Donat Was Here

DonatShell
Server IP : 180.180.241.3 / Your IP : 216.73.216.252
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF
Directory : /Windows/Help/Windows/en-US/
Upload File :
[ HOME SHELL ]
Current File : /Windows/Help/Windows/en-US/hra.h1s
MZ@PELà!@06ž@Ô.rsrcÔ@@.its @@€0€	HX||4VS_VERSION_INFO½ïþÚStringFileInfo¶040904b0b!FileVersion1.00.00                         l"FileDescriptionCompiled Microsoft Help 2.0 TitleBFileStampA853A20D01CA041F4JCompilerVersion2.5.71210.08579VCompileDate2009-07-14T01:08:54      >TopicCount32000000000000¦ALegalCopyright© 2005 Microsoft Corporation. All rights reserved.CCCCCCCCCCCCCDVarFileInfo$Translation	°ti 
¢S¨»Ãn!§ITOLITLS(è›XìŒ¡Ù±^
V¿æî`¸  ˜ xˆ˜ÿÿÿÿÿÿÿÿ 9ÿÿÿÿÿÿÿÿCAOLPHHíC ITSF Ø#ŽV¨	þÂ±-YìŒ¡Ù±^
V¿æîYìŒ¡Ù±^
V¿æîIFCMÿÿÿÿÿÿÿÿAOLLÍÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ9IFCM ÿÿÿÿÿÿÿÿAOLL¿ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ//$FXFtiAttribute//$FXFtiAttribute/BTREE†áAÈ/$FXFtiAttribute/DATA/$FXFtiAttribute/PROPERTY‡©YN/$FXFtiMain//$FXFtiMain/BTREEƒÏ#ƒˆ/$FXFtiMain/DATA†×;ˆ8/$FXFtiMain/PROPERTY†ßsN/$Index/$ATTRNAME‡¯w\/$Index/$PROPBAGˆÛk/$Index/$STRINGS‡Ü7¾H/$Index/$SYSTEMˆÀ%›F
/$Index/$TOC//$Index/$TOC/$hra…/$Index/$TOPICATTR‡«'„P/$Index/$TOPICSˆ¼„/$Index/$URLSTRˆšŸ/$Index/$URLTBLˆº‚/$Index/$VTAIDX‡±SŠd/$Index/AssetId//$Index/AssetId/$LEAVES‡¼7 	/$OBJINST…ƒÊ/assets/0/assets/332915ab-0a04-4c93-87ae-6b773aa4d3e8.xmltêO0/assets/4214362f-4d30-473a-b95b-a2130ba5c1fc.xml‚ˆX·0/assets/6c44027f-a214-41d3-b657-2b9e8d0ddac7.xml‚¿c›0/assets/79885c91-4bc7-4c5a-b663-6140d242bf75.xml‚Únš;0/assets/7a14e840-7d24-402f-9777-6b98e830864f.xml‚õ)š0/assets/ae5d5d44-7a46-4daf-88c1-af580519bdeb.xmlƒBÀJ0/assets/af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a.xmlƒÐåB0/assets/c1916806-39b6-441a-9d1f-1c789e04e84e.xml„µN¤(0/assets/ca01fd62-4e6b-48d7-9d8c-65fc3f94379c.xml„Ùv¦0/assets/cfece017-37f4-4c97-9bb7-e08cd49150d7.xml…€¬60/assets/d3b2e920-86ee-4671-a273-60a818d77520.xml…¬<”\0/assets/d87d5168-61b8-4c8e-988a-365a653696bf.xml…Á0/assets/d9933a4d-3059-48ab-b303-3e3fbd09912e.xml…î(£0/assets/ed2a5c7e-dfa5-4354-8e41-e12e28d57189.xml†‘6‚àv0/assets/ffe5b00d-9333-4ecb-a880-608817d37b62.xmlˆò,ž/hra.h1cŠK‰e/hra.H1FŠš0‰/hra.H1T‹ùx‘G/hra.H1VŠ£IÖ//hra_AssetId.H1KŒ‹?k/hra_BestBet.H1KŒŒ*k/hra_LinkTerm.H1KŒl/hra_SubjectTerm.H1KŒŽo/relatedAssets/7/relatedAssets/79e2ebfc-4b95-4a2c-9b71-fa3dc074046c.gifëC::DataSpace/NameList<(::DataSpace/Storage/MSCompressed/ContentŒŽp‚Œ*,::DataSpace/Storage/MSCompressed/ControlDataT )::DataSpace/Storage/MSCompressed/SpanInfoL/::DataSpace/Storage/MSCompressed/Transform/List<_::DataSpace/Storage/MSCompressed/Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/InstanceData/i::DataSpace/Storage/MSCompressed/Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/InstanceData/ResetTableŽ›P3::Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/kH®TgTA¾Mãp9UncompressedMSCompressedFXìŒ¡Ù±^
V¿æîí-LZXCHH<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Verify NAP Client Configuration</maml:title><maml:introduction>
<maml:para>Use this procedure to verify that NAP-capable client computers are configured for the Network Access Protection (NAP) Internet Protocol security (IPsec) enforcement method. A NAP-capable computer is one that has the NAP components installed and can verify its health state by sending statements of health (SoHs) to Network Policy Server (NPS) for evaluation. For more information about NAP, see <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=94393</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=94393"></maml:uri></maml:navigationLink>.</maml:para>



<maml:para>Membership in <maml:computerOutputInline>Domain Admins</maml:computerOutputInline>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Verify NAP client components</maml:title><maml:introduction>
<maml:para>NAP components include the NAP Agent service, one or more NAP enforcement clients, and at least one system health agent (SHA). Other services can also be required if they support an installed SHA. All of these components work together to continuously monitor the health status of a NAP client computer and provide this status to NAP servers for evaluation.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>NAP Agent</maml:title><maml:introduction>
<maml:para>The NAP Agent service collects and manages health information on the client computer. NAP Agent also processes SoHs from all installed SHAs and reports client health to enforcement clients. NAP Agent must be operational to enable client computers to request or receive health certificates.</maml:para>

<maml:procedure><maml:title>To verify the NAP Agent service is started</maml:title><maml:introduction><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:alertSet class="note"><maml:title>Note </maml:title>
<maml:para>Restarting the NAP Agent service will automatically reinitialize SHAs and the computer will attempt to acquire a new health certificate. This can be useful when troubleshooting NAP.</maml:para>
</maml:alertSet>
</maml:introduction></maml:section></maml:sections></maml:introduction><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Control Panel</maml:ui>, click <maml:ui>System and Maintenance</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then double-click <maml:ui>Services</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the list of services, under <maml:ui>Name</maml:ui>, double-click <maml:ui>Network Access Protection Agent</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that the <maml:ui>Service</maml:ui> status is <maml:ui>Started</maml:ui>, and <maml:ui>Startup type</maml:ui> is set to <maml:ui>Automatic</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If the service is not started, choose <maml:ui>Automatic </maml:ui>next to <maml:ui>Startup type</maml:ui>, and then click <maml:ui>Start</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui> to close the <maml:ui>Network Access Protection Properties</maml:ui> dialog box.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Close the Services console.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>NAP IPsec enforcement client</maml:title><maml:introduction>
<maml:para>The NAP IPsec enforcement client must be installed and enabled on client computers. The NAP enforcement client requests access to a network, and communicates a client computer's health status to other components of the NAP client architecture. The NAP IPsec enforcement client restricts access to IPsec-protected networks by interacting with the certificate store on a client computer.</maml:para>

<maml:procedure><maml:title>To verify the NAP IPsec enforcement client is initialized</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, point to <maml:ui>All Programs</maml:ui>, click <maml:ui>Accessories</maml:ui>, and then click <maml:ui>Command Prompt</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>At the command prompt, type <maml:userInput>netsh nap client show state</maml:userInput>, and press ENTER. This command displays the NAP status of the client computer.

</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the command output, under <maml:ui>Enforcement client state</maml:ui>, verify that the <maml:ui>IPsec Relying Party</maml:ui> status is <maml:ui>Initialized = Yes</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

</maml:sections>
</maml:section><maml:section>
<maml:title>Verify IPsec client configuration</maml:title><maml:introduction>
<maml:para>NAP clients must be configured with settings that allow them to communicate with NAP server components. You can configure these settings by using Group Policy, the NAP Client Configuration console, or the command line. For the IPsec enforcement method, NAP client settings include Request Policy and Trusted Server Groups.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Request policy</maml:title><maml:introduction>
<maml:para>You do not need to modify the default request policy settings on NAP client computers. If these settings are changed, then it is important to verify that similar settings are enabled on your NAP servers. By default, a NAP-capable client computer initiates a negotiation process with a NAP server by using a mutually acceptable default security mechanism for encrypting communication. We recommend that you use the default request policy settings.</maml:para>

<maml:procedure><maml:title>To view request policy settings</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, point to <maml:ui>All Programs</maml:ui>, click <maml:ui>Accessories</maml:ui>, and then click <maml:ui>Command Prompt</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>If Group Policy is used to deploy NAP client settings, at the command prompt, type <maml:userInput>netsh nap client show group</maml:userInput>, and then press ENTER. If local policy is used to deploy NAP client settings, at the command prompt, type <maml:userInput>netsh nap client show config</maml:userInput>, and then press ENTER. These commands display the Group Policy and local policy NAP configuration settings on client computers.

</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the command output, verify that the <maml:ui>Cryptographic service provider (CSP)</maml:ui> and <maml:ui>Hash algorithm</maml:ui> settings correspond to the settings configured on HRA. The default cryptographic service provider is <maml:ui>Microsoft RSA SChannel Cryptographic Provider, keylength = 2048</maml:ui>. The default hash algorithm is <maml:ui>sha1RSA (1.3.14.3.2.29)</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Trusted server groups</maml:title><maml:introduction>
<maml:para>Trusted server groups are configured within client health registration settings so that NAP client computers can contact Web sites that are used by HRA to process health certificate requests. If trusted server groups are not configured or are configured incorrectly, NAP client computers will fail to acquire health certificates.</maml:para>

<maml:procedure><maml:title>To verify the configuration of trusted server groups</maml:title><maml:introduction><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:alertSet class="note"><maml:title>Note </maml:title>
<maml:para>A NAP client computer will attempt to obtain a health certificate from the first URL in all configured trusted server groups unless that server has been marked as unavailable. For more information, see <maml:navigationLink><maml:linkText>Verify IIS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=cfece017-37f4-4c97-9bb7-e08cd49150d7"></maml:uri></maml:navigationLink> and <maml:navigationLink><maml:linkText>Understanding HRA Authentication Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=d9933a4d-3059-48ab-b303-3e3fbd09912e"></maml:uri></maml:navigationLink>.</maml:para>
</maml:alertSet>
</maml:introduction></maml:section></maml:sections></maml:introduction><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, point to <maml:ui>All Programs</maml:ui>, click <maml:ui>Accessories</maml:ui>, and then click <maml:ui>Command Prompt</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>If Group Policy is used to deploy NAP client settings, at the command prompt, type <maml:userInput>netsh nap client show group</maml:userInput>, and then press ENTER. If local policy is used to deploy NAP client settings, at the command prompt, type <maml:userInput>netsh nap client show config</maml:userInput>, and then press ENTER. These commands display the Group Policy and local policy NAP configuration settings on client computers.

</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the command output, under <maml:ui>Trusted server group configuration</maml:ui>, verify that the configuration is correct for entries next to <maml:ui>Processing order</maml:ui>, <maml:ui>Group</maml:ui>, <maml:ui>Require Https</maml:ui>, and <maml:ui>URL</maml:ui>. </maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section>
<maml:title>Review NAP client events</maml:title><maml:introduction>
<maml:para>Reviewing information contained in NAP client events can assist you with troubleshooting. It can also help you to understand NAP client functionality.</maml:para>

<maml:procedure><maml:title>To review NAP client events in Event Viewer</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, point to <maml:ui>All Programs</maml:ui>, click <maml:ui>Accessories</maml:ui>, and then click <maml:ui>Run</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Type <maml:userInput>eventvwr.msc</maml:userInput>, and press ENTER.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the left tree, navigate to <maml:ui>Event Viewer(Local)\Applications and Services Logs\Microsoft\Windows\Network Access Protection\Operational</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click an event in the middle pane.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>By default, the <maml:ui>General</maml:ui> tab is displayed. Click the <maml:ui>Details</maml:ui> tab to view additional information.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>You can also right-click an event and then click <maml:ui>Event Properties</maml:ui> to open a new window for reviewing events.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Troubleshooting HRA</maml:linkText><maml:uri href="mshelp://windows/?id=6c44027f-a214-41d3-b657-2b9e8d0ddac7"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual>GIF89ap,‡0™4™4™8¡<<•<¡@@•@¡D¥D¥D‘D¡D¥HªH™$H… H‘H¡H¥L¥ L¡(L‘UÎ Pª0P$Pª0P‘$U®,U(U®<U}$Y²,Yª<Y…,Y²0Yª8Y•(]²@]ueÿ,]²0]²8]H]}iÆ<]ª<a¡8a®8a²@a<a®4e¶Pem8e²<e²@e®@e²8iº@i²Hi¡qÿDi²eie<m¾]miLq¶DuÆquYUu¶Yu®•ÿ™ÿL}ÆLÎ}L}U(‘îÿP…Î8‰ÿ……Da¾aÂÎe0i²Îi4i…Â¡ÿm…º…DYÖq‰¾Òq8Òq<L‘ÿ8Òu8qÂ$ªÿqÆÖy8Öy@y‘Âe™Ú0®ÿÖ}Du•Î¥™4Ö8Ú4•Æ‰•¶Ú…4}™Î²,Ö…L™ÎÖ…U@²ÿa¡ÿm¡âÞ‰0}ÎÞ,â(‰Æ‰Êq¥æÚY¾¥$¾¥(Â¥$¡Êâ•$æ•‰¥Òqªÿæ™UºÿÞ‘a‘¥ÎæêÊ®}²îÞ™i¶¡®î¥Ö²¶î®Î¡®ÊîªâumÂÿ…¶ÿ²Ú…ºòò®¥²Òæ¥eÞºò²â¥‰¾öêºö¶æ¾ê®aÂúöº®ºÒîÂö¾•Âÿª¾Þú¾™Âÿ²¾Ö…Îÿæ²‘úÂæ²™•ÊÿÿÆöÊÿÊ™ÎÿÂÂÒºÆÚÎÿæº¥¾ÆÚÿÎªÊÿ¥Îÿ™Öÿê¾¥êÂª¾ÎæÚÿ¾ÎêªÖÿ®ÖÿÊÎÞîÆ²ªÞÿºÚÿîÎºÞÒÒÒÖÞÊÚîÂÞÿÒÚîÚÚâÊÞÿòÖÆÂæÿÊâÿÞÞæòÚÎÊæÿÞâæîÞÖÊêÿÒæÿöÞÒÚæöÞæòæææöâÚÒîÿÚêÿêæêâêööæÞÚòÿâîÿæîÿæòúæòÿêòöúîæâöÿêòÿîòÿúòîòöÿîúÿÿöòöúÿÿúúÿÿÿÿÿ	H° Áƒ*\È°¡Ã‡#JœH±¢Å„å¾iÜx±£Ç CŠI²¤É“(Sª\¹ßÆm¹bæ¢„§¦+8sê´òŽÏŸ;ƒ²©‰Ç‘Ì\Ó6æcÉ´©Ó§P£JJ5¤ËoÐb:ª‰ËÏ9ŒÂ2ÚTªl*bhÓª]Ë¶-±VeKmËˆÏÏ/8íà™ÆzUL¸°áÃëa‰Œ¯pþ„%[ÊåË˜3cNU*TXD>Ç<.šË¯;Ä¨S«^Íº5Æi¹8áAceLä±¥piÞÍ»·o¶½ä2}Æ
<œrAûæº¹óçÐ£G,—uí7|E*ë·÷ïà½Ïÿ*e‰‘8Æñ(g.½½û÷ðŸRÏe§F¡º‡ßÏ¿ïñŒüÞqëÅgà&ˆ;Ð˜‚‡}øéçß„Vˆ€Za'É¤£à‡ †ˆX>°áÅ~lgáŠ,¶hY*‘üQ£@˜ˆ8æ¨#Iåã_dWJ/.iä‘h•‰c`¡{;F)å”}#Ì X¼‘È&º!éå—EîR
#èÙ1Ê6þP©æšúóM.Â‘H(D‚içE¦ÉXØaÊ4ü°)è «•3Š^1RžŒ6šg$|`ÁÆŸijé¥Oå
%YBr–£ †êb+b12§aªêª!ÊÆlÿ²‹¨´ÖÚb(ˆœ'ÓTÊê¯À*¤)§o@ÒŠÈöG
!Ì6ûŠ³”zêÁVËj=Éà«¬Év‹–*ÌºÑÄ¸M¸Â¹ îºëFÐÂ»ðÀî¼çžk¹u0ûl‘¸ŽÆ-©Z+ðšõ ÃÆ,ê-¨¼0;EAœ;@	¼ë“!Š+ƒÎÇ ‡,òÈ"sÌqûð®¼œ{Ã¸ù’R!,‰œñ¯‡çŒ£;·ŒÈ±ã¹,å†ÀïnA ‡CòÓPG-5Ô?‚±Ê AMLAˆÌüÑ¬«)8ël6|<£qF"@í¥$bÂ¸‹„Æ®L÷Þ|÷ÿ
20®qEYoÝ„’„íØeŸíxkü$ÃÆÚºí")u4qCº ‘†+Ãø-úè¤ë
8>| õËu\"^$6çBíã´6
§´mùŠ˜Ë=@1ñˆÇ¥oüñO“	êto`„®÷Fóƒ@ãkíØCå'`ð±Éî+6<Å
	DàÃçN#¯þúìƒ\KHL`€M²¯f¡üñ'Pfï?JùH†Ú"Ñ%ðù‡b‚¶…LT£}Œ`û²!
2´À‚À†™]X`¸ÅìþGB”ƒ°ªœÃ£
7a@ ˆ'ÁÚ}Ã8"0 ¸á~–™E"ÿ¨‘"‘CÃ,±Bþð¢F@|ˆÐÝðŠXÄ! |`	¡¼ÀL(ü†\,åˆhTÈöÀð6Ñ7’˜Âàƒ8Ð0‹xÌ#ò€‘†ÀSˆž[p‘ˆ/P¢iL#4ìp†HÌêÞ©C€-ÔB˜ÌäúDq…	LÀ„¸Ì&à€†d*‘%ÌÇ(Øø)HöFb¸ñMÚò–ÇF.xƒºúãÄQé¸zpb( +5£
.H	™H.§IÍÑeã\€˜–^XbŽ(1—JŒÁuZ¦fÜ@>$Ü±šðŒgß\„Ü nÙÄð0ÿqlx8Ã÷Ô©IÁ>È„<ÊÐ¾…ã1H€©–Rð
Eôç¯ Á†9(Œ –!Å&ð@d£¡(MéÔª‡	H€ª`K+þ†U\O£‚‚ü ;²…bpA®`E•õ¨$F={É–Y â·8%NÕ¤Ó?ÌÂ§–©Ã€Q õ«`6
„Ä©e‰áM§Š£ª^«l¹„ƒCH3¬x
k6ñ	LƒÄ@kM×ÊÖM
V…ëZxÁ…
LÀµÌ«d';Œ+DÀbP.1ØÂ*hlàƒ±úŠ)4	—œ¬jW+
$4€aDËfÁ€Ïÿh¡í)\U1×+<pµÀ]í3\;…ûá‚¦µmtÜ1ˆ9è«¤BÒpÒàZ·tÕ0YÓ2Y+4À1EË,þÀD*w5ù0ÅB¡XµHâ°ëuç²ìcG0~0¯(°úûýšÀ{„+îŠ¼l¤¡Cà`+ààˆaž×0þ¸"ÑÞ´Ô!P(}ƒûWÜ7#ð/„À&tA0f…/fLãÛ¸Æ €± ¢Ðb€@0„çŠê/‡ˆÀ
ÌJŒMŒÁR½°íÐ0ŠG¶WˆAÞFœ×ìÆ&à@°b&ìá	7N³š×Ìf]Bÿ
Lð1M2bÁ¤ËBJ´D¢¦R&L:ðÀ‡·*–±§}'—:@áÿ-1	6[úÒ˜^ó›™ „s€
øí<[ 7 eˆ@Ã6M~pâ%NÙEµiB  „.€"ÓÀ¶°m<‰(ð@ Bû4@a„Å0V7E€n//f½QÛš¡á¨ 	à"¨AÆÃN·º…
Š.BR;µá¾-¡8Ã-kí’0÷ÊÄª°#[ž® ð‚I¯ûá6+ÔPÀi(*Ôª	„²£`ƒ8û}’¯·Ã’ÿØ€¼}ðjºâÿB¥#Nóš[E€ÀÈ ñ¤¶à2ƒÅ8e’ƒ¤lE:±ªŠ|€Þ-§&0¨ðtá6ÏºÖ	&@€q¨5É2ñÉgE
É5zG\ý†ÑªsÛ
xDÔ«9õh 
¿ÞºÞ÷néI`{ÈÂ±…	p¸ðÃ ,¬vˆlcÃ®Á<wLÖýîyç»æ7Ÿf¿>ì$ã¸Ç‰‘ï[4~"ü ÄRI„`å•·e5È`w¼sþö¸¿±ç9 _‘ãç¤¹Îxú†|
LT¬*‚€-ÇÞòDPÀ2Ÿûê[BP€XŽ²á©(eÿñâQÀõo©žŸÉG˜@]°¾üç?cVDAD€::oø]üaE7~‘l	íUpÇ~W”
qð< ô7ô×0rW_G¡ jH·ÐvÊç> xhCÏ@uE@}Ø‚Õ÷<ðq`p¿7¨0”Àoýæf²t åàU'ˆE®èæ‚J( P
pb 	– rÅZäS¯0>°€CA‡À  KX†¨]À@à|ÕðF€
o`zFçœÀVæS’0€ð…7ä
 3g†‚Hj@Pk[€—0
Ž€çÿUv°
‡fÀ}|¸>Ã ˆƒØ‰ó§@Õ50›`…†…Šu	°—(AÕ@@†žX‹ô§Q ƒW—0«path‡Š5 h¯x<á¶øŒÈ
Ep"æ
†‡h[(‰»W@yÉh<`K„ÐxŽÖ‡	6`“
Hp—À£QªW\0ÎŽÈS#À,ˆŽ™{‚ Dð@RXoŒ8µ
ÄHZ7€^¨¤ó@àh9iHáP
1`|À	þä”€Š…€{(‘ÈÃŒ´˜‘.i}º°àU^€b€¨ÿÄ‘¨XF–¨’~3#°ºð’F)§ð^ÃpSÀŒ—=˜…õ
.p@y<‡ y”^Y}QÀµH\`^Ù3
v`h u	 	YY<ÕBP”_y—¹‡	°”r@\ ÿÃwHPnÐ=—}s°xÙ˜`9ÃPÀ"é?%©XNÐ…ˆiMD æè˜ ©y“ iP
N9:(0þàÜ¨…W¹™£#
¡Y›œ“Y–xàˆÃƒ0P>E
$—°éPDðXg›Ê¹yO f .ÀQyŸ@ÖyØ™Ú¹ÜÙØiAäÿ2žäYžäX¢"	'€ŒÅ	5ÀÀ´¹œòÉwºP9	~9…ÞÙŸþùŸêŸ;Ð¶B'`‚ã2° Ú ú ¡:¡º?©Gà˜0Ÿªy{Àp\0¨îAJ+n@ù1 Ê£2:£4Z£6z£8š£8:ù¨IYÀvÙ¡Bºu ° ¢hi&Ú(J+Sàà2p®‘=ªGá@K0¤\ªw¬`i@SÐOª±¤ÒÑ¤¡bX)5SZ¥WŠGÕ0-Ù¥tjsE@>ÉP¦'š¢Â.àzÓ¦a¥šôžœX§Šq]ÿ`e¹§%Ú§Ž¨Ä95„Ê†ŠIšœ‹Ú©÷p.©‡a¦¨
¡ªÁª«êªP¦xB©|s©«‘©y”@ê©¼qE*ª¤ºŸ«ªJ¬§
«O!«vB«µJ¥zª¯ŠªÃŠ¬(«X”¥[Ú«Úúp¬ð@0ª¥:¬âú¬«Z®ÑÊÊú%VY©{c«Æú®Š¬ÒÊÖzCÕ`sºú:lEP.@¦„aªJ¬©:¯ðj®ÔªéŠ$¯0œ¢ã®Ðz°æŠ°ôú¦ô Ð•ûº±ÂÖ#ð¯ÂŠóú®ËªËk$
Ëžlê¬Ñšªû®	[õ*AÏÿÀÿÈ±:{i{ð±+®2[°ñ:³%‘².²²¤±äZ°a²{E7›³;[µkÖ³ +Ak¬2±«°~z$€j±ƒê²K±g¯D»5Û>Skµp›iXK¢Q´j;²Ëµ'¶_âìú°fÛµ1ëµÕJ¶Èó¶q›¸–¶ úÉvÛH»"C°~ÅÃ´h›¹i{m«>ˆ«¸ «fŒ¼Ù‘ë“[!F ¨Æc«ªÑ¹Çó¹¡;»6¶©¹§Û©;!N°¦k¶¯k¸¥#»´{¼3f»S@»Ë½Û\€êãº©»Å‹³È›½5¶ÀSÑ¼«ÿñ¼ûá>°>Ô‹Ö;:Æ«½È»P	R±µñz¬»· a´!¾à!	¥£s¾ˆ‘¾~³¾ìÛ¾ï[·ÓJ®¯ªÀø[
<úëªÐZ:˜[²0«¶
¬Ì7áÀZÀ"ì]€â[[²M;¸O{²N{·õ[¬¬ì¼@úw<µåj°¼7=¯#¬½E€¥{)ÌÃ*|¶FËÄÅºÂ=ì5Ü7’ì³ÃƒÅ›[¸ê“ÙZÄ#ì.ð)|°ó‹Áö{·PÌÆmüÃÿPÅ»ñ»äºm<ÅLÌÁÄ»7™`b,Æ¬ÀWàgÌÅDËÅ‘ÆóÿK‹LÅaëä+Av³µpüA5Ã AúÇ"Œ	
¿LqÆœ¶ˆ<®MŒÆR¬Ê
!Ç˜q	à¿Áû´,¼Â—ì™ü4ÙÀTëÉÙ«
@
£ŒÊxû¬øûÂl|®,¼ÆùûÈûÁp˜æ+¼¥üµN|Ë‘Ë$cèË¼Ä"¾#ÍáÊ–1X\ÇÔìÂ´¼ÀQ[:TŸÞ,ÆPÆºË3èÜÑ{C|Ú2‡ õìËºÀrÏLêÌßË²Œ<mý1µP|ÐE

