diff --git a/CHANGELOG.md b/CHANGELOG.md
index b284120..2da351f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## Unreleased
+
+### Fixed
+
+- Rebuild the three Windows Server 2025 role baselines without removing or
+  reordering any controls: Member Server remains 320 resources, Domain
+  Controller 321, and Workgroup Member 296. The full overlays use canonical
+  `REG_*` Registry contracts, writable CSP `Config` paths, five additional
+  CSP-to-Registry mappings, and CEL expressions equivalent to the existing
+  compliance schemas.
+- Export `Microsoft.OSConfig` MOFs with a portable `ModuleVersion = "0.0.0"`
+  placeholder, one shared correlation-group GUID, and canonical `Value`,
+  `ValueName`, and `ValueType` fields. Packaging instructions resolve the
+  placeholder to each customer's installed module version before creating the
+  Machine Configuration ZIP.
+
 ## [0.3.95-author.1] - 2026-07-27
 
 > `mac-v0.3.95-author.1` is the current macOS Author tagged source. Its
diff --git a/apps/desktop/src/data/baseline-catalog.test.ts b/apps/desktop/src/data/baseline-catalog.test.ts
index 2e477c2..df4968b 100644
--- a/apps/desktop/src/data/baseline-catalog.test.ts
+++ b/apps/desktop/src/data/baseline-catalog.test.ts
@@ -1,8 +1,37 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
-import { describe, it, expect } from 'vitest';
-import { BASELINE_CATALOG } from './baseline-catalog';
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import yaml from "js-yaml";
+import { BASELINE_CATALOG } from "./baseline-catalog";
+
+interface BaselineResource {
+  name: string;
+  type: string;
+  properties?: {
+    resource?: {
+      type?: string;
+      properties?: Record<string, unknown>;
+    };
+    expression?: string;
+    schema?: unknown;
+  };
+}
+
+const BASELINE_DIR = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../../../../public/_baselines",
+);
+
+function loadBaseline(filename: string): BaselineResource[] {
+  const document = yaml.load(readFileSync(path.join(BASELINE_DIR, filename), "utf8")) as {
+    resources?: BaselineResource[];
+  };
+  return document.resources ?? [];
+}
 
 /**
  * Regression coverage for the WS2025 standalone-baseline fix.
@@ -14,52 +43,118 @@ import { BASELINE_CATALOG } from './baseline-catalog';
  * in the corrected counts and confirms no "Source" link is rendered for
  * these three baselines, while leaving every other catalog entry untouched.
  */
-describe('BASELINE_CATALOG — WS2025 standalone-provider fix', () => {
-  const ws2025MemberServer = BASELINE_CATALOG.find((b) => b.id === 'ws2025-member-server');
-  const ws2025DomainController = BASELINE_CATALOG.find((b) => b.id === 'ws2025-domain-controller');
-  const ws2025WorkgroupMember = BASELINE_CATALOG.find((b) => b.id === 'ws2025-workgroup-member');
+describe("BASELINE_CATALOG — WS2025 standalone-provider fix", () => {
+  const ws2025MemberServer = BASELINE_CATALOG.find((b) => b.id === "ws2025-member-server");
+  const ws2025DomainController = BASELINE_CATALOG.find((b) => b.id === "ws2025-domain-controller");
+  const ws2025WorkgroupMember = BASELINE_CATALOG.find((b) => b.id === "ws2025-workgroup-member");
 
-  it('reports the corrected resource count for ws2025-member-server (320)', () => {
+  it("reports the corrected resource count for ws2025-member-server (320)", () => {
     expect(ws2025MemberServer?.resourceCount).toBe(320);
   });
 
-  it('reports the corrected resource count for ws2025-domain-controller (321)', () => {
+  it("reports the corrected resource count for ws2025-domain-controller (321)", () => {
     expect(ws2025DomainController?.resourceCount).toBe(321);
   });
 
-  it('reports the corrected resource count for ws2025-workgroup-member (296)', () => {
+  it("reports the corrected resource count for ws2025-workgroup-member (296)", () => {
     expect(ws2025WorkgroupMember?.resourceCount).toBe(296);
   });
 
-  it('has no githubUrl for ws2025-member-server (no Source button)', () => {
+  it("has no githubUrl for ws2025-member-server (no Source button)", () => {
     expect(ws2025MemberServer?.githubUrl).toBeUndefined();
   });
 
-  it('has no githubUrl for ws2025-domain-controller (no Source button)', () => {
+  it("has no githubUrl for ws2025-domain-controller (no Source button)", () => {
     expect(ws2025DomainController?.githubUrl).toBeUndefined();
   });
 
-  it('has no githubUrl for ws2025-workgroup-member (no Source button)', () => {
+  it("has no githubUrl for ws2025-workgroup-member (no Source button)", () => {
     expect(ws2025WorkgroupMember?.githubUrl).toBeUndefined();
   });
 
-  it('leaves manifestUrl and scenarioName untouched for the three WS2025 baselines', () => {
-    expect(ws2025MemberServer?.manifestUrl).toBe('/_baselines/ws2025-member-server.osc.yaml');
-    expect(ws2025MemberServer?.scenarioName).toBe('SecurityBaseline/WS2025/MemberServer');
+  it("leaves manifestUrl and scenarioName untouched for the three WS2025 baselines", () => {
+    expect(ws2025MemberServer?.manifestUrl).toBe("/_baselines/ws2025-member-server.osc.yaml");
+    expect(ws2025MemberServer?.scenarioName).toBe("SecurityBaseline/WS2025/MemberServer");
 
-    expect(ws2025DomainController?.manifestUrl).toBe('/_baselines/ws2025-domain-controller.osc.yaml');
-    expect(ws2025DomainController?.scenarioName).toBe('SecurityBaseline/WS2025/DomainController');
+    expect(ws2025DomainController?.manifestUrl).toBe(
+      "/_baselines/ws2025-domain-controller.osc.yaml",
+    );
+    expect(ws2025DomainController?.scenarioName).toBe("SecurityBaseline/WS2025/DomainController");
 
-    expect(ws2025WorkgroupMember?.manifestUrl).toBe('/_baselines/ws2025-workgroup-member.osc.yaml');
-    expect(ws2025WorkgroupMember?.scenarioName).toBe('SecurityBaseline/WS2025/WorkgroupMember');
+    expect(ws2025WorkgroupMember?.manifestUrl).toBe("/_baselines/ws2025-workgroup-member.osc.yaml");
+    expect(ws2025WorkgroupMember?.scenarioName).toBe("SecurityBaseline/WS2025/WorkgroupMember");
   });
 
-  it('positive control: an untouched baseline still has its githubUrl (Source button preserved)', () => {
+  it("positive control: an untouched baseline still has its githubUrl (Source button preserved)", () => {
     // ws2025-secured-core is a sibling WS2025 baseline that is NOT part of
     // this fix — its upstream link must still render a Source button.
-    const securedCore = BASELINE_CATALOG.find((b) => b.id === 'ws2025-secured-core');
+    const securedCore = BASELINE_CATALOG.find((b) => b.id === "ws2025-secured-core");
     expect(securedCore?.githubUrl).toBe(
-      'https://github.com/microsoft/osconfig/blob/main/security/ws2025/secured_core.osc.yaml',
+      "https://github.com/microsoft/osconfig/blob/main/security/ws2025/secured_core.osc.yaml",
     );
   });
 });
+
+describe("WS2025 full-overlay invariants", () => {
+  const profiles = [
+    ["ws2025-member-server.osc.yaml", 320],
+    ["ws2025-domain-controller.osc.yaml", 321],
+    ["ws2025-workgroup-member.osc.yaml", 296],
+  ] as const;
+
+  it.each(profiles)("preserves every resource in %s", (filename, count) => {
+    const resources = loadBaseline(filename);
+    expect(resources).toHaveLength(count);
+    expect(new Set(resources.map((resource) => resource.name)).size).toBe(count);
+
+    const cspPaths: string[] = [];
+    for (const wrapper of resources) {
+      expect(wrapper.type).toBe("Microsoft.OSConfig/Test");
+      expect(wrapper.properties?.schema).toBeUndefined();
+      expect(wrapper.properties?.expression).toEqual(expect.any(String));
+
+      const inner = wrapper.properties?.resource;
+      if (inner?.type === "Microsoft.Windows/Registry") {
+        expect(inner.properties?.valueType).toMatch(/^REG_/);
+        expect(inner.properties?.keyPath).toMatch(/^(?:HKLM|HKCU|HKCR|HKU|HKCC|HKEY_[A-Z_]+):\\/i);
+      }
+      if (inner?.type === "Microsoft.Windows/CSP") {
+        cspPaths.push(String(inner.properties?.path ?? ""));
+      }
+    }
+
+    expect(cspPaths).toHaveLength(5);
+    expect(cspPaths.every((cspPath) => cspPath.includes("/Policy/Config/"))).toBe(true);
+    expect(cspPaths.some((cspPath) => cspPath.includes("/Policy/Result/"))).toBe(false);
+  });
+
+  it("keeps the reviewed CSP-to-provider repairs", () => {
+    const resources = loadBaseline("ws2025-workgroup-member.osc.yaml");
+    const byName = new Map(resources.map((resource) => [resource.name, resource]));
+    const dedicated = [
+      "AuditBackupAndRestorePrivilege",
+      "DmaGuardDeviceEnumerationPolicy",
+      "DeviceGuardRequirePlatformSecurityFeatures",
+      "RecoveryConsoleAllowFloppyCopyAndAllDrives",
+      "SmartCardRemovalBehavior",
+    ];
+
+    for (const name of dedicated) {
+      expect(byName.get(name)?.properties?.resource?.type).toBe("Microsoft.Windows/Registry");
+    }
+    expect(
+      byName.get("AuditBackupAndRestorePrivilege")?.properties?.resource?.properties,
+    ).toMatchObject({
+      keyPath: "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa",
+      valueName: "FullPrivilegeAuditing",
+      valueType: "REG_BINARY",
+      value: "AA==",
+    });
+    expect(
+      byName.get("NetBTNodeTypeConfiguration")?.properties?.resource?.properties,
+    ).toMatchObject({ value: 0 });
+    expect(
+      byName.get("ServerSPNTargetNameValidationLevel")?.properties?.resource?.properties,
+    ).toMatchObject({ value: 0 });
+  });
+});
diff --git a/docs/src/changelog.md b/docs/src/changelog.md
index 233023d..afbe66c 100644
--- a/docs/src/changelog.md
+++ b/docs/src/changelog.md
@@ -3,6 +3,17 @@
 A concise release history for ConfigForge. Newer entries use the
 shipped semver tag; older entries summarize the foundational work by theme.
 
+## Unreleased
+
+- **Windows Server 2025 baselines:** Rebuilt the full Member Server (320),
+  Domain Controller (321), and Workgroup Member (296) profiles without losing
+  controls or changing their order. Registry resources use canonical contracts,
+  writable CSP paths replace read-only paths, and existing schema semantics are
+  represented as CEL expressions.
+- **Machine Configuration MOF export:** Exported resources use a portable
+  `Microsoft.OSConfig` `0.0.0` placeholder that is resolved at package time,
+  plus the correlation and typed value fields required by the DSC resource.
+
 ## macOS Author v0.3.95-author.1 — 2026-07-27
 
 `mac-v0.3.95-author.1` is the current macOS Author tagged source. Its
diff --git a/docs/src/user-guide/manifest-editor.md b/docs/src/user-guide/manifest-editor.md
index 34a87f4..b115355 100644
--- a/docs/src/user-guide/manifest-editor.md
+++ b/docs/src/user-guide/manifest-editor.md
@@ -126,38 +126,56 @@ installed to bundle it into the package:
 
 ```powershell
 Install-Module GuestConfiguration -Scope AllUsers -Force
-# OSConfig resource module (any 1.2.0 or later - the MOF is not
-# pinned to a specific version, so it binds to whatever is installed)
+# The exported MOF carries a portable 0.0.0 placeholder. Resolve it to
+# the newest module installed on the packaging machine before packaging.
 Install-Module Microsoft.OSConfig -Scope AllUsers -Repository PSGallery -Force
 ```
 
 Then build and publish:
 
 ```powershell
+$InstalledOSConfig = Get-Module -ListAvailable Microsoft.OSConfig |
+  Sort-Object Version -Descending |
+  Select-Object -First 1
+$ResolvedMof = '.\MySecurityBaseline.resolved.mof'
+(Get-Content '.\MySecurityBaseline.mof' -Raw).Replace(
+  'ModuleVersion = "0.0.0";',
+  "ModuleVersion = `"$($InstalledOSConfig.Version)`";"
+) | Set-Content $ResolvedMof -Encoding utf8
+
 # MOF to Machine Configuration package (.zip)
 New-GuestConfigurationPackage `
   -Name MySecurityBaseline `
-  -Configuration .\MySecurityBaseline.mof `
-  -Type AuditAndSet
+  -Configuration $ResolvedMof `
+  -Type Audit `
+  -Path .\package
 
-# Publish the package, then generate the Azure Policy definition
-Publish-GuestConfigurationPackage -Path .\MySecurityBaseline\MySecurityBaseline.zip
+# Upload the returned ZIP to Azure Storage with Set-AzStorageBlobContent,
+# then pass its read-only URI to the policy generator.
 New-GuestConfigurationPolicy `
   -PolicyId <new-guid> `
-  -ContentUri <published-package-uri> `
+  -ContentUri <package-uri> `
   -DisplayName 'My Security Baseline' `
-  -Path .\policy
+  -Path .\policy `
+  -Platform Windows `
+  -PolicyVersion 1.0.0 `
+  -Mode Audit
 ```
 
 Then assign the generated definition in Azure Policy. Use this route
 when you want to own the packaging and publishing step - custom
 storage, your own GUIDs/versioning, or package signing.
 
-> The exported MOF references the `Microsoft.OSConfig` module by name
-> only (no version pin), so packaging succeeds against any installed
-> `Microsoft.OSConfig` 1.2.0+. If the module isn't installed,
+> The exported MOF uses `ModuleVersion = "0.0.0"` as a portable placeholder.
+> Resolve it to the packaging machine's installed version as shown above;
+> Machine Configuration runtime requires the exact bundled version. If the module isn't installed,
 > `New-GuestConfigurationPackage` fails with *"Failed to find a module
 > with the name 'Microsoft.OSConfig'."*
+>
+> Microsoft.OSConfig 1.3.11 can audit these packages, but its PowerShell
+> resource has an upstream `Set()` serialization defect. The example therefore
+> defaults to Audit. Use `AuditAndSet` plus an Apply mode only with a newer
+> module that contains the fix.
 
 ## What changes don't trigger a save
 
diff --git a/packages/core/src/import-export/index.test.ts b/packages/core/src/import-export/index.test.ts
index ebbf776..e8069a4 100644
--- a/packages/core/src/import-export/index.test.ts
+++ b/packages/core/src/import-export/index.test.ts
@@ -27,9 +27,7 @@ describe('parseSecurityDefinition (PR17 hardening)', () => {
   });
 
   it('throws when document is null', () => {
-    expect(() => parseSecurityDefinition('null')).toThrowError(
-      /document must be an object/i,
-    );
+    expect(() => parseSecurityDefinition('null')).toThrowError(/document must be an object/i);
   });
 
   it('does not throw on otherwise empty but valid object', () => {
@@ -69,7 +67,8 @@ describe('exportToAzurePolicy structural shape', () => {
         resource: {
           type: 'Microsoft.Windows/Registry',
           properties: {
-            keyPath: 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\LAPS',
+            keyPath:
+              'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\LAPS',
             valueName: 'BackupDirectory',
             valueType: 'Dword',
             value: 1,
@@ -85,7 +84,8 @@ describe('exportToAzurePolicy structural shape', () => {
         resource: {
           type: 'Microsoft.Windows/Registry',
           properties: {
-            keyPath: 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\LAPS',
+            keyPath:
+              'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\LAPS',
             valueName: 'PasswordLength',
             valueType: 'Dword',
             value: 15,
@@ -110,7 +110,10 @@ describe('exportToAzurePolicy structural shape', () => {
             configurationParameter: Record<string, string>;
           };
         };
-        parameters: Record<string, { type: string; defaultValue?: string; allowedValues?: string[] }>;
+        parameters: Record<
+          string,
+          { type: string; defaultValue?: string; allowedValues?: string[] }
+        >;
         policyRule: {
           if: { anyOf: unknown[] };
           then: {
@@ -150,8 +153,12 @@ describe('exportToAzurePolicy structural shape', () => {
     // so the operator must replace them with their actual MOF .zip URL
     // and SHA256 hash. Shipping a default URL would silently deploy a
     // bogus package.
-    expect(p.properties.metadata.guestConfiguration.contentUri).toBe('REPLACE_WITH_YOUR_MOF_PACKAGE_URI');
-    expect(p.properties.metadata.guestConfiguration.contentHash).toBe('REPLACE_WITH_SHA256_OF_PACKAGE_ZIP');
+    expect(p.properties.metadata.guestConfiguration.contentUri).toBe(
+      'REPLACE_WITH_YOUR_MOF_PACKAGE_URI',
+    );
+    expect(p.properties.metadata.guestConfiguration.contentHash).toBe(
+      'REPLACE_WITH_SHA256_OF_PACKAGE_ZIP',
+    );
   });
 
   it('emits one ARM parameter per manifest setting + scaffolding params', () => {
@@ -199,9 +206,7 @@ describe('exportToAzurePolicy structural shape', () => {
       { name: 'settingname', type: 'T', properties: { value: 2 } },
     ];
 
-    expect(() => exportToAzurePolicy('collision', colliding)).toThrow(
-      /parameter name collision/i,
-    );
+    expect(() => exportToAzurePolicy('collision', colliding)).toThrow(/parameter name collision/i);
   });
 
   it('configurationParameter (metadata) maps ARM names to MOF parameter names', () => {
@@ -223,9 +228,7 @@ describe('exportToAzurePolicy structural shape', () => {
     expect(fields).toContain(
       'Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash',
     );
-    const hashClause = cond.allOf.find((c) =>
-      c.field.includes('parameterHash'),
-    );
+    const hashClause = cond.allOf.find((c) => c.field.includes('parameterHash'));
     // Hash expression references every setting's ARM parameter so any
     // drift triggers reassignment.
     expect(hashClause!.equals).toContain("parameters('PasswordBackup')");
@@ -241,7 +244,8 @@ describe('exportToAzurePolicy structural shape', () => {
 
   it('deployment template has TWO resources (VM + Arc) gated by condition', () => {
     const p = policyOf(lapsResources, { effect: 'DeployIfNotExists' });
-    const resources = p.properties.policyRule.then.details.deployment!.properties.template.resources;
+    const resources =
+      p.properties.policyRule.then.details.deployment!.properties.template.resources;
     expect(resources).toHaveLength(2);
     const vm = resources.find((r) => r.type.startsWith('Microsoft.Compute/'));
     const arc = resources.find((r) => r.type.startsWith('Microsoft.HybridCompute/'));
@@ -290,8 +294,8 @@ describe('exportToAzurePolicy structural shape', () => {
     // configurationParameter is an empty object, not undefined.
     expect(p.properties.metadata.guestConfiguration.configurationParameter).toEqual({});
     // parameterHash still defined (base64 of empty string).
-    const hashClause = p.properties.policyRule.then.details.existenceCondition.allOf.find(
-      (c) => c.field.includes('parameterHash'),
+    const hashClause = p.properties.policyRule.then.details.existenceCondition.allOf.find((c) =>
+      c.field.includes('parameterHash'),
     );
     expect(hashClause).toBeDefined();
   });
@@ -322,10 +326,10 @@ describe('exportToAzurePolicy structural shape', () => {
 //
 // Regression guard for the Export → MOF → New-GuestConfigurationPackage flow.
 // The emitted MOF must reference the real `Microsoft.OSConfig` PSGallery module
-// (NOT the bare `OSConfig`, which fails to resolve) and must NOT pin a
-// `ModuleVersion`, so the packaging cmdlet binds to whatever Microsoft.OSConfig
-// (1.2.0+) the customer has installed. Verified end-to-end against
-// GuestConfiguration 4.11.0 + Microsoft.OSConfig 1.3.11.
+// (NOT the bare `OSConfig`, which fails to resolve) and uses the portable
+// `0.0.0` Machine Configuration placeholder. The packaging workflow resolves
+// it to the customer's newest installed Microsoft.OSConfig version immediately
+// before New-GuestConfigurationPackage runs.
 import { exportToMof } from './index';
 
 describe('exportToMof — Machine Configuration module binding', () => {
@@ -336,11 +340,68 @@ describe('exportToMof — Machine Configuration module binding', () => {
       properties: {
         resource: {
           type: 'Microsoft.Windows/Registry',
-          properties: { keyPath: 'HKLM:\\SOFTWARE\\X', valueName: 'BackupDirectory', valueType: 'Dword', value: 1 },
+          properties: {
+            keyPath: 'HKLM:\\SOFTWARE\\X',
+            valueName: 'BackupDirectory',
+            valueType: 'REG_DWORD',
+            value: 1,
+          },
         },
         schema: { const: 2 },
       },
     },
+    {
+      name: 'NetworkLogon',
+      type: 'Microsoft.OSConfig/Test',
+      properties: {
+        resource: {
+          type: 'Microsoft.Windows/UserRightsAssignment',
+          properties: {
+            name: 'SeNetworkLogonRight',
+            value: ['*S-1-5-32-544', '*S-1-5-11'],
+          },
+        },
+        expression: 'value.size() == 2',
+      },
+    },
+    {
+      name: 'GuestAccount',
+      type: 'Microsoft.OSConfig/Test',
+      properties: {
+        resource: {
+          type: 'Microsoft.Windows/AccountPolicy',
+          properties: { name: 'EnableGuestAccount', value: false },
+        },
+        expression: 'value == false',
+      },
+    },
+    {
+      name: 'AdministratorName',
+      type: 'Microsoft.OSConfig/Test',
+      properties: {
+        resource: {
+          type: 'Microsoft.Windows/AccountPolicy',
+          properties: { name: 'AdministratorAccountName', value: null },
+        },
+        expression: 'value != null',
+      },
+    },
+    {
+      name: 'EmptyBanner',
+      type: 'Microsoft.OSConfig/Test',
+      properties: {
+        resource: {
+          type: 'Microsoft.Windows/Registry',
+          properties: {
+            keyPath: 'HKLM:\\SOFTWARE\\X',
+            valueName: 'Banner',
+            valueType: 'REG_SZ',
+            value: '',
+          },
+        },
+        expression: 'value == ""',
+      },
+    },
   ];
 
   it('references the real Microsoft.OSConfig module so New-GuestConfigurationPackage can resolve it', () => {
@@ -353,9 +414,34 @@ describe('exportToMof — Machine Configuration module binding', () => {
     expect(mof).not.toContain('ModuleName = "OSConfig";');
   });
 
