Citrix Systems Citrix MetaFrame Application for Windows 1.8 - Manual (Page 142)

 0HWD)UDPH $GPLQLVWUDWRUªV *XLGH
If no arguments are specified, query acl checks all local drives and then checks
the HKEY_LOCAL_MACHINE portion of the system registry.
Any files or registry keys that non-administrator users can write to are reported in
the following format:
P7E@8UÃÃDIC@SDUÃ688PVIUÃÃÃÃÃÃÃADG@
fffffffÃfffffffÃfffffffffffffÃfffffffffffffffffffffffffffffffffffffff
9XYQPÃÃÃÃÃÃÃÃÃÃÃc@‰r ’‚rÃÃÃÃÃ8)c6ˆ‡‚r‘rpih‡
YÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃc@‰r ’‚rÃÃÃÃÃ8)ci‚‚‡vv
9XYQPÃÃÃÃÃÃÃÃÃÃÃc@‰r ’‚rÃÃÃÃÃ8)c8‚svt†’†
YÃÃÃÃÃÃÃYÃÃÃÃÃÃÃc@‰r ’‚rÃÃÃÃÃ8)cX‡† ‰
Query acl also audits the MetaFrame execute list (created and maintained by the
Application Security utility) to verify that no executable files in the execute list are
writable by users.