ð*AÎ©ÑÏjÍÒÜ>]]
À©ýÇ‚€¹ëò»Á>ÿ¼Ï/K°ÌL"êŒE'M& ±-ýÇLÐ)1Ó_ëÃÜÅ¦ÌÏí‘ìÓÔŒ¾{<2`\Ô
ÄB»ÌµlÍNmÓ±Óª€jÒÂ»ÏlÓi,Ö¡ÍÀàÕbŒ	À^MËw|Ç1œÇp=;}Åx„¹}ÝÔ0¼Ô‘Ëá0‰j×Hm…ìÄKÖŒœÀ!ÒSE†Ö-¸‘ËY
Ù[ÝÕ$QÙ&»¶OŒÊ-|ý|Öi
AvÌÔÖÜÚô›ÍWý1s]×¦}×y]¤\ÌS,²‰ìµæÜÌàAØyôÙ–Ø„[Í£½ÛýØ¿Ù“=ÃÇ§ÜÂmÿ-d]ÖQ]Ø»ÊomÜ«\A\Ú×}Ú©-©¿!Û˜äÜŠ|ÜÝÑÁ½ýÞ×ô ÝòíA`¹zTÛ8ý×Më´$K\ÝþÝÒLpÞÐ¿!	 I?=ìÞ¾Õ¢ r,,ÐUÀÄÛßþßÐ!1âˆQÅÿ¬á).ÐÄËÖÝâžÌ>ãÎLhmK.ÖÛÇ<^ÔºpÞ â(¡tð	0~´ãÝF·Tä»áð,=B°b>æd^æf~æhžæj¾ælÞæn¾æÝºjðN^ç0ëâŠ0å"ÁŽKîŠÌOÃÉL°Eÿ°„ £ŒÞèŽþèé‘^Lp¼P!ã±ðôð	zÎçÁÃ~Þù½êðìÔºý4]þå¨é„B•N»j€™n`ý°à  .ê{Õ»Qåèª¾Þ€ýÜ"Ñ¹ˆ^†´>(¶Ž¼
-Ó”MÎ`ú@Á>ì£îúkâÓtÁj\ÉÄlèoëÒ~6Õ~¼¹ŽíÂMÑ PÀíàðí¡î!¾È~E‡ : b$cîÜ-Ö‚Äoša¬„Ó.(ïné¨]°ñ1°ñßñÿñô®/`ïË ù.ì¡.ò.ò0šÿAî5tp4C‡PðË®¹ÍžÜQ³ÕÀ¾=ë!Q´®@Ÿ¿·~¼“ ëq7Z	\Ð,VõXõ"
O PòZ°ûp
Ü òYŸöY¯ÿ.A™ :½Nô`9w¥ÅŠ½ÔKï5KÎh†‘›ðøßÇ‚®M¼(0ñ!áÀù[ÿp9öÎ ×°ÿPP$4ß>o4f@äÁ@ý à_q>ÎÖ„Ëà^\_D/ˆvÛàƒÝñÃ¸øÚûô$‘gÀ‘Ï
<O Z`Ú@;Ðù-Òöìúq_ú5vúý0ì:ÿà¢7NÑ=ê÷ƒHÊÇºÈ²/ûÊ\ÉêŸÙÓjþ÷þ.¼Æ¼‹?¦máQü¡ I
¡GÛ	ÄD˜PáB…€¡ƒQâDŠE}À=rÁ|}ù1·~Š<¬pîßJ–-]¾„SæL™9\I¬Æ@WHž=}þ”g€—Š²4ú@Ò¤JW6eŠ´eÔ§R].j«Óª\¡Bí“¡eÍžE›VíZž“Ð„û2ß˜^í.@%Ú/<‰&à]Â…ëÄ¨˜XqDW22R¡·Î#Pi÷´É
p3e\Î=¿´)ñH¶¥Ó½ZtéV°][7}º:ìÿêªcËæZõõTÚ±eŽ5\øpâ>AÈùLÓT¤ÂÍóîíëòoà›_Ox#Óbîk9ÎÙXPgó¤IÑƒY³5e*“¿‡ß24Äœ;‹ß÷…:kjþ¹©zÝÀ°h2
¶Ô*À«\	8ü„0BÜŠO.º°»ë¹' G:À³Ãë$Á ; ¼uÆÊ™uÈ‘BÒË,›
È¨
l*ä±³ùÐ‰£	‡ÓOÁÚþÛÍ5¤’ô¯?§˜<p¶Ö¬rÉÁ!¯Ä’-*éq¥[q!R‚xN‰è£–¦1ÌëŒHÃÄî¼€ž{XüÉ˜uÖ	CFi<ÇÙ!#"ÿvì2QÐn‚èL²,HÞX;’7ý£ôH¦j›ô«)£¼-TQ_²RSOí©‹ºô\Ü<hÌŒvh§ŸF”xâLEVb³:X	S¥pääî¢¢¹GŸ‚!çž>ý”ñ‰%2º@}®¹§"fUFQoÿ™ÏPUKÒoÏE¾RÉe7K]¦ÇUùUÖvÀægô„çÖ\¥×Á~µkŠ+ˆ-–(%Êàfg@böžE 6ƒ«ÕGÙœ§*¨5ƒ‘G&¹d“OF9å”-`”5Ú=ËÜtg¦y¦uaÆB!\è
XÜ´_}Câž<pÍ €}%x!^¨áÅÿŒýG	«× g®ÁÇ“(VÁâ0Ö˜'é©"
È`»m·ß†;n¹çž;aëËY(™kæ»ï›ó\¸I
È§ÂoàpSŒYó}Ø'gîQçè'” nà¦rÃ©§VØj«óèÇ˜¯)Î€€±-{Yrþ!‚‚Í_‡=ÈÀÚ»oÛÓý{vÝÕb¹ø(ÙÄM	j8gh¡'g
ÊÛ¼<!D½"ª=÷|œ¡-ýôŒƒ
|!g×£'ßDGwï©ö.ÿ»½æÜÑ‡?¨.&ˆŸ/ê
3Eðqø,iðá†4˜×<ƒ¨"å›Èô¨§ëùé	¦#›P¸æ5d|ÄàDÄ¿ÿ˜‹6‚Ûw®÷qÐ„ yW¼Þ3/Xà¶h<´vpücL# 1–Aˆ(z
”Q Œíå´]ÅÇC&¢Ãe'ÌÏQ¾%Âz«„P4áÎàÃ†VÀJ`Æ:Ã‘ç0’B<d"N`Lôaõ®§dA3üIy¤‘DY°‰ÄÛ	=8“ÞàFTì[Ò¦ÀbHOé¦@œ"!Y°8É¸ÅÉ)Ç~U‡ÀÌG±ÉôyR‚4Ì± ä$jâô:á-X
ˆtÔKÞQF¢ÁF`SâÿH>ÙAÑƒ½éÏ§t3 PyI³Q
"q'IJVÿsKÉás~¥
#trÖå(;²±3¢R«ÌÈ
^áJ8Å²sxG'8GèÅj8£Gô´Ž9‚ÍÃ,ßùŒ)ÅI5IJX‘¦¦pÝ¡KâÛ«‰>U}ÆXÀÁ¸9+kHc
ØÇ;ÊmX£P¸$\IŒ§E
ŽSnuËzFƒz¸>œLhý °«…&9H™Lé™Òô
ƒjP*ùff¨îX1qx~È¡½ˆ`ÞÃaX3NR¬Ô ‡ùãôláŒ£ÍÓO5]`ôÁSŠùô§›óBà'Dá !jLŒ
M¤.SIF’ŠRiÕ¨ÎÎÿ¾ãðVJŠÊwd†	0²šõ ADZßÉe¸UFp¥žæA×ž.ñ®¯èì!‚Œ@BEdH*U6	UhSssÈDºš…bE9sÑŒºR•Õˆf`Ux!
x†h«æ9(˜—6MíjYÛG×¾aÃ€€îf»Y3è#³áúª8_u¹&<ÅÜÁ™mÌÁºyîf©ûßƒÀR»ô.j=§Úñ’W˜æ5Q„¸õ`#ù6NZ÷Ð×Ãbì}ó.Å…– pŠâ/3Ž¶¤§=;Ñ]%0¸Áv…pwFð„¼UøÂ“!ç9¶€O|ØÈï	ÿ±ˆqVžÅÅU*†òA6PÃTŽo•±:neãñâ8ÇŠ©†r¶^pÈfƒ=jp#·¹3IVr»0€zÀåpQŽ²úâÛ³ÆËh—Yëå/WäB€™!SJÊàY¯›%
ç8³ë%žÉrð|¤ÓaölecÙ¦¶š éJèBO„¤!—¢ÅCóü SF®u½k^÷Ú×¿v°…=lbÛ×U°o¥Ñgƒ À³ðô§‰!íM{:LÒÖÎ¨·ûÃÛ´ï°TÍSV·:"È-ªÔð˜Y·È—×»uV0oz×ÛÞ÷Æw¾õ½o~÷ÛßÿÎ÷$ÿ”mÂ.` p2IÇ²”…W!ÔæôA
m#˜¦~†B'ò0n`–ÛÜÏ`»^À~ÀO>Ùg?ã=p–·œ- (4f‚zYûÓÒ^ÍÂs®ó›3<Úß9m>íŸó¼çK1p•·}åÓúyÁâíryÍM‘C³K;é8{±gA+Þ¬`‚l p——Ýì<9fâˆàÙÜÚD;Îß>m¹ÃÝî®ûÍ¢÷¸$Ô?åóÅÁûôsê‰yµÕw0%àTë¾ˆØÄ€YŒi	*#"ÄÙ5ïrfÏäÉ}ç;Üóþð¡×è£}ÐKo!ð¤îóàS
õAKýðçN7ª®Îÿø˜Ú€Á˜ )Ö…‹Y‹€^¶yæ+¹àüˆI=Æ@úÓÏ=ô¡¿»õŽz¼¯¾ïÄÀîë—^ê¦Ë¾Æ´_µíoòvížzP°Å?(ÈÓìEPOôÈB'!°üæ÷¿š0Ÿ†˜€†? >ºÓ¾ì»;ÔË>îCÀÑ#…¸+cé‡¶bºïZ Žó'õ;¼Gàö[<ûºª?Ôá‰û3ƒNÒ+ÿSA,µƒ‰+@Ÿ£;ÓÃ9ŸÛ9<½ä;¡ÃÁ¥ÐœŸ:„ŽRòSpºÙ+<+4*HArq¿
A°É ÁŸ†uè!(€ôBò€fƒ‰gs8…€8‚1‚8xÿ-°¬h¨¥’mx€$<¿%ÔÀ©3ÌS<Þ£ž)ô“*ü„ká®!‡ùÂCDŸ"ès	é+C3Ì¡)3¯g‚Ç‡c ‡2©2	/;|°Û+Vð@>ô?D}à†3ë‰#²5CDÄW5h€t‰|Äÿš¸ûöê
³ C„–X‡;l5ô‚÷³y²š)LÄT4¢{(†ÑY9XÄF˜Á„0…—Ð4‡Ã¾æÑ³B»ˆÚ€-¨
Fô£˜ð„x0	¸=‰àÀdü@-°uPž)„’c´<2•sÅl$HT€Ax‰A…ÂAj“Á<Ã½»¶æ@+ÿs; ð—RGóÃ@w„G€È®y„'´G>\ƒ[™BØuà<B³_¢˜k,ÈšÌpÁ–ø¼»hÈ‡sÈ¡cˆˆ$¡Lˆ"ItØÈdGTü€í8JˆþƒÂ\F[ÉÌuX‡f‰”ã)š´É±Œ¸ƒ[	~À‚æè¾Ê3Ì¹ë³Á £Ë3¨ü¸ÄZRB?aJ¤¨ŒJˆà²ÛÃ³…wPÉÓúÀ{²rp†féºÉH²´Ìûˆ‚Ø†–è/¶=ïÃAëÛÁíM¢”Ä£|öj‡p«CøKµq½Á”ˆP<Iîª¥¬$ÅÆ³¡ËËôÍÿàPƒ	@†– 9Ï¬¾ïƒHHô¾rËhcˆ\ŒJWÐ,P„yè„2˜‡×¤€Ø”Íˆ3œ‰Â>dÌÜT?dÞôÍS„õdÏötÏ÷„Ïø”Ïù¤Oøü«ÀqNh‰l2Î¶ü p,ÀÏ´»„¸‡$†q”ÍLÀê¼‡~øHØìNŠ*ðlLñ¤£
-ÅÂCÏË|˜ÑÑ%Ñ5ÑEQ˜V6h	;Hã4ÀÐ·M·CN °ˆPˆ8hÊP5üÑ‰¨ÇÚ”ÂñA
Ìß\n‘´÷P†ÐÈÉÀ(µAê#ÊP1íA¼3Pb¨ƒÿüÑpˆ!=ÒaIÒ‰0
%OÜ|RÞŒRßœÒ*µR,œÜ¯pÄ[ô,.µ8…ˆ7BTŠH<&µP–d¼e`Íò„ÒøÍØS>ýŒ+ÕfÛÌÈ$Bõ¬& ƒE5ÕŠ˜J:½SH)OPLJÅSK½ÔÈTMíN!¸™û‡«U³j½SÖˆÈCUmÒåC((X¯
µÌZµÕ¸ÀÕÀa‚È…•(Î_u¥çÖaE7c}Ô”†eXVf=Ï<½Lhu¨fŠ&#›VÀé	ÐÏHÐVWrˆnVÚtÔEÖ˜ju°s¥+g%Ku]ª¥‚¨{×¼	N„üÉºWÿJ—’Í¥Ð×‰Õ~mF'=ÖfE×g¥Rá.(ášiØ1Cý<(…‰% Œ…šÙÕx›=JžÝöWeÕ=×½Tum×Db$h¡”Å˜ƒ• C˜½™5œõYtÀYˆ¬Ù¨ôZb
È™«[ZíØXUZÙi&$¡¢tqZ˜qQ+X	+ ÚËyøZžõYÀíÚÁÕZÃ¥œ\šE\ÆÕYÃU\Å\È%–
Â™øªÎKÛ:Ô¶õ¤Í
…ýOK±º…™ƒzÈ‡/ØÛ¦yÀ¿YÂ
\Â¥]›]®ÝØÅÚ®ÝÿÛÅÝÞ•]Ø±\˜êì—µ=µ%Ø°Ùƒ}Û’•Þé%Ù™1Ýv	€7(‡Am]XyÝ«ÕÝà•\Šø ÜýÝÚ5ßô-_ßÜÇßÍ^œé‚81ú‡8|æ5Ï‚}Þ±DZdÝý8Y”õÓÙ	8øwP¸îõ^_®m_ÄU¯½]öUß›-\ôM_óÜ×‰_œÑ…(À‘Oú‡MÔßÎm[ÐÖ˜¸^v	>˜†;c` qàîÜÎÝ°Eß
ÞaÎÙÁµ`â
&Q`Ñe‚_<a¶Máè]a™har>€ža!„øÚ¾`"¾YÆ}ßÃÅáÈ%ãÿÜâ3Nã•“ªÛS‚SX€&Y£•R(Žb˜˜bTI»+Fœ,Öb.ÎØEucªcÎe-wlèÂ'Þc¸èãSI»dèLAÆ-.dCF4Jä;¦×|Â£ÕãHn‰I6•ƒ\°ELÆMÞä8=äøùd¢õËw,ÒýóÜÏÞJYØh‚$o™[–@eHQeV&@W¾ŽïS^Ô%å {àK½åÕå]æe¸=ÁB—a^‰bÎ’`dVæe®a}uæ£ü`ô‚X‚½´æ×\ªÜe„½ªP&`î”Qàv	qÆ’°NH†d>gÂ`fuŽÓvÞV -ÿÖÁX„]XÓfÀçgÊç¢"¬9,šè+!hNhå„¾‹¾=¼ÄåÝÞm\Ç]çBshô
Ø¬;˜‡ø»hEp€Èèî	|~‘F¦Ý:*i’.àÀ9é”Vi»°ZsãábßÎq™$50^êüŸjjLíeÃ]*b’†
Â
è¦Î˜‹S€ê¨Æ‹–~ßÅ½ë™nµ	¦.X€Ú
ê±ö	¢NÚ„é‘Vkç(i	¹rÆbº®ë©«êól/&I &]èkÁæ	ÂfÐ%$FZ(_Æ¦ÖÁì@–ì…?ª¾ëðµê>ÊpÐv9ÿž™ÅöŒÆŽAH€Ö~m†8ÍVsi3†àÚµ]6žG°ÝV6Þž¢`îà†ùAdPàâ^ˆl“íXæŽo•îé.eSg·Î™(Ø€?€îõîÏ
ðoÅØ±ò6oô–bõÆ&H÷†ï[$#BhRïÍ=ÀïJ£nSÆîa6÷VË_‚Ú
€0p‚ù»ïÎF
Úhð´@ØOQ(¥:j`ömÎˆpü@)€a.m.‡#xÆ†ãË
ß$ÄðpÙÌ«Ù€ò7‹o*Ô6RØ.iñû€7ÐÞ˜ÚG¼ð~è‡kXÏð
‘¤ëñ£„Nœ!ç‰ÿÕ	3÷2ò5r4'åÔPl¦%Yè[åo˜)€Kø‚ÂqYBm‚‡5ø,×rÇýr’¬évY
!?ó4t5OsIÿ2×Ó²Žs¦r(¤Zñ™hrâpQbÀÛˆm»Güsy¨¥5à|†,G>C¿èLôyüÎÝiôI7sK‡ôJßõJñ7`ƒR$År’_ŽOŽÁ™…¨¥W{½ÅS×‚'˜¬IWÏq•jŽãžõÛƒnøYó2w^·t]öö‡,‚²c¿sv‘ÅRÀl9St-È€È€ÉÙÊjÇñ¨®ÂÖmŸÇÂqG—ôƒtGçõr—’(Akÿ˜XòáJdŽÌÜJX	_}özÏ€O˜|W]‚‡kèÅpƒæ˜‚-øyLÕwó—¿u\ÿv!y²Tƒ¾bÑfµV
ÞúçNçãv'!H…•ˆl‡ƒöŽ_‰OX€˜œFèO°†ŠTÓ•7·'òI*ÞÚ*€ÑozTñ.Øî•ðj[ú"[‰’xzÕ’‚ª¿úÂ¸„	Ðú
ìÀ®Ç¢ÐŸ~x¯ ƒûS.ûS)Uˆñ¸(?çx·g‰OÈ¹§ûë8ÍûBCF¾‡¢È‚~X®y/üÂOïÀÉ/b8ƒt`	.ÚxTgú–|Ê·úëÈ×Ìoµÿnç|OÖ‹Q
}|ýÒ{Š7
Y$,¸¤•Ø2\z:p‰ÙŸ‡¹¯ýæoÜÿ²ûÞ}Dö3qýé~?|H)‚€4h	a‡ã…)€z‚Ð€‘…~é¯ûÂ0JëÏ±ÑÈ~í·)¨Ï¸}rÒð13~ÿ2lèð!Äˆ'>T¶ÂÆŒ7rìèñ£FS6Qj8±”*W²léò%K^S$pð©ß¸2Jž@`íß§ZæI±@L–’0 kêô)Ô¨R§Rjõ*Ö¬ZŸò+Ø°bÇ’-kö,Z´¨DSÂ‹$P:éHÐ`Šz÷ò¥h1-`ŽHÿ%Ö°Þ˜¤Š·”IÓ¦>nÁ¤és¦EÉBÌ%j)cb²m-mú4êÔWkyììŒ°`¤›víÚ±}ÙÆ=Û5ðàÁ×¶
ÐÎÌJ Øª»îß’}§SßûW8ÚSˆñ™æË®Ðâ]:®ù)r0”—]ÎübhÑ£âodRmÿ>þüNÃÐ…½,n²	¸o`€ÿ)¸àWÄ¹µP;KÀµÜ;ÒHC…tÕi¸!C×1(–s†;Ù‘Êx)¦ôÊæ¡ç7ú,…IÀ÷™xSl¡=úX•	‚|¼ÍfÛFHù[‚Eù¤‚Ð6B@D4zƒ!ÿ‡]Vç!”	Ä.X<ÄI$*¦8EÌ¼R01ÚÅò…FH?ê¹'d0&H»%X FJ:¨‘€*êš”1ðD–[fè%¥z¹¨F’Š!ƒˆšã1e]é9úØâ™Œñb@8|ÊJÕ3‡<3kT®€€iG¾˜¤€¹!J(¯ÅŠÕ¨CFJ…38û,´ÑJ;-µÕZ+-(›+	'¥sF¨âúOÍ‘cêWÍàsO| …‚+¸Ú‹Î3G°ïÀÜ‹þû›l‚rÔ¤Á»-ÃIùSCÊjIÅ‚X|1Æk¼1Ç{¼1(
‡HÌÐ@^ÿ¹Œ‰ò,“.>’}„*>‹ü3¸1ž^üËg¾ûÁûá¯½A6¼4Óa‚ÂClaÁç0$ñ–4½µ˜73F=9²IÊŒ€òSÆ2‘qD³ÍžÄ£2ÞR?ÿ4ËíÀ#
<ôP±¯õÎê'×‰+ŽÖÓB·ÓO'4ffF;ÿ`M…Ö‹+Î€!³€Ñ§e3&É
öÚmKƒÜ?Ð‚Ýl@ˆŠ
Üªw~|á·35³Žà„“Æ'kš<G÷
3¨îy™µq¤gŽüÒÝcI¸+zh’„`:å¶”áŒ>óÔ,-Ç
 {¡ÿî÷U£o;`3Oï¼p„Y= dØ; ×”·;æiU÷hÄN^@½e]ÆêÂHf²ˆ |Œ!Äø ˆyØ¢ð*†û‚ø•«1¨_jª±ä÷èŸGšp@³:B,(D†uÁqìÈÿöA%(‚C4
¸ðµ°E¥ð xêÐ"âCíœ
iW¶WÅ
†[‘!
õwC8‘aˆÇ|(+]=±Ž‹Z@
èqDüt¢¥ð¢L¹E"°87ÐÀ
$Eú˜Q+™H£
qØ.B*€£3!ƒaxú	‡XÈU~(ÿ°>VgÀÜ°+Ã4²M8b"ß€ƒ"S$šD2˜b@B%³Bœc3»><ñO~2Ž™øÀA.€¡<"Bs)ÎààËX7œ	–kôcYçl`b ñÇÂÌ}ªH
(c2«EÜc¦4©éÉx(à}"Ô‡>dalÁ›øyà©Ñ´@²˜G#Ö uvd ×‚ÖA„
nT8xÅˆJ4NX‚Ÿ6%*Ð;Ø"ïX‡162`LS¡*ÈÀL÷ˆRùb á—EUƒJU¶´ªa™Äp6"ê0(FLŠRm˜£h6°ªÿpö "X A/ÐðÃMãº˜:ø@§;µquùÂóFQš|U>°±ƒP ª©¡BÐ*YtáZ•Å:ÑˆZ6#Î¸ÇIÃ 
k,6BØd#b$âzñz!WØ¨+¡mJŽ$:^4À±v}J9ñÊD%tbu‘‚QJØÓ–]¡6\y`h µÖÝˆ.¢`Y0#³zÇ^¥†u0c±‚¯›ð‚o(Ç^Æ6[Ûæö¶ô%Æ}ï[.#¤á·R	îpóºŽä¶°‡õˆ4þJ?#x‚z#Ì
& Ü%‡W=¡òNT§ˆ0`¢ÿbxŽ/ÐøÃlñ[ßÓ7¿¢“Äü8ÝP(OöE…æ‚„–'ýA;ŒŸCxÄêeEh(ktQ¢ÛdÂ‡œ–H2¦à?°â×–Å]Ý†!càò4ÀJ°15Ÿ@Ã¯Ã¹ù9« ù>S•²zO!.O¦*žÏ²‡¤ßè‹ãÊe«¿³É-nÕ4…+ŒÙ)4.š=™`£2lt£BéÜ`ü@6Ðê}šÔšÚ,˜'.>×—d ø¦‹†´nõ>TÆÁÎ|cMÀ¶¸8Üìê!¹¢Îu[-íiƒå€)÷¦“ÿ/(º¶\î²®Á7„QÀPG'„MÍM[#ÌÁÇ5LpÔ,°¡2¹ïó`jKÙWüæHB’9lƒ:ƒ…½½âú†ûÅL©4µÐÓLµØy`"Žqi ÔÞF}v~ˆüoì	8”‘©LŒXWç$r}9L\ 
ˆót.—Q7±Û`-€ÖãÎÆ÷)S9rã5é5f9¹UÕš’ÖVÇ`ÀÌ£¾ºÒ¯¶°ÇŒ(Îî‹8KÉýyóSê¡+na+ùÙ	F(	*íN’ìj§¨¡Q@Bêv'†æßK7BZ·¸™½þõ{‡?Ñ&{â†… b-~ñk?ãs“göÿ#ƒØ;Èu÷¨OºÜe®ñ°+®ó®7{ðÔ¹~öø)þW‘w¼¿—¤¤Ç«—	^#†6¨¡D«©á/ù¶K€¿ðñÖ·½4ÿ>úá
Þôs:2qÖÕ7õÂ
V`/ùÆéÕÅT±r0øƒC'~¹ïƒÏ’ô/¦ó{ÿ<¦C¿u¯.±ù¦G½~80	êW¿P¯Çþìù[ì äY×˜¤„•u	>éSÂ…†®±Ÿbßû	Wüà•48Øßàá_~ÿ1MÉéÆ “ ÷‰“µµWLy‰)¤‰Š´Ø£yÛ·åW
Ò ná ²„ûÙòáœèqè~ÿæ¨A®Ò
þÛ§PÊ¶õÞÂŸmÝà—aa£1š«ôÖo¡òåA#¼Cä4Qé9_^u5¡=!µµ`JtG¥ÈWŠp¡£=šzY£©˜FcüàñÁ_òÉàIœ:l`ÞôùÈº!$ÚQ¶TÊ?|Ï^áðu¡&r"Ãm¢xH N‰¡!.!Øå^$¶âåq‡wX¢ŠºØz".vbŽPÚ(¢n]à-b6¢€“+
Qì
Ý«¥D¬•Ÿ%b¢-òb^a5æ!bhˆb2‘¢š":Ÿ'a~T°Z2
Ç	
Â¼°H„MÿB¨"¬‚%2´Âæõ øp2
"â7á)#£Œ]:bÇ:Œÿ`¯]„ÅÝ3ÞãB¸\ÔÕ Ìm@-¤™á0Šãóž˜#:.d`J÷àÁÜFªÚÁ¤;æÒ$ZJÔ£Eâ£>nÌåM2)€	¨ÍÍ#à‘žH’£~($J]	FD2ž®äõa_UhôÂðCN^$Jxðñ¤J$SO;Ì	Îý@#*~B–¤ÚR†¯h	"JÑÝrŸCV• ˆ^ÙV.D>zåÆ•*`€ñé+`“ÍC'4B7ü
Õ@Q2ŸA¦â¬ˆÿÜ\¦äTIÂD¤Tâ¥ëõ%<é‚\‚3’ß`.Ä/f&Æ• šÑ5„"à>|Ñ¾\fAå[þHìAgÒe_æåÉ±ÝöIeö‰&<ñ@Ð£=¶æBÔâÒV6þ!®é`0å]‚€<’xo†£óéÁÜH×¬TC\'Z '±ÐžG¤ T:ž^’àF	‚M’@£tJcl:úá~Ù>ÁØo…CTXá Ã!”g[ªzÊ‚6}@¯ñ	gº§†
j‚JÐ¡t2DZabc–¨€ò“XVZS<([ffÀ…nS)ýKpn(Žº†Ü1Pbˆ6D>Œl¨.®ÿŠBÚ>ñÂÜÎ˜=B›¤yRÓx1Ð¨)Ý{ÊeŽn©X¬„¡ýhCÐÝa"©'è€¨"á	‹>CMŒÐEé”7]éÏd(—æ)H &/‰iC8ÔÝ¡uZ#
¨FîÓŠVÚ#|çVeV8Î©•&Óê©¥vÄŽ®Ä¤ 62ÔXÊ•’2©Œ…Tw7x‡Mj@eé¥Æ*FxéJ$`§6Ä‰„êË±)‹¢C6xAµ6LTEùžÊ*—ò©Jàhå2D:¼ÁêêM-j¯ÊÐnRÔbT¥"+—fê‡êÞ³.™RëMñˆY¯6Å3Alÿ«NÁª·æ¨~®„å«CøÌ‚¹ÞÔ%`À…®ëºÒÑ¼nè)¤¦JôÂP¾2Ä6ÌA¿Þ”?
,Å:…AÁº§.@€©Ä(¸VÃ:%MÄòÓÐOÅR,2fì\Úö¨øgÈ.D> –,¡«º¦l¯†ƒ	@Ë.d¦J¼×Ìz
¨â,ýkÀŽ4ÅÓZEÔâN5p@”m+z©ø©¸-DœÒÓÄæÇ‘øÈÔNÅÙšQ-”ÀIb-õ‚ô)1ÀÈ¬×Ò,jØzµÚÇÔ¦í}.Tný«Û®ž.<À<%ìÀ×Ý>ÄÃîmÎº€áøSü-l@ÿíl Ãæ^næjîçbîÓ–èzîçî	„ÓáRßÜJ|ìãF'¬‚äzÐ+`©¢ÆßBíårnïò®ïòîîïSŒîïïðî‰Ò¬.â-Á¸`J”ÄnDøÀBí‚Ï%t€šFÙ‚næ&oÔ‚&ñŽ¯é/ð"ïïîI6p@z1/¿©lmJì0,õ:DæMkö–!Ð@Ój…ùïúªoñ/£oð0ñîÉ0h@ÛÂ/žaÂ®ˆkþ:Ä*€Jÿ–ÍØê.o'pù¦oï2ð7ðžˆ‚
D°G(X@Çª„%”DKØvpÊÏ€ðñ†îƒîù&ÿpç†¯éñ¬°°¿pj‚,®JÌBÞ°Dðð«—‹hÏ
¬3±‘¼,1ôÂp*KD9ÌÿfñxðÂwñº~1_—“1w`p?¹q¨¼	è×±d¸ô¦Ä*tÏÏíú±ŠÜnîòo²!·"‡À"C)‚Ý>òCøC®JrŠÂ	T²%ë&gò8!òÀÔJÌäƒ(ëE>ä)§Èövï*T+»ò*Â`ý¦D/4î-ïÅ·ñ.+†$œ€/ÿr%³0?1wÀÝ°ÄDç2ëÅ?óx‚4ëGçr.qúžîè¶ÿ3á^r_s eó6¯D#s_Ì®8‹G4Osi¤íî²ó	ÿ0S¬(¼€–ÊóaÂhsKl(ãs_Pç>¯ß}õsàž-ùô/æòl&¬Àû*4ò84K´‚8«Dï…?Âõžn‡6*\ðñcŠ¦FgtA«0ú.@¿³Œ-IOŒÀ	ÔsÛþ¶´^X1öV§™: NÛ—U+E9.	u{uÊfƒ	0áQkŽÁR·„ýÊT÷E=è2¡VõLc£‰"ªF‚æLÏ5h¶ÄNŸÆ9£s
¯/`ðé¦l8Á”uâ°Â¤AZ³D2Z[SG:ØÁÍ2ÿÆÒ ’jc¤áµfÛtŠZçg+îR³Œ¥A<óLn"0õ‡ÎâdSÇI8sRìuvŠvgã MânçÚh³)`@Gšöoe‚Œô ×¬6€À! ÈA,»NÎ¶†$CWfõn·D^ó¶™ú6x÷vú2·]õrÛgõA÷W87¦tx"»Ä(ŒvsˆvÛâgw6Vçtwç´€ãbp7†ô0z¿êX¿!^ÊdÛéF¢´“€&;ÞFLN8Û`oDø¶Á ÁsºÄ*Øð~oHc6x·xgáx³xvÚ`M·„øâ‚'Óa'v{§„W¸ot8†Kÿxqþx#g'
’{6’c›LÁK”ø‰{IŠWt ú@ßøÏ¤`ÂŽcx†³c‘_¸Ú%ù‡¹†›¹s¸|ÉXÀ#œÀÎ¸‰O9‡ÜÂ(Xyh¸Á	À«–ßK-p€êÑ‘›æš÷†˜÷
‘/¹§¹‡{¸ì‹.AüBHÛy¥ä·žqÿy%ö\-òyã
‘ICz£#ú¿ú’: <˜&t€jfº¦ozžwºb¨	Œ%¨›‘(XÀ s';„Ëz¤':›o8«+|ªy˜èÂŒÀ0\ÈrKHù®["§KîŒ‡
/dù°ÏJ6ÿ$´bŸ&”@dƒ8Lxû·ƒ;{åU+Æ¸—luºãÎ!X€p¾{ZDÔÂ3tÀœëz¾ßã*l·èü{\ÓRòÀÿK5äÀi!|Y€‚xA8¸ä:~×yÄ[b2°±¿ëµ·]ÛWfÓ5—
)l€‚oüj{ƒ<e-<:\Ap{K ‚~¯üVžÄe[ôfkvw‹6y›¨Ô+/Aø9ÏëÉ0Œ@¸;Ðc&¼dÃ0|”Ãx³Òçä4X6LÔ<^øÌ‡·‹Ë¸MÕÁœ÷ÖÿK<Àª…½FèÙÌœ`¦»D2'CÛÿçÿÔ? oW}hßÿ}ŒÛÔ+¸øsßÿÈ¯ZY½µ[ýTCA'¯Ä.Ìl7þ`ºƒ`±Ó×½êWÍO}Ô÷»ŠpÁwçÛË3üüQ«Ô¨&L€Ü¶.Ød»¾t¾uLxfÿ¶Ý[ôíW>bnÀ ûï÷H-Œ€
(·0‚7el{RP"CˆòÃ D²¯·_º~ÿ½d‚,Ø31(Ø@˜†]	\ˆ%T¸Ø&;õþE”8‘bE‹1fÔ¸‘cGýqBÄdI“'Q¦T¹Òä%[Æ”9“fM›7qæÔ¹“gÏ›áÒ<ˆâ‹hQ£G‘&Uº”iS§O¡F•:µÿ(«"2weƒª”«ñû8–lY³g=®š³‹e[·oášäe¤E5ŸwñæÕ»÷n6*ÔP<˜paÃ‡êŠò NÌa¦¤ìÅ‡ZË—1gÆ8Í¬¸ŸA‡.Ih ¾§Q§V}óQX!–=›vm§ Š(ð’-æ’Rîš“LsqãÇÇºcSJtsço_
ñÁ{uuë×y>£ò (ÛßÁ‡Ÿú„cêèªµ0Â+e+6åÇ—?_"¿A«žç×ÒÍ„GØP&¨.›8°AñlP¼.4á?™Ò˜€•‚ˆ¾
9Ì,¤?zÙODU¹áƒZ¼ŽÀ#»LLÐÿ i¬q0V¢P€ˆde#^Qi”°:,ÒÈ³’9–™ÌO’
|°+EÕ\D§J*"XâÁ)L„ÐMJÇbpá•pyã–#áŒÓ#å,iÒÎæÜh`‹p¦DÊ+WÌòOA)Ð,d1ÑDí©21)¥q.8„O™²¹b‚:V*å=9I-õ"(ñÎUãâÅ‰&ìS¯C
%tÑ[mt&Õµ§p¹&&ÔØÙ)3QjJ£ÈV|LÖÚˆ’\’ÕmÛ*ñDYóÒ5W[q-ÐWZ¯dQ¼†!CØ(¼;VÞ©&)Ó@ÎìñÇ UÚÿŽQ®
¸Z:¹-x¥'£×'qme˜ ^Éw@EùÆ‹4€wÞ•š¤8À×¦aÒ\s¥TÐøFà•KEõ¶ŽÙ¤<÷Tx'‡Åâ‡#6wÝ[Uf»ŒãåX^AŽã™›:ý´-Hì –å©åL†TdÎš!Waµ9'Zk´Ðry¦ÝŸÓ]MhŒ£øÒè0‘æ@éœœ…v%XÞ˜ê½ã¬ÇŽQBÔZpoQôÚðžÒ¾Nhà¡‹IÞO(^(@î¥sòÈ¶V•ïÏá¼å¬aOÝ¦Ä|æ‘#8(à…(ŒÜ0Vö(„LðB”ópÊ¤5ÛÂeNüÿ]ù#Ý±’ÒKwC‚˜UÝzë³Å¡ˆ=b³ý)PÔBƒrHÃŸÁà†Û²m–¯ßHFyC[è³&Äbu=ÎiÈA4 ÚM|“xÀ€¨ãI8!§-»à%Äb?v¨lxÿ´&‰D›`ŠX'@`‚
&x@ à=ÚKLOØ„€& Ã#0×—-4 ¤xK(ÐN±CøÓ
µFŠ 4`7/¤IñF/¢cÜÞpè=&B£
ÕD!`9  \‘¯¼Tã