-  it('omits ModuleVersion so packaging binds to any installed Microsoft.OSConfig (no exact-version pin)', () => {
+  it('emits portable ModuleVersion 0.0.0 for package-time version resolution', () => {
     const mof = exportToMof('LapsBaseline', resources);
-    expect(mof).not.toMatch(/ModuleVersion\s*=/);
+    expect(mof).toContain('ModuleVersion = "0.0.0";');
+    expect(mof.match(/ModuleVersion = "0\.0\.0";/g)).toHaveLength(resources.length);
+  });
+
+  it('emits one shared correlation group so AuditAndSet remediation can call OSConfig.Set', () => {
+    const mof = exportToMof('LapsBaseline', resources);
+    const groups = Array.from(
+      mof.matchAll(/CorrelationGroup = "(\{[0-9a-f-]{36}\})";/gi),
+      (match) => match[1],
+    );
+    expect(groups).toHaveLength(resources.length);
+    expect(new Set(groups).size).toBe(1);
+  });
+
+  it('moves desired values into canonical MOF Value fields for remediation', () => {
+    const mof = exportToMof('LapsBaseline', resources);
+    const propertyLines = mof.match(/    Properties = ".*";/g) ?? [];
+    expect(propertyLines).toHaveLength(resources.length);
+    expect(propertyLines.filter((line) => line.includes('\\"value\\"'))).toHaveLength(1);
+    expect(mof).toContain('    Value = "1";\n    ValueName = "value";\n    ValueType = "integer";');
+    expect(mof).toContain(
+      '    Value = "*S-1-5-32-544,*S-1-5-11";\n    ValueName = "value";\n    ValueType = "string[]";',
+    );
+    expect(mof).toContain('    Value = "0";\n    ValueName = "value";\n    ValueType = "boolean";');
+    expect(mof).toContain('    Value = null;\n    ValueName = "value";\n    ValueType = "string";');
+    expect(mof).toContain('    Value = "";\n    ValueName = "value";\n    ValueType = "string";');
   });
 
   it('still emits the OSConfig DSC resource class and the configuration footer', () => {
diff --git a/packages/core/src/import-export/index.ts b/packages/core/src/import-export/index.ts
index 85ea412..eb2c5d2 100644
--- a/packages/core/src/import-export/index.ts
+++ b/packages/core/src/import-export/index.ts
@@ -273,6 +273,64 @@ function mofEscape(s: string): string {
   return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\r?\n/g, '\\r\\n');
 }
 
+function newUuid(): string {
+  if (globalThis.crypto?.randomUUID) return globalThis.crypto.randomUUID();
+  const bytes = new Uint8Array(16);
+  if (globalThis.crypto?.getRandomValues) {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let index = 0; index < bytes.length; index += 1) {
+      bytes[index] = Math.floor(Math.random() * 256);
+    }
+  }
+  bytes[6] = (bytes[6] & 0x0f) | 0x40;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'));
+  return [
+    hex.slice(0, 4).join(''),
+    hex.slice(4, 6).join(''),
+    hex.slice(6, 8).join(''),
+    hex.slice(8, 10).join(''),
+    hex.slice(10).join(''),
+  ].join('-');
+}
+
+function inferMofValueType(
+  value: unknown,
+  resourceType: string,
+  properties: Record<string, unknown>,
+): 'string' | 'string[]' | 'integer' | 'boolean' {
+  if (Array.isArray(value)) return 'string[]';
+  if (typeof value === 'boolean') return 'boolean';
+  if (typeof value === 'number' || typeof value === 'bigint') return 'integer';
+  if (typeof value === 'string') return 'string';
+
+  if (value === null && resourceType === 'Microsoft.Windows/Registry') {
+    const registryType = String(properties.valueType ?? '').toUpperCase();
+    if (registryType === 'REG_MULTI_SZ' || registryType === 'MULTISTRING') return 'string[]';
+    if (
+      registryType === 'REG_DWORD' ||
+      registryType === 'REG_QWORD' ||
+      registryType === 'DWORD' ||
+      registryType === 'QWORD'
+    ) {
+      return 'integer';
+    }
+  }
+
+  return 'string';
+}
+
+function mofValueString(
+  value: unknown,
+  valueType: 'string' | 'string[]' | 'integer' | 'boolean',
+): string | null {
+  if (value === null || value === undefined) return null;
+  if (valueType === 'string[]') return (value as unknown[]).map(String).join(',');
+  if (valueType === 'boolean') return value ? '1' : '0';
+  return String(value);
+}
+
 /**
  * Serialize a manifest's resources to Machine-Configuration MOF.
  *
@@ -287,13 +345,14 @@ function mofEscape(s: string): string {
  * does via `Get-OscManifest -Format Mof` → `ConvertTo-Mof`.
  */
 export function exportToMof(
-  manifestName: string,
+  _manifestName: string,
   resources: Array<
     { name?: string; type?: string; properties?: Record<string, unknown> } | unknown
   >,
 ): string {
   const instances: string[] = [];
-  const configurationName = crypto?.randomUUID?.() ?? manifestName.replace(/[^a-zA-Z0-9_.-]/g, '_');
+  const configurationName = newUuid();
+  const correlationGroup = `{${newUuid()}}`;
 
   for (const raw of Array.isArray(resources) ? resources : []) {
     if (!raw || typeof raw !== 'object') continue;
@@ -305,6 +364,9 @@ export function exportToMof(
     let expression: string | undefined;
     let schema: unknown | undefined;
     let template: string | undefined;
+    let hasValue = false;
+    let value: unknown;
+    let valueType: 'string' | 'string[]' | 'integer' | 'boolean' | undefined;
 
     // Test-wrapped resources: unwrap to the inner resource (mirrors PS module
     // ConvertTo-Mof lines 1979-1992).
@@ -325,6 +387,19 @@ export function exportToMof(
       if (typeof outerProps.template === 'string') template = outerProps.template;
     }
 
+    if (Object.prototype.hasOwnProperty.call(props, 'value')) {
+      hasValue = true;
+      value = props.value;
+      valueType = inferMofValueType(value, type, props);
+      props = { ...props };
+      // Microsoft.OSConfig.GetActualValue() treats an empty scalar Value as
+      // absent and falls back to Properties.value. Preserve that one fallback
+      // so empty-string requirements survive the MOF round trip.
+      if (!(value === '' && valueType === 'string')) {
+        delete props.value;
+      }
+    }
+
     const propsJson = JSON.stringify(props);
 
