 2010." S1="%RGNAME%" S3="%SMTPNAME%"/>
                        <Rule Name="fSMTPDomainWildcardFound" Query="$.[matches(., '(?i:smtp:\*(\w|\.\*))')]" Error="Warning" Sev="2" Title="SMTP domain wildcard found" Text="SMTP connector '{3}' in routing group '{1}' uses a domain wildcard convention ({7}). This notation is not supported in Exchange Server 2010 and needs to be removed from this connector. Wildcards such as '*.contoso.com' are acceptable." S1="%RGNAME%" S3="%SMTPNAME%" P7="$."/>
                      </Setting>
                    </Object>

                    <!-- // Collect data about all the X400 Connectors in existence in this Routing Group -->
                    <Object Type="Directory" Key2="%DN%" Key3="objectClass=x400Link" Key4="Subtree">
                      <Setting Key1="cn">
                        <Rule Name="szX400Connector" Query="$." Error="Warning" Sev="1" Title="X.400 connector found in topology" Text="X.400 connector '{3}' was found in the organization. Exchange Server 2010 does not support X.400 connectors. This connector will need to remain on existing Exchange 2003 servers." P3="$." GUID="eefdceda-b820-4005-9a98-3e222e4f392e"/>
                      </Setting>
                    </Object>

                    <!-- // Collect data about all the non-specified EDK Connectors in existence in this Routing Group -->
                    <Object Type="Directory" Key2="%DN%" Key3="(&amp;(!(objectClass=x400Link))(!(objectClass=msExchRoutingSmtpConnector))(!(objectClass=msExchNotesConnector))(!(objectClass=msExchDeliveryAgentConnector))(objectClass=mailGateway))">
                      <Setting Key1="cn">
                        <Rule Name="szEDKConnector" Query="$." Error="Warning" Sev="1" Title="Exchange Development Kit (EDK) connector found in topology" Text="Exchange Development Kit (EDK) connector '{3}' was found in the organization. Exchange Server 2010 does not support EDK connectors. This connector will need to remain on existing Exchange 2003 servers." P3="$." GUID="eefdceda-b820-4005-9a98-3e222e4f392e"/>
                      </Setting>
                    </Object>

                  </Object>
                </Object>

                <!-- // Enumerate each Exchange Server in the current Admin Group -->
                <Object Type="Group" Name="Exchange Servers">
                  <Object Type="Directory" Key2="%DN%" Key3="(objectCategory=msExchExchangeServer)" Scope="Server" Class="Server" GroupingClass="True" Async="%65" TrackProgress="TrackProgress" MaxTime="ALL,15" MaxFailures="WMI,1" MaxTimeouts="ALL,1">
                    <Setting Key1="distinguishedName" Substitution="DN"/>
                    <Setting Key1="cn" Substitution="EXSRVNAME">
                      <Rule Name="szFoundExchangeServer" Query="$." Error="None" Text="Found Exchange server {1} in the directory." P1="$."/>
                      <Rule Name="iStatTotalMailboxes" Query="sum($iMailboxes)" Error="None" Text="There are {9} mailboxes on this server." P9="sum($iMailboxes)" AlwaysEvaluate="True"/>
                    </Setting>

                    <!-- // Find out which version of Exchange is running -->
                    <Setting Key1="networkAddress" Substitution="SRVNAME" SubstitutionFormat="(^ncacn_ip_tcp:(?'tcpip'.*))?.*$----${tcpip}"/>
                    <Setting Key1="serialNumber" Substitution="EXVERSION">
                      <Rule Name="fExchange55" Query="contains ($., 'Version 5.5')" Error="Error" Sev="1" Title="Exchange Server 5.5 detected" Text="Server {2} is running Exchange Server 5.5. This server must be decommissioned before Exchange Server 2010 can be installed into the organization." S2="%SRVNAME%" GUID="bda8a6b9-cf3f-4742-a933-759710275595"/>
                      <Rule Name="fExchange2000" Query="contains ($., 'Version 6.0')" Error="Error" Sev="1" Title="Exchange 2000 server detected" Text="Server {2} is running Exchange 2000. This server must be decommissioned or upgraded to Exchange Server 2003 before Exchange Server 2010 can be installed into the organization." S2="%SRVNAME%" GUID="8723d75f-011a-4a50-9801-0c750af16c34"/>
                      <Rule Name="fExchange2003" Query="contains ($., 'Version 6.5')"/>
                      <Rule Name="fExchangePtTi" Query="contains ($., 'Version 6')"/>
                      <Rule Name="fExchange2007" Query="contains ($., 'Version 8')"/>
                      <Rule Name="fExchange2007notSP2" Query="$fExchange2007 and version-compare(replace($., '^Version (\d+\.\d+).*$', '$1'), '8.1') &lt;=0" Error="Error" Sev="1" Title="Exchange Server 2007 SP2 required" Text="Server {2} is not running Exchange 2007 with Service Pack 2 or later. This server must be upgraded to SP2 before Exchange Server 2010 can be installed into the organization." S2="%SRVNAME%" GUID="bda8a6b9-cf3f-4742-a933-759710275595"/>
                      <Rule Name="fExchange2010" Query="contains ($., 'Version 14')"/>
                    </Setting>
                    <Setting Key1="versionNumber">
                      <Rule Name="fExConnectReg" Query="not($szExWinVer)" Error="Warning" Sev="1" Title="Exchange server registry cannot be accessed" Text="Cannot connect to the registry on server {2}. This could be the result of a network or permissions problem." S2="%SRVNAME%" AlwaysEvaluate="True" GUID="fa727882-9fdd-4664-9d49-f0ef95193b49"/>
                      <Rule Name="fExchange2003PreSP2" Query="$fExchange2003 and $. &lt;7638" Error="Error" Sev="2" Title="Exchange Server 2003 version" Text="Server {2} is running Exchange Server 2003, but has not been upgraded to Service Pack 2 or later. Exchange Server 2010 installation will be blocked until this server is upgraded." S2="%SRVNAME%" GUID="976e716a-b14a-4e67-a913-7b2fe0e9045c"/>
                    </Setting>