p‚WÜ‚?BjT4$}ÿJ8,fMFhÀô8@1.ìgcÌIã@˜€ðdAÊ0”¥4¥îBÊ!zr“@ Ã!òXg !Sà—[ä'ÅCî’>þé³WL¡HHâ”À¦.uù,gëÄ|eIv¹‚š®°™Mmª¯š±L0|Ð1Äp!/ÑIŸæ½,˜2ã…àHbÍ¬•=y–Ï^1SšýÜ‹(Z PÁ¥`ƒÊÒ™Ðù$
›hgÖê0½êÑ³ag»çÎò‰Oeú“£>y\?¸¤â£HžBQŸ|Pb¸x¨Ìü—€+@õ¼§>ùI6±M²£pÿÂeˆ°ƒ;RšTùl‰€ÙK¦Š)L"«ŽMsJ¶›bT£=õ*:žá…	H€·„K$Ð°
¥®5>¾DC$ *3I!>ài¶ÓŒ¦í™ˆŠæW¥	¬4À&ûL(Î`ŠB²•±ÅÉ'ÎÀœ¸ÆÌ
70æ	XÍvÔ@Â@AÓŠ9©5íqÒ‡9ìo²Üz$0/Dr³µ½Þ3®ˆ=¡ÁÅØ@¿Ó÷8Û@"žÚZn]Â	ˆ¦lÝÃex–ESP4 ƒ¸ÝEÎ*À‰À)·`uÂe×']õ¦(>0@†*KŒa!ôî}5ÃQÿŒ!ã%ï¶Þ‚ !.\ï÷’GõnÈÏ&ÎÀ‰Åâ—Â˜É‡)ÆP§ÿL\°¬¬Š`ëäqˆAPÅ`VÑ@Ø¥ð‹5óØo8f¼¨]1à…ÌŽXÄµðaAûœR¼Áé€ñ‘SÈ:”Æ1“„$P×C“Ç¶ Ü»)6?¥€àƒd1'Ž8“›Ìa7¡@Â#h[ei>ã>HÀ‚P?§|ÀBÇhÍ”ùNsÌH!†Üù
™ˆ³œSç:$D Cp GŠ9°a‚ö´qÒÁ	þú÷Ð»ÄÄ¡p¶Y8
hçÜ€ÿØm’%Î0á~š×š©‡)¾—–:k¤pƒ6€\‰®0 F¨¦›Ô‹HŒFîõ·‹Ã[€áž!¶éPÝ´`‡hµ³ñë8\¡À¸ß;á"_0…†ÀpÍø`à0ÏµWb
CHö|@QPÞ2F&ÈƒPÛS Do¹5‹?€áöøÉ53
;šÔ	×Ú%êÐ4@Ù- ƒúhÊãZ¸‚[h04¡¶ŽÙ&æ†dœåM'3'¾€s»‹’ DŒ‚	 -@Â+©ÙSX»d@B€
„ 	ÿ×·Ìp‰1Pb×N·{¸Á;4S½¤ š0„„À“]·9Ø«9¥±S³ì>G{¨‚ 4A„À6ÿR1òQüî7Î61H$—ïqõûÕ?øÁ{Ò“	hÁëaß‚ˆk“ödðAìaoÖG~ð“÷¸å'Û\ÛL÷üñ“<Š/üA²¥?·*}éÂ
M°þõ±OôéKÏ4†Å¾Ðmä_>ÇÃ1uç¯Ÿý$ÁE$Î€†d˜œüõ?N=Æ
K¾ýýOø&ø8ÁÅì¯åã îBÁÿðÐZá°€:Í)pCnÐµpÛi áØ`þ*pÿ;¤r
Î ZYz`áÁ`ipCÜAØ`a[°Y!þFÁÛj°¤
–¯ù|°	£‚
na°
‹$’–oZÎ	½0%BÆ€
„
ðæ 4ðáf!ø8
õT¶ÁÐ`þ€ãÐ	ÃðpŒoÑTê!Ö°
ßp×oëðÍp1±Zú
¾À"%ÑåfÁþ`131& ØøàC±É`!üàòPy‘jøaLáçnƒ©èðÐ€ aÂÿzñA‡¶aìÀ
Þà,Qf`a¬€
LaœÍÑ~Ê!\Ñ
à,!·Q?fa°
(íù¾8
°!J¡ãÑ-JÁÁÁ€„áP±)2üá„ð¾€ 
!2!²!ÇÀ
ð€ráè¯"Y’ò#5’#=²àÑg¡"$M%¿a[ò'»ë%…Áð
¬ #ÿ€6¡†w¡6þJN2%}(µòÈ^rð¬ààÀA)K¡ø/øÒ2*¥ÞÀ
°!’¡'z·2/í.¾Á+¿6Ò
Øøà,Ò2-›ÒNž21sò,ýìQ.³.s¾!Ìôr3+ð¾ar!4¥0ÃR0åR2Q35%3Ó0Uó5±À4ç’4M!4/Ó3'’3u3/Ò3}ó71Ò6m8‰s%wS¡;<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding NAP IPsec Enforcement</maml:title><maml:introduction>
<maml:para>Network Access Protection (NAP) Internet Protocol security (IPsec) enforcement provides the strongest and most flexible method for maintaining client computer compliance with network health requirements.</maml:para>

<maml:para>IPsec enforcement confines the communication on your network to those computers that are considered compliant and have acquired health certificates. By leveraging IPsec and its configuration flexibility, this NAP enforcement method allows to you to define requirements for secure communications with compliant clients on a per-IP address or port number basis. For more information about IPsec, see <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=50170</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=50170"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Benefits of IPsec enforcement</maml:title><maml:introduction>
<maml:para>IPsec enforcement is commonly used when you want a stronger and more robust enforcement mechanism than 802.1X, DHCP, or VPN enforcement provide. The following are the benefits of IPsec enforcement:</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Tamper-resistant enforcement</maml:title><maml:introduction>
<maml:para>IPsec enforcement cannot be bypassed by reconfiguring a NAP client. A NAP client cannot receive a health certificate or initiate communication with a compliant computer by manipulating settings on the local computer, even if a user has local administrator privileges. Additionally, IPsec enforcement cannot be bypassed through the use of hubs or virtual computer technologies.</maml:para>
</maml:introduction></maml:section>

<maml:section>
<maml:title>No infrastructure upgrade required</maml:title><maml:introduction>
<maml:para>IPsec enforcement works at the Internet layer of the TCP/IP protocol suite and is therefore independent of physical network infrastructure components, such as hubs, switches, and routers.</maml:para>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Network access limited on per-server or per-application basis</maml:title><maml:introduction>
<maml:para>With IPsec enforcement, compliant computers can initiate communications with noncompliant computers, but noncompliant computers cannot initiate communications with compliant computers. The administrator defines the type of traffic that must be authenticated with a health certificate and protected with IPsec through IPsec policy settings. IPsec policy allows for the creation of IP filters that can define traffic by source IP address, destination IP address, IP protocol number, source and destination TCP port, and source and destination UDP port. With IPsec policy and IP filter definition, it is possible to limit network access on a per-server or per-application basis.</maml:para>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Optional end-to-end encryption</maml:title><maml:introduction>
<maml:para>By specifying IPsec policy settings, you can encrypt IP traffic between IPsec peers for highly sensitive traffic. Unlike IEEE 802.11 wireless local area networks (LANs), which only encrypt frames from the wireless client to the wireless access point, IPsec encryption is between IPsec peer computers.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section>
<maml:title>IPsec enforcement and logical networks</maml:title><maml:introduction>
<maml:para>IPsec enforcement divides a physical network into three logical networks. A computer is a member of only one logical network at any time. The logical networks are defined in terms of which computers have health certificates and which computers require IPsec authentication for incoming communication attempts. Logical networks allow you to limit access of computers that do not meet health requirements and provide compliant computers with a level of protection from noncompliant computers. IPsec enforcement defines the following logical networks:</maml:para>

<maml:list class="unordered">
<maml:listItem>
<maml:para>Secure network</maml:para>

<maml:para>Computers on the secure network have health certificates and require that incoming communication is authenticated with these certificates. They use a common set of IPsec policy settings for providing IPsec protection. For example, most server and client computers that are members of an Active DirectoryÂ® infrastructure would be in a secure network. NAP health policy servers, servers running Active Directory Certificate Services (ADÂ CS), and e-mail servers are examples of network components that normally reside in a secure network.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Boundary network</maml:para>

<maml:para>Computers on the boundary network have health certificates, but do not require IPsec authentication of incoming communication attempts. Computers in the boundary network must be accessible to computers on the entire network. These types of computers are the servers required to assess and remediate NAP client health or otherwise provide network services for computers in the restricted network, such as HRA servers, antivirus update servers, read-only domain controllers, and DNS servers. Because computers in the boundary network do not require authentication and protected communication, they must be closely managed to prevent them from being used to attack computers in the secure network.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Restricted network</maml:para>

<maml:para>Computers on the restricted network do not have health certificates. These are computers that have not completed health checks, are guests, or are NAP-ineligible computers, such as computers running versions of Windows that do not support NAP, Apple Macintosh computers, or UNIX-based computers.</maml:para>
</maml:listItem>
</maml:list>

<maml:para>The following figure shows an example of IPsec logical networks.</maml:para>

<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=79e2ebfc-4b95-4a2c-9b71-fa3dc074046c" mimeType="image/gif"><maml:summary>IPsec network</maml:summary></maml:objectUri></maml:embedObject></maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Overview of HRA</maml:linkText><maml:uri href="mshelp://windows/?id=ae5d5d44-7a46-4daf-88c1-af580519bdeb"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Troubleshooting HRA</maml:title><maml:introduction>
<maml:para>Deploying Network Access Protection (NAP) Internet Protocol security (IPsec) enforcement with Health Registration Authority (HRA) requires NAP infrastructure services and components in addition to HRA.</maml:para>

<maml:list class="unordered">
<maml:listItem>
<maml:para>NAP-capable client computers</maml:para>

<maml:para>NAP Agent, the IPsec enforcement client, and one or more system health agents (SHAs) must be configured and running on your client computers in order for these clients to be NAP-capable. For more information, see <maml:navigationLink><maml:linkText>Verify NAP Client Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=332915ab-0a04-4c93-87ae-6b773aa4d3e8"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Certification authority (CA)</maml:para>

<maml:para>A CA must be configured to provide health certificates to HRA that can be issued to compliant NAP client computers. For more information, see <maml:navigationLink><maml:linkText>Verify CA Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ffe5b00d-9333-4ecb-a880-608817d37b62"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Network Policy Server (NPS)</maml:para>

<maml:para>NPS must be configured on your HRA server as either an NPS proxy or NAP health policy server. Several NAP-related policies and components must also be configured on the NAP health policy server, including connection request policies, health policies, network policies, and system health validators (SHVs). For more information, see <maml:navigationLink><maml:linkText>Verify NPS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ed2a5c7e-dfa5-4354-8e41-e12e28d57189"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Internet Information Services (IIS)</maml:para>

<maml:para>IIS must be running on your HRA server to provide an HTTP/HTTPS interface that clients can use to request health certificates. For more information, see <maml:navigationLink><maml:linkText>Verify IIS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=cfece017-37f4-4c97-9bb7-e08cd49150d7"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>
</maml:list>

<maml:para>Each of these infrastructure components must be available and correctly configured in order for HRA to obtain and issue health certificates to compliant NAP client computers. Problems with one or more of these components can disable NAP functionality, resulting in NAP clients that are unable to acquire a health certificate even when they are compliant with network health requirements.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding NAP IPsec Enforcement</maml:linkText><maml:uri href="mshelp://windows/?id=4214362f-4d30-473a-b95b-a2130ba5c1fc"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Configure HRA Transport Policy</maml:title><maml:introduction>
<maml:para>Use this procedure to configure transport policy in Health Registration Authority (HRA). You can configure transport policy by specifying supported HTTP client user agents. By default, any HTTP client user agent is allowed.</maml:para>

<maml:para>Membership in <maml:computerOutputInline>Domain Admins</maml:computerOutputInline>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>

<maml:procedure><maml:title>To configure transport policy using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open the HRA console.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, double-click <maml:ui>Request Policy</maml:ui>, and then click <maml:ui>Transport Policy</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, right-click <maml:ui>HTTP Client User Agents</maml:ui>, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>The default setting of <maml:ui>Any agent</maml:ui> is selected. This setting allows the use of any HTTP user agent.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>To specify an HTTP user agent, select <maml:ui>Specific agent</maml:ui>, enter the HTTP agent string, and then click <maml:ui>Add</maml:ui>. The HTTP agent string will appear in the list of <maml:ui>Currently allowed agents</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>To modify or remove items in the <maml:ui>Currently allowed agents</maml:ui> list, click the name of the agent, and then click <maml:ui>Edit</maml:ui> or <maml:ui>Remove</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui> to close the <maml:ui>HTTP Client User Agent Properties</maml:ui> dialog box.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding HRA Request Policy</maml:linkText><maml:uri href="mshelp://windows/?id=d87d5168-61b8-4c8e-988a-365a653696bf"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Checklist: Deploy NAP IPsec Enforcement with HRA</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Step</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Reference</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>

<maml:row>
<maml:entry>
<maml:para>Configure a certification authority (CA) to issue health certificates.</maml:para>
</maml:entry>
<maml:entry>
<maml:para><maml:navigationLink><maml:linkText>Verify CA Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ffe5b00d-9333-4ecb-a880-608817d37b62"></maml:uri></maml:navigationLink></maml:para>
</maml:entry></maml:row>

<maml:row>
<maml:entry>
<maml:para>Select authentication requirements and install Health Registration Authority (HRA).</maml:para>
</maml:entry>
<maml:entry>
<maml:para><maml:navigationLink><maml:linkText>Understanding HRA Authentication Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=d9933a4d-3059-48ab-b303-3e3fbd09912e"></maml:uri></maml:navigationLink></maml:para>
</maml:entry></maml:row>

<maml:row>
<maml:entry>
<maml:para>Configure Network Access Protection (NAP) health policy server and Network Policy Server (NPS) proxy (if applicable) on NPS.</maml:para>
</maml:entry>
<maml:entry>
<maml:para><maml:navigationLink><maml:linkText>Verify NPS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ed2a5c7e-dfa5-4354-8e41-e12e28d57189"></maml:uri></maml:navigationLink></maml:para>
</maml:entry></maml:row>

<maml:row>
<maml:entry>
<maml:para>Configure certification authorities in HRA.</maml:para>
</maml:entry>
<maml:entry>
<maml:para><maml:navigationLink><maml:linkText>Configure NAP Certification Authority</maml:linkText><maml:uri href="mshelp://windows/?id=af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a"></maml:uri></maml:navigationLink></maml:para>
</maml:entry></maml:row>

<maml:row>
<maml:entry>
<maml:para>Configure NAP-capable clients for Internet Protocol security (IPsec) NAP enforcement.</maml:para>
</maml:entry>
<maml:entry>
<maml:para><maml:navigationLink><maml:linkText>Verify NAP Client Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=332915ab-0a04-4c93-87ae-6b773aa4d3e8"></maml:uri></maml:navigationLink></maml:para>
</maml:entry></maml:row>

<maml:row>
<maml:entry>
<maml:para>Use IPsec policies to create logical networks.</maml:para>
</maml:entry>
<maml:entry>
<maml:para><maml:navigationLink><maml:linkText>Understanding NAP IPsec Enforcement</maml:linkText><maml:uri href="mshelp://windows/?id=4214362f-4d30-473a-b95b-a2130ba5c1fc"></maml:uri></maml:navigationLink></maml:para>
</maml:entry></maml:row>
</maml:table>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Troubleshooting HRA</maml:linkText><maml:uri href="mshelp://windows/?id=6c44027f-a214-41d3-b657-2b9e8d0ddac7"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Overview of HRA</maml:title><maml:introduction>
<maml:para>Health Registration Authority (HRA) provides a service for the Network Access Protection (NAP) platform that is commonly referred to as a registration authority in an X.509 public key infrastructure (PKI). As a registration authority, HRA is responsible for validating client credentials and then forwarding a certificate request to a certification authority (CA) on behalf of the client. HRA validates certificate requests by checking with Network Policy Server (NPS) to determine if the NAP client is compliant with network health requirements. If the client is found to be compliant, HRA requests a special type of certificate from the CA called a health certificate. The health certificate is used by NAP client computers to communicate on an IPsec-protected network. In this capacity, HRA functions as a NAP enforcement server for the NAP Internet Protocol security (IPsec) enforcement method.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Important concepts</maml:title><maml:introduction>
<maml:para>To understand the role of HRA in a NAP deployment, review the following concepts.</maml:para>

<maml:list class="unordered">
<maml:listItem>
<maml:para>Health certificates</maml:para>

<maml:para>X.509 certificates issued to NAP client computers that are used to provide proof of their compliance with network health requirements. The NAP client computer obtains a health certificate by providing a declaration of its health status, called a statement of health (SoH), to HRA. The NAP client will continuously monitor its health status, and delete the health certificate if it becomes noncompliant. Health certificates can be used to authenticate NAP clients when they initiate IPsec-protected communications with other NAP clients on an intranet. NAP IPsec enforcement limits communication for IPsec-based NAP clients by dropping incoming communication attempts that are sent from computers that do not have health certificates.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>NAP certification authorities</maml:para>

<maml:para>Servers running Active DirectoryÂ® Certificate Services (ADÂ CS) that host X.509 certificates and issue them to NAP clients when they are determined to be compliant with network health requirements. You must specify one or more CAs that will issue NAP health certificates. For more information, see <maml:navigationLink><maml:linkText>Configure NAP Certification Authority</maml:linkText><maml:uri href="mshelp://windows/?id=af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a"></maml:uri></maml:navigationLink> and <maml:navigationLink><maml:linkText>Verify CA Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ffe5b00d-9333-4ecb-a880-608817d37b62"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>HRA request policy</maml:para>

<maml:para>Settings that determine how clients are allowed to communicate with HRA when requesting health certificates. You can customize HRA request policy by customizing cryptographic policy and transport policy settings. You do not need to modify HRA request policy settings. The default settings are recommended. If you choose to change these settings, it is important to configure identical settings on both HRA servers and NAP client computers. For more information, see <maml:navigationLink><maml:linkText>Understanding HRA Request Policy</maml:linkText><maml:uri href="mshelp://windows/?id=d87d5168-61b8-4c8e-988a-365a653696bf"></maml:uri></maml:navigationLink>, <maml:navigationLink><maml:linkText>Configure HRA Cryptographic Policy</maml:linkText><maml:uri href="mshelp://windows/?id=ca01fd62-4e6b-48d7-9d8c-65fc3f94379c"></maml:uri></maml:navigationLink>, and <maml:navigationLink><maml:linkText>Configure HRA Transport Policy</maml:linkText><maml:uri href="mshelp://windows/?id=79885c91-4bc7-4c5a-b663-6140d242bf75"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Internet Information Services (IIS)</maml:para>

<maml:para>A set of Internet-based services that is installed automatically when you install HRA. The IIS service provides an HTTP/HTTPS interface for NAP clients to contact the HRA server and request health certificates. It processes these requests using an Internet Server Application Programming Interface (ISAPI) extension that can be provided to anonymous users or restricted to users who have been authenticated to the domain. For more information, see <maml:navigationLink><maml:linkText>Understanding HRA Authentication Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=d9933a4d-3059-48ab-b303-3e3fbd09912e"></maml:uri></maml:navigationLink> and <maml:navigationLink><maml:linkText>Verify IIS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=cfece017-37f4-4c97-9bb7-e08cd49150d7"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Network Policy Server (NPS)</maml:para>

<maml:para>The Microsoft implementation of a Remote Authentication Dial-In User Service (RADIUS) server and proxy. If your server is not already running NPS, it is automatically installed when you install HRA. You can configure NPS on your HRA server as either a NAP health policy server or NPS proxy. When you configure NPS as a NAP health policy server, you must also configure NAP policies and settings, including:</maml:para>

<maml:list class="unordered">
<maml:listItem>
<maml:para>Connection request policies: Sets of conditions and settings that validate requests for network access and specify where this validation is performed.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Network policies: Sets of conditions, constraints, and settings that allow you to designate who can connect to the network.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Health policies: System health requirements that define which SHVs are used in validating the configuration of computers that attempt to connect to your network.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>System health validators (SHVs): A NAP health policy server software counterpart to a system health agent (SHA). SHVs define configuration requirements for computers that attempt to connect to your network.</maml:para>
</maml:listItem>
</maml:list>
</maml:listItem>
</maml:list>

<maml:para>When you configure NPS as a RADIUS proxy, you must verify network connectivity to remote RADIUS server groups and validate their configuration as NAP health policy servers. For more information, see <maml:navigationLink><maml:linkText>Verify NPS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ed2a5c7e-dfa5-4354-8e41-e12e28d57189"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Checklist: Deploy NAP IPsec Enforcement with HRA</maml:linkText><maml:uri href="mshelp://windows/?id=7a14e840-7d24-402f-9777-6b98e830864f"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configuring HRA</maml:linkText><maml:uri href="mshelp://windows/?id=d3b2e920-86ee-4671-a273-60a818d77520"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Troubleshooting HRA</maml:linkText><maml:uri href="mshelp://windows/?id=6c44027f-a214-41d3-b657-2b9e8d0ddac7"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding NAP IPsec Enforcement</maml:linkText><maml:uri href="mshelp://windows/?id=4214362f-4d30-473a-b95b-a2130ba5c1fc"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Configure NAP Certification Authority</maml:title><maml:introduction>
<maml:para>Health Registration Authority (HRA) must be configured with at least one certification authority (CA) from which to request health certificates on behalf of client computers. Certificates are requested when new clients connect to the network or when the health certificate validity period is about to expire on a compliant client computer. Certificates can also be removed and reissued to client computers if their health state changes while they are connected to the network. HRA will only request health certificates from the CA configured first in the order, unless that server is unavailable or has been identified as unresponsive.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Configure CAs</maml:title><maml:introduction>
<maml:para>Use this procedure to configure CAs in HRA. CAs can be added or deleted, and their order can be modified. You can also specify the number of minutes to wait between requests before identifying a CA as unavailable. If you are using an enterprise CA, you can select the authenticated and anonymous certificate templates to use. If you are using a standalone CA with Network Access Control, you can enable client extended state information by enabling policy OIDs.</maml:para>

<maml:para>Membership in <maml:computerOutputInline>Domain Admins</maml:computerOutputInline>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Add a new CA</maml:title><maml:introduction>
<maml:para>For optimal performance, a dedicated standalone subordinate CA should be used to issue health certificates. Fault tolerance is provided when you configure more than one CA in the HRA snap-in. Load balancing can be achieved by configuring an additional HRA with a different CA processing order. You can use the following procedure to configure CAs for use with HRA.</maml:para>

<maml:procedure><maml:title>To add a new certification authority using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open the HRA console.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click <maml:ui>Certification Authority</maml:ui>, and then click <maml:ui>Add Certification Authority</maml:ui>. The <maml:ui>Add Certification Authority </maml:ui>dialog box opens.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Browse</maml:ui>. The <maml:ui>Select Certification Authority</maml:ui> dialog box opens.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>CA</maml:ui>, click the name of the CA that will be used to issue NAP health certificates, and then click <maml:ui>OK</maml:ui> twice.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the HRA console tree, click <maml:ui>Certification Authority</maml:ui>, and verify the name and order of configured CAs.</maml:para>

<maml:alertSet class="note"><maml:title>Note </maml:title>
<maml:para>You cannot browse to a CA from a workgroup environment.</maml:para>
</maml:alertSet>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Configure CA wait time</maml:title><maml:introduction>
<maml:para>HRA will only attempt to obtain health certificates from the CA that is configured first in the processing order, unless that CA has been marked as unavailable. You can use the following procedure to change the number of minutes to wait before identifying a CA as unavailable.</maml:para>

<maml:procedure><maml:title>To configure certification authority wait time using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open the HRA console.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click <maml:ui>Certification Authority</maml:ui>, and then click <maml:ui>Properties</maml:ui>. The <maml:ui>Certification Authorities Properties </maml:ui>dialog box opens.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Enter the number of minutes to wait between requests before identifying a CA as unavailable, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Configure health certificate validity period</maml:title><maml:introduction>
<maml:para>The default validity period for health certificates is 4 hours. Clients will attempt to renew a health certificate 15 minutes prior to expiration or when a change in client health status occurs. You can use the following procedure to configure a custom validity period for health certificates.</maml:para>

<maml:procedure><maml:title>To configure the validity time for health certificates approved by HRA using the Windows interface</maml:title><maml:introduction><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:alertSet class="important"><maml:title>Important </maml:title>
<maml:para>The maximum health certificate validity period is determined by the CA validity period, which is set by default to 52 weeks. Use caution when configuring a validity period of less than 1 hour due to potential performance issues with the CA server. Do not use a validity period of 15 minutes or less.</maml:para>
</maml:alertSet>
</maml:introduction></maml:section></maml:sections></maml:introduction><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open the HRA console.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click <maml:ui>Certification Authority</maml:ui>, and then click <maml:ui>Properties</maml:ui>. The <maml:ui>Certification Authorities Properties </maml:ui>dialog box opens.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Select the unit of time using the drop-down list. You can select <maml:ui>Minutes</maml:ui>, <maml:ui>Hours</maml:ui>, <maml:ui>Days</maml:ui>, or <maml:ui>Weeks</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>After choosing a unit of time, enter the number of units desired, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If you are using an enterprise CA, you must perform the following steps in order to override the validity period that is configured in your certificate templates.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Click <maml:ui>Start</maml:ui>, right-click <maml:ui>Command Prompt</maml:ui>, and then click <maml:ui>Run as administrator</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>In the command window, <maml:userInput>type Certutil.exe -setreg policy\EditFlags +EDITF_ATTRIBUTEENDDATE</maml:userInput>, and then press ENTER.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>In the command window, type <maml:userInput>net stop certsvc &amp;&amp; net start certsvc</maml:userInput>, and then press ENTER.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Verify that Active DirectoryÂ® Certificate Services (ADÂ CS) stops and starts successfully.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Choose CA type</maml:title><maml:introduction>
<maml:para>Use the following procedure to configure the NAP certification authority type. It is important to choose a CA type that corresponds to the CA that you configured in the preceding procedure. If you are using an enterprise CA, you must configure templates before you perform this procedure.</maml:para>

<maml:procedure><maml:title>To choose the certification authority type using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open the HRA console.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click <maml:ui>Certification Authority</maml:ui>, and then click <maml:ui>Properties</maml:ui>. The <maml:ui>Certification Authorities Properties </maml:ui>dialog box opens.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If you are using a standalone CA, choose <maml:ui>Use standalone certification authority</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Do not select the check box next to <maml:ui>Enable PolicyOIDs</maml:ui> unless you are using client extended state information for Network Access Control.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If you are using an Active Directory-integrated enterprise CA, or you are using both enterprise and standalone CAs, choose <maml:ui>Use enterprise certification authority</maml:ui>, and then use the drop-down list to select an <maml:ui>Authenticated compliant certificate template</maml:ui> and <maml:ui>Anonymous complaint certificate template</maml:ui> from the list of available templates. If you did not choose to allow anonymous requests for health certificates during the installation of HRA, then configuring an anonymous template in this procedure does not enable anonymous certificate requests.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Configure order or delete CAs</maml:title><maml:introduction>
<maml:para>Use the following procedure to modify the priority of CAs used by HRA, or to remove CAs from the HRA configuration. HRA will only request certificates from the first CA configured in the list, unless that CA has been marked as unavailable.</maml:para>

<maml:procedure><maml:title>To configure the order or to delete certification authorities using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open the HRA console.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, click <maml:ui>Certification Authorities</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Right-click a CA name in the list of servers. Click <maml:ui>Move Up</maml:ui> to increase preference for this server in the order. Alternatively, click <maml:ui>Move Down</maml:ui> to decrease preference for this server in the order.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>To delete a CA from the list, right-click the CA name, and then click <maml:ui>Delete</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Verify CA Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ffe5b00d-9333-4ecb-a880-608817d37b62"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Health Registration Authority</maml:title><maml:introduction>
<maml:para>Health Registration Authority (HRA) is a component of a Network Access Protection (NAP) infrastructure that plays a central role in NAP Internet Protocol security (IPsec) enforcement. HRA obtains health certificates on behalf of NAP clients when they are compliant with network health requirements. These health certificates authenticate NAP clients for IPsec-protected communications with other NAP clients on an intranet. If a NAP client does not have a health certificate, the IPsec peer authentication fails and the NAP client cannot initiate communication with other IPsec-protected computers on the network.</maml:para>

<maml:para>HRA is installed on a computer that is also running Network Policy Server (NPS) and Internet Information Services (IIS). If they are not already installed, these services will be added when you install HRA.</maml:para>
<maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Overview of HRA</maml:linkText><maml:uri href="mshelp://windows/?id=ae5d5d44-7a46-4daf-88c1-af580519bdeb"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Checklist: Deploy NAP IPsec Enforcement with HRA</maml:linkText><maml:uri href="mshelp://windows/?id=7a14e840-7d24-402f-9777-6b98e830864f"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configuring HRA</maml:linkText><maml:uri href="mshelp://windows/?id=d3b2e920-86ee-4671-a273-60a818d77520"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding HRA Authentication Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=d9933a4d-3059-48ab-b303-3e3fbd09912e"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding HRA Request Policy</maml:linkText><maml:uri href="mshelp://windows/?id=d87d5168-61b8-4c8e-988a-365a653696bf"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configure NAP Certification Authority</maml:linkText><maml:uri href="mshelp://windows/?id=af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configure HRA Cryptographic Policy</maml:linkText><maml:uri href="mshelp://windows/?id=ca01fd62-4e6b-48d7-9d8c-65fc3f94379c"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configure HRA Transport Policy</maml:linkText><maml:uri href="mshelp://windows/?id=79885c91-4bc7-4c5a-b663-6140d242bf75"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Troubleshooting HRA</maml:linkText><maml:uri href="mshelp://windows/?id=6c44027f-a214-41d3-b657-2b9e8d0ddac7"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding NAP IPsec Enforcement</maml:linkText><maml:uri href="mshelp://windows/?id=4214362f-4d30-473a-b95b-a2130ba5c1fc"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Verify CA Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ffe5b00d-9333-4ecb-a880-608817d37b62"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Verify NAP Client Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=332915ab-0a04-4c93-87ae-6b773aa4d3e8"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Verify NPS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ed2a5c7e-dfa5-4354-8e41-e12e28d57189"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Verify IIS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=cfece017-37f4-4c97-9bb7-e08cd49150d7"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Configure HRA Cryptographic Policy</maml:title><maml:introduction>
<maml:para>Use this procedure to configure cryptographic policy in Health Registration Authority (HRA). You can configure cryptographic policy by specifying supported asymmetric algorithms, hash algorithms, and cryptographic service providers (CSPs).</maml:para>

<maml:para>Membership in <maml:computerOutputInline>Domain Admins</maml:computerOutputInline>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>