     const lines: string[] = [];
@@ -336,16 +411,28 @@ export function exportToMof(
     // module on PSGallery. `New-GuestConfigurationPackage` resolves the module
     // by `ModuleName` to bundle it into the Machine Configuration package, so
     // this MUST be the real module id `Microsoft.OSConfig` (not `OSConfig`).
-    // `ModuleVersion` is intentionally OMITTED: the packaging cmdlet requires it
-    // to match an *installed* version exactly, and customers install whatever
-    // `Microsoft.OSConfig` is current. Omitting it lets the cmdlet bind to the
-    // installed module (1.2.0+); pinning a version would break packaging the
-    // moment the customer's installed version differs.
+    // `0.0.0` is the portable placeholder used by Microsoft's baseline MOFs.
+    // Before New-GuestConfigurationPackage runs, the packaging workflow must
+    // replace it with that customer's newest installed Microsoft.OSConfig
+    // version. The runtime requires an exact version; resolving at package time
+    // keeps the exported MOF portable across customer environments.
     lines.push(`    ModuleName = "Microsoft.OSConfig";`);
+    lines.push(`    ModuleVersion = "0.0.0";`);
     lines.push(`    ConfigurationName = "${mofEscape(configurationName)}";`);
+    lines.push(`    CorrelationGroup = "${correlationGroup}";`);
     lines.push(`    Name = "${mofEscape(name)}";`);
     lines.push(`    Type = "${mofEscape(type)}";`);
     lines.push(`    Properties = "${mofEscape(propsJson)}";`);
+    if (hasValue && valueType) {
+      const serializedValue = mofValueString(value, valueType);
+      lines.push(
+        serializedValue === null
+          ? '    Value = null;'
+          : `    Value = "${mofEscape(serializedValue)}";`,
+      );
+      lines.push('    ValueName = "value";');
+      lines.push(`    ValueType = "${valueType}";`);
+    }
     if (expression) {
       lines.push(`    Expression = "${mofEscape(expression)}";`);
     }
diff --git a/public/_baselines/ws2025-domain-controller.osc.yaml b/public/_baselines/ws2025-domain-controller.osc.yaml
index aa24ef8..5578582 100644
--- a/public/_baselines/ws2025-domain-controller.osc.yaml
+++ b/public/_baselines/ws2025-domain-controller.osc.yaml
@@ -6,14 +6,11 @@ resources:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Afd\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Afd\Parameters
           valueName: DisableAddressSharing
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowAnonymousSIDOrNameTranslation
     type: Microsoft.OSConfig/Test
     properties:
@@ -22,190 +19,161 @@ resources:
         properties:
           name: EnableAnonymousNameTranslation
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: AllowCustomSSPAPIntoLSASS
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: AllowCustomSSPsAPs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: AllowedToFormatAndEjectRemovableMedia
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
           valueName: AllocateDASD
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: AllowICMPRedirectsToOverrideOSPFGeneratedRoutes
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
           valueName: EnableICMPRedirect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: AllowLocalSystemNULLSessionFallback
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: AllowNullSessionFallback
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: AllowLocalSystemToUseComputerIdentityForNTLM
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: UseMachineId
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowPKU2UAuthenticationAllowOnlineID
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\pku2u
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\pku2u
           valueName: AllowOnlineID
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowSystemToBeShutDownWithoutHavingToLogOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ShutdownWithoutLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
           valueName: NoNameReleaseOnDemand
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowUIAccessApplicationsToPromptForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableUIADesktopToggle
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: AmountOfIdleTimeRequiredBeforeSuspendingSession
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: AutoDisconnect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 15
-      schema:
-        minimum: 1
-        maximum: 15
+      expression: (value != null && value >= 1 && value <= 15)
   - name: ApplicationIdentityStartupType
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppIDSvc
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\AppIDSvc
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: ApplicationManagementMSIAllowUserControlOverInstall
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer
           valueName: EnableUserControl
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer
           valueName: AlwaysInstallElevated
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: AppRuntimeAllowMicrosoftAccountsToBeOptional
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: MSAOptional
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditAccountLockout
     type: Microsoft.OSConfig/Test
     properties:
@@ -214,10 +182,7 @@ resources:
         properties:
           subcategory: '{0CCE9217-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditAuthenticationPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -226,10 +191,7 @@ resources:
         properties:
           subcategory: '{0CCE9230-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditAuthorizationPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -238,51 +200,40 @@ resources:
         properties:
           subcategory: '{0CCE9231-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditBackupAndRestorePrivilege
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Audit_AuditTheUseOfBackupAndRestoreprivilege
-          type: string
-          value: MDA=
-      schema:
-        oneOf:
-          - const: MDA=
-          - type: 'null'
+          keyPath: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa
+          valueName: FullPrivilegeAuditing
+          valueType: REG_BINARY
+          value: AA==
+      expression: '["MDA=","AA=="].exists(item, value == item)'
   - name: AuditClientDoesNotSupportEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditClientDoesNotSupportEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditClientDoesNotSupportSigning
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditClientDoesNotSupportSigning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditComputerAccountManagement
     type: Microsoft.OSConfig/Test
     properties:
@@ -291,10 +242,7 @@ resources:
         properties:
           subcategory: '{0CCE9236-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditCredentialValidation
     type: Microsoft.OSConfig/Test
     properties:
@@ -303,10 +251,7 @@ resources:
         properties:
           subcategory: '{0CCE923F-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditDetailedFileShare
     type: Microsoft.OSConfig/Test
     properties:
@@ -315,10 +260,7 @@ resources:
         properties:
           subcategory: '{0CCE9244-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditDirectoryServiceAccess
     type: Microsoft.OSConfig/Test
     properties:
@@ -327,10 +269,7 @@ resources:
         properties:
           subcategory: '{0CCE923B-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditDirectoryServiceChanges
     type: Microsoft.OSConfig/Test
     properties:
@@ -339,10 +278,7 @@ resources:
         properties:
           subcategory: '{0CCE923C-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditDirectoryServiceReplication
     type: Microsoft.OSConfig/Test
     properties:
@@ -351,8 +287,7 @@ resources:
         properties:
           subcategory: '{0CCE923D-69AE-11D9-BED3-505054503030}'
           value: 0
-      schema:
-        minimum: 0
+      expression: (value != null && value >= 0)
   - name: AuditDistributionGroupManagement
     type: Microsoft.OSConfig/Test
     properties:
@@ -361,10 +296,7 @@ resources:
         properties:
           subcategory: '{0CCE9238-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditFileShare
     type: Microsoft.OSConfig/Test
     properties:
@@ -373,10 +305,7 @@ resources:
         properties:
           subcategory: '{0CCE9224-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditGroupMembership
     type: Microsoft.OSConfig/Test
     properties:
@@ -385,24 +314,18 @@ resources:
         properties:
           subcategory: '{0CCE9249-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditInsecureGuestLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditInsecureGuestLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditIPsecDriver
     type: Microsoft.OSConfig/Test
     properties:
@@ -411,10 +334,7 @@ resources:
         properties:
           subcategory: '{0CCE9213-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditKerberosAuthenticationService
     type: Microsoft.OSConfig/Test
     properties:
@@ -423,10 +343,7 @@ resources:
         properties:
           subcategory: '{0CCE9242-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditKerberosServiceTicketOperations
     type: Microsoft.OSConfig/Test
     properties:
@@ -435,10 +352,7 @@ resources:
         properties:
           subcategory: '{0CCE9240-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: AuditLogoff
     type: Microsoft.OSConfig/Test
     properties:
@@ -447,10 +361,7 @@ resources:
         properties:
           subcategory: '{0CCE9216-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditLogon
     type: Microsoft.OSConfig/Test
     properties:
@@ -459,10 +370,7 @@ resources:
         properties:
           subcategory: '{0CCE9215-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditMPSSVCRuleLevelPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -471,10 +379,7 @@ resources:
         properties:
           subcategory: '{0CCE9232-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherAccountManagementEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -483,10 +388,7 @@ resources:
         properties:
           subcategory: '{0CCE923A-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditOtherLogonLogoffEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -495,10 +397,7 @@ resources:
         properties:
           subcategory: '{0CCE921C-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherObjectAccessEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -507,10 +406,7 @@ resources:
         properties:
           subcategory: '{0CCE9227-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherPolicyChangeEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -519,10 +415,7 @@ resources:
         properties:
           subcategory: '{0CCE9234-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditOtherSystemEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -531,10 +424,7 @@ resources:
         properties:
           subcategory: '{0CCE9214-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditPnPExternalDevice
     type: Microsoft.OSConfig/Test
     properties:
@@ -543,10 +433,7 @@ resources:
         properties:
           subcategory: '{0CCE9248-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -555,10 +442,7 @@ resources:
         properties:
           subcategory: '{0CCE922F-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditProcessCreatedOrStarted
     type: Microsoft.OSConfig/Test
     properties:
@@ -567,10 +451,7 @@ resources:
         properties:
           subcategory: '{0CCE922B-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditRemovableStorage
     type: Microsoft.OSConfig/Test
     properties:
@@ -579,10 +460,7 @@ resources:
         properties:
           subcategory: '{0CCE9245-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditSecurityGroupManagement
     type: Microsoft.OSConfig/Test
     properties:
@@ -591,10 +469,7 @@ resources:
         properties:
           subcategory: '{0CCE9237-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSecurityStateChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -603,10 +478,7 @@ resources:
         properties:
           subcategory: '{0CCE9210-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSecuritySystemExtension
     type: Microsoft.OSConfig/Test
     properties:
@@ -615,10 +487,7 @@ resources:
         properties:
           subcategory: '{0CCE9211-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSensitivePrivilegeUse
     type: Microsoft.OSConfig/Test
     properties:
@@ -627,52 +496,40 @@ resources:
         properties:
           subcategory: '{0CCE9228-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditServerDoesNotSupportEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AuditServerDoesNotSupportEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditServerDoesNotSupportSigning
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AuditServerDoesNotSupportSigning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditSettingsIncludeCmdLine
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit
           valueName: ProcessCreationIncludeCmdLine_Enabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditSpecialLogon
     type: Microsoft.OSConfig/Test
     properties:
@@ -681,10 +538,7 @@ resources:
         properties:
           subcategory: '{0CCE921B-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSystemIntegrity
     type: Microsoft.OSConfig/Test
     properties:
@@ -693,10 +547,7 @@ resources:
         properties:
           subcategory: '{0CCE9212-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditUserAccountManagement
     type: Microsoft.OSConfig/Test
     properties:
@@ -705,409 +556,338 @@ resources:
         properties:
           subcategory: '{0CCE9235-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AutoplayDisallowAutoplayForNonVolumeDevices
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoAutoplayfornonVolume
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AutoplaySetDefaultAutoRunBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: NoAutorun
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AutoplayTurnOffAutoPlay
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: NoDriveTypeAutoRun
-          valueType: Dword
+          valueType: REG_DWORD
           value: 255
-      schema:
-        oneOf:
-          - const: 255
-          - type: 'null'
+      expression: ((((value == 255)) || ((value == null))))
   - name: BehaviorOfTheElevationPromptForAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ConsentPromptBehaviorAdmin
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: BehaviorOfTheElevationPromptForStandardUsers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ConsentPromptBehaviorUser
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: BlockConsumerMicrosoftAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftAccount
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\MicrosoftAccount
           valueName: DisableUserAuth
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: BlockNetbiosDiscovery
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Netlogon\Parameters
           valueName: BlockNetbiosDiscovery
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: BlockNTLM
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: BlockNTLM
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: BlockNTLMServerExceptionList
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: BlockNTLMServerExceptionList
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value: []
-      schema: {}
+      expression: 'true'
   - name: ClearVirtualMemoryPageFile
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Memory Management
           valueName: ClearPageFileAtShutdown
-          valueType: Dword
-      schema:
-        const: 0
+          valueType: REG_DWORD
+      expression: (value == 0)
   - name: ConfigureDNSClientNETBIOS
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
           valueName: EnableNetbios
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: ConfigureKernelShadowStacksLaunch
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
           valueName: ConfigureKernelShadowStacksLaunch
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: ConfigureSMBV1ClientDriver
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MrxSmb10
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\MrxSmb10
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 4
-      schema:
-        oneOf:
-          - const: 4
-          - type: 'null'
+      expression: ((((value == 4)) || ((value == null))))
   - name: ConfigureSMBV1Server
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: SMB1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ConnectivityDisableDownloadingOfPrintDriversOverHTTP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers
           valueName: DisableWebPnPDownload
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections
           valueName: NC_AllowNetBridge_NLA
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: CredentialProvidersAllowPINLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: AllowDomainPINLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: CredentialsDelegationRemoteHostAllowsDelegationOfNonExportableCredentials
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation
           valueName: AllowProtectedCreds
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: CredentialsUIDisablePasswordReveal
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredUI
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredUI
           valueName: DisablePasswordReveal
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: CredentialsUIEnumerateAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI
           valueName: EnumerateAdministrators
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: CredSspAllowEncryptionOracle
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
           valueName: AllowEncryptionOracle
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: CryptographyAllowedKerberosEncryptionTypes
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: SupportedEncryptionTypes
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2147483640
-      schema:
-        enum:
-          - 2147483624
-          - 2147483632
-          - 2147483640
+      expression: ([2147483624,2147483632,2147483640].exists(item, value == item))
   - name: CryptographyEccCurve
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
           valueName: EccCurves
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - NistP256
             - NistP384
-      schema: {}
+      expression: 'true'
   - name: CryptographyForceStrongKeyProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography
           valueName: ForceKeyProtection
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: CryptographySSLCipherSuites
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
           valueName: Functions
-          valueType: String
-          value: >-
-            TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
-      schema: {}
+          valueType: REG_SZ
+          value: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
+      expression: 'true'
   - name: DetectApplicationInstallationsAndPromptForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableInstallerDetection
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceGuardRequireMicrosoftSignedBootChain
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\DeviceGuard
           valueName: RequireMicrosoftSignedBootChain
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceGuardRequirePlatformSecurityFeatures
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/DeviceGuard/RequirePlatformSecurityFeatures
-          type: integer
+          keyPath: HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          valueName: RequirePlatformSecurityFeatures
+          valueType: REG_DWORD
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: DeviceGuardRequireUEFIMemoryAttributesTable
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
           valueName: HVCIMATRequired
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceInstallationPreventDeviceMetadataFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Device Metadata
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata
           valueName: PreventDeviceMetadataFromNetwork
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceLockAccountLockoutPolicy
     type: Microsoft.OSConfig/Test
     properties:
@@ -1116,7 +896,7 @@ resources:
         properties:
           name: LockoutDuration
           value: 15
-      schema: {}
+      expression: 'true'
   - name: DeviceLockAccountLockoutPolicy_LockoutThreshold
     type: Microsoft.OSConfig/Test
     properties:
@@ -1125,7 +905,7 @@ resources:
         properties:
           name: LockoutThreshold
           value: 3
-      schema: {}
+      expression: 'true'
   - name: DeviceLockAccountLockoutPolicy_LockoutReset
     type: Microsoft.OSConfig/Test
     properties:
@@ -1134,7 +914,7 @@ resources:
         properties:
           name: LockoutReset
           value: 15
-      schema: {}
+      expression: 'true'
   - name: DeviceLockClearTextPassword
     type: Microsoft.OSConfig/Test
     properties:
@@ -1143,10 +923,7 @@ resources:
         properties:
           name: EnablePasswordReversibleEncryption
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: DeviceLockMaximumPasswordAge
     type: Microsoft.OSConfig/Test
     properties:
@@ -1155,9 +932,7 @@ resources:
         properties:
           name: MaximumPasswordAge
           value: 42
-      schema:
-        minimum: 1
-        maximum: 60
+      expression: (value != null && value >= 1 && value <= 60)
   - name: DeviceLockMinimumPasswordAge
     type: Microsoft.OSConfig/Test
     properties:
@@ -1166,8 +941,7 @@ resources:
         properties:
           name: MinimumPasswordAge
           value: 1
-      schema:
-        minimum: 1
+      expression: (value != null && value >= 1)
   - name: DeviceLockPasswordComplexity
     type: Microsoft.OSConfig/Test
     properties:
@@ -1176,10 +950,7 @@ resources:
         properties:
           name: EnforcePasswordComplexity
           value: true
-      schema:
-        oneOf:
-          - const: true
-          - type: 'null'
+      expression: ((((value == true)) || ((value == null))))
   - name: DeviceLockPasswordHistorySize
     type: Microsoft.OSConfig/Test
     properties:
@@ -1188,307 +959,251 @@ resources:
         properties:
           name: PasswordHistoryLength
           value: 24
-      schema:
-        oneOf:
-          - const: 24
-          - type: 'null'
+      expression: ((((value == 24)) || ((value == null))))
   - name: DeviceLockPreventEnablingLockScreenCamera
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Personalization
           valueName: NoLockScreenCamera
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceLockPreventLockScreenSlideShow
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Personalization
           valueName: NoLockScreenSlideshow
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallyEncryptOrSignSecureChannelDataAlways
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: RequireSignOrSeal
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallyEncryptSecureChannelDataWhenPossible
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: SealSecureChannel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsAlwaysClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: RequireSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsAlwaysServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: RequireSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsIfClientAgrees
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: EnableSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsIfServerAgrees
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: EnableSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignSecureChannelDataWhenPossible
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: SignSecureChannel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DisableLocalAccountPasswordChanges
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: DisablePasswordChange
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: DisableSMBv1Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
           valueName: DependOnService
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - Bowser
             - MRxSmb20
             - NSI
-      schema: {}
+      expression: 'true'
   - name: DisconnectClientsWhenLogonHoursExpire
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: EnableForcedLogoff
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DmaGuardDeviceEnumerationPolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/DmaGuard/DeviceEnumerationPolicy
-          type: integer
+          keyPath: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection
+          valueName: DeviceEnumerationPolicy
+          valueType: REG_DWORD
           value: 0
-      schema:
-        enum:
-          - 0
-          - 1
+      expression: ([0,1].exists(item, value == item))
   - name: DnsClientTurn_Off_Multicast
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
           valueName: EnableMulticast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: DODownloadMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization
           valueName: DODownloadMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        enum:
-          - 0
-          - 1
-          - 2
-          - 99
-          - 100
+      expression: ([0,1,2,99,100].exists(item, value == item))
   - name: DoNotAllowAnonymousEnumerationOfSAMAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RestrictAnonymousSAM
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RestrictAnonymous
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DoNotDisplayLastSignedIn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DontDisplayLastUserName
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DoNotRequireCTRLALTDEL
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DisableCAD
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: EnableAuthRateLimiter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: EnableAuthRateLimiter
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: EnableAuthRateLimiterTimeout
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: InvalidAuthenticationDelayTimeInMs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2000
-      schema:
-        minimum: 2000
-        maximum: 5000
+      expression: (value != null && value >= 2000 && value <= 5000)
   - name: EnabledNTPClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
           valueName: Enabled
-          valueType: Dword
-      schema:
-        const: 0
+          valueType: REG_DWORD
+      expression: (value == 0)
   - name: EnableGuestAccountStatus
     type: Microsoft.OSConfig/Test
     properties:
@@ -1497,752 +1212,623 @@ resources:
         properties:
           name: EnableGuestAccount
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: EnableMailslotsLanmanServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Browser
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Browser
           valueName: EnableMailslots
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EnableMailslotsLanmanWorkstation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider
           valueName: EnableMailslots
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EnableStructuredExceptionHandlingOverwriteProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
           valueName: DisableExceptionChainValidation
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EncryptNTFSPagingFile
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies
           valueName: NtfsEncryptPagingFile
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: EventLogChannelSecurityLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogChannelSetupLogMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: EventLogChannelSetupLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogChannelSystemLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogPercentageThresholdSecurityEventLogMaximumSizeReached
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Eventlog\Security
           valueName: WarningLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 90
-      schema:
-        minimum: 50
-        maximum: 90
+      expression: (value != null && value >= 50 && value <= 90)
   - name: EventLogServiceControlEventLogBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogServiceSpecifyMaximumFileSizeApplicationLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: EventLogServiceSpecifyMaximumFileSizeSecurityLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 196608
-      schema:
-        minimum: 196608
+      expression: (value != null && value >= 196608)
   - name: EventLogServiceSpecifyMaximumFileSizeSystemLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: ExperienceAllowWindowsConsumerFeatures
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent
           valueName: DisableWindowsConsumerFeatures
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: ExperienceDisableConsumerAccountStateContent
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent
           valueName: DisableConsumerAccountStateContent
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ExperienceDoNotShowFeedbackNotifications
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
           valueName: DoNotShowFeedbackNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FileExplorerTurnOffHeapTerminationOnCorruption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoHeapTerminationOnCorruption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: FirewallDomainProfileApplyLocalConnectionSecurityRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: AllowLocalIPsecPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileApplyLocalFirewallRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: AllowLocalPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: FirewallDomainProfileDisplayNotification
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: DisableNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileInboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: DefaultInboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileLogDroppedPackets
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
           valueName: LogDroppedPackets
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileLogFileMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
           valueName: LogFileSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 16384
-      schema:
-        minimum: 16384
+      expression: (value != null && value >= 16384)
   - name: FirewallDomainProfileLogFileName
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
           valueName: LogFilePath
-          valueType: String
+          valueType: REG_SZ
           value: '%SystemRoot%\System32\logfiles\firewall\domainfw.log'
-      schema:
-        pattern: .log
+      expression: (value != null && value.matches(".log"))
   - name: FirewallDomainProfileLogSuccessfulConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
           valueName: LogSuccessfulConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileOutboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: DefaultOutboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallDomainProfileState
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: EnableFirewall
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileUnicastResponse
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: DisableUnicastResponsesToMulticastBroadcast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPrivateProfileApplyLocalConnectionSecurityRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: AllowLocalIPsecPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileApplyLocalFirewallRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: AllowLocalPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileDisplayNotification
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DisableNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileInboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DefaultInboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileLogDroppedPackets
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogDroppedPackets
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileLogFileMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogFileSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 16384
-      schema:
-        minimum: 16384
+      expression: (value != null && value >= 16384)
   - name: FirewallPrivateProfileLogFileName
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogFilePath
-          valueType: String