                    <!-- Find out which Exchange roles are installed -->
                    <Setting Key1="msExchCurrentServerRoles">
                      <Rule Name="fMailboxRoleInstalled" Query="boolean(bitwise-and($.,2))"/>
                      <Rule Name="fClientAccessRoleInstalled" Query="boolean(bitwise-and($.,4))"/>
                      <Rule Name="fPublicFolderRoleInstalled" Query="boolean(bitwise-and($.,8))"/>
                      <Rule Name="fUnifiedMessagingRoleInstalled" Query="boolean(bitwise-and($.,16))"/>
                      <Rule Name="fBridgeheadRoleInstalled" Query="boolean(bitwise-and($.,32))"/>
                      <Rule Name="fGatewayRoleInstalled" Query="boolean(bitwise-and($.,64))"/>
                      <Rule Name="fServerIsProvisioned" Query="boolean(bitwise-and($.,4096))"/>
                    </Setting>

                    <!-- // Resolve the name of the Exchange server -->
                    <Object Type="Resolve" Name="Server Name" Key1="%SRVNAME%,%EXSRVNAME%">
                      <Setting Key1="Dns" Substitution="SRVNAME" Format="^$----%EXSRVNAME%"/>

                      <!-- // Connect to the Exchange server and discover the operating system version -->
                      <Object Type="Registry" Key1="%SRVNAME%" Key3="Software\Microsoft\Windows NT\CurrentVersion" LogText="Processing === Exchange Server: %SRVNAME% ===" TrackProgress="TrackFailHard">
                        <Setting Key1="CurrentVersion" Retrieve="FailHard">
                          <Rule Name="szExWinVer" Query="$."/>
                          <Rule Name="fExWinVer2000" Query="$.='5.0'" Error="None" Text="Exchange server {2} is running Windows 2000 Server." S2="%SRVNAME%"/>
                          <Rule Name="fExWinVer2003" Query="$.='5.2'" Error="None" Text="Exchange server {2} is running Windows Server 2003." S2="%SRVNAME%"/>
                          <Rule Name="fExWinVer2008" Query="$.='6.0'" Error="None" Text="Exchange server {2} is running Windows Server 2008." S2="%SRVNAME%"/>
                          <Rule Name="fExWinVer2008R2" Query="$.='6.1'" Error="None" Text="Exchange server {2} is running Windows Server 2008 R2." S2="%SRVNAME%"/>
                        </Setting>

                        <!-- // Retrieve Active Directory membership information for this Exchange server -->
                        <Object Type="Group" Name="Active Directory Membership">

                          <!-- // First of all, retrieve the Active Directory domain membership and add the value to the cache for later processing -->
                          <Object Type="Registry" Key1="%SRVNAME%" Key3="Software\Microsoft\MSMQ\Parameters\setup">
                            <Setting Key1="MachineDomain" Substitution="NBDOMAIN">
                              <Rule Name="szResidentNetBIOSDomainName" Query="$." Error="None" Title="Active Directory domain membership: {3}" Text="Exchange server {2} belongs to Active Directory domain '{3}'." S2="%SRVNAME%" P3="$."/>
                            </Setting>
                            <Object Type="Cache" Name="Membership Cache" Key1="Add" Key2="Domains" Key3="%NBDOMAIN%" Display="Hide"/>
                          </Object>
                          <Object Type="Registry" Key1="%SRVNAME%" Key3="System\CurrentControlSet\Services\Tcpip\Parameters">

                            <!-- // Second of all, retrieve the DNS domain membership and add the value to the cache for later processing -->
                            <Setting Key1="Domain" Substitution="DNSDOMAIN">
                              <Rule Name="szResidentDNSName" Query="$." Error="None" Title="DNS domain membership: {3}" Text="Exchange server {2} belongs to DNS domain '{3}'." S2="%SRVNAME%" P3="$."/>
                            </Setting>
                            <Object Type="Cache" Name="Membership Cache" Key1="Add" Key2="DnsDomains" Key3="%DNSDOMAIN%" Display="Hide"/>

                            <!-- // Third of all, retrieve the site name -->
                            <Object Type="DsGet" Key1="SiteName" Key2="%SRVNAME%">
                              <Setting Key1="SiteName" Substitution="SITE">
                                <Rule Name="szResidentSiteName" Query="$.!=''" Error="None" Title="Active Directory site membership: {3}" Text="Exchange server {2} belongs to Active Directory site '{3}'." S2="%SRVNAME%" P3="$."/>
                              </Setting>

                              <!-- // Some servers such as clusters and NT4 computers aren't going to report their site name, so we need to exclude these blank entries from the cache -->
                              <Object Type="If" Key1="'%SITE%'!=''">
                                <!-- // Add the site name to the cache -->
                                <Object Type="Cache" Name="Membership Cache" Key1="Add" Key2="Sites" Key3="%SITE%" Display="Hide"/>
                                <!-- // Add the NetBIOS name of the server to a cache associated with the site -->
                                <Object Type="Cache" Name="Membership Cache" Key1="Add" Key2="ADSite-%SITE%" Key3="%EXSRVNAME%" Display="Hide"/>
                              </Object>
                            </Object>
                          </Object>
                        </Object>

                        <!-- // Enumerate the list of storage groups and databases -->
                        <Object Type="Group" Name="Storage Groups and Databases">
                          <Object Type="Directory" Key2="cn=InformationStore,%DN%" Key3="(objectClass=msExchStorageGroup)">
                            <Setting Key1="distinguishedName" Substitution="DN"/>
                            <Setting Key1="cn"/>
                            <Object Type="Directory" Key2="%DN%" Key3="(objectClass=msExchPrivateMDB)">
                              <Setting Key1="cn"/>
                              <Setting Key1="homeMDBBL" Retrieve="CountOnly">
                                <Rule Name="iMailboxes" Query="$."/>
                              </Setting>
                            </Object>
                          </Object>
                        </Object>