<maml:procedure><maml:title>To configure cryptographic policy using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open the HRA console.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, double-click <maml:ui>Request Policy</maml:ui>, and then click <maml:ui>Cryptographic Policy</maml:ui>. <maml:ui>Asymmetric Keys Algorithms</maml:ui>, <maml:ui>Hash Keys Algorithms</maml:ui>, and <maml:ui>Cryptographic Service Providers</maml:ui> are displayed in the details pane.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>To specify asymmetric key algorithms, right-click <maml:ui>Asymmetric Keys Algorithms</maml:ui>, and select <maml:ui>Properties</maml:ui>. The default selection is <maml:ui>Any algorithm</maml:ui>. </maml:para>
<maml:list class="unordered"><maml:listItem><maml:para>To configure a specific asymmetric algorithm, select <maml:ui>Specific algorithms</maml:ui>, and then select the check box next to the desired algorithm in the list.</maml:para></maml:listItem><maml:listItem><maml:para>To edit the minimum and maximum key length for an algorithm, select the name of the algorithm from the list, and then click <maml:ui>Edit</maml:ui>. Enter the desired minimum and maximum key lengths, and then click <maml:ui>OK</maml:ui>.</maml:para></maml:listItem></maml:list><maml:para>When you are finished selecting algorithms, click <maml:ui>OK</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>To specify hash key algorithms, right-click <maml:ui>Hash Keys Algorithms</maml:ui>, and select <maml:ui>Properties</maml:ui>. The default selection is <maml:ui>Any algorithm</maml:ui>. To configure specific algorithms, select <maml:ui>Specific algorithms</maml:ui>, select the check box next to the desired algorithm in the list, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>To specify cryptographic service providers, right-click <maml:ui>Cryptographic Service Providers</maml:ui>, and select <maml:ui>Properties</maml:ui>. The default selection is<maml:ui> Any provider</maml:ui>. To configure specific providers, select <maml:ui>Specific provider</maml:ui>, select the check box next to the desired provider in the list, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>If you configure request policy settings on your HRA servers, you must configure identical request policy settings on your client computers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash key algorithm, and cryptographic service provider as your client computers, then your client computers will not be able to communicate with your HRA servers. Your client computers could be deemed noncompliant, which will result in limited network access.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding HRA Request Policy</maml:linkText><maml:uri href="mshelp://windows/?id=d87d5168-61b8-4c8e-988a-365a653696bf"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Verify IIS Configuration</maml:title><maml:introduction>
<maml:para>Use this procedure to verify that Internet Information Services (IIS) is running and configured correctly on your Health Registration Authority (HRA) server. IIS Web sites are used by HRA to process client health certificate requests.</maml:para>

<maml:para>For more information about IIS, see <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=94386</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=94386"></maml:uri></maml:navigationLink>.</maml:para>

<maml:para>Membership in <maml:computerOutputInline>Domain Admins</maml:computerOutputInline>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Verify availability of DomainHRA and NonDomainHRA Web sites</maml:title><maml:introduction>
<maml:para>Two Web sites can be created on your HRA server, depending on the choices you make during the installation of HRA. These sites are used by HRA to process domain-authenticated or anonymous health certificate requests. After installation, no additional configuration of these Web sites is required. However, if IIS is not running or is not correctly configured, HRA might not be able to issue health certificates.</maml:para>

<maml:procedure><maml:title>To verify availability of DomainHRA and NonDomainHRA Web sites</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Services</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In <maml:ui>Services</maml:ui>, verify that <maml:ui>Started</maml:ui> is displayed for <maml:ui>World Wide Web Publishing Service</maml:ui> and that its <maml:ui>Startup Type</maml:ui> is set to <maml:ui>Automatic</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Internet Information Services (IIS) Manager</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In <maml:ui>Internet Information Services (IIS) Manager</maml:ui>, double-click the computer name of your HRA server.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Double-click <maml:ui>Web Sites</maml:ui>, and then double-click <maml:ui>Default Web Site</maml:ui>.</maml:para>
<maml:list class="unordered"><maml:listItem><maml:para>Verify that both the DomainHRA and NonDomainHRA Web sites are displayed if you chose to allow anonymous requests for health certificates during the installation of HRA.</maml:para></maml:listItem><maml:listItem><maml:para>Verify that only the DomainHRA Web site is displayed if you chose to require requestors to be authenticated as members of a domain during the installation of HRA.</maml:para></maml:listItem></maml:list></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>DomainHRA</maml:ui>, and then double-click <maml:ui>Authentication</maml:ui>. Verify that only <maml:ui>Windows Authentication</maml:ui> is enabled.</maml:para><maml:para>If the NonDomainHRA Web site is installed, click <maml:ui>NonDomainHRA</maml:ui>, and then double-click <maml:ui>Authentication</maml:ui>. Verify that only <maml:ui>Anonymous Authentication</maml:ui> is enabled.</maml:para>

</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the computer name of your HRA server, and then double-click <maml:ui>ISAPI and CGI Restrictions</maml:ui>. Verify that the <maml:ui>hcsrvext.dll</maml:ui> extension is set to <maml:ui>Allowed</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>

<maml:alertSet class="important"><maml:title>Important </maml:title>
<maml:para>If anonymous health certificate requests are enabled, do not configure the NonDomainHRA Web site URL with a higher processing order than the DomainHRA Web site in trusted server group settings on NAP client computers. This can result in NAP clients that are domain members obtaining health certificates that are incompatible with domain authentication requirements used in IPsec-protected communications.</maml:para>
</maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding HRA Authentication Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=d9933a4d-3059-48ab-b303-3e3fbd09912e"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Configuring HRA</maml:title><maml:introduction>
<maml:para>Options for configuring Health Registration Authority (HRA) include:</maml:para>

<maml:list class="unordered">
<maml:listItem>
<maml:para>Authentication requirements</maml:para>

<maml:para>Configured by using the Add Roles Wizard during the installation of the HRA role service. For more information, see <maml:navigationLink><maml:linkText>Understanding HRA Authentication Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=d9933a4d-3059-48ab-b303-3e3fbd09912e"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Certification authorities (CAs)</maml:para>

<maml:para>Configured during installation of HRA, or later using either the HRA snap-in or <maml:computerOutputInline>netsh nap hra</maml:computerOutputInline> context commands. At least one CA must be configured in order for HRA to obtain health certificates on behalf of Network Access Protection (NAP) clients. For more information, see <maml:navigationLink><maml:linkText>Configure NAP Certification Authority</maml:linkText><maml:uri href="mshelp://windows/?id=af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Request policy</maml:para>

<maml:para>Configured after installation of HRA by using the HRA snap-in or the command line. You do not have to modify default HRA request policy settings. For more information, see <maml:navigationLink><maml:linkText>Understanding HRA Request Policy</maml:linkText><maml:uri href="mshelp://windows/?id=d87d5168-61b8-4c8e-988a-365a653696bf"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configure HRA Cryptographic Policy</maml:linkText><maml:uri href="mshelp://windows/?id=ca01fd62-4e6b-48d7-9d8c-65fc3f94379c"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configure HRA Transport Policy</maml:linkText><maml:uri href="mshelp://windows/?id=79885c91-4bc7-4c5a-b663-6140d242bf75"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding HRA Request Policy</maml:title><maml:introduction>
<maml:para>You can use the Health Registration Authority (HRA) snap-in to specify the security mechanisms that the HRA server uses to communicate with client computers. These settings, known as request policy settings, determine which asymmetric key algorithm, hash algorithm, and cryptographic service provider (CSP) the HRA server uses to encrypt communication with client computers. If you specify request policy settings using the HRA snap-in, the HRA server will use only these security mechanisms to communicate with client computers.</maml:para>

<maml:alertSet class="important"><maml:title>Important </maml:title>
<maml:para>You do not need to configure request policy settings on your HRA server. By default, a NAP-capable client computer initiates a negotiation process with an HRA server using a mutually acceptable default security mechanism for encrypting communication. You should not modify request policy settings unless you have thoroughly tested your request policy settings in a secure test environment.</maml:para>
</maml:alertSet>

<maml:para>If you configure request policy settings on your HRA server, you must configure identical request policy settings on your client computers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash algorithm, and CSP as your client computers, then your HRA servers will not be able to communicate with client computers. The client computers might be determined to be noncompliant, which will result in limited network connectivity.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Cryptographic policy</maml:title><maml:introduction>
<maml:para>You can configure HRA server request policy settings by specifying custom cryptographic policy. Cryptographic policy settings specify asymmetric key algorithms, hash key algorithms, and cryptographic service providers. For more information, see <maml:navigationLink><maml:linkText>Configure HRA Cryptographic Policy</maml:linkText><maml:uri href="mshelp://windows/?id=ca01fd62-4e6b-48d7-9d8c-65fc3f94379c"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Asymmetric key algorithms</maml:title><maml:introduction>
<maml:para>Asymmetric key algorithms are also known as public key algorithms. Asymmetric algorithms are used to generate the asymmetric keys that are associated with client health certificate requests. Default settings allow any available algorithm to be accepted in communication between the HRA server and client computers. You can use the HRA snap-in to specify which algorithms in the list are allowed, and you can modify the minimum and maximum key lengths for these algorithms.</maml:para>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Hash key algorithms</maml:title><maml:introduction>
<maml:para>Hash algorithms are also known as secure hash algorithms or hash functions. Hash algorithms are designed to perform a one-way operation on data, providing a unique output value that can be used for verification, but cannot be used to re-create the original data. Default settings support the use of any hash algorithm. You can use the HRA snap-in to specify which algorithms in the list are allowed.</maml:para>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Cryptographic service providers</maml:title><maml:introduction>
<maml:para>Cryptographic service providers are hardware and software components of Windows operating systems that provide generic cryptographic functions. Each of the CSPs configured for use by HRA can support different algorithms, formats, and keys used for encryption and decryption. Default settings support the use of any CSP. You can use the HRA snap-in to specify which CSPs in the list are used.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section>
<maml:title>Transport policy</maml:title><maml:introduction>
<maml:para>You can configure HRA server request policy settings by specifying custom transport policy. Transport policy settings specify HTTP client user agents. For more information, see <maml:navigationLink><maml:linkText>Configure HRA Transport Policy</maml:linkText><maml:uri href="mshelp://windows/?id=79885c91-4bc7-4c5a-b663-6140d242bf75"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>HTTP client user agents</maml:title><maml:introduction>
<maml:para>HTTP client user agents are strings that specify the identity of HTTP/HTTPS client applications used to request health certificates from HRA. Any agent is allowed by default. You can use the HRA snap-in to specify the allowed user agents.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Verify NAP Client Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=332915ab-0a04-4c93-87ae-6b773aa4d3e8"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Troubleshooting HRA</maml:linkText><maml:uri href="mshelp://windows/?id=6c44027f-a214-41d3-b657-2b9e8d0ddac7"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding HRA Authentication Requirements</maml:title><maml:introduction>
<maml:para>During the installation of Health Registration Authority (HRA), you are given the option to configure HRA to provide health certificates only when users are authenticated to the domain, or to optionally provide health certificates to anonymous users. If you choose to allow anonymous requests for health certificates, two Web sites will be created:</maml:para>

<maml:list class="unordered">
<maml:listItem>
<maml:para>DomainHRA</maml:para>

<maml:para>Internet Information Services (IIS) authentication settings on this site have Windows authentication enabled. All other authentication methods are disabled.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>NonDomainHRA</maml:para>

<maml:para>IIS authentication settings on this site have Anonymous authentication enabled. All other authentication methods are disabled.</maml:para>
</maml:listItem>
</maml:list>

<maml:para>If you choose to require that only authenticated members of the domain are granted the ability to receive health certificates, then only the DomainHRA Web site is created.</maml:para>

<maml:para>These Web sites host an IIS Internet Server Application Programming Interface (ISAPI) extension that processes HTTP/HTTPS requests, evaluates health using Network Policy Server (NPS), and issues health certificates using a certification authority (CA).</maml:para>

<maml:alertSet class="important"><maml:title>Important </maml:title>
<maml:para>If anonymous certificate requests are allowed, you should configure trusted server groups on NAP clients so that authenticated certificate requests are given a higher priority in the ordered list of URLs than anonymous certificate requests. This will help to ensure that domain members that pass health checks are not issued anonymous health certificates.</maml:para>
</maml:alertSet>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Certificates for SSL encryption</maml:title><maml:introduction>
<maml:para>IIS can use Secure Sockets Layer (SSL) to encrypt communications with NAP client computers. If you enable SSL, remote clients must access your site by using URLs that start with https://, and your IIS server must be provisioned with a SSL certificate. Requirements for this SSL certificate are:</maml:para>

<maml:list class="unordered">
<maml:listItem>
<maml:para>The certificate must be in either the local computer certificate store or the current user certificate store.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>The current system time must be after the <maml:ui>Valid from</maml:ui> property of the certificate and before the <maml:ui>Valid to</maml:ui> property of the certificate.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>The certificate must be meant for server authentication. This requires the Enhanced Key Usage property of the certificate to specify <maml:ui>Server Authentication</maml:ui> (1.3.6.1.5.5.7.3.1).</maml:para>
</maml:listItem>
</maml:list>

<maml:para>If you import an existing certificate for use with SSL encryption during installation of the HRA role service, it is automatically added to the local computer certificate store. You can also create a self-signed certificate or install a certificate for SSL encryption later.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Overview of HRA</maml:linkText><maml:uri href="mshelp://windows/?id=ae5d5d44-7a46-4daf-88c1-af580519bdeb"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configuring HRA</maml:linkText><maml:uri href="mshelp://windows/?id=d3b2e920-86ee-4671-a273-60a818d77520"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Verify IIS Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=cfece017-37f4-4c97-9bb7-e08cd49150d7"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Verify NPS Configuration</maml:title><maml:introduction>
<maml:para>Network Policy Server (NPS) is the central server used with all Network Access Protection (NAP) enforcement methods to evaluate NAP client access requests. Network health requirements are defined on NPS using policies that grant or restrict access of NAP client computers based on their health. A server running NPS that hosts these NAP policies is called a NAP health policy server. Depending on your deployment, you may have one or more NAP health policy servers on your network. RADIUS clients, connection request policies, network policies, health policies, and system health validators (SHVs) are used by a NAP health policy server to define and enforce network health requirements.</maml:para>

<maml:para>When you install Health Registration Authority (HRA), NPS is installed on the same computer automatically. If you have deployed more than one HRA, and prefer to centralize policy evaluation by placing your NAP health policies on another computer, you must configure the local server running NPS as a RADIUS proxy. When you use NPS as a RADIUS proxy, connection request policy is configured to tell the local server running NPS to forward network access requests to remote RADIUS server groups for evaluation.</maml:para>

<maml:para>For more information about NPS, see <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=94389</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=94389"></maml:uri></maml:navigationLink>.</maml:para>

<maml:para>Membership in <maml:computerOutputInline>Domain Admins</maml:computerOutputInline>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Verify NAP health policy server configuration</maml:title><maml:introduction>
<maml:para>Use the following procedures to verify the configuration of the local server running NPS as a NAP health policy server. If the local HRA server is configured as a RADIUS proxy, see <maml:navigationLink><maml:linkText>Verify NPS proxy configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ed2a5c7e-dfa5-4354-8e41-e12e28d57189#NPS_Proxy"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>RADIUS clients</maml:title><maml:introduction>
<maml:para>If you have configured remote HRA servers as RADIUS proxies to forward connection requests to the local server running NPS for evaluation, then the local server running NPS must have a corresponding RADIUS client entry for each remote HRA server. NAP with IPsec enforcement does not require RADIUS clients if all HRA servers are also NAP health policy servers. If you are using HRA servers that have NPS configured as a RADIUS proxy, use the following procedure to verify that RADIUS clients are configured correctly on the local server running NPS so that it can process client connection requests received by remote HRA servers.</maml:para>

<maml:procedure><maml:title>To verify RADIUS clients</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>nps.msc</maml:userInput>, and then press ENTER.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the NPS console tree, double-click <maml:ui>RADIUS Clients and Servers</maml:ui>, and then click <maml:ui>RADIUS Clients</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, double-click the friendly name of a RADIUS client corresponding to an HRA server with NPS installed and configured as a RADIUS proxy. If no RADIUS client entry is present, use the following procedure to create a new RADIUS client. This procedure applies only if you have remote HRA servers configured to forward connection requests to the local server running NPS.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Right-click <maml:ui>RADIUS Clients</maml:ui>, and then click <maml:ui>New</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Friendly name</maml:ui>, type a name for the RADIUS client (for example, <maml:userInput>HRA-1</maml:userInput>).</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Address (IP or DNS)</maml:ui>, type the IP address or DNS name of the remote HRA server, click <maml:ui>Verify</maml:ui>, and then click <maml:ui>Resolve</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Confirm that the IP address displayed corresponds to the correct remote HRA server, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Shared secret</maml:ui> and <maml:ui>Confirm shared secret</maml:ui>, type the secret that is configured in remote RADIUS server group settings on the remote HRA server.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>If the remote HRA server has enabled the message authenticator attribute in its remote RADIUS server group configuration settings, then select the <maml:ui>Access-Request messages must contain the Message-Authenticator attribute</maml:ui> check box. If this option is not enabled on the remote HRA, then verify that this check box is cleared.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Select the <maml:ui>RADIUS client is NAP-capable check box</maml:ui>, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Resume the current procedure to validate configuration of the new RADIUS client.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the <maml:ui>Properties</maml:ui> window, verify that the <maml:ui>Enable this RADIUS client</maml:ui> check box is selected.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that the <maml:ui>RADIUS client is NAP-capable</maml:ui> check box is selected.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If the remote HRA server is configured to require that access requests contain the message authenticator attribute, then verify that the <maml:ui>Access-Request messages must contain the Message-Authenticator attribute</maml:ui> check box is selected. Otherwise, verify that this check box is cleared.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Next to <maml:ui>Vendor name</maml:ui>, verify that <maml:ui>RADIUS Standard</maml:ui> is selected.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>Address (IP or DNS)</maml:ui>, confirm that the DNS name or IP address listed corresponds to the correct remote HRA server, and then click <maml:ui>Verify</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the <maml:ui>Verify Client</maml:ui> dialog box, click <maml:ui>Resolve</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>IP address</maml:ui>, confirm that the IP address listed corresponds to an HRA server that has been configured to forward requests to the local server running NPS, and that the local server running NPS has network connectivity to this IP address.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui>. If a shared secret mismatch is suspected, type the secret next to <maml:ui>Shared Secret</maml:ui> and <maml:ui>Confirm shared secret</maml:ui>, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Repeat this procedure for each HRA server on your network that is configured to forward connection requests to the local server running NPS for processing.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Connection request policies</maml:title><maml:introduction>
<maml:para>Connection request policies are conditions and settings that validate requests for network access and govern where this validation is performed. Use the following procedure to confirm that connection request policy on the local server running NPS is configured for NAP IPsec enforcement.</maml:para>

<maml:procedure><maml:title>To verify connection request policies</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the NPS console tree, double-click <maml:ui>Policies</maml:ui>, and then click <maml:ui>Connection Request Policies</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, double-click the connection request policy that is used to authenticate incoming network access requests from IPsec-protected NAP clients. If this policy is not present, perform the following steps to create a connection request policy.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Right-click <maml:ui>Connection Request Policies</maml:ui>, and then click <maml:ui>New</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Policy Name</maml:ui>, type a name for the connection request policy (for example, <maml:userInput>NAP IPsec with HRA</maml:userInput>).</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Type of network access server</maml:ui>, select <maml:ui>Health Registration Authority</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Connection request policy requires that at least one condition is specified. To add a condition that does not deny any incoming access requests, on the <maml:ui>Specify Conditions</maml:ui> page, click <maml:ui>Add</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>In the <maml:ui>Select condition</maml:ui> window, click <maml:ui>Day and Time Restrictions</maml:ui>, and then click <maml:ui>Add</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>In the <maml:ui>Time of day constraints</maml:ui> window, select <maml:ui>Permitted</maml:ui>. Verify that all days and times are permitted, click <maml:ui>OK</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>If the local server running NPS is a NAP health policy server, verify that <maml:ui>Authenticate requests on this server</maml:ui> is selected, click <maml:ui>Next</maml:ui> three times, and then click <maml:ui>Finish</maml:ui>. If the local server running NPS will forward requests to another server for evaluation, see <maml:navigationLink><maml:linkText>Verify NPS proxy configuration</maml:linkText><maml:uri href="mshelp://windows/?id=ed2a5c7e-dfa5-4354-8e41-e12e28d57189#NPS_Proxy"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>

</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Overview</maml:ui> tab, verify that the <maml:ui>Policy enabled</maml:ui> check box is selected.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Overview</maml:ui> tab, verify that the <maml:ui>Type of network access server</maml:ui> is either <maml:ui>Health Registration Authority</maml:ui> or <maml:ui>Unspecified</maml:ui>. For more information about specifying an access server type, see â€œAdditional considerationsâ€ later in this topic.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Conditions</maml:ui> tab, and verify that all configured conditions are matched by both compliant and noncompliant NAP clients. For example, <maml:ui>Day and time restrictions</maml:ui> can be configured to permit network access only on specified days at specified times.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Settings</maml:ui> tab. Under <maml:ui>Required Authentication Methods</maml:ui>, click <maml:ui>Authentication Methods</maml:ui>, and verify that the <maml:ui>Override network policy authentication settings</maml:ui> check box is cleared.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>Forwarding Connection Request</maml:ui>, click <maml:ui>Authentication</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>To enable the local server running NPS as a NAP health policy server, verify that <maml:ui>Authenticate requests on this server</maml:ui> is selected.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui> to close the properties window.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Network policies</maml:title><maml:introduction>
<maml:para>Network policies use conditions, settings, and constraints to determine who can connect to the network. To evaluate health status of NAP clients, there must be at least one network policy that will be applied to computers that are compliant with the health requirements, and at least one network policy that will be applied to computers that are noncompliant. Use the following procedure to verify that these policies have been created and configured for NAP IPsec enforcement.</maml:para>

<maml:procedure><maml:title>To verify network policies</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the NPS console tree, double-click <maml:ui>Policies</maml:ui>, and then click <maml:ui>Network Policies</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, verify that you have at least one policy for compliant computers and one policy for noncompliant computers, and that these policies have a <maml:ui>Status</maml:ui> of <maml:ui>Enabled</maml:ui>. To enable a policy, right-click the policy name, and then click <maml:ui>Enable</maml:ui>. If these policies are not present, perform the following steps to create a network policy.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Right-click <maml:ui>Network Policies</maml:ui>, and then click <maml:ui>New</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Policy Name</maml:ui>, type a name for the network policy (for example, <maml:userInput>NAP IPsec with HRA Compliant</maml:userInput> or <maml:userInput>NAP IPsec with HRA Noncompliant</maml:userInput>).</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Type of network access server</maml:ui>, select <maml:ui>Health Registration Authority</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>On the <maml:ui>Specify Conditions</maml:ui> page, click <maml:ui>Add</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>In <maml:ui>Select condition</maml:ui>, click <maml:ui>Health Policies</maml:ui>, and then click <maml:ui>Add</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>If this network policy will apply to compliant client computers, under <maml:ui>Health Policies</maml:ui>, choose a health policy that has been configured to match a compliant client health state, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>If this network policy will apply to noncompliant client computers, under <maml:ui>Health Policies</maml:ui>, choose a health policy that has been configured to match a noncompliant client health state, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:listItem>


<maml:listItem>
<maml:para>Click <maml:ui>Next</maml:ui>, select <maml:ui>Access granted</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>On the <maml:ui>Configure Authentication Methods</maml:ui> page, select the <maml:ui>Perform machine health check only</maml:ui> check box, and then click <maml:ui>Next</maml:ui> twice.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>On the <maml:ui>Configure Settings</maml:ui> page, click <maml:ui>NAP Enforcement</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Choose an enforcement mode for this policy. For more information, see <maml:navigationLink><maml:linkText>NAP enforcement modes</maml:linkText><maml:uri href="mshelp://windows/?id=ed2a5c7e-dfa5-4354-8e41-e12e28d57189#Enforcement_Mode"></maml:uri></maml:navigationLink> later in this topic.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>To enable auto-remediation of noncompliant clients, select the <maml:ui>Enable auto-remediation of client computers</maml:ui> check box. If you do not wish to enable auto-remediation, clear this check box.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click <maml:ui>Next</maml:ui>, and then click <maml:ui>Finish</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Resume the current procedure to validate configuration of the new network policy.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, verify that the <maml:ui>Processing Order</maml:ui> of policies is configured correctly for your deployment. More specific policies are processed before more general policies. To change the order of policies, right-click the policy name, and then click <maml:ui>Move Up</maml:ui> or <maml:ui>Move Down</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, verify that both your compliant and noncompliant NAP policies are configured with an <maml:ui>Access Type</maml:ui> of <maml:ui>Grant Access</maml:ui>. To configure access permissions, right-click the policy name, click <maml:ui>Properties</maml:ui>, click the <maml:ui>Overview</maml:ui> tab, and then select <maml:ui>Grant Access</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, verify that the <maml:ui>Source</maml:ui> of your policies used to process IPsec-protected NAP clients is either <maml:ui>Health Registration Authority</maml:ui> or <maml:ui>Unspecified</maml:ui>. For more information about specifying an access server type, see â€œAdditional considerationsâ€ later in this topic.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, double-click the name of a network policy used to match compliant clients, and then click the <maml:ui>Conditions</maml:ui> tab.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that at least one of the conditions specified is <maml:ui>Health Policy</maml:ui>, and the <maml:ui>Value</maml:ui> corresponds to a health policy that you have configured to match a compliant client health state. If this condition is not present, perform the following steps.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Click <maml:ui>Add</maml:ui>, click <maml:ui>Health Policies</maml:ui>, and then click <maml:ui>Add</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Health Policies</maml:ui>, choose a policy that corresponds to a compliant client health state, and then click <maml:ui>OK</maml:ui>. If no health policies are available, then verify health policies and repeat this procedure.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Constraints</maml:ui> tab, and then click <maml:ui>Authentication Methods</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that the <maml:ui>Perform machine health check only</maml:ui> check box is selected.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Settings</maml:ui> tab, and then click <maml:ui>NAP Enforcement</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that <maml:ui>Allow full network access</maml:ui> is selected for this compliant network policy, and then click <maml:ui>OK</maml:ui>. This completes verification of a compliant network policy.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, double-click the name of a network policy used to match noncompliant clients, and then click the <maml:ui>Conditions</maml:ui> tab.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that at least one of the conditions specified is <maml:ui>Health Policy</maml:ui>, and the <maml:ui>Value</maml:ui> corresponds to a health policy that you have configured to match a noncompliant client health state. If this condition is not present, perform the following steps.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Click <maml:ui>Add</maml:ui>, click <maml:ui>Health Policies</maml:ui>, and then click <maml:ui>Add</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Health Policies</maml:ui>, choose a policy that corresponds to a noncompliant client health state, and then click <maml:ui>OK</maml:ui>. If no health policies are available, then verify health policies and repeat this procedure.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Constraints</maml:ui> tab, and then click <maml:ui>Authentication Methods</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that the <maml:ui>Perform machine health check only</maml:ui> check box is selected.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Settings</maml:ui> tab, and then click <maml:ui>NAP Enforcement</maml:ui>.</maml:para>
<maml:list class="unordered"><maml:listItem><maml:para>Verify that <maml:ui>Allow limited access</maml:ui> is selected for this noncompliant network policy if you have deployed NAP in a full enforcement mode.</maml:para></maml:listItem><maml:listItem><maml:para>Verify that <maml:ui>Allow full network access for a limited time</maml:ui> is selected for this noncompliant network policy if you have deployed NAP in deferred enforcement mode.</maml:para></maml:listItem><maml:listItem><maml:para>Verify that <maml:ui>Allow full network access</maml:ui> is selected for this noncompliant network policy if you have deployed NAP in reporting mode.</maml:para></maml:listItem><maml:listItem><maml:para>Verify that the <maml:ui>Enable auto-remediation of client computers</maml:ui> check box is selected if you wish to enable automatic remediation of noncompliant NAP clients.</maml:para></maml:listItem></maml:list></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Repeat these steps as necessary to verify configuration of each of the network policies used to evaluate access requests from IPsec-protected NAP clients.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section address="Enforcement_Mode"><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>NAP enforcement modes</maml:title><maml:introduction>
<maml:para>When you enable NAP on your network, three enforcement modes are available. Use these enforcement modes for staging your NAP deployment.</maml:para>

<maml:list class="unordered">
<maml:listItem>
<maml:para>To enable reporting mode, select <maml:ui>Allow full network access</maml:ui> for both compliant and noncompliant NAP client computers. In reporting mode, the health status of client computers is logged, but network access is not restricted. Both compliant and noncompliant computers receive health certificates.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>To enable deferred enforcement mode, select <maml:ui>Allow full network access</maml:ui> in your compliant network policy and <maml:ui>Allow full network access for a limited time</maml:ui> in your noncompliant network policy. You must also specify a date and time when the access of noncompliant clients will be restricted. In deferred enforcement mode, client computers immediately receive NAP notifications if they are not in compliance with network health requirements, but their access is not restricted until the specified time and date.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>To enable full enforcement mode, select <maml:ui>Allow full network access</maml:ui> in your compliant network policy and <maml:ui>Allow limited access</maml:ui> in your noncompliant network policy. In full enforcement mode, the network access of client computers is immediately restricted if they are not in compliance with network health requirements.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section><maml:section address="Addl_Consid"><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections></maml:sections>
</maml:section>

<maml:section address="Health_Policies"><maml:title></maml:title><maml:introduction></maml:introduction></maml:section>

<maml:section>
<maml:title>Health policies</maml:title><maml:introduction>
<maml:para>Health policies define which SHVs are evaluated, and how they are used in validating the configuration of computers that attempt to connect to your network. Based on the results of SHV checks, health policies classify client health status. You need at least one health policy that corresponds to a compliant client health state, and at least one health policy that corresponds to a noncompliant client health state. Use the following procedure to verify that compliant and noncompliant health policies have been configured on the NAP health policy server.</maml:para>

<maml:procedure><maml:title>To verify health policies</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the NPS console, double-click <maml:ui>Policies</maml:ui>, and then click <maml:ui>Health Policies</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, under <maml:ui>Policy Name</maml:ui>, double-click the name of a compliant health policy. If this policy is not present, use the following steps to create a compliant health policy.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Right-click <maml:ui>Health Policies</maml:ui>, and then click <maml:ui>New</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Policy name</maml:ui>, type a name for your compliant health policy (for example, <maml:userInput>NAP IPsec with HRA Compliant</maml:userInput>).</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Client SHV checks</maml:ui>, select <maml:ui>Client passes all SHV checks</maml:ui> to create a strict health policy, or select <maml:ui>Client passes one or more SHV checks</maml:ui> to create a more lenient health policy.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>SHVs used in this health policy</maml:ui>, select the check box next to each SHV that will be used to evaluate client health. The Windows Security Health Validator is available by default. Other SHVs are available if they have been installed.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click <maml:ui>OK</maml:ui>.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>Client SHV checks</maml:ui>, verify that either <maml:ui>Client passes all SHV checks</maml:ui> or <maml:ui>Client passes one or more SHV checks</maml:ui> is selected. These conditions are used to create compliant policies that are more restrictive or less restrictive, respectively.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>SHVs used in this health policy</maml:ui>, verify that the check boxes next to installed SHVs that will be used to evaluate health on your IPsec-protected NAP client computers are selected, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, under <maml:ui>Policy Name</maml:ui>, double-click the name of a noncompliant health policy. If this policy is not present, use the following steps to create a noncompliant health policy.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Right-click <maml:ui>Health Policies</maml:ui>, and then click <maml:ui>New</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Policy name</maml:ui>, type a name for your noncompliant health policy (for example, <maml:userInput>NAP IPsec with HRA Noncompliant</maml:userInput>).</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Client SHV checks</maml:ui>, select <maml:ui>Client fails one or more SHV checks</maml:ui> to create a strict health policy, or select <maml:ui>Client fails all SHV checks</maml:ui> to create a more lenient health policy.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>SHVs used in this health policy</maml:ui>, select the check box next to each SHV that will be used to evaluate client health. The Windows Security Health Validator is available by default. Other SHVs are available if they have been installed.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click <maml:ui>OK</maml:ui>.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>Client SHV checks</maml:ui>, verify that either <maml:ui>Client fails one or more SHV checks</maml:ui> or <maml:ui>Client fails all SHV checks</maml:ui> is selected. These conditions are used to create noncompliant policies that are more restrictive or less restrictive, respectively.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>SHVs used in this health policy</maml:ui>, verify that the check boxes next to installed SHVs that will be used to evaluate health on your IPsec-protected NAP client computers are selected, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Repeat these steps for all health policies used to evaluate your IPsec-protected NAP client computers.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>SHVs</maml:title><maml:introduction>
<maml:para>SHVs define software and configuration requirements for computers that attempt to connect to your network. Use the following procedure to verify that SHVs are configured correctly for your deployment.</maml:para>

