Min version2003/XP64 SP1
Max version10 TH2
x64 offset
offset:bitpos
Field Name
0x0000struct _LUID
OperationID
0x0008uint8_t
SecurityEvaluated
0x0009uint8_t
GenerateAudit
0x000Auint8_t
GenerateOnClose
0x000Buint8_t
PrivilegesAllocated
0x000Cunsigned long
Flags
0x0010unsigned long
RemainingDesiredAccess
0x0014unsigned long
PreviouslyGrantedAccess
0x0018unsigned long
OriginalDesiredAccess
0x0020struct _SECURITY_SUBJECT_CONTEXT
SubjectSecurityContext
0x0040void *
SecurityDescriptor
0x0048void *
AuxData
0x0050union <unnamed-tag>
Privileges
0x007Cuint8_t
AuditPrivileges
0x0080struct _UNICODE_STRING
ObjectName
0x0090struct _UNICODE_STRING
ObjectTypeName