                        <!-- // Enumerate the list of SMTP virtual servers -->
                        <Object Type="Group" Name="SMTP">
                          <Object Type="Directory" Key2="CN=SMTP,CN=Protocols,%DN%" Key3="(objectClass=protocolCfgSMTPServer)">
                            <Setting Key1="cn" Substitution="SMTPSERVERNAME"/>
                            <Setting Key1="msExchServerBindings">
                              <Rule Name="fDefaultSMTPPortNot25" Query="'%SMTPSERVERNAME%'=1 and not($.[contains(., ':25:')])" Error="Warning" Sev="1" Title="Default SMTP server is not bound to port 25" Text="The listening port for SMTP server '{3}' on server {2} has been changed from the default of 25. Exchange Server 2010 can only use port 25 for routing messages between servers. Current value: {9}." S2="%SRVNAME%" S3="%SMTPSERVERNAME%" P9="$."/>
                              <Rule Name="fAdditionalSMTPPortNot25" Query="'%SMTPSERVERNAME%'!=1 and not($.[contains(., ':25:')])" Error="Warning" Sev="3" Title="Additional SMTP server is not bound to port 25" Text="The listening port for SMTP server '{3}' on server {2} has been changed from the default of 25. Exchange Server 2010 can only use port 25 for routing messages between servers. Current value: {9}." S2="%SRVNAME%" S3="%SMTPSERVERNAME%" P9="$."/>
                            </Setting>
                            <Setting Key1="msExchSMTPOutgoingPort">
                              <Rule Name="fOutgoingSMTPPortNot25" Query="'%SMTPSERVERNAME%'=1 and $.!=25" Error="Warning" Sev="1" Title="Default SMTP server does not use port 25" Text="The outgoing port for SMTP server '{3}' on server {2} has been changed from the default of 25. Exchange Server 2010 can only use port 25 for routing messages between servers. Current value: {9}." S2="%SRVNAME%" S3="%SMTPSERVERNAME%" P9="$."/>
                              <Rule Name="fAdditionalOutgoingSMTPPortNot25" Query="'%SMTPSERVERNAME%'!=1 and $.!=25" Error="Warning" Sev="3" Title="Additional SMTP server does not use port 25" Text="The outgoing port for SMTP server '{3}' on server {2} has been changed from the default of 25. Exchange Server 2010 can only use port 25 for routing messages between servers. Current value: {9}." S2="%SRVNAME%" S3="%SMTPSERVERNAME%" P9="$."/>
                            </Setting>
                            <Setting Key1="distinguishedName">
                              <Rule Name="szSMTPInstanceDN" Query="$."/>
                            </Setting>
                            <Setting Key1="msExchSmtpSmartHost">
                              <Rule Name="fSMTPInstanceSmartHostSet" Query="$.!=''" Error="Warning" Title="SMTP is configured to route all messages to a smart host" Text="SMTP instance '{3}' is configured to route all messages via smart host '{1}'. Remove this option if this SMTP instance wil be set as the source or target transport server of a routing group connector between Exchange Server 2010 and an Exchange Server 2003 routing group." P1="$." P3="$szSMTPInstanceDN"/>
                            </Setting>
                          </Object>
                        </Object>

                        <!-- // Enumerate routing configuration parameters -->
                        <Object Type="Group" Name="Routing">
                          <Object Type="Registry" Key1="%SRVNAME%" Key3="System\CurrentControlSet\Services\RESvc\Parameters">
                            <Setting Key1="__KEYPATH">

                              <!-- // Although SuppressStateChanges is only necessary on legacy bridgehead servers, we will recommend that this be set on all legacy servers in the org -->
                              <Rule Name="fSuppressStateChangesNotSet" Query="$fExchangePtTi and (count($iSuppressStateChanges)=0 or $iSuppressStateChanges='0')" Error="Warning" Sev="3" Title="Link state suppression is not enabled" Text="Before introducing Exchange Server 2010 into this topology, the '{4}' configuration parameter should be set to '1' on server {2}. This parameter is essential if you plan to create multiple connectors to the dedicated Exchange 2010 routing group." S2="%SRVNAME%" S4="SuppressStateChanges" AlwaysEvaluate="True"/>
                            </Setting>
                            <Setting Key1="SuppressStateChanges">
                              <Rule Name="iSuppressStateChanges" Query="$."/>
                            </Setting>
                          </Object>
                        </Object>

                        <!-- // Enumerate link state data -->
                        <Object Type="If" Key1="starts-with('%EXVERSION%', 'Version 6')" Name="LinkState" Display="Hide">
                          <Object Type="Group" Name="LinkState">
                            <Object Type="LinkState" Key1="%SRVNAME%">
                              <Setting Key1="NodeInfo" Format="RoutingInfo"/>
                              <Setting Key1="OrgInfo" Format="RoutingInfo"/>
                            </Object>
                          </Object>
                        </Object>

                        <!-- // Discover whether an NNTP newsfeed has been created and the service is running -->
                        <Object Type="Group" Name="NNTP">
                          <Object Type="WMI" Key1="%SRVNAME%" Key3="Win32_Service" Key4="Name='NntpSvc'">
                            <Setting Key1="Started">
                              <Rule Name="fNNTPNewsfeed" Query="$.='True' and $fNNTPFeedExists" Error="Warning" Sev="2" Title="NNTP newsfeed found" Text="The Network News Transfer Protocol (NNTP) service is configured and running on server {2}. Exchange Server 2010 does not support NNTP. This service will need to remain on Exchange 2003." S2="%SRVNAME%" GUID="eefdceda-b820-4005-9a98-3e222e4f392e"/>
                            </Setting>
                            <Object Type="Metabase" Key1="%SRVNAME%" Key2="LM/NNTPSVC/1/Feeds" Key3=".*" Key4="OneLevel">
                              <Setting Key1="45456" Key2="FeedName">
                                <Rule Name="fNNTPFeedExists" Query="$."/>
                              </Setting>
                            </Object>
                          </Object>
                        </Object>