+          valueType: REG_SZ
           value: '%SystemRoot%\System32\logfiles\firewall\privatefw.log'
-      schema:
-        pattern: .log
+      expression: (value != null && value.matches(".log"))
   - name: FirewallPrivateProfileLogSuccessfulConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogSuccessfulConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileOutboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DefaultOutboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPrivateProfileState
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: EnableFirewall
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileUnicastResponse
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DisableUnicastResponsesToMulticastBroadcast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPublicProfileApplyLocalConnectionSecurityRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: AllowLocalIPsecPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileApplyLocalFirewallRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: AllowLocalPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileDisplayNotification
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DisableNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileInboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DefaultInboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileLogDroppedPackets
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogDroppedPackets
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileLogFileMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogFileSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 16384
-      schema:
-        minimum: 16384
+      expression: (value != null && value >= 16384)
   - name: FirewallPublicProfileLogFileName
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogFilePath
-          valueType: String
+          valueType: REG_SZ
           value: '%SystemRoot%\System32\logfiles\firewall\publicfw.log'
-      schema:
-        pattern: .log
+      expression: (value != null && value.matches(".log"))
   - name: FirewallPublicProfileLogSuccessfulConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogSuccessfulConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileOutboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DefaultOutboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPublicProfileState
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: EnableFirewall
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileUnicastResponse
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DisableUnicastResponsesToMulticastBroadcast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: SCENoApplyLegacyAuditPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: GroupPolicyDisableBackgroundPolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DisableBkGndGroupPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: GroupPolicyEnableCDP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: EnableCdp
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: GroupPolicyNoBackgroundPolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
           valueName: NoBackgroundPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: GroupPolicyNoGPOListChanges
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
           valueName: NoGPOListChanges
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: ICMNC_ExitOnISP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard
           valueName: ExitOnMSICW
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ImpersonateClient
     type: Microsoft.OSConfig/Test
     properties:
@@ -2255,780 +1841,641 @@ resources:
             - '*S-1-5-6'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: IPSourceRoutingProtectionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
           valueName: DisableIPSourceRouting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: IPv6SourceRoutingProtectionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
           valueName: DisableIPSourceRouting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: KDCHashAlgorithms
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITHashAlgorithmConfigurationEnabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA256
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA256
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA384
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA384
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA512
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA512
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithms
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITHashAlgorithmConfigurationEnabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA256
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA256
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA384
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA384
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA512
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA512
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LANManagerAuthenticationLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: LmCompatibilityLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 5
-      schema:
-        oneOf:
-          - const: 5
-          - type: 'null'
+      expression: ((((value == 5)) || ((value == null))))
   - name: LanmanWorkstationEnableInsecureGuestLogons
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AllowInsecureGuestAuth
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: LDAPClientSigningRequirements
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LDAP
           valueName: LDAPClientIntegrity
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: LDAPServerChannelBindingTokenRequirements
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
           valueName: LdapEnforceChannelBinding
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: LDAPServerLDAPServerIntegritySigningRequirementsEnforcement
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
           valueName: LDAPServerEnforceIntegrity
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LetEveryonePermissionsApplyToAnonymousUsers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: EveryoneIncludesAnonymous
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: LimitBlankPasswordUse
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: LogonBlockUserFromShowingAccountDetailsOnSignin
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: BlockUserFromShowingAccountDetailsOnSignin
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LogonDontEnumerateConnectedUsers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: DontEnumerateConnectedUsers
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LSAPPLProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RunAsPPL
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: MachineInactivityLimit
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: InactivityTimeoutSecs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 900
-      schema:
-        minimum: 1
-        maximum: 900
+      expression: (value != null && value >= 1 && value <= 900)
   - name: MaximumMachineAccountPasswordAge
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Netlogon\Parameters
           valueName: MaximumPasswordAge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 30
-      schema:
-        oneOf:
-          - const: 30
-          - type: 'null'
+      expression: ((((value == 30)) || ((value == null))))
   - name: MessageTextUserLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: LegalNoticeText
-          valueType: String
-          value: >-
-            This system is for authorized use only. Unauthorized access is prohibited and may be subject to criminal and
-            civil penalties. By logging in, you acknowledge and consent to monitoring and recording for security and
-            administrative purposes. If such monitoring reveals evidence of unauthorized activity, it may be provided to
-            appropriate authorities
-      schema: {}
+          valueType: REG_SZ
+          value: This system is for authorized use only. Unauthorized access is prohibited and may be subject to criminal and civil penalties. By logging in, you acknowledge and consent to monitoring and recording for security and administrative purposes. If such monitoring reveals evidence of unauthorized activity, it may be provided to appropriate authorities
+      expression: 'true'
   - name: MessageTextUserLogonTitle
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: LegalNoticeCaption
-          valueType: String
+          valueType: REG_SZ
           value: 'Notice to Users: Authorized Access Only'
-      schema: {}
+      expression: 'true'
   - name: MinimumSessionSecurityForNTLMSSPBasedClients
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: NTLMMinClientSec
-          valueType: Dword
+          valueType: REG_DWORD
           value: 537395200
-      schema:
-        oneOf:
-          - const: 537395200
-          - type: 'null'
+      expression: ((((value == 537395200)) || ((value == null))))
   - name: MinimumSessionSecurityForNTLMSSPBasedServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: NTLMMinServerSec
-          valueType: Dword
+          valueType: REG_DWORD
           value: 537395200
-      schema:
-        oneOf:
-          - const: 537395200
-          - type: 'null'
+      expression: ((((value == 537395200)) || ((value == null))))
   - name: MinimumSMBClientVersion
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: MinSmb2Dialect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 768
-      schema:
-        enum:
-          - 768
-          - 770
-          - 785
+      expression: ([768,770,785].exists(item, value == item))
   - name: MinimumSMBServerVersion
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: MinSmb2Dialect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 768
-      schema:
-        enum:
-          - 768
-          - 770
-          - 785
+      expression: ([768,770,785].exists(item, value == item))
   - name: MitigationOptionsFontBlocking
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
           valueName: MitigationOptions_FontBocking
-          valueType: String
+          valueType: REG_SZ
           value: '1000000000000'
-      schema:
-        oneOf:
-          - const: '1000000000000'
-          - type: 'null'
+      expression: ((((value == "1000000000000")) || ((value == null))))
   - name: NetBTNodeTypeConfiguration
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
           valueName: NodeType
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: NetworkConnectionsNC_ShowSharedAccessUI
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections
           valueName: NC_ShowSharedAccessUI
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: NetworkProviderHardenedPathsNETLOGON
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
           valueName: \\*\NETLOGON
-          valueType: String
+          valueType: REG_SZ
           value: RequireMutualAuthentication=1, RequireIntegrity=1
-      schema: {}
+      expression: 'true'
   - name: NetworkProviderHardenedPathsSYSVOL
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
           valueName: \\*\SYSVOL
-          valueType: String
+          valueType: REG_SZ
           value: RequireMutualAuthentication=1, RequireIntegrity=1
-      schema: {}
+      expression: 'true'
   - name: NetworkSecurityForceLogoffWhenLogonHoursExpire
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/NetworkSecurity_ForceLogoffWhenLogonHoursExpire
+          path: ./Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/NetworkSecurity_ForceLogoffWhenLogonHoursExpire
           type: integer
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableSecureUIAPaths
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: OverrideMinimumEnabledDTLSVersionClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledDTLSVersionClient
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledDTLSVersionClient
           type: string
           value: '1.2'
-      schema:
-        oneOf:
-          - const: '1.2'
-          - type: 'null'
+      expression: ((((value == "1.2")) || ((value == null))))
   - name: OverrideMinimumEnabledDTLSVersionServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledDTLSVersionServer
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledDTLSVersionServer
           type: string
           value: '1.2'
-      schema:
-        oneOf:
-          - const: '1.2'
-          - type: 'null'
+      expression: ((((value == "1.2")) || ((value == null))))
   - name: OverrideMinimumEnabledTLSVersionClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledTLSVersionClient
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledTLSVersionClient
           type: string
           value: '1.2'
-      schema: {}
+      expression: 'true'
   - name: OverrideMinimumEnabledTLSVersionServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledTLSVersionServer
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledTLSVersionServer
           type: string
           value: '1.2'
-      schema: {}
+      expression: 'true'
   - name: PowerShellExecutionPolicyEnableTranscripting
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
           valueName: EnableTranscripting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
           valueName: AddPrinterDrivers
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: PrintersRestrictDriverInstallationToAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
           valueName: RestrictDriverInstallationToAdministrators
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: PrivacyAllowInputPersonalization
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\InputPersonalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\InputPersonalization
           valueName: AllowInputPersonalization
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: PromptUserToChangePasswordBeforeExpiration
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
+          keyPath: HKEY_LOCAL_MACHINE:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
           valueName: PasswordExpiryWarning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 14
-      schema:
-        minimum: 5
-        maximum: 14
+      expression: (value != null && value >= 5 && value <= 14)
   - name: RDPPortNumber
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
           valueName: PortNumber
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3389
-      schema:
-        oneOf:
-          - const: 3389
-          - type: 'null'
+      expression: ((((value == 3389)) || ((value == null))))
   - name: RecoveryConsoleAllowFloppyCopyAndAllDrives
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: >-
-            ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/RecoveryConsole_AllowFloppyCopyAndAccessToAllDrivesAndAllFolders
-          type: integer
+          keyPath: HKLM:\SYSTEM\CurrentControlSet\Control\RecoveryConsole
+          valueName: SetCommand
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RefuseMachineAccountPasswordChanged
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: RefusePasswordChange
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteAssistanceSolicitedRemoteAssistance
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fAllowToGetHelp
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteAssistanceUnsolicitedRemoteAssistance
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fAllowUnsolicited
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteDesktopServicesClientConnectionEncryptionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: MinEncryptionLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema:
-        minimum: 3
-        maximum: 4
+      expression: (value != null && value >= 3 && value <= 4)
   - name: RemoteDesktopServicesDoNotAllowDriveRedirection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fDisableCdm
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesDoNotAllowPasswordSaving
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: DisablePasswordSaving
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesPromptForPasswordUponConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fPromptForPassword
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesRequireSecureRPCCommunication
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fEncryptRPCTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemotelyAccessibleRegistryPaths
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths
           valueName: Machine
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - System\CurrentControlSet\Control\ProductOptions
             - System\CurrentControlSet\Control\Server Applications
             - Software\Microsoft\Windows NT\CurrentVersion
-      schema: {}
+      expression: 'true'
   - name: RemotelyAccessibleRegistryPathsAndSubpaths
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths
           valueName: Machine
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - System\CurrentControlSet\Control\Print\Printers
             - System\CurrentControlSet\Services\Eventlog
@@ -3041,127 +2488,106 @@ resources:
             - System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration
             - Software\Microsoft\Windows NT\CurrentVersion\Perflib
             - System\CurrentControlSet\Services\SysmonLog
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowBasicAuthentication_Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowBasic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowBasicAuthentication_Service
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowBasic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowAutoConfig
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement_IPv4Filter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: IPv4Filter
-          valueType: String
+          valueType: REG_SZ
           value: '*'
-      schema:
-        oneOf:
-          - const: '*'
-          - type: 'null'
+      expression: ((((value == "*")) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement_IPv6Filter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: IPv6Filter
-          valueType: String
+          valueType: REG_SZ
           value: '*'
-      schema:
-        oneOf:
-          - const: '*'
-          - type: 'null'
+      expression: ((((value == "*")) || ((value == null))))
   - name: RemoteManagementAllowUnencryptedTraffic_Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowUnencryptedTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowUnencryptedTraffic_Service
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowUnencryptedTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementDisallowDigestAuthentication
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowDigest
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementDisallowStoringOfRunAsCredentials
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: DisableRunAs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RenameAdministratorAccount
     type: Microsoft.OSConfig/Test
     properties:
@@ -3169,7 +2595,7 @@ resources:
         type: Microsoft.Windows/AccountPolicy
         properties:
           name: AdministratorAccountName
-      schema: {}
+      expression: 'true'
   - name: RenameGuestAccount
     type: Microsoft.OSConfig/Test
     properties:
@@ -3177,406 +2603,347 @@ resources:
         type: Microsoft.Windows/AccountPolicy
         properties:
           name: GuestAccountName
-      schema: {}
+      expression: 'true'
   - name: RequireCaseInsensitivityForNonWindowsSubsystems
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Kernel
           valueName: ObCaseInsensitive
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: RequireEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: RequireEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: RequireStrongSessionKey
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: RequireStrongKey
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RestrictAnonymousAccessToNamedPipesAndShares
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: RestrictNullSessAccess
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: RSSDisableEnclosureDownload
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds
           valueName: DisableEnclosureDownload
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RunAllAdministratorsInAdminApprovalMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableLUA
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SafeDllSearchMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager
           valueName: SafeDllSearchMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SAMRPCPasswordChangePolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM
           valueName: SamrChangeUserPasswordApiPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: SearchAllowIndexingEncryptedStoresOrItems
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Windows Search
           valueName: AllowIndexingEncryptedStoresOrItems
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: SendUnencryptedPasswordToThirdPartySMBServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: EnablePlainTextPassword
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ServerSPNTargetNameValidationLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\LanManServer\Parameters
           valueName: SMBServerNameHardeningLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SharesThatCanBeAccessedAnonymously
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: NullSessionShares
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value: []
-      schema: {}
+      expression: 'true'
   - name: SharingAndSecurityModelForLocalAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: ForceGuest
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ShellDataExecutionPrevention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoDataExecutionPrevention
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ShutdownSystemImmediatelyIfUnableToLogSecurityAudits
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: CrashOnAuditFail
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: SmartCardRemovalBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
-          type: string
+          keyPath: HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+          valueName: ScRemoveOption
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")
   - name: SmartScreenEnableSmartScreenInShell
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: EnableSmartScreen
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SmartScreenPreventOverrideForFilesInShell
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: ShellSmartScreenLevel
-          valueType: String
+          valueType: REG_SZ
           value: Block
-      schema:
-        oneOf:
-          - const: Block
-          - type: 'null'
+      expression: ((((value == "Block")) || ((value == null))))
   - name: StrengthenDefaultPermissionsOfInternalSystemObjects
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager
           valueName: ProtectionMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SwitchToTheSecureDesktopWhenPromptingForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: PromptOnSecureDesktop
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SystemAllowTelemetry
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
           valueName: AllowTelemetry
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: SystemBootStartDriverInitialization
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch
           valueName: DriverLoadPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema: {}
+      expression: 'true'
   - name: SystemEnableSoftwareRestrictionPolicies
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
           valueName: AuthenticodeEnabled
-          valueType: Dword
-      schema:
-        const: 0
+          valueType: REG_DWORD
+      expression: (value == 0)
   - name: SystemMinimizeInternetConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy
           valueName: fMinimizeConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: SystemWindowsSearchService
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wsearch
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Wsearch
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 4
-      schema:
-        oneOf:
-          - const: 4
-          - type: 'null'
+      expression: ((((value == 4)) || ((value == null))))
   - name: TerminalServerTS_TEMP_DELETE
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: DeleteTempDirsOnExit
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TerminalServerTS_TEMP_PER_SESSION
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: PerSessionTempDir
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TerminalServerTS_USER_AUTHENTICATION_POLICY
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: UserAuthentication
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TurnOff_Windows_Error_Reporting
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\AppCompat
           valueName: DisableInventory
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TurnOffPrintingOverHTTP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers
           valueName: DisableHTTPPrinting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: UseAdminApprovalMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: FilterAdministratorToken
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: UserRightsAccessCredentialManagerAsTrustedCaller
     type: Microsoft.OSConfig/Test
     properties:
@@ -3585,7 +2952,7 @@ resources:
         properties:
           name: SeTrustedCredManAccessPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsAccessFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
@@ -3597,7 +2964,7 @@ resources:
             - '*S-1-5-11'
             - '*S-1-5-32-544'
             - '*S-1-5-9'
-      schema: {}
+      expression: 'true'
   - name: UserRightsActAsPartOfTheOperatingSystem
     type: Microsoft.OSConfig/Test
     properties:
@@ -3606,7 +2973,7 @@ resources:
         properties:
           name: SeTcbPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsAdjustMemoryQuotasForProcess
     type: Microsoft.OSConfig/Test
     properties:
@@ -3618,7 +2985,7 @@ resources:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsAllowLocalLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3629,7 +2996,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-9'
-      schema: {}
+      expression: 'true'
   - name: UserRightsAllowLogOnThroughRemoteDesktop
     type: Microsoft.OSConfig/Test
     properties:
@@ -3639,7 +3006,7 @@ resources:
           name: SeRemoteInteractiveLogonRight
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsBackupFilesAndDirectories
     type: Microsoft.OSConfig/Test
     properties:
@@ -3649,7 +3016,7 @@ resources:
           name: SeBackupPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsChangeSystemTime
     type: Microsoft.OSConfig/Test
     properties:
@@ -3661,7 +3028,7 @@ resources:
             - '*S-1-5-32-544'
             - '*S-1-5-32-549'
             - '*S-1-5-19'
-      schema: {}
+      expression: 'true'
   - name: UserRightsChangeTimeZone
     type: Microsoft.OSConfig/Test
     properties:
@@ -3672,7 +3039,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateGlobalObjects
     type: Microsoft.OSConfig/Test
     properties:
@@ -3685,7 +3052,7 @@ resources:
             - '*S-1-5-6'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreatePageFile
     type: Microsoft.OSConfig/Test
     properties:
@@ -3695,7 +3062,7 @@ resources:
           name: SeCreatePagefilePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreatePermanentSharedObjects
     type: Microsoft.OSConfig/Test
     properties:
@@ -3704,7 +3071,7 @@ resources:
         properties:
           name: SeCreatePermanentPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateSymbolicLinks
     type: Microsoft.OSConfig/Test
     properties:
@@ -3715,7 +3082,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-83-0'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateToken
     type: Microsoft.OSConfig/Test
     properties:
@@ -3724,7 +3091,7 @@ resources:
         properties:
           name: SeCreateTokenPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsDebugPrograms
     type: Microsoft.OSConfig/Test
     properties:
@@ -3734,7 +3101,7 @@ resources:
           name: SeDebugPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyAccessFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
@@ -3744,7 +3111,7 @@ resources:
           name: SeDenyNetworkLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLocalLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3754,7 +3121,7 @@ resources:
           name: SeDenyInteractiveLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLogOnAsBatchJob
     type: Microsoft.OSConfig/Test
     properties:
@@ -3764,7 +3131,7 @@ resources:
           name: SeDenyBatchLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLogOnAsService
     type: Microsoft.OSConfig/Test
     properties:
@@ -3774,7 +3141,7 @@ resources:
           name: SeDenyServiceLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyRemoteDesktopServicesLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3784,7 +3151,7 @@ resources:
           name: SeDenyRemoteInteractiveLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsEnableDelegation
     type: Microsoft.OSConfig/Test
     properties:
@@ -3794,7 +3161,7 @@ resources:
           name: SeEnableDelegationPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsGenerateSecurityAudits
     type: Microsoft.OSConfig/Test
     properties:
@@ -3806,7 +3173,7 @@ resources:
             - '*S-1-5-19'
             - '*S-1-5-20'
             - '*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415'
-      schema: {}
+      expression: 'true'
   - name: UserRightsIncreaseSchedulingPriority
     type: Microsoft.OSConfig/Test
     properties:
@@ -3816,7 +3183,7 @@ resources:
           name: SeIncreaseBasePriorityPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsLoadUnloadDeviceDrivers
     type: Microsoft.OSConfig/Test
     properties:
@@ -3827,7 +3194,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-32-550'
-      schema: {}
+      expression: 'true'
   - name: UserRightsLockMemory
     type: Microsoft.OSConfig/Test
     properties:
@@ -3836,7 +3203,7 @@ resources:
         properties:
           name: SeLockMemoryPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsManageAuditingAndSecurityLog
     type: Microsoft.OSConfig/Test
     properties:
@@ -3846,7 +3213,7 @@ resources:
           name: SeSecurityPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsManageVolume
     type: Microsoft.OSConfig/Test
     properties:
@@ -3856,7 +3223,7 @@ resources:
           name: SeManageVolumePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsModifyFirmwareEnvironment
     type: Microsoft.OSConfig/Test
     properties:
@@ -3866,7 +3233,7 @@ resources:
           name: SeSystemEnvironmentPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsModifyObjectLabel
     type: Microsoft.OSConfig/Test
     properties:
@@ -3875,7 +3242,7 @@ resources:
         properties:
           name: SeRelabelPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsProfileSingleProcess
     type: Microsoft.OSConfig/Test
     properties:
@@ -3885,7 +3252,7 @@ resources:
           name: SeProfileSingleProcessPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsProfileSystemPerformance
     type: Microsoft.OSConfig/Test
     properties:
@@ -3896,7 +3263,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420'
-      schema: {}
+      expression: 'true'
   - name: UserRightsRemoteShutdown
     type: Microsoft.OSConfig/Test
     properties:
@@ -3906,7 +3273,7 @@ resources:
           name: SeRemoteShutdownPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsReplaceProcessLevelToken
     type: Microsoft.OSConfig/Test
     properties:
@@ -3917,7 +3284,7 @@ resources:
           value:
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsRestoreFilesAndDirectories
     type: Microsoft.OSConfig/Test
     properties:
@@ -3927,7 +3294,7 @@ resources:
           name: SeRestorePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsShutDownTheSystem
     type: Microsoft.OSConfig/Test
     properties:
@@ -3937,7 +3304,7 @@ resources:
           name: SeShutdownPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsTakeOwnership
     type: Microsoft.OSConfig/Test
     properties:
@@ -3947,137 +3314,114 @@ resources:
           name: SeTakeOwnershipPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableVirtualization
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsExplorerShellProtocolProtectedModeTitle_2
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: PreXPSP2ShellProtocolBehavior