<maml:procedure><maml:title>To verify SHVs</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the NPS console, double-click <maml:ui>Network Access Protection</maml:ui>, and then click <maml:ui>System Health Validators</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, under <maml:ui>Name</maml:ui>, double-click the name of an installed SHV.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Configuration of SHVs will vary based on implementation. If you are using the Windows Security Health Validator, click <maml:ui>Configure</maml:ui>.</maml:para>
<maml:list class="unordered"><maml:listItem><maml:para>To configure health requirements for computers running WindowsÂ Vista, click the <maml:ui>Windows Vista</maml:ui> tab.</maml:para></maml:listItem><maml:listItem><maml:para>To configure health requirements for computers running Windows XP with Service PackÂ 3, click the <maml:ui>Windows XP</maml:ui> tab.</maml:para></maml:listItem></maml:list></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Enable health requirements by selecting the check boxes next to health components. Clear these check boxes to disable requirements. The health requirements available when using the WSHV include: <maml:ui>Firewall</maml:ui>, <maml:ui>Virus Protection</maml:ui>, <maml:ui>Spyware Protection</maml:ui>, <maml:ui>Automatic Updating</maml:ui>, and <maml:ui>Security Update Protection</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui>, and configure error code resolutions for your deployment. Error code resolutions determine how clients are evaluated under the listed error conditions. You can select to return a status of <maml:ui>Compliant</maml:ui> or <maml:ui>Noncompliant</maml:ui> for each condition.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui>, and close the NPS console.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section address="NPS_Proxy"><maml:title></maml:title><maml:introduction></maml:introduction></maml:section><maml:section>
<maml:title>Verify NPS proxy configuration</maml:title><maml:introduction>
<maml:para>Use the following procedure to verify configuration of the local server running NPS as a RADIUS proxy. This procedure does not apply if the local server running NPS is configured as a NAP health policy server.</maml:para>

<maml:procedure><maml:title>To verify NPS proxy configuration</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>nps.msc</maml:userInput>, and then press ENTER.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, double-click <maml:ui>RADIUS Clients and Servers</maml:ui>, and then click <maml:ui>Remote RADIUS Server Groups</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, under <maml:ui>Group Name</maml:ui>, double-click the name of a remote RADIUS server group. If no remote RADIUS server group entry is displayed, perform the following steps to add a remote RADIUS server group.</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>In the console tree, under <maml:ui>RADIUS Clients and Servers</maml:ui>, right-click <maml:ui>Remote RADIUS Server Groups</maml:ui>, and then click <maml:ui>New</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Group name</maml:ui>, type a name for the remote RADIUS server group (for example, <maml:userInput>NAP Health Policy Server1</maml:userInput>).</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click <maml:ui>Add</maml:ui>, and then under <maml:ui>Server</maml:ui>, type the DNS name or IP address of a server running NPS that is configured to evaluate NAP IPsec client connection requests forwarded from the local HRA server.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click <maml:ui>Verify</maml:ui>, and then click <maml:ui>Resolve</maml:ui>. Confirm that the IP address displayed is correct for your deployment, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click the <maml:ui>Authentication/Accounting</maml:ui> tab.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Shared secret</maml:ui> and <maml:ui>Confirm shared secret</maml:ui>, type the secret that is configured in NPS settings on the NAP health policy server.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click <maml:ui>OK</maml:ui> twice.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the server group properties window, under <maml:ui>RADIUS Server</maml:ui>, click the name of a remote RADIUS server, and then click <maml:ui>Edit</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Address</maml:ui> tab, click <maml:ui>Verify</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the <maml:ui>Verify Client</maml:ui> dialog box, click <maml:ui>Resolve</maml:ui>. Verify that the IP address of the RADIUS client corresponds to a NAP health policy server on your network that is configured with a RADIUS proxy corresponding to the local server running NPS.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui>, and then click the <maml:ui>Authentication/Accounting</maml:ui> tab.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that the authentication and accounting ports are correct for your deployment. The default authentication port is 1812 and the default accounting port is 1813.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that the <maml:ui>Request must contain the message authenticator attribute</maml:ui> check box is selected only if a corresponding access-request message requirement for the message authenticator attribute is enabled on the NAP health policy server. Clear this check box if the NAP health policy server does not require this attribute.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If a shared secret mismatch is suspected, type the secret next to <maml:ui>Shared secret</maml:ui> and <maml:ui>Confirm shared secret</maml:ui>, and then click <maml:ui>OK</maml:ui> twice.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the NPS console, double-click <maml:ui>Policies</maml:ui>, and then click <maml:ui>Connection Request Policies</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, double-click the connection request policy that is used to authenticate incoming network access requests from IPsec-protected NAP clients.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Settings</maml:ui> tab, and under <maml:ui>Forwarding Connection Request</maml:ui>, click <maml:ui>Authentication</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that <maml:ui>Forward requests to the following remote RADIUS server group for authentication</maml:ui> is selected, and verify the name of the selected remote RADIUS server group corresponds to the correct NAP health policy servers on your network.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Repeat these steps for all groups and remote servers running NPS.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Close the NPS console.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section><maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:para>If the type of network access server in connection request policy and network policy is set to <maml:ui>Unspecified</maml:ui>, NPS uses this policy to evaluate all connection requests that originate from any type of network access server. If the type of network access server is set to <maml:ui>Health Registration Authority</maml:ui>, then only connection requests that are forwarded from an HRA server are evaluated by this policy. If one or more enabled policies have a specified source of <maml:ui>Health Registration Authority</maml:ui>, then all policies with an <maml:ui>Unspecified</maml:ui> source will be ignored by NPS when processing IPsec-protected NAP client network access requests.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Troubleshooting HRA</maml:linkText><maml:uri href="mshelp://windows/?id=6c44027f-a214-41d3-b657-2b9e8d0ddac7"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Verify CA Configuration</maml:title><maml:introduction>
<maml:para>Use the following procedures on your Network Access Protection (NAP) certification authorities (CAs) to verify that these servers are correctly configured for use with Health Registration Authority (HRA) and the NAP Internet Protocol security (IPsec) enforcement method. NAP CAs are servers that have Active DirectoryÂ® Certificate Services (ADÂ CS) installed and running and can issue NAP health certificates. For more information about ADÂ CS, see <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=127816</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=127816"></maml:uri></maml:navigationLink>.</maml:para>

<maml:para>Membership in <maml:computerOutputInline>Domain Admins</maml:computerOutputInline>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Choosing a NAP CA</maml:title><maml:introduction>
<maml:para>HRA must be associated with at least one CA in order to obtain and issue NAP health certificates to compliant NAP client computers. You can select a CA during the installation of HRA by choosing to install the CA locally or by selecting an existing remote CA. You can also add NAP CAs later using the HRA snap-in or a command line. You must use the HRA snap-in or a command line in order to associate more than one CA with HRA. You can configure HRA to use either an enterprise CA or standalone CA. Configuration requirements for a NAP CA differ depending on the type of CA that you choose. You must configure CA security settings and certificate issuance requirements whether you choose a standalone or enterprise CA. In its recommended configuration, HRA is associated with a dedicated standalone subordinate CA. For more information about configuring HRA to use a NAP CA, see <maml:navigationLink><maml:linkText>Configure NAP Certification Authority</maml:linkText><maml:uri href="mshelp://windows/?id=af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a"></maml:uri></maml:navigationLink>. </maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Choosing a standalone CA</maml:title><maml:introduction>
<maml:para>A standalone CA does not use certificate templates. Therefore, you do not need to configure a health certificate template when you use a standalone NAP CA. If you choose a standalone CA, you must still configure CA security settings and certificate issuance requirements so that HRA can request and automatically issue health certificates to compliant client computers.</maml:para>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Choosing an enterprise CA</maml:title><maml:introduction>
<maml:para>An enterprise CA issues certificates based on certificate templates. The policy module is used to provide a list of certificate extensions to the issued certificates, such as system health authentication for NAP. If your enterprise CA is running WindowsÂ ServerÂ®Â 2008, then the System Health Authentication certificate template is available by default with application policy extensions suitable for domain and health authentication. If your enterprise CA is running Windows ServerÂ®Â 2003, then you must create and publish a template containing these application policy extensions. You can use the following procedures to verify that enterprise CAs are configured to automatically issue health certificates with the correct application policy extensions.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Verify template availability</maml:title><maml:introduction>
<maml:para>If your enterprise CA server is running Windows ServerÂ 2008, a certificate template for domain-authenticated NAP clients is automatically available with a display name of System Health Authentication. If your enterprise CA is running Windows ServerÂ 2003, this template must be created. Use the following procedure to verify that a NAP health certificate template is available with the correct application policy extensions, or create this template if it is not available. This procedure does not apply if you are using a standalone CA.</maml:para>

<maml:procedure><maml:title>To verify template availability</maml:title><maml:introduction><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:alertSet class="note"><maml:title>Note </maml:title>
<maml:para>If this certificate template is used to issue anonymous health certificates, do not include the <maml:ui>Client Authentication</maml:ui> application policy. Certificates containing the client authentication application policy are issued to clients that authenticate with domain credentials.</maml:para>
</maml:alertSet>
</maml:introduction></maml:section></maml:sections></maml:introduction><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>certtmpl.msc</maml:userInput>, and then press ENTER.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, under <maml:ui>Template Display Name</maml:ui>, review the list of templates. Double-click the name of your NAP health certificate template. If a NAP health certificate template is not listed, perform the following steps:</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Right-click <maml:ui>Workstation Authentication</maml:ui>, and then click <maml:ui>Duplicate Template</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Template display name</maml:ui>, type <maml:ui>System Health Authentication</maml:ui>, and then click the <maml:ui>Extensions</maml:ui> tab.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Extensions included in this template</maml:ui>, click <maml:ui>Application Policies</maml:ui>, and then click <maml:ui>Edit</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click <maml:ui>Add</maml:ui>, and then click <maml:ui>New</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>In <maml:ui>New Application Policy</maml:ui>, under <maml:ui>Name</maml:ui>, type <maml:ui>System Health Authentication</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Object identifier</maml:ui>, type <maml:userInput>1.3.6.1.4.1.311.47.1.1</maml:userInput>, and then click <maml:ui>OK</maml:ui> four times.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Confirm that your new template was created successfully.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>To verify your new template, double-click its name and complete the remaining steps in this procedure.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Extensions</maml:ui> tab.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>Extensions included in this template</maml:ui>, click <maml:ui>Application Policies</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Under <maml:ui>Description of Application Policies</maml:ui>, verify that <maml:ui>System Health Authentication</maml:ui> and <maml:ui>Client Authentication</maml:ui> are listed, and then click <maml:ui>Edit</maml:ui>. </maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>System Health Authentication</maml:ui>, and then click <maml:ui>Edit</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In <maml:ui>Edit Application Policy</maml:ui>, under <maml:ui>Object identifier</maml:ui>, verify the value is <maml:userInput>1.3.6.1.4.1.311.47.1.1</maml:userInput>. If the value of the application policy object identifier is different, then use the previous steps in this procedure to create a new system health authentication template. You should also correct application policy names so that the object identifier associated with <maml:ui>System Health Authentication</maml:ui> is <maml:userInput>1.3.6.1.4.1.311.47.1.1</maml:userInput>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Cancel</maml:ui> three times, and then close the Certificate Templates console.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Verify certificate availability</maml:title><maml:introduction>
<maml:para>On an enterprise CA, certificates must be made available before they can be issued to client computers. Use the following procedure to ensure that your NAP health certificate is available to be issued. This procedure does not apply if you are using a standalone CA.</maml:para>

<maml:procedure><maml:title>To verify certificate availability</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>certsvr.msc</maml:userInput>, and then press ENTER.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, click <maml:ui>Certificate Templates</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, under <maml:ui>Name</maml:ui>, verify that your NAP health certificate is listed. If your enterprise CA server is running Windows ServerÂ 2008, the default health certificate template for domain authenticated NAP clients has a display name of <maml:ui>System Health Authentication</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If the health certificate template has been created, but is not displayed in the list, use the following steps to issue the template:</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Right-click <maml:ui>Certificate Templates</maml:ui>, point to <maml:ui>New</maml:ui>, and then click <maml:ui>Certificate Template to Issue</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>In <maml:ui>Enable Certificate Templates</maml:ui>, under <maml:ui>Name</maml:ui>, click the name of your NAP health certificate, and then click <maml:ui>OK</maml:ui>. If the template is not listed, then it has already been enabled, or you must create it before you perform this procedure.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Verify that your NAP health certificate template is added to the list of templates.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Close the Certification Authority console.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>

<maml:section>
<maml:title>Verify certificate enrollment permissions for HRA</maml:title><maml:introduction>
<maml:para>In order for HRA to obtain certificates from an enterprise CA and issue these to clients, it must be granted permission to enroll the health certificate. Enabling autoenroll permission allows HRA to automatically add this certificate to its local certificate store. If only enroll permission are allowed, you must manually provision a health certificate on the HRA server. Use the following procedure to verify that HRA has been granted these permissions. This procedure does not apply if you are using a standalone CA.</maml:para>

<maml:procedure><maml:title>To verify certificate enrollment permissions for HRA</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>certtmpl.msc</maml:userInput>, and then press ENTER.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the details pane, under <maml:ui>Template Display</maml:ui> <maml:ui>Name</maml:ui>, double-click the name of your NAP health certificate. If your enterprise CA server is running Windows ServerÂ 2008, the default health certificate template for domain-authenticated NAP clients has a display name of <maml:ui>System Health Authentication</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Security</maml:ui> tab.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that <maml:ui>Enroll</maml:ui> and <maml:ui>Autoenroll</maml:ui> permissions have been granted to the DNS name of your HRA server, or to a group of which the HRA server is a member. If these permissions are not allowed, perform the following steps:</maml:para>

<maml:list class="ordered">
<maml:listItem>
<maml:para>Click <maml:ui>Add</maml:ui>, click <maml:ui>Object Types</maml:ui>, select the <maml:ui>Computers</maml:ui> check box, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Under <maml:ui>Enter the object names to select</maml:ui>, type the DNS name of your HRA server, and then click <maml:ui>OK</maml:ui>. Alternatively, you can type the name of a group of which the HRA server is a member.</maml:para>
</maml:listItem>

<maml:listItem>
<maml:para>Click the name or group you added, select <maml:ui>Allow</maml:ui> permissions for <maml:ui>Enroll</maml:ui> and <maml:ui>Autoenroll</maml:ui>, and then click <maml:ui>OK</maml:ui>. </maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Close the Certificate Templates console.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section><maml:section address="CA_Security"><maml:title></maml:title><maml:introduction></maml:introduction></maml:section><maml:section>
<maml:title>Verify CA security settings</maml:title><maml:introduction>
<maml:para>CA security settings determine whether HRA has permission to issue health certificates. Use the following procedure to verify these permissions on your NAP CAs. This procedure applies to both enterprise and standalone CA servers.</maml:para>

<maml:procedure><maml:title>To verify certificate security settings</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>certsrv.msc</maml:userInput>, and then press ENTER.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Right-click the common name for your CA, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Security</maml:ui> tab.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If your HRA and NAP CA are running on the same computer, verify that <maml:ui>NETWORK SERVICE</maml:ui> is found under <maml:ui>Group or user names</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>If your HRA and NAP CA are running on different computers, verify that the computer name for your HRA server is found under <maml:ui>Group or user names</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the name of your HRA server, or click <maml:ui>NETWORK SERVICE</maml:ui>, and verify that permissions are allowed to <maml:ui>Issue and Manage Certificates</maml:ui>, <maml:ui>Manage CA</maml:ui>, and <maml:ui>Request Certificates</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui>, and then close the Certification Authority console.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section><maml:section address="CA_Issue_Req"><maml:title></maml:title><maml:introduction></maml:introduction></maml:section><maml:section>
<maml:title>Verify certificate issuance requirements</maml:title><maml:introduction>
<maml:para>In order for NAP client computers to acquire health certificates immediately when they are determined to be compliant with network health requirements, NAP CAs must be configured to issue health certificates automatically. Use the following procedure to verify that certificates are issued automatically. This procedure applies to both enterprise and standalone CA servers.</maml:para>

<maml:procedure><maml:title>To verify certificate issuance requirements</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>certsrv.msc</maml:userInput>, and then press ENTER.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Right-click the common name of your CA, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Policy Module</maml:ui> tab, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Verify that <maml:ui>Follow the settings in the certificate template</maml:ui> is selected.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>OK</maml:ui> twice, and then close the Certification Authority console.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>