                        <!-- // Discover whether the legacy Exchange event scripting service is running -->
                        <Object Type="Group" Name="Scripting Service">
                          <Object Type="WMI" Key1="%SRVNAME%" Key3="Win32_Service" Key4="Name='MSExchangeES'">
                            <Setting Key1="Started">
                              <Rule Name="fEventService" Query="$.='True' and $fExchangePtTi" Error="Warning" Sev="2" Title="Exchange Event service is running" Text="The Microsoft Exchange Event service is running on server {2}. Exchange Server 2010 does not support this facility. This service will need to remain on Exchange 2003." S2="%SRVNAME%" GUID="eefdceda-b820-4005-9a98-3e222e4f392e"/>
                            </Setting>
                          </Object>
                        </Object>

                        <!-- // Discover whether the IFS drive is enabled -->
                        <Object Type="Group" Name="IFS">
                          <Object Type="Registry" Key1="%SRVNAME%" Key3="System\CurrentControlSet\Services\EXIFS\Parameters">
                            <Setting Key1="DriveLetter">
                              <Rule Name="fIFSDriveEnabled" Query="count($.) &gt;0 and $.!=''" Error="Warning" Sev="3" Title="Exchange IFS drive is enabled" Text="The Exchange Installable File System (IFS) drive on server {2} is enabled. Exchange Server 2010 does not support Exchange IFS drives. Any applications using the Exchange IFS drive will need to remain on Exchange 2003 servers." S2="%SRVNAME%" GUID="eefdceda-b820-4005-9a98-3e222e4f392e"/>
                            </Setting>
                          </Object>
                        </Object>

                        <!-- // Find out if this is an Active/Active cluster -->
                        <Object Type="Group" Name="Clustering">
                          <Object Type="WMI" Key1="%SRVNAME%" Key3="Win32_Service" Key4="Name='ClusSvc'">
                            <Setting Key1="Started">
                              <Rule Name="fActiveActiveCluster" Query="sum($iStatClusterNode)=2 and count($fClusterStoreInstance)=2" Error="None" Title="Active/active cluster" Text="Server {2} is a 2-node active/active cluster." S2="%SRVNAME%"/>
                            </Setting>
                            <Object Type="Registry" Key1="%SRVNAME%" Key3="Cluster\Nodes" Key4=".*">
                              <Setting Key1="NodeName">
                                <Rule Name="iStatClusterNode" Query="count($.)"/>
                              </Setting>
                            </Object>
                            <Object Type="Registry" Key1="%SRVNAME%" Key3="Cluster\Resources" Key4=".*" Key5="Onelevel">
                              <Setting Key1="Type">
                                <Rule Name="fClusterStoreInstance" Query="$.='Microsoft Exchange Information Store'"/>
                              </Setting>
                            </Object>
                          </Object>
                        </Object>

                      </Object>
                    </Object>
                  </Object>
                </Object>
              </Object>
            </Object>
          </Object>
        </Object>

        <!-- // There have been several cases where an existing permissions inheritance block has caused Exchange 2007 installation issues -->
        <!-- // We'll perform a check on the Exchange objects in the configNC -->
        <Object Type="Group" Name="Permission Check">
          <!-- // Call Config-Inheritance-Check type to perform inheritance blocking checks -->
          <Reference Type="Config-Inheritance-Check" Name="ConfigInheritanceCheck" File="ExBPA.Permissions.xml"/>
          <Reference Type="Site-Inheritance-Check" Name="SiteInheritanceCheck" File="ExBPA.Permissions.xml"/>
          <Reference Type="Domain-Inheritance-Check" Name="DomainInheritanceCheck" File="ExBPA.Permissions.xml"/>
        </Object>

        <!-- // Dump out the caches -->
        <Object Type="Group" Name="Caches">
          <!-- // List Active Directory domains that contain Exchange servers -->
          <Object Type="Cache" Name="Membership Cache" Key1="Dump" Key2="Domains" Display="Hide">
            <Setting Key1="Active Directory domains with Exchange">
              <Rule Name="szCacheExchangeDomain" Query="$."/>
            </Setting>
          </Object>

          <!-- // List DNS domains that contain Exchange servers -->
          <Object Type="Cache" Name="Membership Cache" Key1="Dump" Key2="DnsDomains" Display="Hide">
            <Setting Key1="DNS domains with Exchange">
              <Rule Name="szCacheExchangeDNSDomain" Query="$."/>
            </Setting>
          </Object>

          <!-- // List the Exchange servers by Active Directory site -->
          <Object Type="Cache" Name="Membership Cache" Key1="Dump" Key2="Sites" Display="Hide">
            <Setting Key1="Site with Exchange" Substitution="SITE">
              <Rule Name="szCacheExchangeSite" Query="$."/>
            </Setting>
            <Object Type="Group" Name="Exchange servers in Active Directory site '%SITE%'">
              <Setting Key1="Site routing map">
                <Rule Name="szFirstRGMember" Query="$szRoutingGroupMembership[1]"/>
                <Rule Name="fSiteSpansRoutingGroup" Query="count($fSiteRGMismatch)&gt;0" Error="Warning" Sev="3" Title="Site and routing alignment: {1}" Text="Active Directory site '{1}' contains Exchange servers from different routing groups. In Exchange Server 2010, all routing is based on Active Directory site boundaries." S1="%SITE%" AlwaysEvaluate="True"/>
              </Setting>
              <Object Type="Cache" Name="Membership Cache" Key1="Dump" Key2="ADSite-%SITE%" Display="Hide">
                <Setting Key1="Server" Substitution="EXSRVNAME"/>