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: WindowsHelloAntiSpoofing
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures
           valueName: EnhancedAntiSpoofing
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonAllowAutomaticRestartSignOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DisableAutomaticRestartSignOn
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonConfigAutomaticRestartSignOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: AutomaticRestartSignOnConfig
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonDisableLockScreenAppNotifications
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: DisableLockScreenAppNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonDontDisplayNetworkSelectionUI
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: DontDisplayNetworkSelectionUI
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsPowerShellTurnOnPowerShellScriptBlockLogging
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
           valueName: EnableScriptBlockLogging
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WinVerityTrustSignatureValidationVulnerabilityMitigation1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Wintrust\Config
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config
           valueName: EnableCertPaddingCheck
-          valueType: String
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")
   - name: WinVerityTrustSignatureValidationVulnerabilityMitigation2
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config
           valueName: EnableCertPaddingCheck
-          valueType: String
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")
diff --git a/public/_baselines/ws2025-member-server.osc.yaml b/public/_baselines/ws2025-member-server.osc.yaml
index 4291613..00972db 100644
--- a/public/_baselines/ws2025-member-server.osc.yaml
+++ b/public/_baselines/ws2025-member-server.osc.yaml
@@ -6,14 +6,11 @@ resources:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Afd\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Afd\Parameters
           valueName: DisableAddressSharing
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowAnonymousSIDOrNameTranslation
     type: Microsoft.OSConfig/Test
     properties:
@@ -22,204 +19,172 @@ resources:
         properties:
           name: EnableAnonymousNameTranslation
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: AllowCustomSSPAPIntoLSASS
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: AllowCustomSSPsAPs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowedToFormatAndEjectRemovableMedia
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
           valueName: AllocateDASD
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: AllowICMPRedirectsToOverrideOSPFGeneratedRoutes
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
           valueName: EnableICMPRedirect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: AllowLocalSystemNULLSessionFallback
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: AllowNullSessionFallback
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: AllowLocalSystemToUseComputerIdentityForNTLM
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: UseMachineId
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowPKU2UAuthenticationAllowOnlineID
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\pku2u
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\pku2u
           valueName: AllowOnlineID
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowSystemToBeShutDownWithoutHavingToLogOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ShutdownWithoutLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
           valueName: NoNameReleaseOnDemand
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowUIAccessApplicationsToPromptForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableUIADesktopToggle
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: AmountOfIdleTimeRequiredBeforeSuspendingSession
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: AutoDisconnect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 15
-      schema:
-        minimum: 1
-        maximum: 15
+      expression: (value != null && value >= 1 && value <= 15)
   - name: ApplicationIdentityStartupType
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppIDSvc
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\AppIDSvc
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: ApplicationManagementMSIAllowUserControlOverInstall
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer
           valueName: EnableUserControl
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer
           valueName: AlwaysInstallElevated
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ApplyUACRestrictionsToLocalAccountsOnNetworkLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: LocalAccountTokenFilterPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: AppRuntimeAllowMicrosoftAccountsToBeOptional
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: MSAOptional
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditAccountLockout
     type: Microsoft.OSConfig/Test
     properties:
@@ -228,10 +193,7 @@ resources:
         properties:
           subcategory: '{0CCE9217-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditAuthenticationPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -240,10 +202,7 @@ resources:
         properties:
           subcategory: '{0CCE9230-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditAuthorizationPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -252,51 +211,40 @@ resources:
         properties:
           subcategory: '{0CCE9231-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditBackupAndRestorePrivilege
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Audit_AuditTheUseOfBackupAndRestoreprivilege
-          type: string
-          value: MDA=
-      schema:
-        oneOf:
-          - const: MDA=
-          - type: 'null'
+          keyPath: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa
+          valueName: FullPrivilegeAuditing
+          valueType: REG_BINARY
+          value: AA==
+      expression: '["MDA=","AA=="].exists(item, value == item)'
   - name: AuditClientDoesNotSupportEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditClientDoesNotSupportEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditClientDoesNotSupportSigning
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditClientDoesNotSupportSigning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditCredentialValidation
     type: Microsoft.OSConfig/Test
     properties:
@@ -305,10 +253,7 @@ resources:
         properties:
           subcategory: '{0CCE923F-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditDetailedFileShare
     type: Microsoft.OSConfig/Test
     properties:
@@ -317,10 +262,7 @@ resources:
         properties:
           subcategory: '{0CCE9244-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditFileShare
     type: Microsoft.OSConfig/Test
     properties:
@@ -329,10 +271,7 @@ resources:
         properties:
           subcategory: '{0CCE9224-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditGroupMembership
     type: Microsoft.OSConfig/Test
     properties:
@@ -341,24 +280,18 @@ resources:
         properties:
           subcategory: '{0CCE9249-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditInsecureGuestLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditInsecureGuestLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditIPsecDriver
     type: Microsoft.OSConfig/Test
     properties:
@@ -367,10 +300,7 @@ resources:
         properties:
           subcategory: '{0CCE9213-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditLogoff
     type: Microsoft.OSConfig/Test
     properties:
@@ -379,10 +309,7 @@ resources:
         properties:
           subcategory: '{0CCE9216-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditLogon
     type: Microsoft.OSConfig/Test
     properties:
@@ -391,10 +318,7 @@ resources:
         properties:
           subcategory: '{0CCE9215-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditMPSSVCRuleLevelPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -403,10 +327,7 @@ resources:
         properties:
           subcategory: '{0CCE9232-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherLogonLogoffEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -415,10 +336,7 @@ resources:
         properties:
           subcategory: '{0CCE921C-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherObjectAccessEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -427,10 +345,7 @@ resources:
         properties:
           subcategory: '{0CCE9227-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherPolicyChangeEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -439,10 +354,7 @@ resources:
         properties:
           subcategory: '{0CCE9234-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditOtherSystemEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -451,10 +363,7 @@ resources:
         properties:
           subcategory: '{0CCE9214-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditPnPExternalDevice
     type: Microsoft.OSConfig/Test
     properties:
@@ -463,10 +372,7 @@ resources:
         properties:
           subcategory: '{0CCE9248-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -475,10 +381,7 @@ resources:
         properties:
           subcategory: '{0CCE922F-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditProcessCreatedOrStarted
     type: Microsoft.OSConfig/Test
     properties:
@@ -487,10 +390,7 @@ resources:
         properties:
           subcategory: '{0CCE922B-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditRemovableStorage
     type: Microsoft.OSConfig/Test
     properties:
@@ -499,10 +399,7 @@ resources:
         properties:
           subcategory: '{0CCE9245-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditSecurityGroupManagement
     type: Microsoft.OSConfig/Test
     properties:
@@ -511,10 +408,7 @@ resources:
         properties:
           subcategory: '{0CCE9237-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSecurityStateChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -523,10 +417,7 @@ resources:
         properties:
           subcategory: '{0CCE9210-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSecuritySystemExtension
     type: Microsoft.OSConfig/Test
     properties:
@@ -535,10 +426,7 @@ resources:
         properties:
           subcategory: '{0CCE9211-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSensitivePrivilegeUse
     type: Microsoft.OSConfig/Test
     properties:
@@ -547,52 +435,40 @@ resources:
         properties:
           subcategory: '{0CCE9228-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditServerDoesNotSupportEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AuditServerDoesNotSupportEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditServerDoesNotSupportSigning
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AuditServerDoesNotSupportSigning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditSettingsIncludeCmdLine
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit
           valueName: ProcessCreationIncludeCmdLine_Enabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditSpecialLogon
     type: Microsoft.OSConfig/Test
     properties:
@@ -601,10 +477,7 @@ resources:
         properties:
           subcategory: '{0CCE921B-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSystemIntegrity
     type: Microsoft.OSConfig/Test
     properties:
@@ -613,10 +486,7 @@ resources:
         properties:
           subcategory: '{0CCE9212-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditUserAccountManagement
     type: Microsoft.OSConfig/Test
     properties:
@@ -625,422 +495,350 @@ resources:
         properties:
           subcategory: '{0CCE9235-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AutoplayDisallowAutoplayForNonVolumeDevices
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoAutoplayfornonVolume
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AutoplaySetDefaultAutoRunBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: NoAutorun
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AutoplayTurnOffAutoPlay
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: NoDriveTypeAutoRun
-          valueType: Dword
+          valueType: REG_DWORD
           value: 255
-      schema:
-        oneOf:
-          - const: 255
-          - type: 'null'
+      expression: ((((value == 255)) || ((value == null))))
   - name: BehaviorOfTheElevationPromptForAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ConsentPromptBehaviorAdmin
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: BehaviorOfTheElevationPromptForStandardUsers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ConsentPromptBehaviorUser
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: BlockConsumerMicrosoftAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftAccount
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\MicrosoftAccount
           valueName: DisableUserAuth
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: BlockNetbiosDiscovery
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Netlogon\Parameters
           valueName: BlockNetbiosDiscovery
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: BlockNTLM
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: BlockNTLM
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: BlockNTLMServerExceptionList
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: BlockNTLMServerExceptionList
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value: []
-      schema: {}
+      expression: 'true'
   - name: ClearVirtualMemoryPageFile
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Memory Management
           valueName: ClearPageFileAtShutdown
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ConfigureDNSClientNETBIOS
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
           valueName: EnableNetbios
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: ConfigureKernelShadowStacksLaunch
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
           valueName: ConfigureKernelShadowStacksLaunch
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: ConfigureSMBV1ClientDriver
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MrxSmb10
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\MrxSmb10
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 4
-      schema:
-        oneOf:
-          - const: 4
-          - type: 'null'
+      expression: ((((value == 4)) || ((value == null))))
   - name: ConfigureSMBV1Server
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: SMB1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ConnectivityDisableDownloadingOfPrintDriversOverHTTP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers
           valueName: DisableWebPnPDownload
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections
           valueName: NC_AllowNetBridge_NLA
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: CredentialProvidersAllowPINLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: AllowDomainPINLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: CredentialsDelegationRemoteHostAllowsDelegationOfNonExportableCredentials
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation
           valueName: AllowProtectedCreds
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: CredentialsUIDisablePasswordReveal
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredUI
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredUI
           valueName: DisablePasswordReveal
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: CredentialsUIEnumerateAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI
           valueName: EnumerateAdministrators
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: CredSspAllowEncryptionOracle
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
           valueName: AllowEncryptionOracle
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: CryptographyAllowedKerberosEncryptionTypes
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: SupportedEncryptionTypes
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2147483640
-      schema:
-        enum:
-          - 2147483624
-          - 2147483632
-          - 2147483640
+      expression: ([2147483624,2147483632,2147483640].exists(item, value == item))
   - name: CryptographyEccCurve
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
           valueName: EccCurves
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - NistP256
             - NistP384
-      schema: {}
+      expression: 'true'
   - name: CryptographyForceStrongKeyProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography
           valueName: ForceKeyProtection
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: CryptographySSLCipherSuites
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
           valueName: Functions
-          valueType: String
-          value: >-
-            TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
-      schema: {}
+          valueType: REG_SZ
+          value: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
+      expression: 'true'
   - name: DetectApplicationInstallationsAndPromptForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableInstallerDetection
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceGuardLsaCfgFlags
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: LsaCfgFlags
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: DeviceGuardRequireMicrosoftSignedBootChain
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\DeviceGuard
           valueName: RequireMicrosoftSignedBootChain
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceGuardRequirePlatformSecurityFeatures
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/DeviceGuard/RequirePlatformSecurityFeatures
-          type: integer
+          keyPath: HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          valueName: RequirePlatformSecurityFeatures
+          valueType: REG_DWORD
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: DeviceGuardRequireUEFIMemoryAttributesTable
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
           valueName: HVCIMATRequired
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceInstallationPreventDeviceMetadataFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Device Metadata
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata
           valueName: PreventDeviceMetadataFromNetwork
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceLockAccountLockoutPolicy
     type: Microsoft.OSConfig/Test
     properties:
@@ -1049,7 +847,7 @@ resources:
         properties:
           name: LockoutDuration
           value: 15
-      schema: {}
+      expression: 'true'
   - name: DeviceLockAccountLockoutPolicy_LockoutThreshold
     type: Microsoft.OSConfig/Test
     properties:
@@ -1058,7 +856,7 @@ resources:
         properties:
           name: LockoutThreshold
           value: 3
-      schema: {}
+      expression: 'true'
   - name: DeviceLockAccountLockoutPolicy_LockoutReset
     type: Microsoft.OSConfig/Test
     properties:
@@ -1067,7 +865,7 @@ resources:
         properties:
           name: LockoutReset
           value: 15
-      schema: {}
+      expression: 'true'
   - name: DeviceLockClearTextPassword
     type: Microsoft.OSConfig/Test
     properties:
@@ -1076,10 +874,7 @@ resources:
         properties:
           name: EnablePasswordReversibleEncryption
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: DeviceLockMaximumPasswordAge
     type: Microsoft.OSConfig/Test
     properties:
@@ -1088,9 +883,7 @@ resources:
         properties:
           name: MaximumPasswordAge
           value: 42
-      schema:
-        minimum: 1
-        maximum: 60
+      expression: (value != null && value >= 1 && value <= 60)
   - name: DeviceLockMinimumPasswordAge
     type: Microsoft.OSConfig/Test
     properties:
@@ -1099,8 +892,7 @@ resources:
         properties:
           name: MinimumPasswordAge
           value: 1
-      schema:
-        minimum: 1
+      expression: (value != null && value >= 1)
   - name: DeviceLockMinimumPasswordLength
     type: Microsoft.OSConfig/Test
     properties:
@@ -1109,8 +901,7 @@ resources:
         properties:
           name: MinimumPasswordLength
           value: 14
-      schema:
-        minimum: 14
+      expression: (value != null && value >= 14)
   - name: DeviceLockPasswordComplexity
     type: Microsoft.OSConfig/Test
     properties:
@@ -1119,10 +910,7 @@ resources:
         properties:
           name: EnforcePasswordComplexity
           value: true
-      schema:
-        oneOf:
-          - const: true
-          - type: 'null'
+      expression: ((((value == true)) || ((value == null))))
   - name: DeviceLockPasswordHistorySize
     type: Microsoft.OSConfig/Test
     properties:
@@ -1131,321 +919,262 @@ resources:
         properties:
           name: PasswordHistoryLength
           value: 24
-      schema:
-        oneOf:
-          - const: 24
-          - type: 'null'
+      expression: ((((value == 24)) || ((value == null))))
   - name: DeviceLockPreventEnablingLockScreenCamera
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Personalization
           valueName: NoLockScreenCamera
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceLockPreventLockScreenSlideShow
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Personalization
           valueName: NoLockScreenSlideshow
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallyEncryptOrSignSecureChannelDataAlways
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: RequireSignOrSeal
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallyEncryptSecureChannelDataWhenPossible
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: SealSecureChannel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsAlwaysClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: RequireSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsAlwaysServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: RequireSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsIfClientAgrees
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: EnableSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsIfServerAgrees
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: EnableSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignSecureChannelDataWhenPossible
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: SignSecureChannel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DisableLocalAccountPasswordChanges
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: DisablePasswordChange
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: DisableSMBv1Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
           valueName: DependOnService
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - Bowser
             - MRxSmb20
             - NSI
-      schema: {}
+      expression: 'true'
   - name: DisconnectClientsWhenLogonHoursExpire
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: EnableForcedLogoff
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DmaGuardDeviceEnumerationPolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/DmaGuard/DeviceEnumerationPolicy
-          type: integer
+          keyPath: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection
+          valueName: DeviceEnumerationPolicy
+          valueType: REG_DWORD
           value: 0
-      schema:
-        enum:
-          - 0
-          - 1
+      expression: ([0,1].exists(item, value == item))
   - name: DnsClientTurn_Off_Multicast
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
           valueName: EnableMulticast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: DODownloadMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization
           valueName: DODownloadMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        enum:
-          - 0
-          - 1
-          - 2
-          - 99
-          - 100
+      expression: ([0,1,2,99,100].exists(item, value == item))
   - name: DoNotAllowAnonymousEnumerationOfSAMAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RestrictAnonymousSAM
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RestrictAnonymous
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DoNotDisplayLastSignedIn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DontDisplayLastUserName
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DoNotRequireCTRLALTDEL
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DisableCAD
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: EnableAuthEpResolution
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc
           valueName: EnableAuthEpResolution
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: EnableAuthRateLimiter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: EnableAuthRateLimiter
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: EnableAuthRateLimiterTimeout
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: InvalidAuthenticationDelayTimeInMs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2000
-      schema:
-        minimum: 2000
-        maximum: 5000
+      expression: (value != null && value >= 2000 && value <= 5000)
   - name: EnabledNTPClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
           valueName: Enabled
-          valueType: Dword
-      schema:
-        const: 0
+          valueType: REG_DWORD
+      expression: (value == 0)
   - name: EnableGuestAccountStatus
     type: Microsoft.OSConfig/Test
     properties:
@@ -1454,752 +1183,623 @@ resources:
         properties:
           name: EnableGuestAccount
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: EnableMailslotsLanmanServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Browser
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Browser
           valueName: EnableMailslots
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EnableMailslotsLanmanWorkstation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider
           valueName: EnableMailslots
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EnableStructuredExceptionHandlingOverwriteProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
           valueName: DisableExceptionChainValidation
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EncryptNTFSPagingFile
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies
           valueName: NtfsEncryptPagingFile
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: EventLogChannelSecurityLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogChannelSetupLogMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: EventLogChannelSetupLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogChannelSystemLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogPercentageThresholdSecurityEventLogMaximumSizeReached
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Eventlog\Security
           valueName: WarningLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 90
-      schema:
-        minimum: 50
-        maximum: 90
+      expression: (value != null && value >= 50 && value <= 90)
   - name: EventLogServiceControlEventLogBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogServiceSpecifyMaximumFileSizeApplicationLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: EventLogServiceSpecifyMaximumFileSizeSecurityLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 196608
-      schema:
-        minimum: 196608
+      expression: (value != null && value >= 196608)
   - name: EventLogServiceSpecifyMaximumFileSizeSystemLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: ExperienceAllowWindowsConsumerFeatures
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent
           valueName: DisableWindowsConsumerFeatures
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: ExperienceDisableConsumerAccountStateContent
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent
           valueName: DisableConsumerAccountStateContent
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ExperienceDoNotShowFeedbackNotifications
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
           valueName: DoNotShowFeedbackNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FileExplorerTurnOffHeapTerminationOnCorruption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoHeapTerminationOnCorruption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: FirewallDomainProfileApplyLocalConnectionSecurityRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: AllowLocalIPsecPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileApplyLocalFirewallRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: AllowLocalPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: FirewallDomainProfileDisplayNotification
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: DisableNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileInboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: DefaultInboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileLogDroppedPackets
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
           valueName: LogDroppedPackets
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileLogFileMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
           valueName: LogFileSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 16384
-      schema:
-        minimum: 16384
+      expression: (value != null && value >= 16384)
   - name: FirewallDomainProfileLogFileName
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
           valueName: LogFilePath
-          valueType: String
+          valueType: REG_SZ
           value: '%SystemRoot%\System32\logfiles\firewall\domainfw.log'
-      schema:
-        pattern: .log
+      expression: (value != null && value.matches(".log"))
   - name: FirewallDomainProfileLogSuccessfulConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging
           valueName: LogSuccessfulConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileOutboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: DefaultOutboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallDomainProfileState
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: EnableFirewall
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallDomainProfileUnicastResponse
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
           valueName: DisableUnicastResponsesToMulticastBroadcast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPrivateProfileApplyLocalConnectionSecurityRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: AllowLocalIPsecPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileApplyLocalFirewallRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: AllowLocalPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileDisplayNotification
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DisableNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileInboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DefaultInboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileLogDroppedPackets
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogDroppedPackets
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileLogFileMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogFileSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 16384
-      schema:
-        minimum: 16384
+      expression: (value != null && value >= 16384)
   - name: FirewallPrivateProfileLogFileName
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogFilePath
-          valueType: String
+          valueType: REG_SZ
           value: '%SystemRoot%\System32\logfiles\firewall\privatefw.log'
-      schema:
-        pattern: .log
+      expression: (value != null && value.matches(".log"))
   - name: FirewallPrivateProfileLogSuccessfulConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogSuccessfulConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileOutboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DefaultOutboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPrivateProfileState
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: EnableFirewall
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileUnicastResponse
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DisableUnicastResponsesToMulticastBroadcast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPublicProfileApplyLocalConnectionSecurityRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: AllowLocalIPsecPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileApplyLocalFirewallRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: AllowLocalPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileDisplayNotification
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DisableNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileInboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DefaultInboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileLogDroppedPackets
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogDroppedPackets
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileLogFileMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogFileSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 16384
-      schema:
-        minimum: 16384
+      expression: (value != null && value >= 16384)
   - name: FirewallPublicProfileLogFileName
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogFilePath
-          valueType: String
+          valueType: REG_SZ
           value: '%SystemRoot%\System32\logfiles\firewall\publicfw.log'
-      schema:
-        pattern: .log
+      expression: (value != null && value.matches(".log"))
   - name: FirewallPublicProfileLogSuccessfulConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogSuccessfulConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileOutboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DefaultOutboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPublicProfileState
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: EnableFirewall
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileUnicastResponse
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DisableUnicastResponsesToMulticastBroadcast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: SCENoApplyLegacyAuditPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: GroupPolicyDisableBackgroundPolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DisableBkGndGroupPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: GroupPolicyEnableCDP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: EnableCdp
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: GroupPolicyNoBackgroundPolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
           valueName: NoBackgroundPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: GroupPolicyNoGPOListChanges
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
           valueName: NoGPOListChanges
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: ICMNC_ExitOnISP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard
           valueName: ExitOnMSICW
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ImpersonateClient
     type: Microsoft.OSConfig/Test
     properties:
@@ -2212,738 +1812,608 @@ resources:
             - '*S-1-5-6'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: IPSourceRoutingProtectionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
           valueName: DisableIPSourceRouting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: IPv6SourceRoutingProtectionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
           valueName: DisableIPSourceRouting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: KDCHashAlgorithms
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITHashAlgorithmConfigurationEnabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA256
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA256
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA384
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA384
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA512
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA512
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithms
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITHashAlgorithmConfigurationEnabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA256
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA256
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA384
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA384
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA512
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA512
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LANManagerAuthenticationLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: LmCompatibilityLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 5
-      schema:
-        oneOf:
-          - const: 5
-          - type: 'null'
+      expression: ((((value == 5)) || ((value == null))))
   - name: LanmanWorkstationEnableInsecureGuestLogons
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AllowInsecureGuestAuth
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: LDAPClientSigningRequirements
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LDAP
           valueName: LDAPClientIntegrity
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: LetEveryonePermissionsApplyToAnonymousUsers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: EveryoneIncludesAnonymous
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: LimitBlankPasswordUse
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: LogonBlockUserFromShowingAccountDetailsOnSignin
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: BlockUserFromShowingAccountDetailsOnSignin
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LogonDontEnumerateConnectedUsers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: DontEnumerateConnectedUsers
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LSAPPLProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RunAsPPL
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: MachineInactivityLimit
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: InactivityTimeoutSecs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 900
-      schema:
-        minimum: 1
-        maximum: 900
+      expression: (value != null && value >= 1 && value <= 900)
   - name: MaximumMachineAccountPasswordAge
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\Netlogon\Parameters
           valueName: MaximumPasswordAge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 30
-      schema:
-        oneOf:
-          - const: 30
-          - type: 'null'
+      expression: ((((value == 30)) || ((value == null))))
   - name: MessageTextUserLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: LegalNoticeText
-          valueType: String
-          value: >-
-            This system is for authorized use only. Unauthorized access is prohibited and may be subject to criminal and
-            civil penalties. By logging in, you acknowledge and consent to monitoring and recording for security and
-            administrative purposes. If such monitoring reveals evidence of unauthorized activity, it may be provided to
-            appropriate authorities
-      schema: {}
+          valueType: REG_SZ
+          value: This system is for authorized use only. Unauthorized access is prohibited and may be subject to criminal and civil penalties. By logging in, you acknowledge and consent to monitoring and recording for security and administrative purposes. If such monitoring reveals evidence of unauthorized activity, it may be provided to appropriate authorities
+      expression: 'true'
   - name: MessageTextUserLogonTitle
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: LegalNoticeCaption
-          valueType: String
+          valueType: REG_SZ
           value: 'Notice to Users: Authorized Access Only'
-      schema: {}
+      expression: 'true'
   - name: MinimumSessionSecurityForNTLMSSPBasedClients
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: NTLMMinClientSec
-          valueType: Dword
+          valueType: REG_DWORD
           value: 537395200
-      schema:
-        oneOf:
-          - const: 537395200
-          - type: 'null'
+      expression: ((((value == 537395200)) || ((value == null))))
   - name: MinimumSessionSecurityForNTLMSSPBasedServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: NTLMMinServerSec
-          valueType: Dword
+          valueType: REG_DWORD
           value: 537395200
-      schema:
-        oneOf:
-          - const: 537395200
-          - type: 'null'
+      expression: ((((value == 537395200)) || ((value == null))))
   - name: MinimumSMBClientVersion
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: MinSmb2Dialect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 768
-      schema:
-        enum:
-          - 768
-          - 770
-          - 785
+      expression: ([768,770,785].exists(item, value == item))
   - name: MinimumSMBServerVersion
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: MinSmb2Dialect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 768
-      schema:
-        enum:
-          - 768
-          - 770
-          - 785
+      expression: ([768,770,785].exists(item, value == item))
   - name: MitigationOptionsFontBlocking
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
           valueName: MitigationOptions_FontBocking
-          valueType: String
+          valueType: REG_SZ
           value: '1000000000000'
-      schema:
-        oneOf:
-          - const: '1000000000000'
-          - type: 'null'
+      expression: ((((value == "1000000000000")) || ((value == null))))
   - name: NetBTNodeTypeConfiguration
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
           valueName: NodeType
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: NetworkConnectionsNC_ShowSharedAccessUI
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections
           valueName: NC_ShowSharedAccessUI
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: NetworkProviderHardenedPathsNETLOGON
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
           valueName: \\*\NETLOGON
-          valueType: String
+          valueType: REG_SZ
           value: RequireMutualAuthentication=1, RequireIntegrity=1
-      schema: {}
+      expression: 'true'
   - name: NetworkProviderHardenedPathsSYSVOL
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
           valueName: \\*\SYSVOL
-          valueType: String
+          valueType: REG_SZ
           value: RequireMutualAuthentication=1, RequireIntegrity=1
-      schema: {}
+      expression: 'true'
   - name: NetworkSecurityForceLogoffWhenLogonHoursExpire
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/NetworkSecurity_ForceLogoffWhenLogonHoursExpire
+          path: ./Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/NetworkSecurity_ForceLogoffWhenLogonHoursExpire
           type: integer
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableSecureUIAPaths
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: OverrideMinimumEnabledDTLSVersionClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledDTLSVersionClient
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledDTLSVersionClient
           type: string
           value: '1.2'
-      schema:
-        oneOf:
-          - const: '1.2'
-          - type: 'null'
+      expression: ((((value == "1.2")) || ((value == null))))
   - name: OverrideMinimumEnabledDTLSVersionServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledDTLSVersionServer
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledDTLSVersionServer
           type: string
           value: '1.2'
-      schema:
-        oneOf:
-          - const: '1.2'
-          - type: 'null'
+      expression: ((((value == "1.2")) || ((value == null))))
   - name: OverrideMinimumEnabledTLSVersionClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledTLSVersionClient
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledTLSVersionClient
           type: string
           value: '1.2'
-      schema: {}
+      expression: 'true'
   - name: OverrideMinimumEnabledTLSVersionServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledTLSVersionServer
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledTLSVersionServer
           type: string
           value: '1.2'
-      schema: {}
+      expression: 'true'
   - name: PowerShellExecutionPolicyEnableTranscripting
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
           valueName: EnableTranscripting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
           valueName: AddPrinterDrivers
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: PrintersRestrictDriverInstallationToAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
           valueName: RestrictDriverInstallationToAdministrators
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: PrivacyAllowInputPersonalization
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\InputPersonalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\InputPersonalization
           valueName: AllowInputPersonalization
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: PromptUserToChangePasswordBeforeExpiration
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
+          keyPath: HKEY_LOCAL_MACHINE:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
           valueName: PasswordExpiryWarning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 14
-      schema:
-        minimum: 5
-        maximum: 14
+      expression: (value != null && value >= 5 && value <= 14)
   - name: RDPPortNumber
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
           valueName: PortNumber
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3389
-      schema:
-        oneOf:
-          - const: 3389
-          - type: 'null'
+      expression: ((((value == 3389)) || ((value == null))))
   - name: RecoveryConsoleAllowFloppyCopyAndAllDrives
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: >-
-            ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/RecoveryConsole_AllowFloppyCopyAndAccessToAllDrivesAndAllFolders
-          type: integer
+          keyPath: HKLM:\SYSTEM\CurrentControlSet\Control\RecoveryConsole
+          valueName: SetCommand
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteAssistanceSolicitedRemoteAssistance
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fAllowToGetHelp
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteAssistanceUnsolicitedRemoteAssistance
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fAllowUnsolicited
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteDesktopServicesClientConnectionEncryptionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: MinEncryptionLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema:
-        minimum: 3
-        maximum: 4
+      expression: (value != null && value >= 3 && value <= 4)
   - name: RemoteDesktopServicesDoNotAllowDriveRedirection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fDisableCdm
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesDoNotAllowPasswordSaving
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: DisablePasswordSaving
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesPromptForPasswordUponConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fPromptForPassword
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesRequireSecureRPCCommunication
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fEncryptRPCTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemotelyAccessibleRegistryPaths
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths
           valueName: Machine
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - System\CurrentControlSet\Control\ProductOptions
             - System\CurrentControlSet\Control\Server Applications
             - Software\Microsoft\Windows NT\CurrentVersion
-      schema: {}
+      expression: 'true'
   - name: RemotelyAccessibleRegistryPathsAndSubpaths
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths
           valueName: Machine
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - System\CurrentControlSet\Control\Print\Printers
             - System\CurrentControlSet\Services\Eventlog
@@ -2956,141 +2426,117 @@ resources:
             - System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration
             - Software\Microsoft\Windows NT\CurrentVersion\Perflib
             - System\CurrentControlSet\Services\SysmonLog
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowBasicAuthentication_Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowBasic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowBasicAuthentication_Service
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowBasic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowAutoConfig
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement_IPv4Filter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: IPv4Filter
-          valueType: String
+          valueType: REG_SZ
           value: '*'
-      schema:
-        oneOf:
-          - const: '*'
-          - type: 'null'
+      expression: ((((value == "*")) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement_IPv6Filter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: IPv6Filter
-          valueType: String
+          valueType: REG_SZ
           value: '*'
-      schema:
-        oneOf:
-          - const: '*'
-          - type: 'null'
+      expression: ((((value == "*")) || ((value == null))))
   - name: RemoteManagementAllowUnencryptedTraffic_Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowUnencryptedTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowUnencryptedTraffic_Service
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowUnencryptedTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementDisallowDigestAuthentication
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowDigest
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementDisallowStoringOfRunAsCredentials
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: DisableRunAs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteProcedureCallRestrictUnauthenticatedRPCClients
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc
           valueName: RestrictRemoteClients
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RenameAdministratorAccount
     type: Microsoft.OSConfig/Test
     properties:
@@ -3098,7 +2544,7 @@ resources:
         type: Microsoft.Windows/AccountPolicy
         properties:
           name: AdministratorAccountName
-      schema: {}
+      expression: 'true'
   - name: RenameGuestAccount
     type: Microsoft.OSConfig/Test
     properties:
@@ -3106,433 +2552,370 @@ resources:
         type: Microsoft.Windows/AccountPolicy
         properties:
           name: GuestAccountName
-      schema: {}
+      expression: 'true'
   - name: RequireCaseInsensitivityForNonWindowsSubsystems
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Kernel
           valueName: ObCaseInsensitive
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: RequireEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: RequireEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: RequireStrongSessionKey
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
           valueName: RequireStrongKey
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RestrictAnonymousAccessToNamedPipesAndShares
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: RestrictNullSessAccess
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: RestrictClientsAllowedToMakeRemoteCallsToSAM
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RestrictRemoteSAM
-          valueType: String
+          valueType: REG_SZ
           value: O:BAG:BAD:(A;;RC;;;BA)
-      schema: {}
+      expression: 'true'
   - name: RSSDisableEnclosureDownload
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds
           valueName: DisableEnclosureDownload
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RunAllAdministratorsInAdminApprovalMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableLUA
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SafeDllSearchMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager
           valueName: SafeDllSearchMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SAMRPCPasswordChangePolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM
           valueName: SamrChangeUserPasswordApiPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SearchAllowIndexingEncryptedStoresOrItems
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Windows Search
           valueName: AllowIndexingEncryptedStoresOrItems
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: SendUnencryptedPasswordToThirdPartySMBServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: EnablePlainTextPassword
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ServerSPNTargetNameValidationLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\LanManServer\Parameters
           valueName: SMBServerNameHardeningLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SharesThatCanBeAccessedAnonymously
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: NullSessionShares
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value: []
-      schema: {}
+      expression: 'true'
   - name: SharingAndSecurityModelForLocalAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: ForceGuest
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ShellDataExecutionPrevention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoDataExecutionPrevention
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ShutdownSystemImmediatelyIfUnableToLogSecurityAudits
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: CrashOnAuditFail
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: SmartCardRemovalBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
-          type: string
+          keyPath: HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+          valueName: ScRemoveOption
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")
   - name: SmartScreenEnableSmartScreenInShell
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: EnableSmartScreen
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SmartScreenPreventOverrideForFilesInShell
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: ShellSmartScreenLevel
-          valueType: String
+          valueType: REG_SZ
           value: Block
-      schema:
-        oneOf:
-          - const: Block
-          - type: 'null'
+      expression: ((((value == "Block")) || ((value == null))))
   - name: StrengthenDefaultPermissionsOfInternalSystemObjects
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager
           valueName: ProtectionMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SwitchToTheSecureDesktopWhenPromptingForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: PromptOnSecureDesktop
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SystemAllowTelemetry
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
           valueName: AllowTelemetry
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: SystemBootStartDriverInitialization
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch
           valueName: DriverLoadPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema: {}
+      expression: 'true'
   - name: SystemEnableSoftwareRestrictionPolicies
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
           valueName: AuthenticodeEnabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SystemLogonCacheSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
           valueName: CachedLogonsCount
-          valueType: String
+          valueType: REG_SZ
           value: '4'
-      schema:
-        minimum: 0
-        maximum: 4
+      expression: (value != null && value.matches("^-?[0-9]+$") && int(value) >= 0 && int(value) <= 4)
   - name: SystemMinimizeInternetConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy
           valueName: fMinimizeConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: SystemWindowsSearchService
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wsearch
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Wsearch
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 4
-      schema:
-        oneOf:
-          - const: 4
-          - type: 'null'
+      expression: ((((value == 4)) || ((value == null))))
   - name: TerminalServerTS_TEMP_DELETE
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: DeleteTempDirsOnExit
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TerminalServerTS_TEMP_PER_SESSION
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: PerSessionTempDir
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TerminalServerTS_USER_AUTHENTICATION_POLICY
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: UserAuthentication
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TurnOff_Windows_Error_Reporting
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\AppCompat
           valueName: DisableInventory
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TurnOffPrintingOverHTTP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers
           valueName: DisableHTTPPrinting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: UseAdminApprovalMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: FilterAdministratorToken
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: UserRightsAccessCredentialManagerAsTrustedCaller
     type: Microsoft.OSConfig/Test
     properties:
@@ -3541,7 +2924,7 @@ resources:
         properties:
           name: SeTrustedCredManAccessPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsAccessFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
@@ -3552,7 +2935,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-11'
-      schema: {}
+      expression: 'true'
   - name: UserRightsActAsPartOfTheOperatingSystem
     type: Microsoft.OSConfig/Test
     properties:
@@ -3561,7 +2944,7 @@ resources:
         properties:
           name: SeTcbPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsAdjustMemoryQuotasForProcess
     type: Microsoft.OSConfig/Test
     properties:
@@ -3573,7 +2956,7 @@ resources:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsAllowLocalLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3583,7 +2966,7 @@ resources:
           name: SeInteractiveLogonRight
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsAllowLogOnThroughRemoteDesktop
     type: Microsoft.OSConfig/Test
     properties:
@@ -3594,7 +2977,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-32-555'
-      schema: {}
+      expression: 'true'
   - name: UserRightsBackupFilesAndDirectories
     type: Microsoft.OSConfig/Test
     properties:
@@ -3604,7 +2987,7 @@ resources:
           name: SeBackupPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsBypassTraverseChecking
     type: Microsoft.OSConfig/Test
     properties:
@@ -3618,7 +3001,7 @@ resources:
             - '*S-1-5-32-551'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsChangeSystemTime
     type: Microsoft.OSConfig/Test
     properties:
@@ -3629,7 +3012,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
-      schema: {}
+      expression: 'true'
   - name: UserRightsChangeTimeZone
     type: Microsoft.OSConfig/Test
     properties:
@@ -3640,7 +3023,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateGlobalObjects
     type: Microsoft.OSConfig/Test
     properties:
@@ -3653,7 +3036,7 @@ resources:
             - '*S-1-5-6'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreatePageFile
     type: Microsoft.OSConfig/Test
     properties:
@@ -3663,7 +3046,7 @@ resources:
           name: SeCreatePagefilePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreatePermanentSharedObjects
     type: Microsoft.OSConfig/Test
     properties:
@@ -3672,7 +3055,7 @@ resources:
         properties:
           name: SeCreatePermanentPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateSymbolicLinks
     type: Microsoft.OSConfig/Test
     properties:
@@ -3683,7 +3066,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-83-0'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateToken
     type: Microsoft.OSConfig/Test
     properties:
@@ -3692,7 +3075,7 @@ resources:
         properties:
           name: SeCreateTokenPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsDebugPrograms
     type: Microsoft.OSConfig/Test
     properties:
@@ -3702,7 +3085,7 @@ resources:
           name: SeDebugPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyAccessFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
@@ -3712,7 +3095,7 @@ resources:
           name: SeDenyNetworkLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLocalLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3722,7 +3105,7 @@ resources:
           name: SeDenyInteractiveLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLogOnAsBatchJob
     type: Microsoft.OSConfig/Test
     properties:
@@ -3732,7 +3115,7 @@ resources:
           name: SeDenyBatchLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLogOnAsService
     type: Microsoft.OSConfig/Test
     properties:
@@ -3742,7 +3125,7 @@ resources:
           name: SeDenyServiceLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyRemoteDesktopServicesLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3752,7 +3135,7 @@ resources:
           name: SeDenyRemoteInteractiveLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsEnableDelegation
     type: Microsoft.OSConfig/Test
     properties:
@@ -3761,7 +3144,7 @@ resources:
         properties:
           name: SeEnableDelegationPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsGenerateSecurityAudits
     type: Microsoft.OSConfig/Test
     properties:
@@ -3773,7 +3156,7 @@ resources:
             - '*S-1-5-19'
             - '*S-1-5-20'
             - '*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415'
-      schema: {}
+      expression: 'true'
   - name: UserRightsIncreaseProcessWorkingSet
     type: Microsoft.OSConfig/Test
     properties:
@@ -3784,7 +3167,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
-      schema: {}
+      expression: 'true'
   - name: UserRightsIncreaseSchedulingPriority
     type: Microsoft.OSConfig/Test
     properties:
@@ -3794,7 +3177,7 @@ resources:
           name: SeIncreaseBasePriorityPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsLoadUnloadDeviceDrivers
     type: Microsoft.OSConfig/Test
     properties:
@@ -3804,7 +3187,7 @@ resources:
           name: SeLoadDriverPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsLockMemory
     type: Microsoft.OSConfig/Test
     properties:
@@ -3813,7 +3196,7 @@ resources:
         properties:
           name: SeLockMemoryPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsManageAuditingAndSecurityLog
     type: Microsoft.OSConfig/Test
     properties:
@@ -3823,7 +3206,7 @@ resources:
           name: SeSecurityPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsManageVolume
     type: Microsoft.OSConfig/Test
     properties:
@@ -3833,7 +3216,7 @@ resources:
           name: SeManageVolumePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsModifyFirmwareEnvironment
     type: Microsoft.OSConfig/Test
     properties:
@@ -3843,7 +3226,7 @@ resources:
           name: SeSystemEnvironmentPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsModifyObjectLabel
     type: Microsoft.OSConfig/Test
     properties:
@@ -3852,7 +3235,7 @@ resources:
         properties:
           name: SeRelabelPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsProfileSingleProcess
     type: Microsoft.OSConfig/Test
     properties:
@@ -3862,7 +3245,7 @@ resources:
           name: SeProfileSingleProcessPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsProfileSystemPerformance
     type: Microsoft.OSConfig/Test
     properties:
@@ -3873,7 +3256,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420'
-      schema: {}
+      expression: 'true'
   - name: UserRightsRemoteShutdown
     type: Microsoft.OSConfig/Test
     properties:
@@ -3883,7 +3266,7 @@ resources:
           name: SeRemoteShutdownPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsReplaceProcessLevelToken
     type: Microsoft.OSConfig/Test
     properties:
@@ -3894,7 +3277,7 @@ resources:
           value:
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsRestoreFilesAndDirectories
     type: Microsoft.OSConfig/Test
     properties:
@@ -3904,7 +3287,7 @@ resources:
           name: SeRestorePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsShutDownTheSystem
     type: Microsoft.OSConfig/Test
     properties:
@@ -3914,7 +3297,7 @@ resources:
           name: SeShutdownPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsTakeOwnership
     type: Microsoft.OSConfig/Test
     properties:
@@ -3924,151 +3307,125 @@ resources:
           name: SeTakeOwnershipPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableVirtualization
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsExplorerShellProtocolProtectedModeTitle_2
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: PreXPSP2ShellProtocolBehavior
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: WindowsHelloAntiSpoofing
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures
           valueName: EnhancedAntiSpoofing
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonAllowAutomaticRestartSignOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DisableAutomaticRestartSignOn
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonConfigAutomaticRestartSignOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: AutomaticRestartSignOnConfig
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonDisableLockScreenAppNotifications
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: DisableLockScreenAppNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonDontDisplayNetworkSelectionUI
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: DontDisplayNetworkSelectionUI
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonEnumerateLocalUsersOnDomainJoinedComputers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: EnumerateLocalUsers
