\Registry\Machine

    System
      CurrentControlSet
        Services
            Rip
                DependOnService = REG_MULTI_SZ "Tcpip" "EventLog"
                DisplayName = REG_SZ RIP Service
                ErrorControl = REG_DWORD 0x1
                ImagePath = REG_EXPAND_SZ %SystemRoot%\System32\rip.exe
                ObjectName = REG_SZ LocalSystem
                Start = REG_DWORD 0x2
                Type = REG_DWORD 0x10

            EventLog
                System
                    Rip
                        EventMessageFile = REG_EXPAND_SZ %SystemRoot%\System32\rip.exe
                        TypesSupported = REG_DWORD 0x7