                <!-- // Retrieve the routing group membership for each Exchange server so that we can correlate it back to the Active Directory site name -->
                <Object Type="WMI" Key1="%EXSRVNAME%" Key2="root\MicrosoftExchangeV2" Key3="Exchange_Server" Key4="Name='%EXSRVNAME%'" Display="Hide">
                  <Setting Key1="RoutingGroup">
                    <Rule Name="szRoutingGroupMembership" Query="$."/>
                    <Rule Name="fSiteRGMismatch" Query="$.!=$szFirstRGMember"/>
                  </Setting>
                </Object>
              </Object>
            </Object>
          </Object>
        </Object>
      </Object>

    </Object>

  </Type>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI=""><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>YLIAWTOntFOuTA5wSLNxj++dixs=</DigestValue></Reference></SignedInfo><SignatureValue>
    dmQSwuP6ZKqsdGy0gi/ZODG02nq9MAuvx7cWQdFYYhMmtQWy5NhunwIx11/Lt+NiActS7Sb6
    hCWk/i2cvjpc5vN6E1sWSNkW4awHtbV/pkuz++fSGdCfpFgw9zrYwDblbctdwxBBPA5+37ye
    ivw+MqhP/4MsbCowlwkwgYNFMuzdjkOu4I8t73wWALX7wDHxC5D0cJezA52TftvHrlYPUVnh
    c70vXwi8DFUOVwmTaar40KIzR1Ni1uKMwKhKsXoi4ft4baUdvQE6Z479KZn/nRkdmHJi3VxS
    pqXFS88QZLhTXhbmNKJOwdWg82Aa6RLkE49rJKy41Jf7GpLpquQ1Aw==
  </SignatureValue><KeyInfo>
      <KeyValue>
        <RSAKeyValue>
          <Modulus>
            vTCJ+0VyqFNrnolPACPAvtQdPbFZQDjzc5GCJuaWEgBT2RyCDjzOHbu990KNl9T8OBrkufnj
            7NNhA7+g09Z1TVxGqe1e8NLiaVsac+qzHI0EzSlEoGRZLx6YXW7Hqxg5gmXEp7yrdYgZ6oeX
            FCazfyZ2pNQ4OYTjsybVGPkr6dLJFlpUIfKXjYeGKf70SSzmi/gEP33NzZaShg1xA+LQ/gxC
            Nf/XuD/djkUKffbXS61b8HZyHXcjfYk1xBxdslADS0dtB6dViJgGgKaBrVRO2IHW+r9CwDG+
            VQ2Z1VNJEjDr5aWIfF7EeloUhwi0N2mg6zIkjAjr+dQUuuD8zeqkFQ==
          </Modulus>
          <Exponent>AQAB</Exponent>
        </RSAKeyValue>
      </KeyValue>
      <X509Data>
        <X509Certificate>
          MIIEejCCA2KgAwIBAgIKYQHPPgAAAAAADzANBgkqhkiG9w0BAQUFADB5MQswCQYDVQQGEwJV
          UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWlj
          cm9zb2Z0IENvcnBvcmF0aW9uMSMwIQYDVQQDExpNaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBD
          QTAeFw0wOTEyMDcyMjQwMjlaFw0xMTAzMDcyMjQwMjlaMIGDMQswCQYDVQQGEwJVUzETMBEG
          A1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0
          IENvcnBvcmF0aW9uMQ0wCwYDVQQLEwRNT1BSMR4wHAYDVQQDExVNaWNyb3NvZnQgQ29ycG9y
          YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9MIn7RXKoU2ueiU8AI8C+
          1B09sVlAOPNzkYIm5pYSAFPZHIIOPM4du733Qo2X1Pw4GuS5+ePs02EDv6DT1nVNXEap7V7w
          0uJpWxpz6rMcjQTNKUSgZFkvHphdbserGDmCZcSnvKt1iBnqh5cUJrN/Jnak1Dg5hOOzJtUY
          +Svp0skWWlQh8peNh4Yp/vRJLOaL+AQ/fc3NlpKGDXED4tD+DEI1/9e4P92ORQp99tdLrVvw
          dnIddyN9iTXEHF2yUANLR20Hp1WImAaApoGtVE7Ygdb6v0LAMb5VDZnVU0kSMOvlpYh8XsR6
          WhSHCLQ3aaDrMiSMCOv51BS64PzN6qQVAgMBAAGjgfgwgfUwEwYDVR0lBAwwCgYIKwYBBQUH
          AwMwHQYDVR0OBBYEFDh4BXPIGzKbX5KGVa+JusaZsXSOMA4GA1UdDwEB/wQEAwIHgDAfBgNV
          HSMEGDAWgBTMHc52AHBbr/HaxE6aUUQuo0Rj8DBEBgNVHR8EPTA7MDmgN6A1hjNodHRwOi8v
          Y3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9DU1BDQS5jcmwwSAYIKwYBBQUH
          AQEEPDA6MDgGCCsGAQUFBzAChixodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRz
          L0NTUENBLmNydDANBgkqhkiG9w0BAQUFAAOCAQEAKAODqxMN8f4Rb0J22EOruMZC+iRlNK51
