| Min version | 7 | 8 Pre RTM |
|---|---|---|
| Max version | 7 SP1 | 10 TH2 |
| x64 offset offset:bitpos | Field Name | |
| 0x0000 | struct _PRIVILEGE_SET * PrivilegesUsed | |
| 0x0008 | struct _GENERIC_MAPPING GenericMapping | |
| 0x0018 | unsigned long AccessesToAudit | |
| 0x001C | unsigned long MaximumAuditMask | |
| 0x0020 | struct _GUID TransactionId | |
| 0x0030 | void * NewSecurityDescriptor | |
| 0x0038 | void * ExistingSecurityDescriptor | |
| 0x0040 | void * ParentSecurityDescriptor | |
| 0x0048 | function * DeRefSecurityDescriptor | |
| 0x0050 | void * SDLock | |
| 0x0058 | struct _ACCESS_REASONS AccessReasons | |
| 0x00D8 | uint8_t GenerateStagingEvents | |