| Min version | 7 | 8 Pre RTM | |||
|---|---|---|---|---|---|
| Max version | 7 SP1 | 10 TH2 | |||
| Architecture | x86 | x64 | x86 | x64 | |
| x86 offset offset:bitpos | Field Name | x64 offset offset:bitpos | |||
| 0x0000 | struct _PRIVILEGE_SET * PrivilegesUsed | 0x0000 | |||
| 0x0004 | struct _GENERIC_MAPPING GenericMapping | 0x0008 | |||
| 0x0014 | unsigned long AccessesToAudit | 0x0018 | |||
| 0x0018 | unsigned long MaximumAuditMask | 0x001C | |||
| 0x001C | struct _GUID TransactionId | 0x0020 | |||
| 0x002C | void * NewSecurityDescriptor | 0x0030 | |||
| 0x0030 | void * ExistingSecurityDescriptor | 0x0038 | |||
| 0x0034 | void * ParentSecurityDescriptor | 0x0040 | |||
| 0x0038 | function * DeRefSecurityDescriptor | 0x0048 | |||
| 0x003C | void * SDLock | 0x0050 | |||
| 0x0040 | struct _ACCESS_REASONS AccessReasons | 0x0058 | |||
| 0x00C0 | uint8_t GenerateStagingEvents | 0x00D8 | |||