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: WindowsPowerShellTurnOnPowerShellScriptBlockLogging
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
           valueName: EnableScriptBlockLogging
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WinVerityTrustSignatureValidationVulnerabilityMitigation1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Wintrust\Config
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config
           valueName: EnableCertPaddingCheck
-          valueType: String
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")
   - name: WinVerityTrustSignatureValidationVulnerabilityMitigation2
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config
           valueName: EnableCertPaddingCheck
-          valueType: String
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")
diff --git a/public/_baselines/ws2025-workgroup-member.osc.yaml b/public/_baselines/ws2025-workgroup-member.osc.yaml
index 9964292..471b104 100644
--- a/public/_baselines/ws2025-workgroup-member.osc.yaml
+++ b/public/_baselines/ws2025-workgroup-member.osc.yaml
@@ -6,14 +6,11 @@ resources:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Afd\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Afd\Parameters
           valueName: DisableAddressSharing
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowAnonymousSIDOrNameTranslation
     type: Microsoft.OSConfig/Test
     properties:
@@ -22,190 +19,161 @@ resources:
         properties:
           name: EnableAnonymousNameTranslation
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: AllowCustomSSPAPIntoLSASS
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: AllowCustomSSPsAPs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowedToFormatAndEjectRemovableMedia
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
           valueName: AllocateDASD
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: AllowICMPRedirectsToOverrideOSPFGeneratedRoutes
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
           valueName: EnableICMPRedirect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: AllowLocalSystemNULLSessionFallback
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: AllowNullSessionFallback
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: AllowLocalSystemToUseComputerIdentityForNTLM
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: UseMachineId
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowPKU2UAuthenticationAllowOnlineID
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\pku2u
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\pku2u
           valueName: AllowOnlineID
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowSystemToBeShutDownWithoutHavingToLogOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ShutdownWithoutLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
           valueName: NoNameReleaseOnDemand
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AllowUIAccessApplicationsToPromptForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableUIADesktopToggle
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: AmountOfIdleTimeRequiredBeforeSuspendingSession
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: AutoDisconnect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 15
-      schema:
-        minimum: 1
-        maximum: 15
+      expression: (value != null && value >= 1 && value <= 15)
   - name: ApplicationIdentityStartupType
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppIDSvc
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\AppIDSvc
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: ApplicationManagementMSIAllowUserControlOverInstall
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer
           valueName: EnableUserControl
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ApplicationManagementMSIAlwaysInstallWithElevatedPrivileges
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Installer
           valueName: AlwaysInstallElevated
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: AppRuntimeAllowMicrosoftAccountsToBeOptional
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: MSAOptional
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditAccountLockout
     type: Microsoft.OSConfig/Test
     properties:
@@ -214,10 +182,7 @@ resources:
         properties:
           subcategory: '{0CCE9217-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditAuthenticationPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -226,10 +191,7 @@ resources:
         properties:
           subcategory: '{0CCE9230-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditAuthorizationPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -238,51 +200,40 @@ resources:
         properties:
           subcategory: '{0CCE9231-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditBackupAndRestorePrivilege
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Audit_AuditTheUseOfBackupAndRestoreprivilege
-          type: string
-          value: MDA=
-      schema:
-        oneOf:
-          - const: MDA=
-          - type: 'null'
+          keyPath: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa
+          valueName: FullPrivilegeAuditing
+          valueType: REG_BINARY
+          value: AA==
+      expression: '["MDA=","AA=="].exists(item, value == item)'
   - name: AuditClientDoesNotSupportEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditClientDoesNotSupportEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditClientDoesNotSupportSigning
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditClientDoesNotSupportSigning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditCredentialValidation
     type: Microsoft.OSConfig/Test
     properties:
@@ -291,10 +242,7 @@ resources:
         properties:
           subcategory: '{0CCE923F-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditDetailedFileShare
     type: Microsoft.OSConfig/Test
     properties:
@@ -303,10 +251,7 @@ resources:
         properties:
           subcategory: '{0CCE9244-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditFileShare
     type: Microsoft.OSConfig/Test
     properties:
@@ -315,10 +260,7 @@ resources:
         properties:
           subcategory: '{0CCE9224-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditGroupMembership
     type: Microsoft.OSConfig/Test
     properties:
@@ -327,24 +269,18 @@ resources:
         properties:
           subcategory: '{0CCE9249-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditInsecureGuestLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: AuditInsecureGuestLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditIPsecDriver
     type: Microsoft.OSConfig/Test
     properties:
@@ -353,10 +289,7 @@ resources:
         properties:
           subcategory: '{0CCE9213-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditLogoff
     type: Microsoft.OSConfig/Test
     properties:
@@ -365,10 +298,7 @@ resources:
         properties:
           subcategory: '{0CCE9216-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditLogon
     type: Microsoft.OSConfig/Test
     properties:
@@ -377,10 +307,7 @@ resources:
         properties:
           subcategory: '{0CCE9215-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditMPSSVCRuleLevelPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -389,10 +316,7 @@ resources:
         properties:
           subcategory: '{0CCE9232-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherLogonLogoffEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -401,10 +325,7 @@ resources:
         properties:
           subcategory: '{0CCE921C-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherObjectAccessEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -413,10 +334,7 @@ resources:
         properties:
           subcategory: '{0CCE9227-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditOtherPolicyChangeEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -425,10 +343,7 @@ resources:
         properties:
           subcategory: '{0CCE9234-69AE-11D9-BED3-505054503030}'
           value: 2
-      schema:
-        enum:
-          - 2
-          - 3
+      expression: ([2,3].exists(item, value == item))
   - name: AuditOtherSystemEvents
     type: Microsoft.OSConfig/Test
     properties:
@@ -437,10 +352,7 @@ resources:
         properties:
           subcategory: '{0CCE9214-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditPnPExternalDevice
     type: Microsoft.OSConfig/Test
     properties:
@@ -449,10 +361,7 @@ resources:
         properties:
           subcategory: '{0CCE9248-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditPolicyChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -461,10 +370,7 @@ resources:
         properties:
           subcategory: '{0CCE922F-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditProcessCreatedOrStarted
     type: Microsoft.OSConfig/Test
     properties:
@@ -473,10 +379,7 @@ resources:
         properties:
           subcategory: '{0CCE922B-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditRemovableStorage
     type: Microsoft.OSConfig/Test
     properties:
@@ -485,10 +388,7 @@ resources:
         properties:
           subcategory: '{0CCE9245-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditSecurityGroupManagement
     type: Microsoft.OSConfig/Test
     properties:
@@ -497,10 +397,7 @@ resources:
         properties:
           subcategory: '{0CCE9237-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSecurityStateChange
     type: Microsoft.OSConfig/Test
     properties:
@@ -509,10 +406,7 @@ resources:
         properties:
           subcategory: '{0CCE9210-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSecuritySystemExtension
     type: Microsoft.OSConfig/Test
     properties:
@@ -521,10 +415,7 @@ resources:
         properties:
           subcategory: '{0CCE9211-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSensitivePrivilegeUse
     type: Microsoft.OSConfig/Test
     properties:
@@ -533,52 +424,40 @@ resources:
         properties:
           subcategory: '{0CCE9228-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditServerDoesNotSupportEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AuditServerDoesNotSupportEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditServerDoesNotSupportSigning
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AuditServerDoesNotSupportSigning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditSettingsIncludeCmdLine
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit
           valueName: ProcessCreationIncludeCmdLine_Enabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AuditSpecialLogon
     type: Microsoft.OSConfig/Test
     properties:
@@ -587,10 +466,7 @@ resources:
         properties:
           subcategory: '{0CCE921B-69AE-11D9-BED3-505054503030}'
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: AuditSystemIntegrity
     type: Microsoft.OSConfig/Test
     properties:
@@ -599,10 +475,7 @@ resources:
         properties:
           subcategory: '{0CCE9212-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AuditUserAccountManagement
     type: Microsoft.OSConfig/Test
     properties:
@@ -611,422 +484,350 @@ resources:
         properties:
           subcategory: '{0CCE9235-69AE-11D9-BED3-505054503030}'
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: AutoplayDisallowAutoplayForNonVolumeDevices
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoAutoplayfornonVolume
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AutoplaySetDefaultAutoRunBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: NoAutorun
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: AutoplayTurnOffAutoPlay
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: NoDriveTypeAutoRun
-          valueType: Dword
+          valueType: REG_DWORD
           value: 255
-      schema:
-        oneOf:
-          - const: 255
-          - type: 'null'
+      expression: ((((value == 255)) || ((value == null))))
   - name: BehaviorOfTheElevationPromptForAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ConsentPromptBehaviorAdmin
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: BehaviorOfTheElevationPromptForStandardUsers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: ConsentPromptBehaviorUser
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: BlockConsumerMicrosoftAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftAccount
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\MicrosoftAccount
           valueName: DisableUserAuth
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: BlockNetbiosDiscovery
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Netlogon\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Netlogon\Parameters
           valueName: BlockNetbiosDiscovery
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: BlockNTLM
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: BlockNTLM
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: BlockNTLMServerExceptionList
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: BlockNTLMServerExceptionList
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value: []
-      schema: {}
+      expression: 'true'
   - name: ClearVirtualMemoryPageFile
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Memory Management
           valueName: ClearPageFileAtShutdown
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ConfigureDNSClientNETBIOS
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
           valueName: EnableNetbios
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: ConfigureKernelShadowStacksLaunch
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
           valueName: ConfigureKernelShadowStacksLaunch
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: ConfigureSMBV1ClientDriver
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MrxSmb10
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\MrxSmb10
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 4
-      schema:
-        oneOf:
-          - const: 4
-          - type: 'null'
+      expression: ((((value == 4)) || ((value == null))))
   - name: ConfigureSMBV1Server
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: SMB1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ConnectivityDisableDownloadingOfPrintDriversOverHTTP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers
           valueName: DisableWebPnPDownload
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ConnectivityProhibitInstallationAndConfigurationOfNetworkBridge
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections
           valueName: NC_AllowNetBridge_NLA
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: CredentialProvidersAllowPINLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: AllowDomainPINLogon
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: CredentialsDelegationRemoteHostAllowsDelegationOfNonExportableCredentials
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation
           valueName: AllowProtectedCreds
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: CredentialsUIDisablePasswordReveal
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredUI
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CredUI
           valueName: DisablePasswordReveal
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: CredentialsUIEnumerateAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI
           valueName: EnumerateAdministrators
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: CredSspAllowEncryptionOracle
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
           valueName: AllowEncryptionOracle
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: CryptographyAllowedKerberosEncryptionTypes
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: SupportedEncryptionTypes
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2147483640
-      schema:
-        enum:
-          - 2147483624
-          - 2147483632
-          - 2147483640
+      expression: ([2147483624,2147483632,2147483640].exists(item, value == item))
   - name: CryptographyEccCurve
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
           valueName: EccCurves
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - NistP256
             - NistP384
-      schema: {}
+      expression: 'true'
   - name: CryptographyForceStrongKeyProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography
           valueName: ForceKeyProtection
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: CryptographySSLCipherSuites
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
           valueName: Functions
-          valueType: String
-          value: >-
-            TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
-      schema: {}
+          valueType: REG_SZ
+          value: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
+      expression: 'true'
   - name: DetectApplicationInstallationsAndPromptForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableInstallerDetection
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceGuardLsaCfgFlags
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: LsaCfgFlags
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: DeviceGuardRequireMicrosoftSignedBootChain
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\DeviceGuard
           valueName: RequireMicrosoftSignedBootChain
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceGuardRequirePlatformSecurityFeatures
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/DeviceGuard/RequirePlatformSecurityFeatures
-          type: integer
+          keyPath: HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          valueName: RequirePlatformSecurityFeatures
+          valueType: REG_DWORD
           value: 1
-      schema:
-        enum:
-          - 1
-          - 3
+      expression: ([1,3].exists(item, value == item))
   - name: DeviceGuardRequireUEFIMemoryAttributesTable
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
           valueName: HVCIMATRequired
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceInstallationPreventDeviceMetadataFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Device Metadata
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata
           valueName: PreventDeviceMetadataFromNetwork
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceLockAccountLockoutPolicy
     type: Microsoft.OSConfig/Test
     properties:
@@ -1035,7 +836,7 @@ resources:
         properties:
           name: LockoutDuration
           value: 15
-      schema: {}
+      expression: 'true'
   - name: DeviceLockAccountLockoutPolicy_LockoutThreshold
     type: Microsoft.OSConfig/Test
     properties:
@@ -1044,7 +845,7 @@ resources:
         properties:
           name: LockoutThreshold
           value: 3
-      schema: {}
+      expression: 'true'
   - name: DeviceLockAccountLockoutPolicy_LockoutReset
     type: Microsoft.OSConfig/Test
     properties:
@@ -1053,7 +854,7 @@ resources:
         properties:
           name: LockoutReset
           value: 15
-      schema: {}
+      expression: 'true'
   - name: DeviceLockClearTextPassword
     type: Microsoft.OSConfig/Test
     properties:
@@ -1062,10 +863,7 @@ resources:
         properties:
           name: EnablePasswordReversibleEncryption
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: DeviceLockMaximumPasswordAge
     type: Microsoft.OSConfig/Test
     properties:
@@ -1074,9 +872,7 @@ resources:
         properties:
           name: MaximumPasswordAge
           value: 42
-      schema:
-        minimum: 1
-        maximum: 70
+      expression: (value != null && value >= 1 && value <= 70)
   - name: DeviceLockMinimumPasswordAge
     type: Microsoft.OSConfig/Test
     properties:
@@ -1085,8 +881,7 @@ resources:
         properties:
           name: MinimumPasswordAge
           value: 1
-      schema:
-        minimum: 1
+      expression: (value != null && value >= 1)
   - name: DeviceLockMinimumPasswordLength
     type: Microsoft.OSConfig/Test
     properties:
@@ -1095,8 +890,7 @@ resources:
         properties:
           name: MinimumPasswordLength
           value: 14
-      schema:
-        minimum: 14
+      expression: (value != null && value >= 14)
   - name: DeviceLockPasswordComplexity
     type: Microsoft.OSConfig/Test
     properties:
@@ -1105,10 +899,7 @@ resources:
         properties:
           name: EnforcePasswordComplexity
           value: true
-      schema:
-        oneOf:
-          - const: true
-          - type: 'null'
+      expression: ((((value == true)) || ((value == null))))
   - name: DeviceLockPasswordHistorySize
     type: Microsoft.OSConfig/Test
     properties:
@@ -1117,268 +908,219 @@ resources:
         properties:
           name: PasswordHistoryLength
           value: 24
-      schema:
-        oneOf:
-          - const: 24
-          - type: 'null'
+      expression: ((((value == 24)) || ((value == null))))
   - name: DeviceLockPreventEnablingLockScreenCamera
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Personalization
           valueName: NoLockScreenCamera
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DeviceLockPreventLockScreenSlideShow
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Personalization
           valueName: NoLockScreenSlideshow
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsAlwaysClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: RequireSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsAlwaysServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: RequireSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsIfClientAgrees
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: EnableSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DigitallySignCommunicationsIfServerAgrees
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: EnableSecuritySignature
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DisableSMBv1Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
           valueName: DependOnService
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - Bowser
             - MRxSmb20
             - NSI
-      schema: {}
+      expression: 'true'
   - name: DisconnectClientsWhenLogonHoursExpire
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: EnableForcedLogoff
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DmaGuardDeviceEnumerationPolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/DmaGuard/DeviceEnumerationPolicy
-          type: integer
+          keyPath: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection
+          valueName: DeviceEnumerationPolicy
+          valueType: REG_DWORD
           value: 0
-      schema:
-        enum:
-          - 0
-          - 1
+      expression: ([0,1].exists(item, value == item))
   - name: DnsClientTurn_Off_Multicast
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient
           valueName: EnableMulticast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: DODownloadMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization
           valueName: DODownloadMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        enum:
-          - 0
-          - 1
-          - 2
-          - 99
-          - 100
+      expression: ([0,1,2,99,100].exists(item, value == item))
   - name: DoNotAllowAnonymousEnumerationOfSAMAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RestrictAnonymousSAM
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RestrictAnonymous
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DoNotDisplayLastSignedIn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DontDisplayLastUserName
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: DoNotRequireCTRLALTDEL
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DisableCAD
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: EnableAuthEpResolution
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc
           valueName: EnableAuthEpResolution
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: EnableAuthRateLimiter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: EnableAuthRateLimiter
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: EnableAuthRateLimiterTimeout
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: InvalidAuthenticationDelayTimeInMs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2000
-      schema:
-        minimum: 2000
-        maximum: 5000
+      expression: (value != null && value >= 2000 && value <= 5000)
   - name: EnabledNTPClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
           valueName: Enabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: EnableGuestAccountStatus
     type: Microsoft.OSConfig/Test
     properties:
@@ -1387,591 +1129,491 @@ resources:
         properties:
           name: EnableGuestAccount
           value: false
-      schema:
-        oneOf:
-          - const: false
-          - type: 'null'
+      expression: ((((value == false)) || ((value == null))))
   - name: EnableMailslotsLanmanServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Browser
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Browser
           valueName: EnableMailslots
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EnableMailslotsLanmanWorkstation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider
           valueName: EnableMailslots
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EnableStructuredExceptionHandlingOverwriteProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
           valueName: DisableExceptionChainValidation
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: EncryptNTFSPagingFile
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies
           valueName: NtfsEncryptPagingFile
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: EventLogChannelSecurityLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogChannelSetupLogMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: EventLogChannelSetupLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogChannelSystemLogRetention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogPercentageThresholdSecurityEventLogMaximumSizeReached
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Eventlog\Security
           valueName: WarningLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 90
-      schema:
-        minimum: 50
-        maximum: 90
+      expression: (value != null && value >= 50 && value <= 90)
   - name: EventLogServiceControlEventLogBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
           valueName: Retention
-          valueType: String
+          valueType: REG_SZ
           value: '0'
-      schema: {}
+      expression: 'true'
   - name: EventLogServiceSpecifyMaximumFileSizeApplicationLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: EventLogServiceSpecifyMaximumFileSizeSecurityLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 196608
-      schema:
-        minimum: 196608
+      expression: (value != null && value >= 196608)
   - name: EventLogServiceSpecifyMaximumFileSizeSystemLog
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System
           valueName: MaxSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 32768
-      schema:
-        minimum: 32768
+      expression: (value != null && value >= 32768)
   - name: ExperienceAllowWindowsConsumerFeatures
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent
           valueName: DisableWindowsConsumerFeatures
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: ExperienceDisableConsumerAccountStateContent
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\CloudContent
           valueName: DisableConsumerAccountStateContent
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ExperienceDoNotShowFeedbackNotifications
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
           valueName: DoNotShowFeedbackNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FileExplorerTurnOffHeapTerminationOnCorruption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoHeapTerminationOnCorruption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: FirewallPrivateProfileApplyLocalConnectionSecurityRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: AllowLocalIPsecPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileApplyLocalFirewallRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: AllowLocalPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileDisplayNotification
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DisableNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileInboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DefaultInboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileLogDroppedPackets
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogDroppedPackets
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileLogFileMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogFileSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 16384
-      schema:
-        minimum: 16384
+      expression: (value != null && value >= 16384)
   - name: FirewallPrivateProfileLogFileName
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogFilePath
-          valueType: String
+          valueType: REG_SZ
           value: '%SystemRoot%\System32\logfiles\firewall\privatefw.log'
-      schema:
-        pattern: .log
+      expression: (value != null && value.matches(".log"))
   - name: FirewallPrivateProfileLogSuccessfulConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging
           valueName: LogSuccessfulConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileOutboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DefaultOutboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPrivateProfileState
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: EnableFirewall
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPrivateProfileUnicastResponse
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile
           valueName: DisableUnicastResponsesToMulticastBroadcast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPublicProfileApplyLocalConnectionSecurityRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: AllowLocalIPsecPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileApplyLocalFirewallRules
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: AllowLocalPolicyMerge
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileDisplayNotification
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DisableNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileInboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DefaultInboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileLogDroppedPackets
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogDroppedPackets
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileLogFileMaxSize
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogFileSize
-          valueType: Dword
+          valueType: REG_DWORD
           value: 16384
-      schema:
-        minimum: 16384
+      expression: (value != null && value >= 16384)
   - name: FirewallPublicProfileLogFileName
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogFilePath
-          valueType: String
+          valueType: REG_SZ
           value: '%SystemRoot%\System32\logfiles\firewall\publicfw.log'
-      schema:
-        pattern: .log
+      expression: (value != null && value.matches(".log"))
   - name: FirewallPublicProfileLogSuccessfulConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging
           valueName: LogSuccessfulConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileOutboundConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DefaultOutboundAction
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: FirewallPublicProfileState
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: EnableFirewall
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: FirewallPublicProfileUnicastResponse
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile
           valueName: DisableUnicastResponsesToMulticastBroadcast
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: SCENoApplyLegacyAuditPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: GroupPolicyEnableCDP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: EnableCdp
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: GroupPolicyNoBackgroundPolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
           valueName: NoBackgroundPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: GroupPolicyNoGPOListChanges
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
           valueName: NoGPOListChanges
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: ICMNC_ExitOnISP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard
           valueName: ExitOnMSICW
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: ImpersonateClient
     type: Microsoft.OSConfig/Test
     properties:
@@ -1984,685 +1626,564 @@ resources:
             - '*S-1-5-6'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: IPSourceRoutingProtectionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
