<?xml version="1.0" encoding="utf-8"?>
<!--  (c) 2006 Microsoft Corporation  -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
  <displayName>enter display name here</displayName>
  <description>enter description here</description>
  <resources>
    <stringTable>
      <string id="ServiceControlManagerCat">Service Control Manager Settings</string>
      <string id="ServiceControlManagerSecurityCat">Security Settings</string>
      <string id="SvchostProcessMitigationEnable">Enable svchost.exe mitigation options</string>
      <string id="SvchostProcessMitigationEnableExplain">This policy setting enables process mitigation options on svchost.exe processes.

If you enable this policy setting, built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them.

This includes a policy requiring all binaries loaded in these processes to be signed by microsoft, as well as a policy disallowing dynamically-generated code.

If you disable or do not configure this policy setting, these stricter security settings will not be applied.</string>
    </stringTable>
  </resources>
</policyDefinitionResources>