</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configure NAP Certification Authority</maml:linkText><maml:uri href="mshelp://windows/?id=af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Troubleshooting HRA</maml:linkText><maml:uri href="mshelp://windows/?id=6c44027f-a214-41d3-b657-2b9e8d0ddac7"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><?xml version="1.0" encoding="utf-8"?>
<HelpCollection Id="hra" DTDVersion="1.0" FileVersion="" LangId="1033" Copyright="Â© 2005 Microsoft Corporation. All rights reserved." Title="Health Registration Authority" xmlns="http://schemas.microsoft.com/help/collection/2004/11">
	<CompilerOptions CompileResult="H1S" CreateFullTextIndex="Yes" BreakerId="Microsoft.NLG.en.WordBreaker">
		<IncludeFile File="hra.H1F" />
	</CompilerOptions>
	<TOCDef File="hra.H1T" Id="hra_TOC" />
	<VTopicDef File="hra.H1V" />
	<KeywordIndexDef File="hra_AssetId.H1K" />
	<KeywordIndexDef File="hra_BestBet.H1K" />
	<KeywordIndexDef File="hra_LinkTerm.H1K" />
	<KeywordIndexDef File="hra_SubjectTerm.H1K" />
	<ItemMoniker Name="!DefaultTOC" ProgId="HxDs.HxHierarchy" InitData="AnyString" />
	<ItemMoniker Name="!DefaultFullTextSearch" ProgId="HxDs.HxFullTextSearch" InitData="AnyString" />
	<ItemMoniker Name="!DefaultAssetIdIndex" ProgId="HxDs.HxIndex" InitData="AssetId" />
	<ItemMoniker Name="!DefaultBestBetIndex" ProgId="HxDs.HxIndex" InitData="BestBet" />
	<ItemMoniker Name="!DefaultAssociativeIndex" ProgId="HxDs.HxIndex" InitData="LinkTerm" />
	<ItemMoniker Name="!DefaultKeywordIndex" ProgId="HxDs.HxIndex" InitData="SubjectTerm" />
</HelpCollection><?xml version="1.0" encoding="utf-8"?>
<HelpFileList xmlns="http://schemas.microsoft.com/help/filelist/2004/11">
	<File Url="assets\332915ab-0a04-4c93-87ae-6b773aa4d3e8.xml" />
	<File Url="relatedAssets\79e2ebfc-4b95-4a2c-9b71-fa3dc074046c.gif" />
	<File Url="assets\4214362f-4d30-473a-b95b-a2130ba5c1fc.xml" />
	<File Url="assets\6c44027f-a214-41d3-b657-2b9e8d0ddac7.xml" />
	<File Url="assets\79885c91-4bc7-4c5a-b663-6140d242bf75.xml" />
	<File Url="assets\7a14e840-7d24-402f-9777-6b98e830864f.xml" />
	<File Url="assets\ae5d5d44-7a46-4daf-88c1-af580519bdeb.xml" />
	<File Url="assets\af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a.xml" />
	<File Url="assets\c1916806-39b6-441a-9d1f-1c789e04e84e.xml" />
	<File Url="assets\ca01fd62-4e6b-48d7-9d8c-65fc3f94379c.xml" />
	<File Url="assets\cfece017-37f4-4c97-9bb7-e08cd49150d7.xml" />
	<File Url="assets\d3b2e920-86ee-4671-a273-60a818d77520.xml" />
	<File Url="assets\d87d5168-61b8-4c8e-988a-365a653696bf.xml" />
	<File Url="assets\d9933a4d-3059-48ab-b303-3e3fbd09912e.xml" />
	<File Url="assets\ed2a5c7e-dfa5-4354-8e41-e12e28d57189.xml" />
	<File Url="assets\ffe5b00d-9333-4ecb-a880-608817d37b62.xml" />
</HelpFileList><?xml version="1.0" encoding="utf-8"?>
<VTopicSet DTDVersion="1.0" xmlns="http://schemas.microsoft.com/help/vtopic/2004/11">
	<Vtopic Url="assets\332915ab-0a04-4c93-87ae-6b773aa4d3e8.xml" RLTitle="Verify NAP Client Configuration">
		<Attr Name="assetid" Value="332915ab-0a04-4c93-87ae-6b773aa4d3e8" />
		<Keyword Index="AssetId" Term="332915ab-0a04-4c93-87ae-6b773aa4d3e8" />
		<Keyword Index="AssetId" Term="332915ab-0a04-4c93-87ae-6b773aa4d3e81033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="332915ab-0a04-4c93-87ae-6b773aa4d3e8" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="relatedAssets\79e2ebfc-4b95-4a2c-9b71-fa3dc074046c.gif">
		<Keyword Index="AssetId" Term="79e2ebfc-4b95-4a2c-9b71-fa3dc074046c" />
	</Vtopic>
	<Vtopic Url="assets\4214362f-4d30-473a-b95b-a2130ba5c1fc.xml" RLTitle="Understanding NAP IPsec Enforcement">
		<Attr Name="assetid" Value="4214362f-4d30-473a-b95b-a2130ba5c1fc" />
		<Keyword Index="AssetId" Term="4214362f-4d30-473a-b95b-a2130ba5c1fc" />
		<Keyword Index="AssetId" Term="4214362f-4d30-473a-b95b-a2130ba5c1fc1033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="4214362f-4d30-473a-b95b-a2130ba5c1fc" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\6c44027f-a214-41d3-b657-2b9e8d0ddac7.xml" RLTitle="Troubleshooting HRA">
		<Attr Name="assetid" Value="6c44027f-a214-41d3-b657-2b9e8d0ddac7" />
		<Keyword Index="AssetId" Term="6c44027f-a214-41d3-b657-2b9e8d0ddac7" />
		<Keyword Index="AssetId" Term="6c44027f-a214-41d3-b657-2b9e8d0ddac71033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="6c44027f-a214-41d3-b657-2b9e8d0ddac7" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\79885c91-4bc7-4c5a-b663-6140d242bf75.xml" RLTitle="Configure HRA Transport Policy">
		<Attr Name="assetid" Value="79885c91-4bc7-4c5a-b663-6140d242bf75" />
		<Keyword Index="AssetId" Term="79885c91-4bc7-4c5a-b663-6140d242bf75" />
		<Keyword Index="AssetId" Term="79885c91-4bc7-4c5a-b663-6140d242bf751033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="79885c91-4bc7-4c5a-b663-6140d242bf75" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\7a14e840-7d24-402f-9777-6b98e830864f.xml" RLTitle="Checklist: Deploy NAP IPsec Enforcement with HRA">
		<Attr Name="assetid" Value="7a14e840-7d24-402f-9777-6b98e830864f" />
		<Keyword Index="AssetId" Term="7a14e840-7d24-402f-9777-6b98e830864f" />
		<Keyword Index="AssetId" Term="7a14e840-7d24-402f-9777-6b98e830864f1033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="7a14e840-7d24-402f-9777-6b98e830864f" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\ae5d5d44-7a46-4daf-88c1-af580519bdeb.xml" RLTitle="Overview of HRA">
		<Attr Name="assetid" Value="ae5d5d44-7a46-4daf-88c1-af580519bdeb" />
		<Keyword Index="AssetId" Term="ae5d5d44-7a46-4daf-88c1-af580519bdeb" />
		<Keyword Index="AssetId" Term="ae5d5d44-7a46-4daf-88c1-af580519bdeb1033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="ae5d5d44-7a46-4daf-88c1-af580519bdeb" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a.xml" RLTitle="Configure NAP Certification Authority">
		<Attr Name="assetid" Value="af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a" />
		<Keyword Index="AssetId" Term="af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a" />
		<Keyword Index="AssetId" Term="af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a1033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\c1916806-39b6-441a-9d1f-1c789e04e84e.xml" RLTitle="Health Registration Authority">
		<Attr Name="assetid" Value="c1916806-39b6-441a-9d1f-1c789e04e84e" />
		<Keyword Index="AssetId" Term="c1916806-39b6-441a-9d1f-1c789e04e84e" />
		<Keyword Index="AssetId" Term="c1916806-39b6-441a-9d1f-1c789e04e84e1033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="c1916806-39b6-441a-9d1f-1c789e04e84e" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\ca01fd62-4e6b-48d7-9d8c-65fc3f94379c.xml" RLTitle="Configure HRA Cryptographic Policy">
		<Attr Name="assetid" Value="ca01fd62-4e6b-48d7-9d8c-65fc3f94379c" />
		<Keyword Index="AssetId" Term="ca01fd62-4e6b-48d7-9d8c-65fc3f94379c" />
		<Keyword Index="AssetId" Term="ca01fd62-4e6b-48d7-9d8c-65fc3f94379c1033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="ca01fd62-4e6b-48d7-9d8c-65fc3f94379c" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\cfece017-37f4-4c97-9bb7-e08cd49150d7.xml" RLTitle="Verify IIS Configuration">
		<Attr Name="assetid" Value="cfece017-37f4-4c97-9bb7-e08cd49150d7" />
		<Keyword Index="AssetId" Term="cfece017-37f4-4c97-9bb7-e08cd49150d7" />
		<Keyword Index="AssetId" Term="cfece017-37f4-4c97-9bb7-e08cd49150d71033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="cfece017-37f4-4c97-9bb7-e08cd49150d7" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\d3b2e920-86ee-4671-a273-60a818d77520.xml" RLTitle="Configuring HRA">
		<Attr Name="assetid" Value="d3b2e920-86ee-4671-a273-60a818d77520" />
		<Keyword Index="AssetId" Term="d3b2e920-86ee-4671-a273-60a818d77520" />
		<Keyword Index="AssetId" Term="d3b2e920-86ee-4671-a273-60a818d775201033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="d3b2e920-86ee-4671-a273-60a818d77520" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\d87d5168-61b8-4c8e-988a-365a653696bf.xml" RLTitle="Understanding HRA Request Policy">
		<Attr Name="assetid" Value="d87d5168-61b8-4c8e-988a-365a653696bf" />
		<Keyword Index="AssetId" Term="d87d5168-61b8-4c8e-988a-365a653696bf" />
		<Keyword Index="AssetId" Term="d87d5168-61b8-4c8e-988a-365a653696bf1033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="d87d5168-61b8-4c8e-988a-365a653696bf" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\d9933a4d-3059-48ab-b303-3e3fbd09912e.xml" RLTitle="Understanding HRA Authentication Requirements">
		<Attr Name="assetid" Value="d9933a4d-3059-48ab-b303-3e3fbd09912e" />
		<Keyword Index="AssetId" Term="d9933a4d-3059-48ab-b303-3e3fbd09912e" />
		<Keyword Index="AssetId" Term="d9933a4d-3059-48ab-b303-3e3fbd09912e1033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="d9933a4d-3059-48ab-b303-3e3fbd09912e" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\ed2a5c7e-dfa5-4354-8e41-e12e28d57189.xml" RLTitle="Verify NPS Configuration">
		<Attr Name="assetid" Value="ed2a5c7e-dfa5-4354-8e41-e12e28d57189" />
		<Keyword Index="AssetId" Term="ed2a5c7e-dfa5-4354-8e41-e12e28d57189" />
		<Keyword Index="AssetId" Term="ed2a5c7e-dfa5-4354-8e41-e12e28d571891033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="ed2a5c7e-dfa5-4354-8e41-e12e28d57189" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
	<Vtopic Url="assets\ffe5b00d-9333-4ecb-a880-608817d37b62.xml" RLTitle="Verify CA Configuration">
		<Attr Name="assetid" Value="ffe5b00d-9333-4ecb-a880-608817d37b62" />
		<Keyword Index="AssetId" Term="ffe5b00d-9333-4ecb-a880-608817d37b62" />
		<Keyword Index="AssetId" Term="ffe5b00d-9333-4ecb-a880-608817d37b621033" />
		<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
		<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
		<Attr Name="appliesToSite" Value="BWCOnly" />
		<Attr Name="CommunityContent" Value="1" />
		<Attr Name="WillHaveMamlFeed" Value="True" />
		<Attr Name="zzpub_assetBug" Value="1728" />
		<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
		<Attr Name="zzpub_MTPSVersion" Value="11" />
		<Attr Name="Locale" Value="kbEnglish" />
		<Attr Name="AssetID" Value="ffe5b00d-9333-4ecb-a880-608817d37b62" />
		<Attr Name="TopicType" Value="kbArticle" />
	</Vtopic>
</VTopicSet><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpTOC>
<HelpTOC xmlns="http://schemas.microsoft.com/help/toc/2004/11" DTDVersion="1.0" Id="hra_TOC" FileVersion="" LangId="1033" ParentNodeIcon="Book" PluginStyle="Hierarchical">
	<HelpTOCNode Url="mshelp://windows/?tocid=e6634fa2-498d-4ae1-8eb2-88654bd60ee7" Title="">
		<HelpTOCNode Url="mshelp://windows/?id=c1916806-39b6-441a-9d1f-1c789e04e84e" Title="Health Registration Authority">
			<HelpTOCNode Url="mshelp://windows/?id=ae5d5d44-7a46-4daf-88c1-af580519bdeb" Title="Overview of HRA" />
			<HelpTOCNode Url="mshelp://windows/?id=7a14e840-7d24-402f-9777-6b98e830864f" Title="Checklist: Deploy NAP IPsec Enforcement with HRA" />
			<HelpTOCNode Url="mshelp://windows/?id=d3b2e920-86ee-4671-a273-60a818d77520" Title="Configuring HRA">
				<HelpTOCNode Url="mshelp://windows/?id=d9933a4d-3059-48ab-b303-3e3fbd09912e" Title="Understanding HRA Authentication Requirements" />
				<HelpTOCNode Url="mshelp://windows/?id=d87d5168-61b8-4c8e-988a-365a653696bf" Title="Understanding HRA Request Policy" />
				<HelpTOCNode Url="mshelp://windows/?id=af9c4178-10a6-4c02-b9b3-5d6a7d3cd20a" Title="Configure NAP Certification Authority" />
				<HelpTOCNode Url="mshelp://windows/?id=ca01fd62-4e6b-48d7-9d8c-65fc3f94379c" Title="Configure HRA Cryptographic Policy" />
				<HelpTOCNode Url="mshelp://windows/?id=79885c91-4bc7-4c5a-b663-6140d242bf75" Title="Configure HRA Transport Policy" />
			</HelpTOCNode>
			<HelpTOCNode Url="mshelp://windows/?id=6c44027f-a214-41d3-b657-2b9e8d0ddac7" Title="Troubleshooting HRA">
				<HelpTOCNode Url="mshelp://windows/?id=4214362f-4d30-473a-b95b-a2130ba5c1fc" Title="Understanding NAP IPsec Enforcement" />
				<HelpTOCNode Url="mshelp://windows/?id=332915ab-0a04-4c93-87ae-6b773aa4d3e8" Title="Verify NAP Client Configuration" />
				<HelpTOCNode Url="mshelp://windows/?id=ffe5b00d-9333-4ecb-a880-608817d37b62" Title="Verify CA Configuration" />
				<HelpTOCNode Url="mshelp://windows/?id=ed2a5c7e-dfa5-4354-8e41-e12e28d57189" Title="Verify NPS Configuration" />
				<HelpTOCNode Url="mshelp://windows/?id=cfece017-37f4-4c97-9bb7-e08cd49150d7" Title="Verify IIS Configuration" />
			</HelpTOCNode>
		</HelpTOCNode>
	</HelpTOCNode>
</HelpTOC><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="AssetId" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="BestBet" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="LinkTerm" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="SubjectTerm" /> evy`!VU¿?îë‚ûT]¡"9îÕ¶¤JS!UjJ(hU° „æ©$Ú”¤¢Ù¦¦M+Ó…
ŠB‘š£°Ö½ïÑ+#»,ÀügÞúÛïóÜÏãýsî{Þ$HA„‚¡]Ü7k‰¤°
aY„è-šAÙ°#†Xf&=¬!Ðèô`¢ Ù£ý€` #"Ý„3ÿË6>árA  ¹¼ÒÌUÏóßé[Î{x»ôuî¯þÅj/Ó#òµ/?Öâõ÷øOÐoU¿7{÷ëƒ˜
ÞÅ¿gˆéÝZ_í‘ëûüá€µ¸íÞ æþñ‹Ó¼ÿV Ÿ¶áÖú~ÿÃCömýí.~¦ïû]‡š‘w¼ç¾í§ó‡Iïó§ºëƒ˜
‡ÞÅ¿Ñ‘ßÏðoóõî²öú¿þw¿ åÞ WùÞð_2wŽýçéýºy»÷ÐÏœÑyœ·óo ö9ó9oó¾?Ú½Qó§s
ç½þDÓû÷y7Ó/'õÞ-çzwúûÌ7õýóë¡®÷¼÷-üCüËÐ«¹¸Í~³¤;ÿà~„?&·î×ùº‡üÂW«ýw¶Þ/øMw¿’Ÿ“ÏÏó×	c~î€—¾9ÙîïÜ·³ïžðö»¯»/}ùà-¸üïô<ïqëà^K?½ËOã.Óû¦óg÷ Ü~È8ù—ùgÜçñm>ÿo»yíôC¾çôÛîŠ/ò+>Òoø|Þ6s¾çGi+wýWšíÊgú¦$ßtáäÛI¼ñÀ&ÉÙý¶g7í¦}òŸœ”oål~çmþ~ú§çúîç†n¨òSÎÊ»9·ïVÜ+{åÙ±¾ýÛµ›åG=‚oêÙ~Ûæ£õä,¾—úÞèÄ¿§žÄ·Ç›ê–9ªß¹ùŸ=ÖOÄ½öWßOâÛoõ'7é¹YOýxÝÖƒñ¼x_ýÓü„}Në»xžCçžÒæ»èäXþ+þ<ïŸã|ïõ¯oytíÈ<“8o¨Ü`_ÖÙûu¿Úa]øÃ~Ø¯¾¶_;k±Ûå‡]._<óóÙÞ»0³_µéÿòƒâë³óµ|
ÏÇt+,¿ÙSh??]9ˆç–ÝT{æcšwunß½óe|JÏ&D»ëÏ~¸³Ä~
ô×|;‰¾Þ¯ƒ6Úv¼…¾Ú¯¹vü
¾c³Õë•Ÿè†¾_ÏÑ×ûu×fëµÍ÷Û~ïµú¿6ÚnwéœñmóoH_ûýu6}ý_'m¸=vû~Ü¯»v¾6¯•¶Ü•»aüßÜ	g¦¯ž_K×M›îX^ÑÛéqîÁµàkóõ®]®2³uk›ê“À=gÔ×óu®½_×RÛîs]S_î×]û‚np³y5é_õÍ3«V_ï×k>Æ÷ñn½ýu{ßùÜÞM¹{ûòû¼Ñþ9ßÑ³»oßý@ÎÐÃ‘x-ô¡}ìc»è¾}lcûèHúØÇN»ïJúØÇ^6Ó›>ô±íØƒ~úÔÇ>6±£-õ©}ìcS»êVýØkûxé«ƒúì¾³±vëÎúÍÎï·ûwŸlíÚ¹zwçÞnÙümçøÝÎ-»ß{ðË®w}nïînÂ}w…ßïÜ¿[¹
nÂ>üüç|cÏFÄwgâ3xvßíÜŠûñ¿ä¹~7s3îÈnü’çøÝÏí»'ûñÝ›ùUÎ
ªA{½
sëUœûU“G~”s¯jlÉZåÉ—àì.µûÁüˆ×¦Ô-»òý^»©Ç¶|_Îv©ž-W€ìËZæó«=R›ùÕž|©ÎÖ©mÞ|oÎ|©Îæ©uî|yÎ|©Îö©{þ|…Î}©Î©=v+úRœ¥[ôž:ô¥:{¥¾›ô>úR]RsmúŸv©ŸM©>}½Î}©ÎF©ÁN}ÅÎ}©ÏVÔ›¯¾Ðg_jÆY©S]vQŸ}©În©Ëv}±Ï¾Ôg¿ÔjÃ¾lg¾ÔgÇÔn6»ãÎv©}RÏííi|Úí¸ìCÙ‡´¯Èyn¸åKg;¼í]j»öÛ÷~Çíßn~»ÜýÜ¹ZãÇ½Ýð}ÈýÖc÷ïsæ{î©¿Úw¸ÓO×]N÷ý—wØ÷q÷ûmà]sï»ošÇÐÃïä¼?Þý¸¼cï¾;úáðæ?¿‡<CðÁ<ð(ÃÃH<CñÅ<ñhÇÃtí ^ò‘÷H$b2&÷Úî
}ûÿäqMüÿy1ì8×§Õè_çÿ?3Ë)‡3Ð:¥ú§Ã½š×á~µ/WÓ7¢ÞvóñO×ÎpüX¾îüÿî9È¿K]Ó¾•¼òð{wº”ç§)óÓ:¥t†Q§”ÎYêÒ:OªSJg\uNéï)ÒÙ_S:g¬uJéœO”ÎYëŸÒÖ)¥ó>S:³à>¥:®SJg&|§tçÂ|Jt6Ã§JçF|§tÎ]ø”éœŠO”Î¼øOéÎŒø”éÜŽO”ÎüøOéÎë”ÒÙS:sä>¥:KäS¥ó;§tgÊvJé•O”ÎlùNéÅò)Òù1Ÿ)9óŸÒ5ó)Òy9Ÿ)¹óŸÒ=ó)ÒùAŸ)óØ>¥:‡èS¥³>S:3é>¥:—éS¥³&;§tçÓ}JtFÔ§JçV}§tçÕ}Jtfe§”ÎÜúOéÎ®ú”éü°O”ÎûNéÍÙ)¥óF;§tÎií”ÒYeŸ)yöŸÒiÚ)¥óf;§tÎmû”é\¶O”Î|ûNéÝÛ)¥ó†;§tgÜ}JtÎq§”ÎYîŸÒu÷)ÒyyŸ)óÜ>¥:÷ºSJg\wOéÎ¾î”ÒÙßS:óï?¥:¼SJgœwNéõÞ)¥óæ;§tÎ}ï”ÒÙ&œ§tÎð”ÒžS:gÁxJé<	O)sá<¥t6‡§”ÎñžÒ:'ÅSJg¼xOéã)¥sv<§tÎò”ÒGžS:gÉcJ)é,çIeJ)óä§Nþóö
/Þ‹âÅxñ^¼/Å‹ñâ¼x/^‹âÅxñ^¼/Å‹ñâ¼x/^‹âÅxñ^¼/Å‹ñâ¼x/^‹âÅxñ^¼/Å‹ñâ¼x/^‹âÅxñ^¼/Å‹ñâ¼x/^‹âÅxñ^¼/Å‹ñâ¼x/^‹âÅxñ^¼/Å‹ñâ¿xrÿ¥—~o85ÐGC4tz|=4ìÃwGøhhüø|4‚C>
C¤ÈG£¡˜ôðh†Ã‘éGÑP\ú~4
™$†Ã’ÉG£¡Øôùh4<¢|?†NÓ£áõùh4Lª|>
Waà££aåðÑÑPŒú~4
¥©GÃêúÑ4¬~
Ã«ëGÑÌú~4
µGÃëúÑ4ì½~
†-×£áöýh†b?†C—ìGÑpøòùh4„Æ|?†d™GCáÌæ£Ñ,û~4
Í³GÃaÍö£hˆ¦ý?†jÚ£áÈöýh¶n?†C›íGÑð„û~4
ã¹GCáÍ÷£h8Òý>
q9†CîGÑ°¸óýhÚw?†CžïGÑÌû~4
õ½GÃaÏç£ÑÐøóúh4}>
…C†C¢ÑG£aÈ÷úh44}>
‘I†aßé£ÑP¸ôúh?d™@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@~@ãëvü_mÓèaÑ€`À0À€0`€`À0À€0`€`À0À€0`€`À0À€0`€`À0À€0`€`À0À€0`€`À0À€0`€`À0À€?`ü4¿o¥ÍeOýÜí…“ò»_Mà£ñ¾éï¼}—›ü·ðê¿÷?pÚÑœ?©ë¯À›âÎOO9óîMoªW¹ôû¦j•ûÒñ›rî’Žß´ÍrõÝ.8WÃô·õ¾:NðX=åŽ{œ“N9Ça^I§ã1g¡S¸èáé”Ãßü[ÿ(–Ó?zß™²Ã;ËMö£ç±AŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bŒ#FˆbÄ1FŒ#Äˆ1bíÿ©																																																																																																																																																																																																																																																														z	:LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLcÜy2dC†!dÈ2†!CÈ2dC†!dÈ2†!CÈ2dC†!dÈ2†!CÈ2dC†!dÈ2†!CÈ2dC†!dÈ2†!CÈ2dC†!dÈ2†!CÈ2dC†!dÈ2†!CÈ2dC†!dÈ2†!CÈ2dC†!dÈ2†!Cÿ¾kô_»„þD·Üý”ßÊŸ®îø«qp¦9÷£üþÿ¤.\m'.ÜÂ…pá\¸.…áÂ¸p.\Â…pá\¸.Œ.Üp3\¸.…áÂ¸p.\Â…pá\¸.…áÂ¸p.\pq\¸.‹¸8.\Â…pá\¸.…áÂAè¾Ãe¬Ð»ë.…áÂ¸p.\Â…pá~¸{ÜËÃ…êÐ[ì.…áÂ¸p.\Â…pá\¸.…áÂ¸p.\Â…pá\¸´cÒQ;õû–0áÛûÍ6íÏ®Žµ;ØûhöQíÃnÇ¼w÷Gîq}ÈûÐ÷±¹ƒ\íºcêø>awÇÝ›ßúãï~½#öà;£ïm¿ØyMx¿û<CðÁ<ð(ÃÃH<CñÅ<ñhWÛòÈ$13ÿäöÜi¸{.\á*WqÅ4
MÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MOÓÜmýtÖ!µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÛV¸¶ŠÛŠÏiš¦¦iÛžl¸¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦íi»ä¶«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶ÚµÝrÃµÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[µÕ[mÕVmµV[¶Õ®í~?Ÿµ4MÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓö4òßÍŸão¿}önþ}'¿þön‰oßáæ¸p.\â*,Ëåÿ&.¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú«Új¶j«¶Ú·qm·ŸÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MÏ÷ ÑòR4MÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÛ64MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ44MMÓÓ4~O”Ÿ¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¶iÆÝ¦Éišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iišš¦¦iùž¯ñ¼,M£Ó46M¸Ûàó×9ùc½^øÛ41bì@àì	àßÝvõÐídü’ÑJrŒ²’Z&–Ý´i´ÑmÓŠZ¤BVmÛp4¦nÓÝ!lµgnñ˜ÎtÍìž·÷6¾ß4ü33XCuig>	ûûßÜçw<Ÿù¾ß|K}ðˆ.$@â{éê+#ë8qˆRádT¢æ’-+Y•ÂÙs"#+ßIjîÂÔfÿhc·íæp¯#€Ž«ÉîÜMofÅ-ušhâm„ÊÿvoÜ•'a¡#›&Ð¿m…ðY	ÀÕŒœTUg?ÞØ<åŽuºœwYÕ%,4û’]‚(üR,æý“É¾@t‡’ ¨ŠÓ£xÄôpf8
ÌðútÒÅ÷&™õ÷WÉ)îS©jiÝû)ÿÉ<ýþCËç-k†ŒZñÒÇæeñÄÑtBáMÙøñÅ~x^Ë¸,„»ÖãOnoûø½Žÿ
öGÏº¡@¡ÌzU”~±'|&@B¾†¾
u;éœûçÇ¼‘Ã¿è/³‹¿Ç³û„›'Úr{tºñ‡Òu‚ƒ+òø½Kv/¤7~\
²ý§T\õ×½__÷Gù:}B`‹ö‹Â,;G#yÅž]þüBÄŒy)·ˆ+=„ÝË–?¤<2Z‹§²ÉþÐ×`ºàÏÕÕ¡¨¦ÅþGwêæwŸûPsù‰¼_³=‹R.Im+ÿÃfzl¡y3[bÜ×ºÐà?¥3ûAÆ@ÿ±IõËRNpAqfü3ËÓöNs#†‰ËUëÄÏD£¶ò¯Ñ?ÿ%>LA$ÛßûÀ•Ð(ø"ß¦æCDi”áŸ
t[ÃÎ¤´Ö†?”?ï-C»'Øõc\2â@qI„5G“çè€ä¹²i…uÎÜí]@„Îb-`^Ýø®ÉN‚5Îüí ï_¼=Vº¿þßùï‰²C¬‚ý@tn?wOÚÌ6PtàR²œb/ØN/£A\Zs+æ®¿&*QÀBþÕ<H‹¸ ð3ÏjÆ?Òìº\3K9öÿ,&®TºúX"˜ØƒOG\5=•¹I‹KA À^ÙŽåNÝCá#]Ì¶Öï¤r‡Û´R"âÊ"æ"ï¤c’á«¸]Y–Ê²e‹´[Yã|¤W@ÚTÅuï¶3iv‹0\ oìÔôèu*Ía¶´¤í9!{ÀDË.NPüñZ*‹9dfºðŒ¶–õ³'ƒÚxžíP5‘+Z£”6æ‹TÔÊxŠCƒÒ–ƒ¡fk‡ïx3tŠ»U‚ÜÀrãTÇQ(§œ8Ps¢æMRôø¬¥C$ùøé€)×ìsÆVh?úg7Å
a€dqMºçjÿ˜›<VIÞ0Î¯/õùæˆè ñ"ƒ¸.U»|:¶öqå9³bY¬×²1Ö§8[a]
güxçÌß®Í‡¥œäb•‚ï°&lê^œ¯<F7¼÷*àÔ‚ãÈXi‹ÔTåØØk4UD¾ ¦vFnêèŽÚ°ªX§®q•rÎâ“Ïz‚«Í—ò†~*”^K\UéÉ*Œc‡'ìÖâr÷€Ä\ê®}ëyý˜1@·j†	cO¦þ[mò‹ånŒ(M+!‹Ô üÙ¿+Z6öUž'“‰Sjq6ZìŽÕ?ÞíUxrEÀLÝôúÎü3Ã
ý´qsóîºÎì²×nþš{·Í˜d’Â6ó‘ÞªI7‚2ˆÐÚÞn·ÑnJà¶¥Â1PFø²[ÀØ8ihB¬ÖÁqþ”òÒ» ý[9Éo
5áð¸ò®Eº8€fã¬LŽtÊ‹pÌòÌV •]õ¯’&²cgW	ô¤ÜûF@µŸÿ4Æò~r”™æZçHSh¿~ùd_RÎðÛ†ì‘ Íìƒ=Ä,ì›¶0]Àz¢ˆ«P,®áÕ²¼*ýÄ²‡Qœ¦±ÐM-Æ?C-ûìÌÈuŸ¬%šu¯¤A^ã‘i°À)Mùj—WULk
=½Ì&¹òÁú¬&X&I“UW†-×K¿:åpg2._ABA8b]:ÑGrþlqÛSyÆ–¤à@ñq1óÔkcbMz\ÉÜ	«ˆï¶ýÃå1E^ˆò
i¼eÃ 6Oä	OÔ‹ÍeÒl…‘|jïjOÎÂ2üZ
»4îúØ·.Èr‹’6$}AìhrG·ÌÒ_7±
ÍÖþa£?‘gyå©ˆB
[1T{†•]ÿÖ›¢"G3Ðë)øKÙ†”Ž3ÈZ:»ñœÿê]£é·\1S«Ý˜–/†º…1ZÈ]N¬yüÍ¢¬Ž¦ÝT14
v¬†ïÕ5Á&9¦´i7t¿µDX‹Wš„0»&wq±8±2œcô¦$%~UcåCÂ[¼Q1‹÷=þÖæ':~×*AËª]ìÞJ:Ç¿KÂAivLT¶i1p»‹|xž&œ&ÀFRÔ+ë¶M±·¤Äfhð|\Fÿ¯Òt['®4Hú-œàu£3¨-0Ç°"–—Þpq‹B Puµ£ÛÈ“%þ¸BÜfEÆj©ÒHíUÇaRA’œ¹ZÊÒÝšËÚûCÝ±Û6ôÙ9ä—çëÛÑöv]Ïý³Nkšu£isÈïíž Á ¯¹\qeÁ3^äY¹«K6T¿xwñ7˜›ÝŒv4²ûyÝÿE'W¨vC]ÄæÞ?úQ!L~JÿlÀ¾qIãøeŒü§Q&E^â#uOGˆ
,BÏ^Çˆ‰¿öÅiÒçÍÃÝ&n‘}1n8™ƒ³ÅÜšg¢Œø¬¾§½¿²ÓB€ØóSD«ä<1K¡1â_W7;g¾ƒýUÿ¥l£|©$œ•Úì¨ÆÝúä^ún°Ýì=£¥3å÷–Ê~>¿;[¢xHùä¹ŒÅ‹Ð˜A«:N³ƒÉˆ¨Á“çæjoD	š“ºpåM^dÔ…}PB¤ŠmÔî¦…ÜDåvÜr"âÜž¨µºSÇ'i' Žl´°·@×Zî¼&ÓÌ¥Ç;Ò™¯šæVã…t¬ŠbÆu~¥´p
#‰‚\’åÄx–˜ˆ€íƒîÌ_6r§€ùó›8Fö"(‘çµ•Ñ”$ò]G”Zƒ=îvo¤¹Ž±e¸èñ,©RÕ„e%ë?Ž±™ŸÙiÎã5æ|üIyÅ´
íÎÍ%Ù¡èû§.&ã‰¬öÉ¾Å'©ŸŽÏæîê~’ö»»g&×Fr°Æ{ÐÝ~ý1+÷°;%ÀŠ@ñ$¯ÖYlœÅŠ¢[€@>GzW.`ŒÞÂ/|Á£xgY°¾šø†ðš’{¡»a”—Í£ÏtÏÄ®ûÏ
Â?„×AÏö0°Q!_¯¬è©Z1¼mvSØé†¦-ÞqwÃy[oÐzýfûßaG8il&÷FáP=æéŸM?Ñ;6©£¶íû×šü¹F½MÚÝìŒüq~›¯‘ãç\¶øHÌ©ƒÛF F
9½¨´\Èäoò&6£ä*GYKœQ7QÅ7¾Y.à}4™ÊÃÍNqAËð!jË]¯¶yBÙÃ »‰Q:,Ë¦ŒÖOÝ$ÆšÃãØ©lEiÇ´Êç‚¹Êþó’|Y_ µç»0b‡#!Fê…ž8ÉwNÒ&ºÉúLO‡p›TB¢b¨©Ü¶Bãx/h‘TÂ:qGE¢'7GZn3
„¬jGNéŒr„ƒn	‡tµ”rNFFg¥¯Ò)”í™gUùû¨£ÇOe9–ôªvŠÞq“B¬êHnIÒ$ ãýší[gÏˆÅD[æ3Ôî¡ûw¸èÇ;€ð³!@øï¾Ô›žd"kÜº¼'ELíbpc<–éÒæI_±«xYÒR-m;:M‡¶ÑjÝfesô#ëeÚsí;ºG‹S¸îX–ß¤¾ÞðSð‚{m`æªò,·9åÅYg_òCï¹½q.òåïn´,¢·£eŠ
ap{ekó¾ÂNº8¸ƒÙ£q«à®Q1ô¹€¶í8\0ŽGH–*6\
N`?O6'¦vT‚ÆZS¤w2ó)¹r|›ûÞö”ƒ €lá
@ÖåæR—|¥jL(Êì‘†RÊÚqX´gD‰ž$þY€§}×gÂõYô
Œ¾Jö‚·ÉÚˆž°´·¹E:¯€ñ¸'}?u°#¨;åñ‹ÊøM$v
<¶±Õ
þÕbç J¦Oùoiõ<þåKAâü/ÃT¹ëÁY¿ò°K56F~™>>Ñ¿Í‚\Žøµf§´Wj ôóuýë<õ®ì*ì5……›€{Ð\ýÌ;ê¾ìfxçVêÚÜ£èÆÀS©R±w>½¸öÚZ÷»ÓO!‰RnFß®ÒÃÃÏˆOÅâÀEr;Ö>üß†ŒXÒ½> %5Àu«²ÍÃÎ† £`{¾¥åRT%–òr}îÝï\#0ÈøèPÙŒ	¸ÿj¬=íCá“¥/	!mã©|~”5…»õÙ Ã_çÿnã`’)º¯B1Ø´³(Iî¢Rh¥Ó½Ëí´YÍeÀÏÊ8¢ÛÐ£/ÏNÍâÏq'î–«:¹T-èëôxõB›&p6l™)F½+X´öÞëÅÛ“·`·¯[i@)‚×q·¤ä3.t ::ÇÖú[)ºó’ Öí3þ0=–e-Ú…"KR+(p¶YÞ'ÝFö55å†-ÐåqÃ„«âÍ‚ªrt¿Vñß-ÄdÓx.üF¨¿/Øt¦Læõ²~4¤·\F»‘ÔDj.c«ù
ŠïQf±³†úý¸ª‰kd;e‰.æÔ]sULPw”SGÍ«š»â¿ßžÍ‘®sÕi;ÌMî2"E§@k“††¼nê¨»ïcÝ;Ùû —öUÂ"èšXüF]ˆ
ˆ}ù
Û»	Ø€TžÂ±z˜•Q$§+±éÛ"^äÔdk>¦½ “†ò#ëÙÅÉ×ª*DÐ(beã;wF€Â>êâÑ´
X“qmhß¼Y@% 0š™8FTø–Í½¢%óÃ³‰].º´Ísƒ{¢" *#FÜäÌ”
•Òä¢ñ,¦˜dçÈ”T}šAC?ut7/>®©S«3êÄRÄrÚ‰2ª(¸°¤eCÞ¾?›!²ŠàØÈw¬Ûø$…CKÜ2(·dTµcÌa„ð«³¾_ÅË—'ºµ£´©oÔ:7ñõMzòÐEÌ#Ô^ÇÑÈˆÞYDQcŽ—ÇM;•TBÖ®ª„’‚ÑYÖqeIÐw9yÆ÷£îe¥iIJ¹Å"/«ÿ§slú~$yÃ‰èrÜyáõ•ÚÑ œ›Ó„Ao,JG92¸amcÍq£Œ‡l5L_Îñ2äH[lE^í‚w]r÷WwÔW6+8öAQw&G–™à‹°!½#¤$‡š«çÎò!–\d¼Ý±{L“êÉ²e°½³†7¾úX¾µs®3‡þ”lYÎGÌïàuÅ(ûš¹húò=	¹‘˜ƒþ«à[¶² “öÝÜ©Õ‘Qü"O¢Ó ù{6›üyÈ¯’æo«&ÍìîˆK£dõúûý<Å}™õñŽäôÁ«n„šT„eéÇ·©Á”†?Z]ÓÉªÔu¸ZØÏšÐˆ%ªÙú<¾™Ø”üì—I'¸@ëÞ7’ûXé²Óÿ*l.a×ãÅª¢RØBÐ—èÃ–ñk—qE`vo«M0Í†Áš×ûÞjTÌûˆU©B>V`œ‘Šù¤èòÛæ6Ø7‚=ˆ{¿ö-@þ®Y	™¿./}j~ñÙôÇ¤Å¾èî|"\4\º.oxÙoPEþ$¼Úeõöl

