Min versionXP
Max version2003/XP64 SP2
x86 offset
offset:bitpos
Field Name
0x0000unsigned long
CapturedSidCount
0x0004struct _SID_AND_ATTRIBUTES *
CapturedSids
0x0008unsigned long
CapturedSidsLength
0x000Cunsigned long
CapturedGroupCount
0x0010struct _SID_AND_ATTRIBUTES *
CapturedGroups
0x0014unsigned long
CapturedGroupsLength
0x0018unsigned long
CapturedPrivilegeCount
0x001Cstruct _LUID_AND_ATTRIBUTES *
CapturedPrivileges
0x0020unsigned long
CapturedPrivilegesLength