(((TargetObject:\\Control\\Terminal\ Server\\* OR TargetObject:\\Windows\ NT\\Terminal\ Services\\*) TargetObject:\\Shadow (Details:DWORD\ \(0x00000001\) OR Details:DWORD\ \(0x00000002\) OR Details:DWORD\ \(0x00000003\) OR Details:DWORD\ \(0x00000004\))) OR ((TargetObject:\\Control\\Terminal\ Server\\* OR TargetObject:\\Windows\ NT\\Terminal\ Services\\*) (TargetObject:\\DisableRemoteDesktopAntiAlias OR TargetObject:\\DisableSecuritySettings OR TargetObject:\\fAllowUnsolicited OR TargetObject:\\fAllowUnsolicitedFullControl) Details:DWORD\ \(0x00000001\)) OR (TargetObject:\\Control\\Terminal\ Server\\InitialProgram* OR TargetObject:\\Control\\Terminal\ Server\\WinStations\\RDP\-Tcp\\InitialProgram* OR TargetObject:\\services\\TermService\\Parameters\\ServiceDll* OR TargetObject:\\Terminal\ Server\\WinStations\\RDP\-Tcp\\SecurityLayer* OR TargetObject:\\Windows\ NT\\Terminal\ Services\\InitialProgram*)) (-(TargetObject:\\SecurityLayer Details:DWORD\ \(0x00000002\)))