           valueName: DisableIPSourceRouting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: IPv6SourceRoutingProtectionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
           valueName: DisableIPSourceRouting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        oneOf:
-          - const: 2
-          - type: 'null'
+      expression: ((((value == 2)) || ((value == null))))
   - name: KDCHashAlgorithms
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITHashAlgorithmConfigurationEnabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA256
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA256
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA384
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA384
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KDCHashAlgorithmsSHA512
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
           valueName: PKINITSHA512
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithms
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITHashAlgorithmConfigurationEnabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA1
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA256
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA256
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA384
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA384
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: KerberosHashAlgorithmsSHA512
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
           valueName: PKINITSHA512
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LANManagerAuthenticationLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: LmCompatibilityLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 5
-      schema:
-        oneOf:
-          - const: 5
-          - type: 'null'
+      expression: ((((value == 5)) || ((value == null))))
   - name: LanmanWorkstationEnableInsecureGuestLogons
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: AllowInsecureGuestAuth
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: LDAPClientSigningRequirements
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LDAP
           valueName: LDAPClientIntegrity
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: LetEveryonePermissionsApplyToAnonymousUsers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: EveryoneIncludesAnonymous
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: LimitBlankPasswordUse
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: LogonBlockUserFromShowingAccountDetailsOnSignin
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: BlockUserFromShowingAccountDetailsOnSignin
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: LSAPPLProtection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RunAsPPL
-          valueType: Dword
+          valueType: REG_DWORD
           value: 2
-      schema:
-        minimum: 1
-        maximum: 2
+      expression: (value != null && value >= 1 && value <= 2)
   - name: MachineInactivityLimit
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: InactivityTimeoutSecs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 900
-      schema:
-        minimum: 1
-        maximum: 900
+      expression: (value != null && value >= 1 && value <= 900)
   - name: MessageTextUserLogon
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: LegalNoticeText
-          valueType: String
-          value: >-
-            This system is for authorized use only. Unauthorized access is prohibited and may be subject to criminal and
-            civil penalties. By logging in, you acknowledge and consent to monitoring and recording for security and
-            administrative purposes. If such monitoring reveals evidence of unauthorized activity, it may be provided to
-            appropriate authorities
-      schema: {}
+          valueType: REG_SZ
+          value: This system is for authorized use only. Unauthorized access is prohibited and may be subject to criminal and civil penalties. By logging in, you acknowledge and consent to monitoring and recording for security and administrative purposes. If such monitoring reveals evidence of unauthorized activity, it may be provided to appropriate authorities
+      expression: 'true'
   - name: MessageTextUserLogonTitle
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: LegalNoticeCaption
-          valueType: String
+          valueType: REG_SZ
           value: 'Notice to Users: Authorized Access Only'
-      schema: {}
+      expression: 'true'
   - name: MinimumSessionSecurityForNTLMSSPBasedClients
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: NTLMMinClientSec
-          valueType: Dword
+          valueType: REG_DWORD
           value: 537395200
-      schema:
-        oneOf:
-          - const: 537395200
-          - type: 'null'
+      expression: ((((value == 537395200)) || ((value == null))))
   - name: MinimumSessionSecurityForNTLMSSPBasedServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
           valueName: NTLMMinServerSec
-          valueType: Dword
+          valueType: REG_DWORD
           value: 537395200
-      schema:
-        oneOf:
-          - const: 537395200
-          - type: 'null'
+      expression: ((((value == 537395200)) || ((value == null))))
   - name: MinimumSMBClientVersion
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: MinSmb2Dialect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 768
-      schema:
-        enum:
-          - 768
-          - 770
-          - 785
+      expression: ([768,770,785].exists(item, value == item))
   - name: MinimumSMBServerVersion
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanServer
           valueName: MinSmb2Dialect
-          valueType: Dword
+          valueType: REG_DWORD
           value: 768
-      schema:
-        enum:
-          - 768
-          - 770
-          - 785
+      expression: ([768,770,785].exists(item, value == item))
   - name: MitigationOptionsFontBlocking
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
           valueName: MitigationOptions_FontBocking
-          valueType: String
+          valueType: REG_SZ
           value: '1000000000000'
-      schema:
-        oneOf:
-          - const: '1000000000000'
-          - type: 'null'
+      expression: ((((value == "1000000000000")) || ((value == null))))
   - name: NetBTNodeTypeConfiguration
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
           valueName: NodeType
-          valueType: Dword
-      schema:
-        const: 0
+          valueType: REG_DWORD
+          value: 0
+      expression: (value == 0)
   - name: NetworkConnectionsNC_ShowSharedAccessUI
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Network Connections
           valueName: NC_ShowSharedAccessUI
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: NetworkSecurityForceLogoffWhenLogonHoursExpire
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/NetworkSecurity_ForceLogoffWhenLogonHoursExpire
+          path: ./Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/NetworkSecurity_ForceLogoffWhenLogonHoursExpire
           type: integer
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableSecureUIAPaths
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: OverrideMinimumEnabledDTLSVersionClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledDTLSVersionClient
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledDTLSVersionClient
           type: string
           value: '1.2'
-      schema:
-        oneOf:
-          - const: '1.2'
-          - type: 'null'
+      expression: ((((value == "1.2")) || ((value == null))))
   - name: OverrideMinimumEnabledDTLSVersionServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledDTLSVersionServer
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledDTLSVersionServer
           type: string
           value: '1.2'
-      schema:
-        oneOf:
-          - const: '1.2'
-          - type: 'null'
+      expression: ((((value == "1.2")) || ((value == null))))
   - name: OverrideMinimumEnabledTLSVersionClient
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledTLSVersionClient
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledTLSVersionClient
           type: string
           value: '1.2'
-      schema: {}
+      expression: 'true'
   - name: OverrideMinimumEnabledTLSVersionServer
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/CSP
         properties:
-          path: ./Vendor/MSFT/Policy/Result/Cryptography/OverrideMinimumEnabledTLSVersionServer
+          path: ./Vendor/MSFT/Policy/Config/Cryptography/OverrideMinimumEnabledTLSVersionServer
           type: string
           value: '1.2'
-      schema: {}
+      expression: 'true'
   - name: PowerShellExecutionPolicyEnableTranscripting
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
           valueName: EnableTranscripting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
           valueName: AddPrinterDrivers
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: PrintersRestrictDriverInstallationToAdministrators
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
           valueName: RestrictDriverInstallationToAdministrators
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: PrivacyAllowInputPersonalization
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\InputPersonalization
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\InputPersonalization
           valueName: AllowInputPersonalization
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: PromptUserToChangePasswordBeforeExpiration
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
+          keyPath: HKEY_LOCAL_MACHINE:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
           valueName: PasswordExpiryWarning
-          valueType: Dword
+          valueType: REG_DWORD
           value: 14
-      schema:
-        minimum: 5
-        maximum: 14
+      expression: (value != null && value >= 5 && value <= 14)
   - name: RDPPortNumber
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
           valueName: PortNumber
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3389
-      schema:
-        oneOf:
-          - const: 3389
-          - type: 'null'
+      expression: ((((value == 3389)) || ((value == null))))
   - name: RecoveryConsoleAllowFloppyCopyAndAllDrives
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: >-
-            ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/RecoveryConsole_AllowFloppyCopyAndAccessToAllDrivesAndAllFolders
-          type: integer
+          keyPath: HKLM:\SYSTEM\CurrentControlSet\Control\RecoveryConsole
+          valueName: SetCommand
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteAssistanceSolicitedRemoteAssistance
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fAllowToGetHelp
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteAssistanceUnsolicitedRemoteAssistance
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fAllowUnsolicited
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteDesktopServicesClientConnectionEncryptionLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: MinEncryptionLevel
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema:
-        minimum: 3
-        maximum: 4
+      expression: (value != null && value >= 3 && value <= 4)
   - name: RemoteDesktopServicesDoNotAllowDriveRedirection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fDisableCdm
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesDoNotAllowPasswordSaving
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: DisablePasswordSaving
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesPromptForPasswordUponConnection
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fPromptForPassword
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteDesktopServicesRequireSecureRPCCommunication
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: fEncryptRPCTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemotelyAccessibleRegistryPaths
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths
           valueName: Machine
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - System\CurrentControlSet\Control\ProductOptions
             - System\CurrentControlSet\Control\Server Applications
             - Software\Microsoft\Windows NT\CurrentVersion
-      schema: {}
+      expression: 'true'
   - name: RemotelyAccessibleRegistryPathsAndSubpaths
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths
           valueName: Machine
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value:
             - System\CurrentControlSet\Control\Print\Printers
             - System\CurrentControlSet\Services\Eventlog
@@ -2675,141 +2196,117 @@ resources:
             - System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration
             - Software\Microsoft\Windows NT\CurrentVersion\Perflib
             - System\CurrentControlSet\Services\SysmonLog
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowBasicAuthentication_Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowBasic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowBasicAuthentication_Service
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowBasic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowAutoConfig
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement_IPv4Filter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: IPv4Filter
-          valueType: String
+          valueType: REG_SZ
           value: '*'
-      schema:
-        oneOf:
-          - const: '*'
-          - type: 'null'
+      expression: ((((value == "*")) || ((value == null))))
   - name: RemoteManagementAllowRemoteServerManagement_IPv6Filter
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: IPv6Filter
-          valueType: String
+          valueType: REG_SZ
           value: '*'
-      schema:
-        oneOf:
-          - const: '*'
-          - type: 'null'
+      expression: ((((value == "*")) || ((value == null))))
   - name: RemoteManagementAllowUnencryptedTraffic_Client
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowUnencryptedTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: RemoteManagementAllowUnencryptedTraffic_Service
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: AllowUnencryptedTraffic
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementDisallowDigestAuthentication
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client
           valueName: AllowDigest
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        oneOf:
-          - const: 0
-          - type: 'null'
+      expression: ((((value == 0)) || ((value == null))))
   - name: RemoteManagementDisallowStoringOfRunAsCredentials
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service
           valueName: DisableRunAs
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RemoteProcedureCallRestrictUnauthenticatedRPCClients
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc
           valueName: RestrictRemoteClients
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RenameAdministratorAccount
     type: Microsoft.OSConfig/Test
     properties:
@@ -2817,7 +2314,7 @@ resources:
         type: Microsoft.Windows/AccountPolicy
         properties:
           name: AdministratorAccountName
-      schema: {}
+      expression: 'true'
   - name: RenameGuestAccount
     type: Microsoft.OSConfig/Test
     properties:
@@ -2825,403 +2322,348 @@ resources:
         type: Microsoft.Windows/AccountPolicy
         properties:
           name: GuestAccountName
-      schema: {}
+      expression: 'true'
   - name: RequireCaseInsensitivityForNonWindowsSubsystems
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Control\Session Manager\Kernel
           valueName: ObCaseInsensitive
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: RequireEncryption
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation
           valueName: RequireEncryption
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: RestrictAnonymousAccessToNamedPipesAndShares
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: RestrictNullSessAccess
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema: {}
+      expression: 'true'
   - name: RestrictClientsAllowedToMakeRemoteCallsToSAM
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: RestrictRemoteSAM
-          valueType: String
+          valueType: REG_SZ
           value: O:BAG:BAD:(A;;RC;;;BA)
-      schema: {}
+      expression: 'true'
   - name: RSSDisableEnclosureDownload
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds
           valueName: DisableEnclosureDownload
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: RunAllAdministratorsInAdminApprovalMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableLUA
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SafeDllSearchMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager
           valueName: SafeDllSearchMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SAMRPCPasswordChangePolicy
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM
           valueName: SamrChangeUserPasswordApiPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SearchAllowIndexingEncryptedStoresOrItems
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Windows Search
           valueName: AllowIndexingEncryptedStoresOrItems
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: SendUnencryptedPasswordToThirdPartySMBServers
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
           valueName: EnablePlainTextPassword
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ServerSPNTargetNameValidationLevel
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\System\CurrentControlSet\Services\LanManServer\Parameters
           valueName: SMBServerNameHardeningLevel
-          valueType: Dword
-      schema:
-        const: 0
+          valueType: REG_DWORD
+          value: 0
+      expression: (value == 0)
   - name: SharesThatCanBeAccessedAnonymously
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
           valueName: NullSessionShares
-          valueType: MultiString
+          valueType: REG_MULTI_SZ
           value: []
-      schema: {}
+      expression: 'true'
   - name: SharingAndSecurityModelForLocalAccounts
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: ForceGuest
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ShellDataExecutionPrevention
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Explorer
           valueName: NoDataExecutionPrevention
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: ShutdownSystemImmediatelyIfUnableToLogSecurityAudits
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Lsa
           valueName: CrashOnAuditFail
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: SmartCardRemovalBehavior
     type: Microsoft.OSConfig/Test
     properties:
       resource:
-        type: Microsoft.Windows/CSP
+        type: Microsoft.Windows/Registry
         properties:
-          path: ./Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
-          type: string
+          keyPath: HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+          valueName: ScRemoveOption
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")
   - name: SmartScreenEnableSmartScreenInShell
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: EnableSmartScreen
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SmartScreenPreventOverrideForFilesInShell
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: ShellSmartScreenLevel
-          valueType: String
+          valueType: REG_SZ
           value: Block
-      schema:
-        oneOf:
-          - const: Block
-          - type: 'null'
+      expression: ((((value == "Block")) || ((value == null))))
   - name: StrengthenDefaultPermissionsOfInternalSystemObjects
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Control\Session Manager
           valueName: ProtectionMode
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SwitchToTheSecureDesktopWhenPromptingForElevation
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: PromptOnSecureDesktop
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SystemAllowTelemetry
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
           valueName: AllowTelemetry
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        minimum: 0
-        maximum: 1
+      expression: (value != null && value >= 0 && value <= 1)
   - name: SystemBootStartDriverInitialization
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch
           valueName: DriverLoadPolicy
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema: {}
+      expression: 'true'
   - name: SystemEnableSoftwareRestrictionPolicies
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
           valueName: AuthenticodeEnabled
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: SystemMinimizeInternetConnections
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy
           valueName: fMinimizeConnections
-          valueType: Dword
+          valueType: REG_DWORD
           value: 3
-      schema:
-        oneOf:
-          - const: 3
-          - type: 'null'
+      expression: ((((value == 3)) || ((value == null))))
   - name: SystemWindowsSearchService
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wsearch
+          keyPath: HKEY_LOCAL_MACHINE:\SYSTEM\CurrentControlSet\Services\Wsearch
           valueName: Start
-          valueType: Dword
+          valueType: REG_DWORD
           value: 4
-      schema:
-        oneOf:
-          - const: 4
-          - type: 'null'
+      expression: ((((value == 4)) || ((value == null))))
   - name: TerminalServerTS_TEMP_DELETE
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: DeleteTempDirsOnExit
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TerminalServerTS_TEMP_PER_SESSION
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: PerSessionTempDir
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TerminalServerTS_USER_AUTHENTICATION_POLICY
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
           valueName: UserAuthentication
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TurnOff_Windows_Error_Reporting
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\AppCompat
           valueName: DisableInventory
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: TurnOffPrintingOverHTTP
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows NT\Printers
           valueName: DisableHTTPPrinting
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: UseAdminApprovalMode
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: FilterAdministratorToken
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: UserRightsAccessCredentialManagerAsTrustedCaller
     type: Microsoft.OSConfig/Test
     properties:
@@ -3230,7 +2672,7 @@ resources:
         properties:
           name: SeTrustedCredManAccessPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsAccessFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
@@ -3241,7 +2683,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-11'
-      schema: {}
+      expression: 'true'
   - name: UserRightsActAsPartOfTheOperatingSystem
     type: Microsoft.OSConfig/Test
     properties:
@@ -3250,7 +2692,7 @@ resources:
         properties:
           name: SeTcbPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsAdjustMemoryQuotasForProcess
     type: Microsoft.OSConfig/Test
     properties:
@@ -3262,7 +2704,7 @@ resources:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsAllowLocalLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3272,7 +2714,7 @@ resources:
           name: SeInteractiveLogonRight
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsAllowLogOnThroughRemoteDesktop
     type: Microsoft.OSConfig/Test
     properties:
@@ -3283,7 +2725,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-32-555'
-      schema: {}
+      expression: 'true'
   - name: UserRightsBackupFilesAndDirectories
     type: Microsoft.OSConfig/Test
     properties:
@@ -3293,7 +2735,7 @@ resources:
           name: SeBackupPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsBypassTraverseChecking
     type: Microsoft.OSConfig/Test
     properties:
@@ -3307,7 +2749,7 @@ resources:
             - '*S-1-5-32-551'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsChangeSystemTime
     type: Microsoft.OSConfig/Test
     properties:
@@ -3319,7 +2761,7 @@ resources:
             - '*S-1-5-32-544'
             - '*S-1-5-32-549'
             - '*S-1-5-19'
-      schema: {}
+      expression: 'true'
   - name: UserRightsChangeTimeZone
     type: Microsoft.OSConfig/Test
     properties:
@@ -3330,7 +2772,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateGlobalObjects
     type: Microsoft.OSConfig/Test
     properties:
@@ -3343,7 +2785,7 @@ resources:
             - '*S-1-5-6'
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreatePageFile
     type: Microsoft.OSConfig/Test
     properties:
@@ -3353,7 +2795,7 @@ resources:
           name: SeCreatePagefilePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreatePermanentSharedObjects
     type: Microsoft.OSConfig/Test
     properties:
@@ -3362,7 +2804,7 @@ resources:
         properties:
           name: SeCreatePermanentPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateSymbolicLinks
     type: Microsoft.OSConfig/Test
     properties:
@@ -3373,7 +2815,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-83-0'
-      schema: {}
+      expression: 'true'
   - name: UserRightsCreateToken
     type: Microsoft.OSConfig/Test
     properties:
@@ -3382,7 +2824,7 @@ resources:
         properties:
           name: SeCreateTokenPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsDebugPrograms
     type: Microsoft.OSConfig/Test
     properties:
@@ -3392,7 +2834,7 @@ resources:
           name: SeDebugPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyAccessFromNetwork
     type: Microsoft.OSConfig/Test
     properties:
@@ -3402,7 +2844,7 @@ resources:
           name: SeDenyNetworkLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLocalLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3412,7 +2854,7 @@ resources:
           name: SeDenyInteractiveLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLogOnAsBatchJob
     type: Microsoft.OSConfig/Test
     properties:
@@ -3422,7 +2864,7 @@ resources:
           name: SeDenyBatchLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyLogOnAsService
     type: Microsoft.OSConfig/Test
     properties:
@@ -3432,7 +2874,7 @@ resources:
           name: SeDenyServiceLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsDenyRemoteDesktopServicesLogOn
     type: Microsoft.OSConfig/Test
     properties:
@@ -3442,7 +2884,7 @@ resources:
           name: SeDenyRemoteInteractiveLogonRight
           value:
             - '*S-1-5-32-546'
-      schema: {}
+      expression: 'true'
   - name: UserRightsEnableDelegation
     type: Microsoft.OSConfig/Test
     properties:
@@ -3451,7 +2893,7 @@ resources:
         properties:
           name: SeEnableDelegationPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsGenerateSecurityAudits
     type: Microsoft.OSConfig/Test
     properties:
@@ -3463,7 +2905,7 @@ resources:
             - '*S-1-5-19'
             - '*S-1-5-20'
             - '*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415'
-      schema: {}
+      expression: 'true'
   - name: UserRightsIncreaseProcessWorkingSet
     type: Microsoft.OSConfig/Test
     properties:
@@ -3474,7 +2916,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-19'
-      schema: {}
+      expression: 'true'
   - name: UserRightsIncreaseSchedulingPriority
     type: Microsoft.OSConfig/Test
     properties:
@@ -3484,7 +2926,7 @@ resources:
           name: SeIncreaseBasePriorityPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsLoadUnloadDeviceDrivers
     type: Microsoft.OSConfig/Test
     properties:
@@ -3494,7 +2936,7 @@ resources:
           name: SeLoadDriverPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsLockMemory
     type: Microsoft.OSConfig/Test
     properties:
@@ -3503,7 +2945,7 @@ resources:
         properties:
           name: SeLockMemoryPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsManageAuditingAndSecurityLog
     type: Microsoft.OSConfig/Test
     properties:
@@ -3513,7 +2955,7 @@ resources:
           name: SeSecurityPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsManageVolume
     type: Microsoft.OSConfig/Test
     properties:
@@ -3523,7 +2965,7 @@ resources:
           name: SeManageVolumePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsModifyFirmwareEnvironment
     type: Microsoft.OSConfig/Test
     properties:
@@ -3533,7 +2975,7 @@ resources:
           name: SeSystemEnvironmentPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsModifyObjectLabel
     type: Microsoft.OSConfig/Test
     properties:
@@ -3542,7 +2984,7 @@ resources:
         properties:
           name: SeRelabelPrivilege
           value: []
-      schema: {}
+      expression: 'true'
   - name: UserRightsProfileSingleProcess
     type: Microsoft.OSConfig/Test
     properties:
@@ -3552,7 +2994,7 @@ resources:
           name: SeProfileSingleProcessPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsProfileSystemPerformance
     type: Microsoft.OSConfig/Test
     properties:
@@ -3563,7 +3005,7 @@ resources:
           value:
             - '*S-1-5-32-544'
             - '*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420'
-      schema: {}
+      expression: 'true'
   - name: UserRightsRemoteShutdown
     type: Microsoft.OSConfig/Test
     properties:
@@ -3573,7 +3015,7 @@ resources:
           name: SeRemoteShutdownPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsReplaceProcessLevelToken
     type: Microsoft.OSConfig/Test
     properties:
@@ -3584,7 +3026,7 @@ resources:
           value:
             - '*S-1-5-19'
             - '*S-1-5-20'
-      schema: {}
+      expression: 'true'
   - name: UserRightsRestoreFilesAndDirectories
     type: Microsoft.OSConfig/Test
     properties:
@@ -3594,7 +3036,7 @@ resources:
           name: SeRestorePrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsShutDownTheSystem
     type: Microsoft.OSConfig/Test
     properties:
@@ -3604,7 +3046,7 @@ resources:
           name: SeShutdownPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: UserRightsTakeOwnership
     type: Microsoft.OSConfig/Test
     properties:
@@ -3614,137 +3056,114 @@ resources:
           name: SeTakeOwnershipPrivilege
           value:
             - '*S-1-5-32-544'
-      schema: {}
+      expression: 'true'
   - name: VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: EnableVirtualization
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsExplorerShellProtocolProtectedModeTitle_2
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
           valueName: PreXPSP2ShellProtocolBehavior
-          valueType: Dword
+          valueType: REG_DWORD
           value: 0
-      schema: {}
+      expression: 'true'
   - name: WindowsHelloAntiSpoofing
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures
           valueName: EnhancedAntiSpoofing
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonAllowAutomaticRestartSignOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: DisableAutomaticRestartSignOn
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonConfigAutomaticRestartSignOn
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
           valueName: AutomaticRestartSignOnConfig
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonDisableLockScreenAppNotifications
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: DisableLockScreenAppNotifications
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsLogonDontDisplayNetworkSelectionUI
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\System
           valueName: DontDisplayNetworkSelectionUI
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WindowsPowerShellTurnOnPowerShellScriptBlockLogging
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
           valueName: EnableScriptBlockLogging
-          valueType: Dword
+          valueType: REG_DWORD
           value: 1
-      schema:
-        oneOf:
-          - const: 1
-          - type: 'null'
+      expression: ((((value == 1)) || ((value == null))))
   - name: WinVerityTrustSignatureValidationVulnerabilityMitigation1
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Wintrust\Config
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config
           valueName: EnableCertPaddingCheck
-          valueType: String
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")
   - name: WinVerityTrustSignatureValidationVulnerabilityMitigation2
     type: Microsoft.OSConfig/Test
     properties:
       resource:
         type: Microsoft.Windows/Registry
         properties:
-          keyPath: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config
+          keyPath: HKEY_LOCAL_MACHINE:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config
           valueName: EnableCertPaddingCheck
-          valueType: String
+          valueType: REG_SZ
           value: '1'
-      schema:
-        const: '1'
+      expression: (value == "1")