]—î‹ÍÜ³8Ø <:G&òï¡‰±sÏˆÐpi£ˆ!BÛ£#TR!ˆÏ“IˆÓ¦KP/–sg
‹ú®ÿ)ƒ2"}ÍPa´P‡
Z™lwÜÐD&;‚)ˆW£QLX
EÅ®qUž¢nŸ`žŒÏ©
q	A1Ê†ÎÝÅË!ÐÊWœ}Šf€Åz¬Ðñcék²R2xj‘ä#¬ã.‡
Ö(ðÕ¹7A…D¬{]–$‚ä£âÄ÷$+jh…”ÇÃ´ŸÏ¸Ë‘8e..O*±n9DÐ·N7µµˆ–ÓE¬½§kú^tTª6§4‡Ù
ñ„3ÙaèC2£Ëac*”Å!,È-8DT_½4¬{²ô%D#,g©ìvøî¢\Š^¡3‡Ì(“6˜(4ÓÒQoX.Äãcû|[Cë?u7OÌ—ã¢VOq¢l›_èT‚øÔkÊ5’ˆ€¤l§†ZäÂq4è»äíñFˆ¸˜“À;…sIÝªùÛ}r÷0;šƒ›è£S„°1¸–ïFˆ`âÅ$GæÅ)=8ú•šm_uøº»?ò!Aî¼;ßú
´‹Iõ„¹Ñtš
º=‘é<§Ýºª,éh9Ø›ú¥«Ó-½6•“îY?äÎ‡ ´~dZª:ˆÝE¾³ÛDÉ¤Š¬±»ÙþÀøq!µ¨ƒJu„8‚ñ¯T1ÓÁÒ®ËæÁ}“u¨u-`ïó_¨ýðÇ‡¡ÛpÞz×vé3þ?DàK`„vRÃÞQ9h+¥ïÉ¾D§žƒÛìÆ“†+æˆ¡â¨-Â#—e[™öx“¿šøâh±ôyí²†?‘òŸ|ÞætÃ{þÆ¶ª5Q€•ö³Sêc$àõF‚‘°&>÷ÕÏ—zf×\Ë±ì÷aŸAY—K(éØ‘ÒÌO’4z |¬Í…Â_F¡Á[Úp¬5V½;S>$»l$Å˜}Jm\çysd®0µLýLOïÞ2µ£ß«T¢éU&ì_+R~E…¥‚ÀÚ§á°MÝ	§šù^ˆTt;s|e°
Y™À‹xM/NnåQŠþPv
^hÊ¹tÜH3tL1”L/F20ž¸øÀV»MÁu”ªòW¥eÍ/Fgz&&f–¨kó„tFÌƒÝé§þ÷cWfF×2™ßQtçÚô(õ®
d®cönuÙ¡Ê1lZà¾È£·Æ½G¿Û¥ï‰¦´žY'¹Ì”ÝvÈuþU;•–½BH"Y}Ò f’^ˆ²g'¶YK¶êÍå1ÊÚ*¡è2U¬2äEœNç©©‡åßË¹& ú:"RUûÕæ„Âjl’º·Z±ãÑ	gž¦-à ð&Æ…ø$[Þ§ü
°(&Â-Ë”Z„õròÔ
Jg"ü$FBélšŸy—$ªë»Ìº“öçúŽP{^À“XÂuôºÈyá—XS}·‚<|—.9¼†]C9qÉäö|éì—ÀÔ˜j°ý*gÎœn›õýdža?~žž.ˆG†¹$=†Å.eZi(Ç-Ò-èt&Š “^J± |¥YÏnf¯rhÆøÕQD\Œ¡%t&skÅ*¯yí:APSWŒ[7ÓÓ’vE
¯ôdÞŽ;_vFéž3Ã§*åÂËÚTö?ç!YFÖFÀ2öIúÎýßF*u÷ü€Ó.®g0kì£lÄkšÄ¿•D=PÞ¢¬nx£ý‰B/=|»ÿ¥ÐšVê©HT
å¹-{fèöUÍÕArÁ9PDM*Ç^gÉ›/¢eù©ÌK&g)Wœ™Ìñ'‘që£6‰^ø¾É™¯`—Qª)Õ	EMkÖ€'–*k‘FƒŒjSÌº»d&¡$ËVW‰ÓúæÄÛ_Žú{ýVée^o6ÂÜÏ*FG,$òÅÚÕ—+¹Ö°¥uº‘]kfðd@8ò4š”Åkb ’ÔLÛŸx…Ù¹™(l/0JÄÜp°ŒçµZ1?OÂk¢šJ$SJ9^“8¦=‚ mñ8›²›¾7šÀŒh&ê¦oæOFE…òØÝâ–ÖZœYõ+T…«IÁM¹¡à[p4Ù¬¨šØ›`‰øŠÈvÙ §m¡4AúžÅÀ¸Y!ÿÆý©þ/ù¸NJ?G/oÄÀ_ë®]Ÿµ¹MÁ‘Ì/ŸÀ8bÿ9ÞcCÁü¸«àuÀ³? ’™dI&d’&™’I™dI&d’&™’I™dI&d’&™’I™dI&d’/™/è¢¹%Z€X}a?%’ <%8\¸—T@v)ð(å7€šï^.Iß'ßÀMM
z©ïÄÇÌùœ|‚‹mÝÂŸ¸EB‘U²q4k„I¦S¤È&Òy-ñÎU¶µ+[ïG-Ô:æD
±â!Â>OØ´J¸N$›µ^Öãêf¨!üþßQeÕÏ3ßµ/&éT†¶y5ÇU;3¯;ð|}ÍT÷¯•/¨í»MU‰¹üŒmÎâgáÝÛéGKžõ
w¤²4ãlg8ågÝ>St-ÕÐÌ4=ÖÍ·=>iï9·> ÅúÊ*Û$¡®O~œZa±¶ ƒ/5÷¶»œÌ1f÷Áë†ÞáI	* @i-ï;›ZÉÚræ˜ýÎ>žÁR)ZqëQÙR#^I¶#®`&
DáSÓî˜ ×Tíxxp|úÇ“lGiè&g/›)ÎoV¡ØÖ"Ú§c
ÿN+›/H¤Ïtc’-.Y_¢“¤ˆD8QLÍq™ïÌ÷jÂ`öy/‰Ä`šËV6³8µ‘+KÒ•mÛÙ,^›¼×%öÜá•—µ«É‘jÄ>”ÿü,åü«¾¨arªûr¦ÜŽV„@S4z4€
Iº(P-ÂÀ|Y%´›³ðäá_˜@îÀcNäå
ð²
ÞúÊ72žu-eÜæ ?'u¸&«“þÝn´ö„zU"{]‚mŠ93ÌXÖ—÷àç¼ÞÝwý_LÜU“ƒÉ€& d.Êyº‘¶þ»dÁ¹þ„:d
î£zçð†Þp½òZ[|Z¾ÍÒ… ½ƒ®!Ò5e Ü	
¼ó…Gúè%œ”7ÏçŠ¨Mü¿0òåtï}.ýˆ‘Ù8ðžwUü{0Ý‘Ù¯œ‰AWæ½>AQE“ßÜ2ë¢sþö	Üõaƒ½/Î>&ÚÐ£<òÛ˜êißåo¯€RNUs´zÙþ|çÆ"sQ¯±º+˜ÇFQ¨O±´a›< #Â©9p®æÂñæ/\½Nø¨kD	µ–>Žg¬[„qðÙ_E¶Ù×Óë¦åçG½ºQ±TÌLÊ:_ÞH¸z¬pÎßVKÔcHó`ó"Áu“IÓPyüêfgoøw´˜H ÓlÏ ýÃ]ƒllîOŠÝ–8ôöâD'Í´o2UºI€ƒ{¹í@÷ š+ÛÎ™È?œTËÉQ„•Læ“•™(e‘Fs¢‘Ÿµ1Ìä+!Ä›Û1Ö°S"kŸät_ÅûžýÀÖò"¤¾d8ËªÒ£"ón¦²±¾KS=RáàWošÜÁÆéA¼¿ïFs“ó°6¢«t?²=#£g^Ï™+æ+G2ž5©9]#G9JØýõíºR/‘»®a}ød7þÉ±3šX9Eƒ*aÌ’,´VS¿~aÁHgÁ-P›|_Ú]i²‡6(Òl|ðßó=K‹| TQbŽû%
¡ÈÀÃEÃ	Xþ»*3>:ØA×Uìæ{Ò9Ú½o0»9
<¢
Á}I÷è|’Ê«;4[þ!úJŽqß6e¨Ary{ùYc€ûÃl¼åqu“OdÆLÄÏ“,€™í,ý«>GvR½‚"'ƒø¶YoVyŒ[	©ULÄŸÔåMKÁ×ðî¨ÍÇFˆq0sXøA9’ÖÎh¡’W³z’yõ·Í;=/¿‘ó§¤á'*w<Ië?X±åVJ‰>5™	§Ë–èØ+^ ÂT8l©EJŽ|ªtco¦„ž¾FíßJVF}Ë›™˜ÃÊÆØ~ØypM|Ç«•ód×Í—31ŒKus tY~6,Å<ì`ÂP¤+ªÑÙÔ	Ô²5uâ®‰È¼x
£U*(Ó±NóÈKÇ$'–'fØûÌ&5'ŠÃ:¶>*êñÑOz¶îd8Q“‹^Œèš(£ÃÎeÌr
J°ƒÊó/-£0_™DHÁb2ÎÆµ»ïÎ¼rÒî\#á“#Ç5Ñr?$wøž¡#Í¾£Þððæ÷=õ|,Öÿâ‰ºù_+˜¦áÕ<%‘Ja"~…*ØrŽPš¶äœAXŠ‡m»Oþ
^A3ï	–ùÎm³,UÎUm©{:G4i¹“J6˜+€
yßñ-Ðì-/\,¤b¨3$ÆBðcfn0*Äóu	cj•ÞÞé[ÔŸû¢w·1
¬Ò×Øƒ‹Gò1™Q¶Ë>É9‚5^}@Â(<é†¶·å)0Á\{]
¶Ìœ›ß£¬Ý‹–Ø!8Îûv~žd{£ÏÙ‡½„éí•Ù¶=ëÆ::[Ã±GÁ¶K-”lä’M„ô.ô?m9í¼Þ/ªŠð¯‘êuæ„Ðô*üwfÓM4iÅ/:àïALÝ–FÕ©ÎÙúB«—‹–}¾Öå Cæ{ôsQ1Bª•Òne˜Öèþdz£xœ9F:ž•¡¹·qC ™´…œì¦-M‡A¯K!_/ŠV(ÇQì¥«Ða@nÆ¦;u@%˜¿ÖQ1»<Œ12_úè˜ü@oOù•IP'5ž!Žé=óq¯uö?“KÌÇðìÂ0%9¹
øï”à:¨
=ñp k÷§«sõÐiS:^^9g—+ ‹f!Ñ
'çÉgdº=’2d%ß¤H·¡#iXgŠK%¦hvoé»†ßÎ*ôCmžAÿQ3¼§A®2æÆ}jÞ"nÁ~úÒ²î·Òg%Nés¶‚éCŸ!Æ+ãÀí•
9¹€xù]¹«ª³ |µ¶OÙùüíhŠ¼”À£çqêÙÈõ,ß©î‹…ÈIš‰^§‰ð%lŽªjžØ±#:_,6ÍTl¯,Ä¢™.>®Ã #b~Ûô{˜Íy/h|C`¼íM;4Êd¸}§ Še"muWG4suø²…ð6ó:üëÿRÆïc,P=¥áœÏ½¯Û¹ù|sÞË9YÏ“åüñ¶ÔDï°·¢ƒÌ
ôtëÖØw  Î3ä4Ê}û³Ú®6¦c¥¦Ó€õ+¨/æ€9w\kw§{®z¿¹™	wTßR5ôE–ª©p(Z5ŽˆIôŸQÄŽ±¶<Ã`‹ž}ƒàƒ{zA°¦ïÌ(Ý®mŽ|(¬s
làsÝÅÕÞPZ€Î[Þ÷Í¥>TÐ;L^=¶´6ÆxÁ ˆd"7_LÒ®rö¹khw¿8øšuT’ÝÏM¿}ZDÝÈ¡¬H1LrüJœuÏj‹e¤Ü "•·I©5µQz°62‘€‚
þ6Ë’†~Û²ÒFá²KŠê^¬ÍmÜ4·!Û•w5ûùœ–ž}!vG[p™´WÕø\Ñy,lu(FŒ6<£tòXYLR·³Ë„„0¥ÜjÑíÁíL*|Jâ+]ä*+£š¨vKQ¥9¶,EÓÇ“èqõ±†#C›Î£ùÍÅ,ÿ¤çx¬t“vW<z^é2" ú¹Ì4tg&:@lÝ…	‡L®ÆiËp·\”,Äcšª,«ùz¥$¶W^F;Çeñä4D¦2Œ‚ƒñ¾‡^èdÃ;ßg3ú~ÙÅæHï™ÞE†wV7/o 4òã¿Ö‰õB¿4Ÿf¿ûäèV¥…ñ=HY¤±9x‹\éõö¼&p³Ëh¿›qŠ¸©úSÝ_ì«0ðëë™mM0ðt	¸™èÙ–¨éûWAóÁcHÚ9˜FMfôŒ?JÛ-AäšPŽ3±’°"A“íDø–¾7Z¥ŒI Òó¥äÙ*2ÝUQ^üº>4ýÆsgíµ¼Ç×bªÍ„ŽSð¢aížÆ«½¿¬Ü—Ë-ˆí"¤™žÐ3TDLÌ…kn§Ä·Íƒ›XÖættä¢«I&àÁÛç¼4uxº¼½ù}óßMñ¨²¹ [íÚáC%Ãä&4¹¼—¢´[§kƒL·ÚL
Ï¦bñ…ÏJÓÒ®g–@¬óx(FY1ÉÚ†6·.p	U3›éu¼l<øŒôf‚¾(Ú=ñ@ÜÙ%ÛÇe£cØ0Ç3‰OìÄMÇXÆÍ›´©bÞ'-ê4ËF“Û-§Ùì—žë‰j“cwpÈÄ Q"Sú+L$ZßáÑ»Ä3n‡Íxn¼§øÉëú ;&2ÒEä'©ølPíÐeÕR›l¸ÿJª8!S#lÂý§ÃZñE×&{V˜^±ËšÐÖB›l?rO€Dü7úž2¨)NçÕ &†Fö´!¡¥7ÔŒµN®–ïPI›¿°+eØIVPYTÐÞm›]VCûá"Èiæx ^~{]ô·5±q§˜>jŽ‰úwLq^´dèŽÏ•—U	/ñöRjù(x¦mðãé.sTöGt±8ó.
A ÜùYþò½êòiöfoµ8.R„C.•¡S¿P@Yá=Š™"£Øg"z.BDzÖ(Æœà¥¬®,àp`ONg‰KUÑÅ"lKÂXrË ³.ªÑ\SI“¨â·ñ£«ìË€½œŠ½„R„¡1 ”²pF¤
À—¸„bÄùè,C@á…Ç¬G¹ge	v¸'çèDvæ^Y‚«À,Þ4Fe¬êÄ€âgÚ2GÊE”N:ÄÁàèéu„KaýÙ/²”5¿~£a66†,þÂošßw¿šúfEô¾•	›Ø”‡y¹ÖÀ(½•íÕ³0ú~(ÎóV|¡nÛJ°f€õóÝ¥aL8«µRIÐÿe£˜¢ºT5×[w¥(@0ÄH*»E’s¡ñÎõ·P*Éd4á¤¥Ä„î%YikeLD;-
…D}vVÒ£Â†™‚Œòcƒõaä1/G–ÌÆLcÐ¡b–(A2CÃTk‡ŠqÒÇÃd{Ô~ªãK~„~¶oGKQÅpÓ N!”…$«ÇÀa]÷ð?6mº.(†uŒä½Â)÷ÆƒhìÎõàt:Œ¡'WC‘¥9¡ØGÔÇêÙnS2ƒ˜,Ya#	{†!b]ëÞ"T£x)CLìRž 09¸Ð:˜jWx½íÏÍ[àC{¢‡Ï0»PÒ`Ö´àfHc·|U ¿<> 7Þ&,˜bŸ„Îa»ç’ ßžgÈÔû|?1â3L…v¡}¸ƒá´êºÿ)¢èáÿ?xÝ(o’dYÚYÿ/ïpùÿÖŸw8‰aòÊø¥j„ªýnƒ};ëÄÛgœÈÓžuûÙø._e$h]€£_Xõ²¥õ¬EÆ	Î{Oûë+´ÆVO±hõ>A\¬Øý{¼V_ËA
49}¨ý_²ë!ùÃ›¦í ¨Ó?Vœˆï
8;8ŽOkTàÆù ¨G›Òÿ-ßÆÚ8b¶[$+WÓÍ%»àÎ
‡RA‘“§:ÛÕª‹(¥—KØœZld:Ó)ùqt}›ú¯ ‹PN®ù£¨5'sù'«ê¨y'C!¡Âç\´ˆûÛÉý©Ú@_»'ª,U·Ñr„>èúBKá¹³¾ZÕßQ2¥{™of¸¯¼kñoÍYƒ¸÷"jÐj1>4€_»P)œÌd\)h"×íHb½µñÌ` IS¾f*»ä‹'&õ9äÐ¾
}ñ/¸Œvì0šF¼Åß%ÄÃD<w »ê&WB6<¶Ê3îïÍL¸O|?pU‘I¨Š~†ñ‚ç
ÀnÇH½PGþ¸=…!Òty‚ZÊÅ™½\QèžLF2ƒÅ@#gâò_	o.Mdö	
ÛðÐ¸ÙÞªÔ	Ê%Uh·v-Û¦9ÒDÅ®ñqMÂL1ÑÉ‡c\¬DïlW$0Âì¹uªì’—m[8»˜T'Ã›×yML85sPŸÙ\âVXBéŽ+ÇÙ<#‘¡,»ì†'«†Úº)’k%2k˜´ÒU§6xÚJfÊƒïvµÞ¦Ù:i#Å‚Î»ðZ€„ÌHMM¯§‰‡&g*â8ŽDlß°]w~Ëø¾ããq§ˆœå…gÄ²HLš´7âî	¼jMT?²®·x’.Sô#öÍé½q}5c°·î=oûÙ
˜ìÖµ‡âƒÞN<Ò‹Ã¹™½‘Úkàf,erÈ˜«KàÃKÙ€‹TåqÚ}þf†TÇUüÏmÅï¤ã¨ÉØ$A!W…ÈÄX{vØx1fB¤„1ƒÍƒº
¦ ÊG&€	pzpZ|šóVèÿ"•C‰#”Í±•¯_	]‹¤¶š¦¨Ò:G‰º“ÊÈ8[ìÀAæÐoú´V½î~kA^äõvz"ŽW´‚ùm4¬®É,]y°ÛfÉs<LÝDïˆ=šïŸöó‚\Äª‡$±x&ç.x¼‡Ûðá!ä‰F)y,åÅÈ¶²¸.¢Oj®áB‹ü•Õl÷Õ9np:|*is·³Ÿí³¤®1Ø¡#W#ÓeüàÞB¬>öŒäËaûšåàÖ´"}À>»ó'ù;’‰?ºUÑßMÁb&æiÄ÷×Ø Æá(4üøÒDÕ.å¯>4	I#yc|ÊœëÅêq
ÅUí[Å÷e¬¿
¬·ù	[å9úŸ›=R¸À°H‚S×€ðu¼ÈÌiŒ:ÈG†j,ÙbÂe–“rNbÁ–;?Øî˜Àä¸
ašo1ÎLù62š½QQ'ÛÍfÃq46£rãFØäÁ5³˜Ú<-ñ·wÊÜ¸Ü«¬4-C„ƒH©¼CÓ>á—â¬V
Êvªô±“Q®Å±Wƒ/£¶o“mwÑ$0Ös+äò¢KðÜrh“õµK3ÏYÉô¬Žáp!KÏ´Ñ®‘H÷¨8Î©tr¶`æ¬eÖ>²v
…‡ã£_H¿€^š¦™š#7NÇñóÈäË0µç[Ÿ—ÝÆ¶NOãQAÉð
D™Øí7ÇÓÊ»Ä'¼¦jO?EL0‰ªtP²=•œ¬àTôÈdì‘ò“åÇ£ƒ\;´#Ã²¡ÆÎèr%+-Üó=Ú/T–óFw(x'…Ö×ˆfñhO±ÚÛHäèVÛš£¨o*ªWü]Ãú9HûVÄŽ¡ðŠ<‹ipk¥XÞ°èìT”Üü)¯‰fÓM1jAgwMrfôÈ¹SýÃ?‘™ò¶aqGc@Ä§»'râ.Qp¼¬€•²`xóðOh…[ö?ÈE½Ð‚dÅåiÚ÷‡P‡4£4Xƒå<Y?€òþËˆBªÈ•àÔø®QÎU†s#Bx˜Ë²‡ì€ƒþ*-°½ºÞ×Â‡“¡¹ã»Öe’?ë·»ù®×s9ˆ 	vc7¤¤Ö…ä¾Çù}|ºé³<j&ïe³îOÛàÙ±ºl=ÏÜ÷g©¢ÕÊÜÐÿš—
3TÌ›M5&,XÅ‘8·¢Ý@$w›”¨*pñ}MÚ#›#*s£®lóÔ•ç3¡Q
ß'¹ÏÀ:P)CÎ8O¹¶Gƒ=ç\±úýª!¿ô
HÔq~kA;øûî)° ¡ãÛdÌjÚ8O¬t'À‚žCš•6éJº
â=~Ï0nO«Gá©¾}R×“fII§y¬æˆm¹VÄz_¼Þ»)ÎsÐ#’âÀZ”N²³<²Œ
s©ë¡i^Ävë»G4»SFÊ–üe‚#OÁž›±¨i	e5sVà7fŸ-O`ñJBu¡¯OgŸŠ’qG¾˜c¡#Z%‚äßÒN×Èæ”°
Qö-‹Î:°ŒXNÍêCÃÕìN}*ãä
ÊgÕ¿øO`—ñúÍÀÏþóPÉE†¨Ê‘„*Ù?’C^d€òåNÜ¤ÒÏ²ÀëÑïý®“yÞžUtÉ{ÕŒ¡úµ6y±È´1}@RƒtVÍ¾®s»±Öëë>Ät–öð¸n~(pdÌï‡©3Pk3IQzµq™Œ÷•s/Ý!îæ£|4ƒð+‘|´ž^w.!.4×ïÍ^íó=³ŠtŠÁ.€ôø˜ÌœKöŽå'åËFO™áö€UäCºx÷
½Ñ5d)BÃ©Ó×n(é¨ýfà;~‚ss³Ýˆ²ÃpoZÄgËÊÕäUÄVI½nœöËû¼Öü3Éµá“ÊÑ¨4Mœ@G(÷d½c±,55„	*µÅ+€ 5¹Ãà«ëã·–¨0ï¾iBK]é&$Ã;*Ò<Zâ
©ÍÝûæÃº$¾vü}“Ênë 	MŽH ßßÀ|øæ½œá¿(¨X#Wk¨4ÕyŽ“jî¶óåe&G3ºlI1ÃáD]&€L‚ÃˆÏKDß%¬¶4£&eÈ8Çê:q:C%¦Cím_Á1¬ZüÊÔ']„»Cîkÿh9²‚Ö+¸ÕéÖ/ŠÍÐÑW öÒþO~£7,yXˆÙIŒbŽ‹‘í“¼ù<æe+)5A”žxkk<gD°Éa9¨]x<¡‘;z«Â"Üan0x'ñ3
Ÿ2”ÜÅZø«V,˜vªBç¯öšÜE|ÙŽ»‡ÖÖ÷eyæ1²O@“¹ÎoÆZ)â-§^¦mzž¸à”lSVÒìV%6ãŠÉc?Õø<c%f4ºTñ¢'dÌEXæè@òßúå¼(+—øyŽP€úîæ»@>[ÿ˜EËÎžDE,"“ÿ*s}EŽæœ,A¾wó´B=To¹	´õQ2I2
ûÈË†qJ8Ë^†©æ>± S©œüz¶´ÅŒ´%À¡¿Ã"f"ù
h3MKN¾GsŠ5©ziC¢´Œ6îg[Æâ”aï¦7IV4€êGDÀ•"ÎM	ôÌ
Ä·.MX0Ý¾0Ý9¨:Ù±Ÿæ
Ž’OÊ„ˆ8W-Åf~_5Òš|@ê6F„Œöè8½¤†žuŒŒµñŽõEÇ±_[ëÒpªØ‹OGaI¸Â1•%,Óá™ÂØ%qÜ·ÑÙÓ‚¶¬\×Euâ@áç¡ÝƒaçßÑÈÁ=KD&YÞ)l§1Æ”i`Õ¥E%„‘"}®[¸kr²©#|bbdyeñ‘>L¥·“¼U—‡ÎÈ@¥¥aãºA¥°hÃHq$n®v°{C¼ïÓ¾
íŽPg”\
ã™.Û"¶^é]·å™ÍÚ+¡fŒ‡«wb‚S‰A¼S‘ïÝ®’Ácr?W9Ö»u˜+ü4œI¸0ôàØe[ÕVÅÀQ±ct¦È?¦•ÚÖrç·¸ó1]\ù„£›‚ôÚlòŽ
&To»Š8‹Õ"ª\\²ŸªñÎì‘Ú$öé÷V«„høÈ¯œuáÛyTŸÕ[ÇbÏd“"ƒ'’ÏëÃwåvå7z‡áN/¯D9'æ(GÐêº·ê”úàª–¦ý1Îº«P†”Æ¦ÀSä66+©ka®š…¤Â’dF‚Å„6x(¸ú<ÇæÂ°°9å«ëUX2Í£Âm&™fi	p]U-ŒÌ£-»`lŠµ!6#z,“X?ª¹ÕÛEŒ#lèióð+) SûQ®³#ùnþ%N”iÍ~ÝÙ]GÛÞ1
{²ëçˆ
ÛÑ^ø-%:Œ‡Ž3áª<2»–?Í‡†áÒdSvˆ¼SB’vaâ´´8«µõxJúåxÍÁÎ³YR”;¹½óöBÊ±ÈÕEv™ý÷œ{¾¤:ÚéÏ»{Ì§ é¶Ä|º&œÿÈê¥z¯Å×YO¸è†'èzœÙeðé¦×G=cå9¦Åï±—šÇk{=2cø^Ú£»èTz+^ë=6˜7# ¤é(ººGqz ‡îÉí°à¾„ õÒ™s^~°_Š»·ž¹ùž±=,Ð~b#T¼õ{ÃâÕäåùåümúGxë×£Ä…{¸Wì©À„¿ó•£[5œJ±;É¦5€ÿÎÄ_ÁÆÐS¸³ÜeÝ
¦—ßjLJü6ó6¶}anÛªÛ4Ù±;u\.iA3múò)DÝ·‘×ÿ@bÛHÝmšà£_æd´šùÀµb©Dé¨`¹oÕÙ†R(Ä’‚ŒsŠ°¡‹ô;ìÂK{«Úp‘S*¸åÚ{Çýr}R2îCt#/»â¯:Æ1^qT”\g*—(Zqå²FÒ×úÉÍ¬ø’¢ÿ<YÛ¦òûŒ¾8ÍŠšÞaØ§qL+8S¢VÖï¢ªÓÙmàµŠ¶‘|oÜ¤wTn[hM±*ÌV±Cª¼³(4ÕøsV^³Á
öÖÝ8„ný-ô/bw¾çÏûÇuÍ´T‘nü&àÿûÜòÐ8¡e`é[7¹7ŽUÒçïþÝIužÐ±¯î†öà¾¦RIRàœŠYNÊ›‰Áš{óøLcd¸£È$¡uÞ÷wÑõËž5å‚5Òï-€…‡àq$»óEÓ¡ËÕýFRP@uN¢
çJîÅå
ãÃÕ_RmÂù9{áM6I”ÐlÕc¹o
Ijà4<(Lƒžà`”ÏÀ#€R—.bm£R Ð„+ç¨›Ø„%ù¤HÝå¨òˆ—Ï`'ilÙÒa¬*2ekÑ¦ò!Œ½¢Ù¶m6Ì‹\La?w·^Ðb¢ŽÊääl\öú%Oüb½ÄoO4iÛÔÔx‚ß7¹ß#é.ïÑ÷šhb¹äÜ"à †t‚j|³ñüû|ÙõñÃ3¡dHLm»Ë3Rå÷gË…ÅÊÚÞé€8\ç¹ñ>5K‡pºÞJ‘x²¬,9c<aiŸô©çfùdXfË¹&ÖþŽ?[;Ñ³YÄ_ÅÕ#‹Î[‹‰h•QãZ“Ù1´ôî~ 6_ÑÁ†<ƒ¨âÃ†eÙµªì»ôÄo3xÿu_i¶¿ƒ$^¼ÐäÍÊ›+ø›‹GjØ.es…x‚”Á¼”)Ñ]„Ù)š™éÇInN¼ê+yHÉ$~€l9ðoÜdoNë¶óBô<xÂ|óˆS¡)8ç8Äƒ©¼«MO	ÂéZƒK}~#:áWèX_q–®ÂB{ôªÀ‹¢æþ?x×	o¦Uå›z73~n¥©˜„=–ÿÇÌ”ºV®->0õÄ|×Ýh6{\ÓQÂxŠ ñÕjÚYÄdúÊf0m-€xýNºG¶ÍÁQI)ÉíÊ§4–|}ìë®k¬‚Ã»O¾
ÈÛdæW(ZÛ¤¹xÚê…¢ªG)¹nœñˆY¥¬ÓšqŠ)«‚œymÀÔAÜò¶ª’)¦ù˜A{ÂÑ¼¡ÕôñPI6¼690ÁRý™6=Æ=Þ-QØ
¬™†×òBÚ¢úÊû¨šš}6°%qãïÁ
?Înt‘™ðëíi/ØO*ò"ð˜\¸‡//j@Zq2f‚W‘Rx ¾h´Öllx¬Ro„¯ð|Ú-õ²„#¿SÍ¥Þ½@ ß†^ãcæÎw~ú6åfºk@}xK¥'¬ÆTlÜ‘ýÓLÀê§0°/"•ŸÄQ¨àJ•Ÿ
û?#‘§ k$÷µ<vôåJ[ËØ.ý
âb+·ÆeÍ5°·(<“^Nø]É*¬ç’+EÝÎGE¥p!7ØûB³ùü«½sÛ_Ãÿç&˜'¾0/âòŒìÔXé½ù¨?ü>#‘üèIbñ‰+bÄ/\Ö–1×{¶v]PŠ-ÁäÇJhÓ¤ÞS81åñ®Mà$™€>©,®	•^£²
)ï…MQÒƒœ"ÿ¡$î.+òoÝ`
Dá
¿îîvÂHnÉ"vÖ³õLyœe:ìºi?K7Š§ÌŸ ŠN<ø9Ÿ„u¥*žðZ+W¢¿dø÷äž(pEqg¢Å†×ˆ~–ŸÇJv$ú-•mSðÿÖ‰H¡de´¨ŽàekÄ—·\æ,£ŽNéÂ%ÏÙH×Ü¥§4“Ø‚p–pÜ¬ú4æ6tXi§“r¢\µ¦h8€šS(œ Œ¿%©)ÏB:Rn„À&lÅÎŽU^mCûV¶U‚Äð‹9N®äÞ=P>ÒòÚ„ŒµÁ¿â°bcPi©ëq'æb5Q®1ÂÜZÉ¨D×þ½ ‹©rÅñÌ·R˜‚TÛg‚%ˆøü½g„ 80	@w‚¹k'Yq_YAñÑè	z1ÚáÃ"‚¾Â²?§‹=B
bi!çZ%NÇ›¡P,çÔƒ˜pL¥«°–ãRÈ§PØ‡fVÊHhêñŠØW“;¨£«2Š¾¾@Mè.KS!T¶’øžaQ—iÓvàE¦•Þù:O8ò&œýÒz²ª³N#LÌðÁõÏkÇ«ÅÞ6Ñ@-Šôý®]Þ¬ûÓäj~6(†Ÿ;l³º¢ìlºžð‘,}8Ûê÷7žµÅTGkÑÝ3¹áABzëôŽÌJ÷%®:“œ9inOÂ¾$”TrcuE?ÍN®‚™ÃÅþ±3
Ú4[o¸Ùº
Ç®û¹¨æøÅ•`{E´«dOí§¥)Ìo6˜±ÉÍ1‘÷:[¹Êä4"ô‘-Åæ©£[Óý 'ƒvŸÂ¦>6ëQ‚ãJ[*ÞLöSü¶ÙCåCjj83¥q÷EcÄôä~î^¢$êQWGB)—êùí‹&.¤¯ÍÈ©rp8aue7¾w–bL“Õ*íó*[3ÁYãšš˜2Ž‚Ç¤¦ò|ÒFR³¾ƒt2®¬Hí`SúW^M<º²™¿ìSmŸéu¤±¬‰P?©ÐéOª
¿î&©9ÿˆEÅ·CPDâr' ‡ì•¾§·h¶½¾ó½ÔßOŠ
Ýµ§öØE«—îPT)-lO	¨…cÓs¢ÜåÌ±W™i'{‚Qœ³ÞisÊI°Ž'ß?{~Êƒ6¼—&_ó¨TeŸ+ËhÈSíÏ¬R+{åJ|Kœ™9[£_7×jF©Ù¢Nn©øÊF»âÍitiœ8.ûaºû ›ÇÆF¦3uêI˜=ÑúðJ)¬ì?~F9¼iæXkI‚Áƒ
,ýmoµ àþ.ñ†Ë†ØæUÃ\c›Éž1ÊTež1”©ÌâË$‹×eêEÉy¼d²X<¾”ª˜U¬)¤”A”Ñ³…h0EÃ
;	{„ø" <á`Âœ…š„¸	;c?g€ÈùÎ@ÿ[¤‘TOuÜJL»ÁXäuænÖQð¡ƒ“•£·F-QÔ‰G¤šà²€xøgŠZÉXüˆæ#F‰ÓÑùÊí
¨FäRïª5m|¥Mªú!_–6$“ÁãL¬¾UAÒP´ñ~|ÃðÎf§Oh~Gæ>xLd5HŒµÂÉ2OåÉ
>Á
¹ßš«Ì®ªz¼yX|”Ý“¯ŸESôj"þŽÃ¢w‡›Íwøéô)ŽZÞ7ÞYH·LÃŠ :Á¤{Ú‡sAi˜.,Ò>9aŠö U˜Üê3m(€zßD—ØžÐEa'yDiÒ?ïõž_®aÊ3Ê‘ƒ_Xà¸&ÔCîå´ë„oÝMËA/q4‘_Í…–cGŒì‹Oææ:Fï	)q¬ky‚—˜¹¤‘5)~ÏÊÈ‘ ð‹ìÙ]UFwÒ›4hÂU¦ŠOadÕ©z”‚åë·«…À139Aí<«L?±"7øq4>;¼æužã°úÎ
ŽÑ©ê˜
Ù ?©bó˜ŒO&rÏUÂµüéÑ<þ2Äeoë§›¿ü\Tf£!`m@V“Ýýž‘;è¶<íì•BåB»oô¤n‡²…$-+wŽ+ÒÂ.¹Òµ†³Çâã‡qÞ´¨,‘y+| jó<Þ÷Ñ]„66õÀÑrW À od¨öÁÎ^Øwãá&•½Ë³GÒy“‡óE¼L/ÊõÔD1rÈç8ÛÉí„C
d&€´šÙn Ý6ò/T2j‡yQ/³ÏÒå(…ë‡£!#näÕëaË¥™†pçÄ[›¨ÉÆ·ýt$î™	ð“UãPm¦€x—0g¦î—þ…6$¬Íµ:)>»38ãä‚ÙYY[jk¦SéÚªá£Bz:Ú
©‚®+‘B¬ŒÅ%)âÎgT-J9%ìï?ùë°þ¼;¡°Õ¯ó‘ç7¸q‘ZyIÇ3>"gjõÈìBvÕ,ú"UrøŸœ¢‘äv’©i¾ïFªå¨r‘½;hÈZDÈôª™U”6·ÕQœ¯Ô«"†bÄt«‚Æ2SPªää”kÚxb.À&Œ.xèg–ü¸§"µôHìò·›‘ì.¿”c´—ê4þ?7Á{ÌÍÌ¥˜í£1!5êÙÝ<h>Ò×‘l9dü)w^0
¿.ÔOñõŠ³>>qT6p<-;1x/æ6ƒè¯‹èÿ¯Õ÷r¥¦ÀGü%™¸œÁ	ÞYŠº×ÂWï©¢y»F}fìNšX'<4ñ/Öñ\â#ª©”†K5-ýs™µønøþ4¡`UÖ³1Õ#3 âWˆ‡/™"×Štƒ´kä·de§vˆÎùZ·zÙßPûÀ5PK4`£ÆÙá/Ñæ')Ô=;h&~O'ïLíXêÆí>(z¿Fc€öíÖÉ–Úî'•õ¥›xRóÔ5ÙXçÑFs}ôZTèt7ñânæñ²Ä$Ú"yÊbjÐˆÑr©Ãÿ;@Vÿ€[+èýã†9MáÚë%ÐíjßKÒ¬›*.K9âKœu}€÷öQE@ò¶¦nŽXG—[ªÇr?
Ø
„æsYÒNÈñ
JºJK'o¢O„cÑ¸ðGCªÕöí—ýÀKê¹«LÔLø˜kõ+Oî,Ò>4@vcÞ|• q€Kg–±³i‘Xm¦e)Ê±›X	@¸6@áM;Éé„-µV;«orÈb)‘&jxÁÐ'Ú[í£‰øÚ\Xju:w¬NQtqGT*õ%½F0ËgÍôÀÓOô‰òU’ÔF³–/Ÿ6›'Î(×Î[:?g¬2ÈjV”H»Û„[†ëFc†¼ñ0ªXdÛúF•a²ŽÀ–?xÍ.6ÂÀÅ‡¹«J”Mè5,äòúÓ-ÇŽ˜¨‰ÜÖç™¢ÞÊÀ‹Ñ€?ýÖüMÑn–õ]ir!ZN_™“ŽI6½lrÄ
Pé¼Ðôƒ”†NÀoÌó=ˆÁ“ÆÅP€ã"Mâ“l3¿b×ö!ƒaXøˆo¤k:Vï“Ÿ‰³6¹‚‚KëkØ<'1»ÞÌ´y6µ‹#ûˆ|Î¥¨DÌÕä£A‘ŠQí’Îïé„Ù'“ª‘èÖ9Œ;êoæðRiÙ¸rÐ›6H&H²ÉSÈÅq²¡;¸Aº—G
æiÖ±â{ú„PyæB±Ž_o±N¤ahXgÑ¥JÜÓÊ@ƒ¦¤ÌÈ²d°¡Ç¦CfAe‹ÑŒ[£“Ôh”’töØ‚ÉØì|#cäëÐ’ËÖ}Ørèà|!uÎ“î"
O„½ÈŸyÛVUº´%Å¤Ž»{GäÁ°'Ø±‹äÅ;qRÂ}6ÂÎò3Õ«cœ@i§Ž!.§‹·þ‚“{9‹%
Ž+·3nàè³[þ~,Qf"¶×¯,6&MÎ01W}'³’ÂËDã/s€®=¤½†X‡ä‰Õ*ŠÌÓàU÷²/@×ª@]Ü–·þa\X=Á«a<ñ¸lÛÁÚ°ÜÿøµÄã×ú·‰PÃà‚üü‘í%zi• Tº
¦‘¥h”3þÛ¾¦dÂ¬Ó[1(ï¶Œm\up{=.×¢¥GP¨SÁ´œße ; `óy¬k„P0"9Ç4QA³ñ{Ôšý¥TˆÒãí¼ÃÊõ1áË@†k¸èëþ<)NGOeôº öóÚÀ€
g”#¤Ô0E©\ZñBÑêÀð"›5óë
¢)}ãÍÚ®‡úhþ“]bXçäîÏ_d"'ÅÿÕú€3ŽÏî'*º¹äxôÜ€¥yøÜRS„[‰ÆÑ!«§_çŠ2aÊÖà{Ä(Cz¾úÆq}Ç±6]~ròˆüÿøP©62=óêYMšêã$S¼2ÖÄ
f•+/,3wþ¦-¢||Mºà<}ˆLŒ‹géÊ²¿¤K¨«oîäF»õîc:0ŒßÞZFÜø$n›Ë"^ Äú¬$	ïæúšp„‡”:‡¦^Œ0ìêGú²"ö6Ã§§àÞ3 ²† ÆÖ±‰0M‚<2¼  fÈ3ëü‰SÚRtÄÉg>µK[¨’&@&Ÿ³ãó2nBðeW^g ¢“¡—0”é±öþs7‡cS‹’ÒçÛ·!Þ°ô›™cˆFo9?Ï5jÑæ[?9a<ËBËdÎ$°aILL_l¶QŠŸÏO„ð~°Ö
»ÇÎDoäð'uðë÷
§v¾\Vø½P~,æK1%_QŒáä9Fd^O®ÊÆš·uýñ‹Þ:³ë›Mß`xU¿ž:j‹9rÕl?%ž³–˜bjyrä+Gü*)‘´„M×§ÓæAù—è Ù‹1Úè‰•iñ>/o4;v>jSPŒéÂtúQÿ×[h5>¥b3x¸ôb¥ÖIpfø“¤ð©hoœê XfG;ö©9¢Üšœ¬E³èÑ”GÉ¬Z™%·”‡á	CŸ>|¹3ç° ÞÜ“¬[«ÊÓŒ—sé=©I$Š†™¾dÌãAâØpïþÝ
°Áõé7ÿºßªÏ3;ÞÃOˆbò´˜uK^ÉÜQÕ7m+,ÿßèèotÏO¬Ä'Ìw€š
âîæ5Ì· ñu8±„23¬þŠB	 û»s‡ÈnL nÛFq‚ò¾ÿª~W<õÏŸ¦Ý!¡^r%6ÃLœþ`¶tkü$„ÖŽ1ˆ¨zÎÿ 
z£ºÏ„õ!o´Æ×3ûlãI:¦ÝAIp;Ðz$!¢k5ßUïGæ¤“ÜÆìj
Ç¼Ó0mOco´ŒEpÕâžš«]±ÌpW„TgT§è—sdpŒBnÝr~³ï]`€ÂàÑÎ6DJÅQÓçŒûr—žjgçFiØ‹tò§:+~œïÉ+äàübðZåÃ·a~9N&hûÄlf4óŽ -¸ŠG¶_Û%u}ƒ$±^8gs1tÔº•âyPq(E;&;vÄMœ½kc#	ÔÙÊÍ!’#"È2Ë¨‘ðTÒŠáà¥ßÙæ×Ë^‘ø	±p¶XlOm
Œú°«ÿåtPfm’E7	W1Y™ï×®O´Ìkd¾ûrn*¡¤'Ê,RUø*Gu¹”!H¿¿œm‡ƒ1½¿AÌÒÕiÖ!¤\¢Øóµ8SN)T
vI{Sˆ£^x^7h¹²ÏÜ4˜Õ\í9÷8ÿ‡ßÚ`þL«\+rŠ‚6"½¦•íã¨jq§´ÙqâšgTC9Íö$uÌ	O<Ž,žjclš™Ù™àiJ
¹6-	gÝ†6O kDtnk¯Åyè£ÐQjà£÷÷åû$¾ôâpî¢¼@¨|^ÿçwô×‹`
3Œõ²÷5ÙË5â6ì