          sHEwjpa2g/py5P7NN+c6cJhRIA66cbTJ9NXkiugocHPV7eHCe+7xVjRagILrENdyA+oSTuzd
          DYx7RE8MYXX9bpwH3c4rWhgNObBg/dr/BKoCo9j6jqO7vcFqVDsxX+QsbsvxTSoc8h52e4av
          xofWsSrtrMwOwOSff+jP6IRyVIIYbirInpW0Gh7Bb5PbYqbBS2utye09kuOyL6t6dzlnagB7
          gp0DEN5jlUkmQt6VIsGHC9AUo1/cczJyNh7/yCnFJFJPZkjJHR2pxSY5aVBOp+zCBmwuchvx
          IdptJEiAgRVAfJ/MdDhKTw==
        </X509Certificate>
      </X509Data>
      <X509Data>
        <X509Certificate>
          MIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQEBBAUAMHAxKzApBgNV
          BAsTIkNvcHlyaWdodCAoYykgMTk5NyBNaWNyb3NvZnQgQ29ycC4xHjAcBgNVBAsTFU1pY3Jv
          c29mdCBDb3Jwb3JhdGlvbjEhMB8GA1UEAxMYTWljcm9zb2Z0IFJvb3QgQXV0aG9yaXR5MB4X
          DTk3MDExMDA3MDAwMFoXDTIwMTIzMTA3MDAwMFowcDErMCkGA1UECxMiQ29weXJpZ2h0IChj
          KSAxOTk3IE1pY3Jvc29mdCBDb3JwLjEeMBwGA1UECxMVTWljcm9zb2Z0IENvcnBvcmF0aW9u
          MSEwHwYDVQQDExhNaWNyb3NvZnQgUm9vdCBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUA
          A4IBDwAwggEKAoIBAQCpAr3BcOY78k4bKJ+XeF4w6qKpjSVf+P6VTKO3/p2iID58UaKboo9g
          MmvRQmR57qx2yVTa8uuchhyPn4Rms8VremIj1h083g8BkuiWxL8tZpqaaCaZ0Dosvwy1WCbB
          RucKPjiWLKkoOajsSYNC44QPu5psVWGsgnyhYC13TOmZtGQ7mlAcMQgkFJ+p55ErGOY9mGMU
          YFgFZZ8dN1KH96fvlALGG9O/VUWziYC/OuxUlE6u/ad6bXROrxjMlgkoIQBXkGBpN7tLEgc8
          Vv9b+6RmCgim0oFWV++2O14WgXcE2va+roCV/rDNf9anGnJcPMq88AijIjCzBoXJsyB3E4Xf
          AgMBAAGjgagwgaUwgaIGA1UdAQSBmjCBl4AQW9Bw72lyniNRfhSyTY7/y6FyMHAxKzApBgNV
          BAsTIkNvcHlyaWdodCAoYykgMTk5NyBNaWNyb3NvZnQgQ29ycC4xHjAcBgNVBAsTFU1pY3Jv
          c29mdCBDb3Jwb3JhdGlvbjEhMB8GA1UEAxMYTWljcm9zb2Z0IFJvb3QgQXV0aG9yaXR5gg8A
          wQCLPDyIEdE+9mPs30AwDQYJKoZIhvcNAQEEBQADggEBAJXoC8CN85cYNe24ASTYdxHzXGAy
          n54Lyz4FkYiPyTrmIfLwV5MstaBHyGLv/NfMOztaqTZUaf4kbT/JzKreBXzdMY09nxBwarv+
          Ek8YacD80EPjEVogT+pie6+qGcgrNyUtvmWhEoolD2Oj91Qc+SHJ1hXzUqxuQzIH/YIX+OVn
          bA1R9r3xUse958Qw/CAxCYgdlSkaTdUdAqXxgOADtFv0sd3IV+5lScdSVLa0AygS/5DW8AiP
          friXxas3LOR65Kh343agANBqP8HSNorgQRKoNWobats14dQcBOSoRQTIWjM4bk0cDWK3CqKM
          09VUP0bNHFWmcNsSOoeTdZ+n0qA=
        </X509Certificate>
      </X509Data>
      <X509Data>
        <X509Certificate>
          MIIEYDCCA0ygAwIBAgIKLqsR3FD/XJ3LwDAJBgUrDgMCHQUAMHAxKzApBgNVBAsTIkNvcHly
          aWdodCAoYykgMTk5NyBNaWNyb3NvZnQgQ29ycC4xHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jw
          b3JhdGlvbjEhMB8GA1UEAxMYTWljcm9zb2Z0IFJvb3QgQXV0aG9yaXR5MB4XDTA3MDgyMjIy
          MzEwMloXDTEyMDgyNTA3MDAwMFoweTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0
          b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEj
          MCEGA1UEAxMaTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EwggEiMA0GCSqGSIb3DQEBAQUA
          A4IBDwAwggEKAoIBAQC3eX3WXbNFOag0rDHa+SU1SXfA+x+ex0Vx79FG6NSMw2tMUmL0mQLD
          TdhJbC8kPmW/ziO3C0i3f3XdRb2qjw5QxSUr8qDnDSMf0UEk+mKZzxlFpZNKH5nNsy8iw0ot
          fG/ZFR47jDkQOd29KfRmOy0BMv/+J0imtWwBh5z7urJjf4L5XKCBhIWOsPK4lKPPOKZQhRcn
          h07dMPYAPfTG+T2BvobtbDmnLjT2tC6vCn1ikXhmnJhzDYav8sTzILlPEo1jyyzZMkUZ7rtK
          ljtQUxjOZlF5qq2HyFY+n4JQiG4FsTXBeyS9UmY9mU7MK34zboRHBtGe0EqGAm6GAKTAh99T
          AgMBAAGjgfowgfcwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgaIGA1UdAQSBmjCBl4AQW9Bw72ly
          niNRfhSyTY7/y6FyMHAxKzApBgNVBAsTIkNvcHlyaWdodCAoYykgMTk5NyBNaWNyb3NvZnQg
