2.2 Message Syntax

Messages exchanged in the Group Policy: Audit Configuration Extension correspond to advanced audit policy files transferred by using file access protocol sequences as described in [MS-FASOD]. The protocol is driven through the exchange of these messages, as specified in section 3.

All advanced audit policy files processed by the Group Policy: Audit Configuration Extension are UTF-8 encoded and based on the following file syntax.

 CSVFile = Header SubcategorySettings AuditOptions GlobalObjectAccessAuditSettings
 Header = "Machine Name,Policy Target,Subcategory,Subcategory GUID,Inclusion Setting,Exclusion Setting,Setting Value" LineBreak

The preceding syntax is given in the Augmented Backus-Naur Form (ABNF) grammar, as specified in [RFC4234] and as augmented by the following rules.

 LineBreak = CRLF
 String = *(ALPHANUM / %d47 / %d45 / %d58 / %d59)
 StringWithSpaces = String / String Wsp StringWithSpaces
 QuotedString = DQUOTE *(%x20-21 / %x23-7E) DQUOTE
 Wsp = *WSP
 ALPHANUM = ALPHA / DIGIT
 GUID                   = %x7B time-low hyphen time-mid hyphen
                          time-high-and-version hyphen 
                          clock-seq-and_reserved
                          clock-seq-low hyphen node %x7D
 time-low               = hexOctet hexOctet hexOctet hexOctet
 time-mid               = hexOctet hexOctet
 time-high-and-version  = hexOctet hexOctet
 clock-seq-and-reserved = hexOctet
 clock-seq-low          = hexOctet
 node                   = hexOctet hexOctet hexOctet
                          hexOctet hexOctet hexOctet
 hexOctet               = hexDigit hexDigit
 hexDigit               = digit / a / b / c / d / e / f
 digit                  = "0" / "1" | "2" / "3" / "4" / "5" / "6" / "7" /
                          "8" / "9"
 hyphen                 = "-"
 a                      = "a" / "A"
 b                      = "b" / "B"
 c                      = "c" / "C"
 d                      = "d" / "D"
 e                      = "e" / "E"
 f                      = "f" / "F"