^/è<¬Ç*'/?‚^µ¯ÇSD¡×wêû“Lœ+f¶¤áqä7kBJZ‹òÌ‹Ø½ù›Í†¥œi2¬ÌxK>ƒJ_ru£SØ22UñÐÄ7Ì«_¶FþÎ0ª•²SË¯ÂRKÄã¤Ò$q¡GÈæµëy$&–²‹Ëý ’.˜¼TÊ°ÍaiÜòêö6b?Š|Ÿ3AˆR™ØÂÞÁ"KBÐUïëãv©Jè‡ïŒZ)0Žßã‰aQšÔKòR
IÝY@*¦içÊ×r½úŒ³ò²
2UzG.Ô*=³Ç…íÛÑ¤g÷¯+#Å„ûqS¤ŽFÎ¡R3é8Ðkçc¿+l0‡Ô¬_š#/öá÷7¡SUhŽTˆËCß[NzxZÁ)Ú”PÎ²9^*œ †VpÊã´Â‘Ø0¯Ò÷Å0ö¨{¤rx+kIÖ>UCÉÀ±?r§‰‚RíÙ2CÚ+\HêJ}
^4)¢Ô~ƒ¦Aä³™gtœ¯€|/+<ˆë§58.,Ž¿KúrEýì{êxP›Ö”Â2¥ÚQ®¬–z_ð•‰ò¹ŸbÑkú/3ÍiÜUäSŽÈWÂ-ÂC¾CÈuŸØÆØ3"@.+·r ó6\(ªÁ‚å›ˆ:©gÿÀ'™{„JŸëq¥@O	â*]Ðèuï¸LëÍI„‚î×Ý€ïBq
ÊÏé ¸øƒÅŸ~QÿqV˜‹±ÝŸ:úÿXÃEöñûïdºÇ£ãF”ÀdlÁ‘1ýòn¿Í‚ÝûÊ«ì>¾Ë»¡Ðâß•ÿŸ°\:†ñ²qå!ý›Ù+H¼L—äÎ*†ÃÞâG1å‘ÇR¹¯üD{"Ïö¶šÇä%%ìúhLœóªXóÏ’¹ ¬¡n³WY%|¢KMÒ¹'°øùåÜZì™êþ4k¿ý‹}uÈê¥Ã#Ü
@}4m±:g«ãFšML7²ÈfÉ&E/Ïeú[½òT„á¤%õ˜ŸÚ¶œ'BýÐ6ZäñW<ªµ9*:.úPòY«#÷—-ç|_–ÜÎ
"ž_tV“EtÕày„fåZÕ8ÿSþî.AÙ3v+ä°¤D‰ƒ`´¹RZ¸XÜÂŠçÌ‹4¯½Bh’F
mgÎ
ÕÓq;àÑz¬Nµâ*Qqå„¼é¦¤F‘‹4ŽÝg‹.ÃGÓoÔ¶"ª&V³94¤<ì‘„PûDÍ‘™ÒkK*æ,³aòÄi‹Œ'(rGz¸<òh9žÍòËV.5°=«ø³ÁÅ^ÎB	k~ÐÉ-è—€gTÅGºá³£½†w,|kû»“
ª¤’©Õ$€tàÅü›Œ/lþ[MÑ#xlž¤
E7L<¯Fû8abÙƒÌ*Ë.s]ùû7ïžóßI˜îWù×°8ÕÚ7ºOmj4Ý©)˜ø)A#)øÞ¤ÏV ŒB¡÷såYa$×¶Už÷|c&4Œ³þUuª…l‘0k  w‘¹‘ãìOµ9ÃLý
Úe€fwÅŒ	Úð¡ ¢¶CðÛen‡–*:V™
Y×«_›Õ2lìÿ
£Ãs¢re*2è¤ÌdØªÒFü’iÈí JŠ¦	õÅíÍÌ0Jr¹âø´Œ)ûãÈÆñÔ>Ü¶©üª>;¦íàU°ªÌ¶)´A>ê¢²p†ŸÞèrÍ^¨þ?ßŽë¨ßo,õû‹Ì[pÌäÈ9Q…z4ü~æé"š+c/Ò–‹m$²·7Â?¨ŸwÓ5Þ8:QåwlÖâ&C#Ak|›Ãdd—óIåQõbUýZj£Æ2eÉeAT’±ÞúL\ñ¬!±·óJïzþz›K©ÞÚëà9‡ŽÔ~ßÈ¾VSÚÚ-2 |ª™.-P73—ˆdLIÓ„)š`‰5°aÒk4S;þ¾
ºúò¾¶°xÈ{kË–\[å4Ÿ€Ð>ƒ¼E"Æé¿ûÂŠÞgTlÀ»²DIÀ}j.ÊHC¼ñ.‡§yÃkc±)µAÖÄhöil3Q2‹§˜7ª—!¼—-
,“,e•ÑŠÕÊâJ‘ŠœÊM¥mÑxIc`½ Â¨Br»BYüÐk`X †Ðá†Aª
ð	X_	(`—# Õ{
ìütùSž]Å/Nomðö¦íEÛ~cÒ
7×šIÆLN!©«eØ=Ã©ñ/Ú·äÎòlô+©x¥gØ“7º$âÊKš€ÒúÍG®V÷Q/±ö³¢ç%±´Š•L4Pt/ÝK#Ã;%˜ÝÊho£ˆÔÕopèK!Dˆ§ÉÌÂríY9ÎRêæüBrý6—ðU4¨¸ôÆÖ)ádçke¼è6É\13†½_è\L³ÿæ‡¼YØôÊðßÍõ—_±ô5Ã}»ðÁ7í¤µ|°÷¶÷Èp–ìÕ~lBS© ýüaó˜DÁ Xë#ïßò9ôÓK~½À\ü¬bòdáKs–û¦õrÝ´J\!òõÁ… vü¿½År7TðbøhôQðñ¿åðÕÎ9•µCç[ŒËÊÍ—
ÂûMqÐ(õ¡Þå{Ï°ú&4ÂN‡ßù'êŒôRþÐzè:£ûÙ.e3ÓÙìÎ‡¸æ'ØRìR"’!¾·KðÞQ"ú°@jl¹þ0Ø’¡þo%r1¾Ë·LnSƒÛ·ƒÇ`¾Þª¯uŠÂDÐ ãˆ`Ž£‚+Ýª+y9Fõ¢SZ,‡T‹ä°PÕe³æ¼Jª<Å!@‹Ó´œz‡
ŒvÓ¶óÃ»LqÒ-˜>M¦ëNÓVƒ4ï Â²×Èsís÷”$Ë§üA“ïåŽ$`S[Eb42àùfõÙGô}Lï‘T©Ý›¨MgüÙê$Ä fLpŸþÌ¬¶¨.)FÏÂ¯"ÇŠdwPX‚ŽîØRérÙ1ìc+§ÈxShØ0Âª¨ó¹7³é™EÛ¤¸}¡“cŽ³pB"4M…€ Ì²ñîŠ#¨Ä2¼Ñ´KÆŒ#W±chYÎ!oeüP´tëÖ—}C”.§Ð
ƒ¿ñ&ç&úÏ÷y–TO€G=8	ˆ…~!ñ¼ÝKÓ^˜øŽç‘;7tTÆCK¦ž_œº·ý®ÖÏQ‚Ôìƒ_¾ˆ=cP5ü4.ÆœÖü·è~`øwíý¿¬Çs i-ìIH –äÄm$QJqÊ«ù‘âÞÊ•õi{O9:G2=¹Zfƒ°ÃÏ¿·”áN‚a§ÎpÒÎ†TC¯¯)Dâò¦0¦ÄkE¨Ò§j¦&âa…"{/j•Xc†åË¸´üDe*
ï‹ÌŒäh–"›¬Öi\´Ëøèjw…qH
 K®*¸“ª‘,Ìj	ÝsØø¸’ÓŒ©‹M^U`LyÆKO
ÓÊÑçÃGÎ[Ù]EÖEós^¾Hs^¾0bà6'™ùìúqpå-qN¥‰R¿ïçZµkôƒ²HM.šõìr
²`4C4²â“LÉ$L2$“2É“LÉ$L2$“2É“LÉ$L2$“2Éò_Wð‡€ÞP]AÔ@è@ @ÿ}t@pÿ +{Õe/Ñ±V¡²íìŒh›ž–ùã)0cGd¿UKæ
û˜¼2ü‡$+Žü^f‡À†@Èi·ò5FèóÖÙÄ*§†“G¸bKžÀ•/¿AŸS'^kTDYžE ŽÛ¡zæ1‹ï˜ª£’ŠÎeðÎÀ=ýÞm>ÓÐN?ÂÝ–‘§-j¸—FŽAÇäÜÍŠqG¨UT…„2™4ó<5>|±`I‡ÁK“®œÔ
5vÐ“_ˆ¤§Y [ÏIgxý+=êMuJ{eýSAIOÛ²BÇˆb¤®´ÉËöÆCêhDlòOV«X¨øïIt/u-Ã#ž+¦ÔQ¿gYV„QrY€·XÛ½T†*ëu×L!ÑzxKó}¯z¨¡3u
!Õ‘ÏQœbYÍÓP¡d_\OÚÐ©¶íx˜
»
¢ïÕ3TÔbá!:–P¹;’‚ZA=ŒÙÀäí‚¸!šÚ.=ªÂ"ÞG˜ˆ5¹À© \&gƒeÙåŠ3ÉBÚ¡#pËàgŠ¶gÅó%!6Jlç*ÖHŸj%ÆŒðÛ%Î(V(„H+èRcÌã`£âøA7â4+š™bSYÑµrNsa^ÀS[ƒÜ©'G?lX¢Ó.†,¸Ã% Õä¹€0²¨'–¹Â–&,·6¸Ucp[?Æ@Ô¨7
–*µüü\l…t›¢9>LPn2ˆV
µ“Ž:4)öU|äFùteÊÍ=5€ÅEÉAÞJ¸Ê²¨äbá£'ŽpÐ–EÇGŽIhâM±7ÙÄšÌæÁA)VTn£
òÑ<::Q€èhÖ8ëÔ£ˆõ.22Öäl@1$£Ýyüœ¢;0Í.
ht£{
N ¤†~¶v”úNIÖËÛÆ!SžSGª!Õ—çê;®ÈD8ùnMY¬·ˆ7ˆÇøÆÅc6cWî2‡bÖÊÅd8Õ²Œ..‡'ÿpeqŠ‡p0¦©ÆJB‡H”¿E¹Ä†OsÐp*P)/U‡„•ÖÇ”™·8jC0$Ú,h²7"Ã\`ˆ!ŸÒZ„ŽT×¥,È‡„2åpjwë,©¼uüÀòÊYFÁpõX&ˆ…ÈÖAXVbN/´Ã$°Nc´…Óu»*˜R©œM/È±_/:J8¢%¿“ã¡lY“Ž4Ó¥'É-±P‹8#2Í
5œÂYÂšº6a¡¿oXŠ#*âÝr!M	ôRc‰¹,X@¢£ÝÏêpÎ‰"E0i$¬AFuÁãdª	¢P/’d˜†‹Ü)´êl´í¤¥u·7¸a·LÞŸ3ø›J\SŒžZð]Š×º´eO”*]Î¢Š%ˆÄ¶È”G«¹”n©®Ýl›] ÖŽÂŽVÜ©b´35äxèùKb±Œ=Üvšs—n‹÷W;‘këIrÐº•…¡Ù—m…S:ëàí‘?ÀÅ‹7lŽÚÉlœQáçuÐ}dPy*3žf%(? ;Ÿµ/fCÓ–o¬†Å$ï0SQ¡çQÄ)IAØ¹Ìoû§`øOV0`ûA{Ö®"{\À2Öë£Ú§SóÿžH½Óþ’°Õ»\¦±þ§s‚ûGh‡ûTÍ¿Æ#G}ÿ§Öëgýìâ7ØóßA’%83ÄtNîKMï²G’Õ$è‘]I`€!I_ÎW"€zúåŸêyÞÜí7Íß/D„¾@ÌDÿƒ^9ÿ|jºõÅ“ÜƒÓù\ý
ôLR\)Y·ÉyÐ±IMýÛ-¾àÄ|+ëëFˆjN‚·Ubýðq_äqßtXÂš…S½\],óé÷Òo/|—@;²]ˆyB0ÅPýÜ—‰zâDµ^‰H½]ódÊ•»±§ 6'~B3lá0ÈËbfÓÛŽ¾½2>ðu Œ•õ:¢îjÎ¤ý]ä‰ñóy83vSÖ±oèwJy%£ÝçÛ/ß{±EîóWôÈa;ÅÊ_‰å½ï9Õ«õçÛé´O«½ä¶»íP¸gËwxòØb•/¾²Fk‹úöá'kvF	èñÌ–^eõ€‘Šì÷ÐQ>h"ÈU¾W3e£œUØóÏ¤„µ¿¾7Ó9›s6Öâ9èGvÎuã…tA[Sy-=ÝñíºU²6²¹2¶ï46Àº¤-Rœ_;µue›2‹”•?Ÿµj¢ã6ý‘¦–ó}’±úú-0`{ŸïBO§÷ùèêîÿBP8vìÔju:Pv&ýÿ.	R
¬äÚ³M½ª:yÐƒÁ‡§$PÃ[Ú¹P²¶¿/o1-¥.‰—s—;àyÍÁ¤Ÿí-a´"…j;}jÛvMø~!º–P§f¦~ýÅàLï«?ÑÛ7RèV[B¿Q;öånòmf¨‰ÁéÆÙÜÜÝêêAA±å÷‘mD¬¸ê°Á^äÒ©„©–¹€öØÛ¹‰xªÔ}]¤dÒŽoßË¬ÁÌÜÞG˜›·:BÝåEtWçmýíÌ·³¨]:MÊãNÝÅÇ‹Ôƒ0íFB‹ÛÃÝTG
í.a›^7’M<½O³¹¹Y¹Õàw¼¹\ÆÜÛØA6bêäîJ7S]	¡írÝð *îí‰êÚ@«kÜv½EeÌÛíÜ–ÝÅßº‹(ñQ/Nõ&ÑÝA¬0Öòm
ÜæÒÇèn8Ü·ºdnŒvw‘Ô|É
à.¹krtª.!	f'¹©muï´ÎÝY—[›=6œ¶5iÇ|ƒÝoË´=„i¯¶kt?‘”ù¹Ý>/®Dï(ß‘)x@Ü=oH·ÿ|,»-._º–B·ÝF¨ÅÝ›nÄ|ÎEìpí=x>zo¡ÆqBæãß•Ÿn$oy¹=‡O´ô¬‘úóiƒ„ËŽ&}kÖ…b¢ýgíÐÜt¹…Õ1:Õ–ÝýùÆ¸¸LžÌ´û¬ùí neí‹µOý÷‘1fs·ž0U/—õ½; ´î·OÞÔ.J®ï˜›?È’!3?²Ü;j$‚>†ÐZðTm›FõlG¨ÞÂ(ï³/dâjß~D‹£}tï±FÎ>¸&õõÙÜÃ@ÅO+ˆª÷Y5hÿ•í½_¸&z€.í§	J«ž\ÐÃñ
Ïé¨0¸´ÿžûj¡{ªŽRªkÓóúï×£›'K˜<D=õèá<—ï,S%jµ(Ú?®’ê½ã÷í&VµýsyüÎ¥Þ¥Û¨±Ç²¾¨R{3dHTõd•9Cõå+MAÙ¦ê§Ö‰˜ÓKäá,ÚG†‘¢šzYí|rSï¤=R{|YñI&d’&™’I™dI&d’&™’IòÿéIÈ¤MâÈƒ¯„=|óA’%‹{öþÊ%#þËÕžÿé/‡7:‚èþ¯&óÖ?F™ð‘ì5¯; 5Å„»øó$Sz! ‘ 6ÿÀáÑÜš-: ²Ç|™´Gèñ»T£¾W"1I—+j¡l53J¢cI4q~5kÓkä
Î•bÉ’Ì%-©«œ¹é‡aŒ¦%=˜%.W©7PP†OÉ˜ÌÃÓK””Ô’c‚^/{Öy(ƒ‚Z"5–ýÆ\brf‚QKF
W#\0/iÖU+{Äœ$©k’Ùöeh0Kl÷Rq9¹Úi‰Ó„ZrõœÀ\ŽÃÉ{´ì+1Ç0~N._¬ƒì0ø@`oÆ Û\PØuØX‡â#çÂv,O°brç°n°WçvV+`±¶§ÕVŠW{Ãoè'2<¥‹9ÊUPßQþÿ\C÷Õ™Q(÷×ãBóå‹öÞ9ÊÌÕy]å¨hI¦6«u§˜ë‡õ•dcÖ1-$8þ…(wAû®æaØY´ûðYØ¿ÀªþˆUÅ›ŒûRT„à¶Ÿ£UìNåÿ{½¶*~¡%-Y	ZhBKZâ’ÀÐ†–´$%2™¡
-h	KjbCZÝ’éMâºÍo*KX\;üí„v´ÝÓ^vÒm`§fk{µjOÛ¼à¦Ý×Nj;žöyÕR·Úv®íÕ«=9Üe°Œýí.º)ùY§&’[<&æ²Ô`Â{y/LIÕ!Ks&¸mêÝæ?nÌtø³ü™ÛPjOÛ¼ç¯®îv–Û¹Ë¯íi›W@vcÚ©mçÓ^¯Úí6SËÎµ½Úµ§m^ Ûžk§µO{¼j¸Û`NM;×öjÕž·yuº®Õv=íóªòn
€;µí\Ú«U{Ýæöê¹vWÛö´Í«¼8íÔ¶si¯Wíx›`ªsµµ½÷~Šß2É“LÉ$€{ÝÿGiVÕŒª`ýùsŸ>nýýs_º&«Œ¥ëô3T²§ÿ·ÉÝ¾“^ýB[Øª ¾BçÃ¦yK¹›¡tTÎWo.†ZHÀú®žš!"Íq§PqÐ<‡Ûþ>8ÎkF¹8~Ïk¤îß_EUð‰$@þ/$Ê÷%çÛ/;Üâh^G¯GüûŽaü®MSä´xNÙœoŠi#Ùüö>¦ñ^ã/ÜjTÙO=Oú·±ÃfùN·B"¾tyÏm*¯ Þ³^ŠªÍ$|
>{íÙØúö0ùPŠëùî¦¾ ïî¨.»>€·w°ûË;èk®°òë¿înÒéÝpî|
a¯«;6‚Æ¾\wéä6¯\w›±^_wÃÂý¬¾Íˆ	“[øº¶KÐ½ºîïÀ_×e³üµÝÕ>z>Ûï¦	w¯¾¼¯vï;Zß½#PýgèÐ÷ÙÞ7õ¾{Þhú¤HÔ~ûÙÜîµgq©¦³)¤
ÄM’$%?gC® ‰K™[Dá·,í
ÐûíŠñ@F	Ûê0—Íý‰r®<wæ•ß(lC	=Ú´Ò‰ÎºŠŸ;=5“	(8¬Ý75›º¹î—?eß)ZŽÿOm6ö¼ŽÚtâc-mÙ›aÊI[a{¥3¯
·?‰!«cj$d‰¾ U–BE#gÞçÔµuk¶Ô6}êt¥w-½w÷Þï{-v»k;[j[wÇ‡›9}ï÷ÞkwÞµ½{»»Z±E‚*AQ¤B‘$,ŸêU@J"a‚p@ dfŠïáµkûüw´žd¦ŸR®%+PšÖœç½c±¤sÜ}ë—½ì«(®¥÷U7‘bv´gV(ˆãÄÒÔ™ìâ„H@Ò(Åiÿÿ@ˆ
f ’ËÙÝq·T]"Î¥ü	!cÞ=Ðg"Ôÿ0?ò‹ž%2Pb‘(–*
C^*\Xˆ^Ã“‹,A¹.&Xf™PòRñÂRRâpð…%#”®AI""˜hv³&ˆV\eâ’™•ƒ±aôFz£»1f“©mÏlqTó1Æ’|¦¡£û—ÅÎ
ëh«hÔÀ¸6ªÓ7U”äm5$œ6{¸ˆæ Íãô«Þ@¿2
E«â7˜¯…ÁÝœé¯ª4´U{.D©!Óþ&ë* ³ÊH"¼b	–#kÀW+šÞkÈ*ºLµö³¢Ñð$š3œ2ÙCÄ’¸Å>õ˜=Ö¦x•^ÓAßÝ&œsÁœlö'¢\›zðº22R¥1õž½E¨êœ¹„½óœhVÓS
^J„êó}(¦§6ba^ˆ£©[cOGÄ01g\!Rj»Zêjs«îm M#n¬$ãT2$à®_‡Aç0Ã&ké¹«c„L™……XÒW UE*mn¼Ù{o6gõUÍŸô©#
¹á³ÚLå3ƒü¹r(QuOøºóhP£A(B|§üBH…2Z1Ð#rúê<~¤Îb(Ÿ,S‚•µƒô9‰DQ¸	˜£IÀ¤|†ÍDÒ?©‚é'%’™sÔ¥ø}Ž*7Ü<×ÐÎÿn{ž÷³~Žßš>•è©tzâ=[&Gá>_øó³º|`Iv pjS¼ûJ¡A~eM~Ü¸•ªáŒ¼ÇÄc¡øÃE*,<§&ÎmR¾1 8aCAgZ¸8-I™GEðÚ;×Õç€s=dB¯e(1½ÁUcåjÐ:rê•Íh›"ÇÖ†Ý©Ù<9‰²ç±F?˜lÜ8¢¶†;CiÚÖN’mjŸ–¨5éŒ£¹>:¹¸1ÉZÛ“h«²yå¼Â ¸Ö6’G·u[ÃYÒâËöv•áJ÷¹j8p\žLÙ•n§GÝñÛÌZýI™W¹Ré‡"³²Î¨Ÿi¬p‡>!"›²Ôà†Ý\«A[ÈnE/”à0rj¯§æÕq‹;#å¾®Ë2éÆOTá›·i-Û<"+Gþì;‡”É[sÁ‚ûœ>‘…/TÄÉ‡èt·i_÷½$7
%s‘hê‰üe*:ðÈ2¸s²²5DÁDÓõK=qîàí"‚j\¿Èö_|:‚ò[|êµÒ"0kŒÖd>Û°¤²Œ;+Å¯Ó¡¤^<Ê%ø"ÈñÖ…_ñoÃ	ÔƒÆOàZkÈ{FþžY‚àÞDQMÂ\ßm‚Ëq³öuÖd=ØÇ¬·Œýîþh¡vê9íA¤dpË÷mö-!¾QÏ¨e…â‘£, nGé‘òÝ±€îEkì÷€cèÈÙÈ¢u‡õù±{f…%ò}u]‡-÷ï!m!êÚc3tuKˆCˆB¹lg'PgîZFîpê?AÃ°KTE³’j/ï‡L_îZÆôFîSFá%üÁLäòJ'Iÿ†Q‡fO6je¶†tûtfìŠ\·Þ1Ö"Ù:4ôP‹¶¤B[¶UPSp›îÀÆ§ÜÆÞÞ"eG5rBòtî66á^ÝO´U¡ôås^ ÀK¹;™ÊNoî¦Z3Sö|-WSÙöªþžëèº?ñùb•×xó»Ç|&¯ìã3¨tÞº"3ÿÇé¸·pÀî]µUoâë
x9“®™
ÿ-'›“À½~„|‚Ùîº›+“å‰í*ßõØË>ü%¯¸Œˆ²Î¼¯KÞ/>å:·®ªžûMrèòå>Ù£s¹…”ÊˆûW²îE~o5êhãéãéŸ©>Õ|ÖïŠô"¸~ÆQ;å²;¿{Û[è=™W>ê©Å2ô=?P't¼àz_°Î®§õBùòNñ”«~üç¾r]ûqWopRæ±…ø£e¾#öå)ìöMí#9ºÙi\ÆT0N¡¥°‹‹ƒJ`Cú1ö,J;ÏÆC
2€³ñÅ1àia9ØV”gi²¿ÆqfÞã¥/h2MãXÖ”äŒÚ‡µ&˜µ!Ý[wdXV)Cgõ!¬ÊÞ“)H›˜ê´ÿs¦h>ë†d“1©73õìþî¦ô>‡«ËëîÁéÓÝ'!fE òù3™j×²–=/'Þž{èO{¾¦„.$,ºaá¸|jûq|éÏ£mÇ°Té¶jÏê¿rÖAü?ÙàJ
šˆ
=Nf/î¼]Öza±Ùl6ÊÒä×ëÛ#<£m?yŒ7Ò8ôÌ>²ÝWðle/ÞJÚ’ßHóR<JŸÚ|ÓÓJ†å¯ûù=‚ßéÇäþÞîJ\ýÝcæÚ	Ìq1Õ?`L¡Þ„~íØ*éÄ®†þP¦[œú¾VÈ½QÙ#Í
æ
$Æ‚ð`	ÅFë!Kœ²?m‹?]™nA6j°kõ›yûÉÖºE¸C]‚¼ð‘¦•9‹šëÖxÎ3ñ¶jf²îº3šbiL~£òµ|„Úëa 80_q9iüëüêoE.¸§îÚOF¸QbØajÝŒ*ˆ˜ºØëŽGW³Í½ÿ¼MŸ:Ãþ¬7æ*°Wîbü¶|§mÒ¿ðkÖýÿÅÉí¦‹^E4ùAJèÿUÙÐ0,RMÂVèéùì½fC(ûHÇ³¤½ó¼¿‹h©z·^gjO
ð+¢Þ»oŒ(à€(í-*†€„8)Pd8}
Anon7 - 2022
AnonSec Team