          Q29ycC4xHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEhMB8GA1UEAxMYTWljcm9z
          b2Z0IFJvb3QgQXV0aG9yaXR5gg8AwQCLPDyIEdE+9mPs30AwDwYDVR0TAQH/BAUwAwEB/zAd
          BgNVHQ4EFgQUzB3OdgBwW6/x2sROmlFELqNEY/AwCwYDVR0PBAQDAgGGMAkGBSsOAwIdBQAD
          ggEBAHurrn5KJvLOvE50olgndCp1s4b9q0yUeABN6crrGNxpxQ6ifPMCQ8bKh8z4U8zCn71W
          b/BjRKlEAO6WyJrVHLgLnxkNlNfaHq0pfe/tpnOsj945jj2Yarw4bdKIryP93+nWaQmRiL3+
          4QC7NPP3fPkQEi4F6ymWk0JrKHG3OI/gBw3JXWjNvYBBa2aou7e7jjTK8gMQfHr10uBC33v+
          4eGs/vbf1Q2zcNaS40+2OKJ8LdQ92zQLYjcCn4FqI4n2XGOPsFq7OddgjFWEGjP1O5igggyi
          X4uzLLehpcur2iC2vzAZhSAUDSq8UvRB4F4w45IoaYfBcOLzp6vOgEJydg4=
        </X509Certificate>
      </X509Data>
    </KeyInfo><Object id="ts-countersig"><X509Data><X509Certificate>MIIEqjCCA5KgAwIBAgIKYQWiMAAAAAAACDANBgkqhkiG9w0BAQUFADB5MQswCQYDVQQGEwJVUzET
MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0
IENvcnBvcmF0aW9uMSMwIQYDVQQDExpNaWNyb3NvZnQgVGltZXN0YW1waW5nIFBDQTAeFw0wODA3
MjUxOTAxMTVaFw0xMzA3MjUxOTExMTVaMIGzMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu
Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMQ0w
CwYDVQQLEwRNT1BSMScwJQYDVQQLEx5uQ2lwaGVyIERTRSBFU046ODVEMy0zMDVDLTVCQ0YxJTAj
BgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQDwBC2ylsAagWclsSZisxNLzjC6wBI4/IFlNAfENrIkaPYHBMAHl/S38XseYixG
2UukUTS302ztWju0g6FHPREILjVrRebCPIwCZgKpGGnrSu0nLO48d1uk1HCZS1eEENCvLfiJHebq
KbTnz54GYqdyVMI7xs8/uOGwWBBs5aXXw8J1N730heGB6CjYG/HyrvGCo9bXA6KfFYT7Pfqr4bYy
yKACZPPm/xomcQhTihUC8oMndkmCcafvrTJ4xtdsFk8iZZdiTUYv/yOvheymcL0Dy9rYMgXFK5BA
tp7VLIZst8sTMn2Nxn6uFy8y/Ga7HbBFVfit+i1ng2cpk4TSWqEjAgMBAAGjgfgwgfUwHQYDVR0O
BBYEFOiX9vfvjPHmaeNZaE73mIp63ZsuMB8GA1UdIwQYMBaAFG/oTj+XuTSrS4aPvJzqrDtBQ8bQ
MEQGA1UdHwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1
Y3RzL3RzcGNhLmNybDBIBggrBgEFBQcBAQQ8MDowOAYIKwYBBQUHMAKGLGh0dHA6Ly93d3cubWlj
cm9zb2Z0LmNvbS9wa2kvY2VydHMvdHNwY2EuY3J0MBMGA1UdJQQMMAoGCCsGAQUFBwMIMA4GA1Ud
DwEB/wQEAwIGwDANBgkqhkiG9w0BAQUFAAOCAQEADT93X5E8vqU1pNsFBYQfVvLvmabHCI0vs80/
cdWGfHcf3esXsr184/mZ8gpFSK0Uu2ks8j5nYlTy7n8nEZI57M7Zh06I92BHI3snFUAIn78NMQSC
2DW2DJwA04uqeGHFtYhBnT423FikJ5s62r0GXRSmsg9MwY48i/Jimfhm7dXzHCiwMtvKMQm8+yJo
Rkz603Mi5ymOIgD7Vr8GroGgFbo0+SiOH0piBaGJ9YFH6Q2RCNdYO48eawlpqcBIfFWCP18AOEOc
Bsw/2C+/T3MJPf26XvTH7DfCZGGgTdQ9cMxbsBOBwdSjMRq9ZNaW0no/KltGUwk8zQP5P1kAzIlT
YQ==</X509Certificate></X509Data><X509Data><X509Certificate>MIIEnTCCA4WgAwIBAgIQaguZT8AAJasR20UfWHpnojANBgkqhkiG9w0BAQUFADBwMSswKQYDVQQL
EyJDb3B5cmlnaHQgKGMpIDE5OTcgTWljcm9zb2Z0IENvcnAuMR4wHAYDVQQLExVNaWNyb3NvZnQg
Q29ycG9yYXRpb24xITAfBgNVBAMTGE1pY3Jvc29mdCBSb290IEF1dGhvcml0eTAeFw0wNjA5MTYw
MTA0NDdaFw0xOTA5MTUwNzAwMDBaMHkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9u
MRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xIzAhBgNV
BAMTGk1pY3Jvc29mdCBUaW1lc3RhbXBpbmcgUENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA3Ddu+6/IQkpxGMjOSD5TwPqrFLosMrsST1LIg+0+M9lJMZIotpFk4B9QhLrCS9F/Bfjv
db6Lx6jVrmlwZngnZui2t++Fuc3uqv0SpAtZIikvz0DZVgQbdrVtZG1KVNvd8d6/n4PHgN9/TAI3
lPXAnghWHmhHzdnAdlwvfbYlBLRWW2ocY/+AfDzu1QQlTTl3dAddwlzYhjcsdckO6h45CXx2/p1s
bnrg7D6Pl55xDl8qTxhiYDKe0oNOKyJcaEWL3i+EEFCy+bUajWzuJZsT+MsQ14UO9IJ2czbGlXqi
zGAG7AWwhjO3+JRbhEGEWIWUbrAfLEjMb5xD4GrofyaOawIDAQABo4IBKDCCASQwEwYDVR0lBAww
CgYIKwYBBQUHAwgwgaIGA1UdAQSBmjCBl4AQW9Bw72lyniNRfhSyTY7/y6FyMHAxKzApBgNVBAsT
IkNvcHlyaWdodCAoYykgMTk5NyBNaWNyb3NvZnQgQ29ycC4xHjAcBgNVBAsTFU1pY3Jvc29mdCBD
b3Jwb3JhdGlvbjEhMB8GA1UEAxMYTWljcm9zb2Z0IFJvb3QgQXV0aG9yaXR5gg8AwQCLPDyIEdE+
9mPs30AwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFG/oTj+XuTSrS4aPvJzqrDtBQ8bQMBkG
CSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MA0G
CSqGSIb3DQEBBQUAA4IBAQCUTRExwnxQuxGOoWEHAQ6McEWN73NUvT8JBS3/uFFThRztOZG3o1YL
3oy2OxvR+6ynybexUSEbbwhpfmsDoiJG7Wy0bXwiuEbThPOND74HijbB637pcF1Fn5LSzM7djsDh
vyrNfOzJrjLVh7nLY8Q20Rghv3beO5qzG3OeIYjYtLQSVIz0nMJlSpooJpxgig87xxNleEi7z62D
Ok+wYljeMOnpOR3jifLaOYH5EyGMZIBjBgSW8poCQy97Roi6/wLZZflK3toDdJOzBW4MzJ3cKGF8
SPEXnBEhOAIch6wGxZYyuOVAxlM9vamJ3uhmN430IpaczLB3VFE61nJEsiP2</X509Certificate></X509Data><CounterSignature xmlns="http://schemas.microsoft.com/xmldsig/timestamp/2003" ts-format="cms-timestamp-message">MIIGyQYJKoZIhvcNAQcCoIIGujCCBrYCAQMxCTAHBgUrDgMCGjCCARMGCSqGSIb3DQEHAaCCAQQE
ggEAdmQSwuP6ZKqsdGy0gi/ZODG02nq9MAuvx7cWQdFYYhMmtQWy5NhunwIx11/Lt+NiActS7Sb6
hCWk/i2cvjpc5vN6E1sWSNkW4awHtbV/pkuz++fSGdCfpFgw9zrYwDblbctdwxBBPA5+37yeivw+
MqhP/4MsbCowlwkwgYNFMuzdjkOu4I8t73wWALX7wDHxC5D0cJezA52TftvHrlYPUVnhc70vXwi8
DFUOVwmTaar40KIzR1Ni1uKMwKhKsXoi4ft4baUdvQE6Z479KZn/nRkdmHJi3VxSpqXFS88QZLhT
XhbmNKJOwdWg82Aa6RLkE49rJKy41Jf7GpLpquQ1A6CCA32hggN5MIICYQIBATCB46GBuaSBtjCB
szELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc
BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjENMAsGA1UECxMETU9QUjEnMCUGA1UECxMebkNp
cGhlciBEU0UgRVNOOjg1RDMtMzA1Qy01QkNGMSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFt
cCBTZXJ2aWNloiUKAQEwCQYFKw4DAhoFAAMVAE1vNX8OZDTal7GvxUD7b90OhaifoIHBMIG+pIG7
MIG4MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEe
MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMQwwCgYDVQQLEwNBT0MxJzAlBgNVBAsTHm5D
aXBoZXIgTlRTIEVTTjoyMkExLTIwOEUtODdCMDErMCkGA1UEAxMiTWljcm9zb2Z0IFRpbWUgU291
cmNlIE1hc3RlciBDbG9jazANBgkqhkiG9w0BAQUFAAIFAM9CdoowIhgPMjAxMDAzMTAxOTUwMzRa
GA8yMDEwMDMxMTE5NTAzNFoweDA+BgorBgEEAYRZCgQBMTAwLjAKAgUAz0J2igIBADAKAgEAAgIC
QQIB/zAIAgEAAgMDangwCgIFAM9DyAoCAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoD
AaAKMAgCAQACAw9CQKEKMAgCAQACAwehIDANBgkqhkiG9w0BAQUFAAOCAQEAOWhw9OnlS8t+FvUt
myFd9gYwmBHn9YApOI1GnXE0O6GOz4yYt+C4WbZtigdvY3UlcT2fFIrYDKDuRozhO1GWjkGPu+VC
/0xyoFAF8yqiLup05nuAzTGjmv3lctADsV2I+c5H9d0rGbskyUq/CmUz1KC7khy9/VHGC63SN2k2
x2HukYGRGQS7/rXmQt/gcJKnlue9HLRUHviWN9JV+XeOPOXqk0nVNA7Q/t4VLVmJSFTbYB+ti+Rg
BkTf8qyBpPoq169BC4UVjdQw/kmRezUJ+pAmHLKr0HgBtf6g3WK0oHGrgKT0ri+UKm9yCv3+kug+
0+ib6q4gkew2WhDnXBGIwDGCAgwwggIIAgEBMIGHMHkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX
YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRp
b24xIzAhBgNVBAMTGk1pY3Jvc29mdCBUaW1lc3RhbXBpbmcgUENBAgphBaIwAAAAAAAIMAcGBSsO
AwIaoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTAwMzExMDEw
NzQ4WjAjBgkqhkiG9w0BCQQxFgQUJC0+lQ5wKAz5SQctXMuUvRC9zB4wDQYJKoZIhvcNAQEFBQAE
ggEAFeWZ4L4vbQJLDIkiz/K6x5aZCFC7puleHMZ9efcIx5xKOHYdVS8Nc+Zkn6jV58IFRJrUVQM8
0u98iNAL3DOtrGNhevms8lQFmHUIWh/n5VcrAzOzVjTnElTQ/EvEgctFe6k1zkFGRKPP70wpnmV/
YXLyiu2i6BDN2mvAOegiE/X5YU3psItCai23tteYxs6D0ipbTxsNeyiHm0ul6yJboNxDeRRZhzjZ
rQJgEb7VZ3Ac9jDBobZ5KmVzqetjhQ94x+xbwRtIT9iTVMsnJa4mKuseMnYFwECFoPvF6LpGVYwM
CEuqHNHIHqKOb26o9mov7sPsLeY24VRXpMQBYFDCZQ==</CounterSignature></Object></Signature></ObjectCollector>
