POLICY_AUDIT_EVENT_MASK

• LSA_ENUMERATION_HANDLE, LSA_OPERATIONAL_MODE, POLICY_AUDIT_EVENT_OPTIONS
• LSA_OBJECT_ATTRIBUTES
• LSA_STRING
• LSA_UNICODE_STRING
• PDOMAIN_PASSWORD_INFORMATION
• PLSA_AUTH_INFORMATION
• PLSA_ENUMERATION_HANDLE, PLSA_OPERATIONAL_MODE, PPOLICY_AUDIT_EVENT_OPTIONS
• PLSA_ENUMERATION_INFORMATION
• PLSA_HANDLE
• PLSA_OBJECT_ATTRIBUTES
• PLSA_REFERENCED_DOMAIN_LIST
• PLSA_STRING
• PLSA_TRANSLATED_NAME
• PLSA_TRANSLATED_SID
• PLSA_TRUST_INFORMATION
• PLSA_UNICODE_STRING
• PMSV1_0_AV_PAIR
• PMSV1_0_CHANGEPASSWORD_REQUEST
• PMSV1_0_CHANGEPASSWORD_RESPONSE
• PMSV1_0_DERIVECRED_REQUEST
• PMSV1_0_DERIVECRED_RESPONSE
• PMSV1_0_INTERACTIVE_LOGON
• PMSV1_0_INTERACTIVE_PROFILE
• PMSV1_0_LM20_LOGON
• PMSV1_0_LM20_LOGON_PROFILE
• PMSV1_0_LOGON_SUBMIT_TYPE
• PMSV1_0_NTLM3_RESPONSE
• PMSV1_0_PROFILE_BUFFER_TYPE
• PMSV1_0_PROTOCOL_MESSAGE_TYPE
• PMSV1_0_SUBAUTH_LOGON
• PMSV1_0_SUBAUTH_REQUEST
• PMSV1_0_SUBAUTH_RESPONSE
• PMSV1_0_SUPPLEMENTAL_CREDENTIAL
• POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO
• PPOLICY_ACCOUNT_DOMAIN_INFO
• PPOLICY_AUDIT_EVENTS_INFO
• PPOLICY_AUDIT_EVENT_TYPE
• PPOLICY_AUDIT_FULL_QUERY_INFO
• PPOLICY_AUDIT_FULL_SET_INFO
• PPOLICY_AUDIT_LOG_INFO
• PPOLICY_DEFAULT_QUOTA_INFO
• PPOLICY_DNS_DOMAIN_INFO
• PPOLICY_DOMAIN_INFORMATION_CLASS
• PPOLICY_DOMAIN_KERBEROS_TICKET_INFO
• PPOLICY_DOMAIN_LOCKOUT_INFO
• PPOLICY_DOMAIN_PASSWORD_INFO
• PPOLICY_DOMAIN_PUBLIC_KEY_INFO
• PPOLICY_EFS_INFO
• PPOLICY_INFORMATION_CLASS
• PPOLICY_LOCAL_INFORMATION_CLASS
• PPOLICY_LOCAL_IPSEC_REFERENCE_INFO
• PPOLICY_LOCAL_MACHINE_PASSWORD_INFO
• PPOLICY_LOCAL_POLICY_LOCATION_INFO
• PPOLICY_LOCAL_QUALITY_OF_SERVICE_INFO, PPOLICY_DOMAIN_QUALITY_OF_SERVICE_INFO
• PPOLICY_LSA_SERVER_ROLE
• PPOLICY_LSA_SERVER_ROLE_INFO
• PPOLICY_MODIFICATION_INFO
• PPOLICY_PD_ACCOUNT_INFO
• PPOLICY_PRIMARY_DOMAIN_INFO
• PPOLICY_PRIVILEGE_DEFINITION
• PPOLICY_REPLICA_SOURCE_INFO
• PPOLICY_SERVER_ENABLE_STATE
• PSECURITY_LOGON_TYPE
• PTRUSTED_CONTROLLERS_INFO
• PTRUSTED_DOMAIN_AUTH_INFORMATION
• PTRUSTED_DOMAIN_FULL_INFORMATION
• PTRUSTED_DOMAIN_INFORMATION_BASIC
• PTRUSTED_DOMAIN_INFORMATION_EX
• PTRUSTED_DOMAIN_NAME_INFO
• PTRUSTED_INFORMATION_CLASS
• PTRUSTED_PASSWORD_INFO
• PTRUSTED_POSIX_OFFSET_INFO
• TRUSTED_DOMAIN_INFORMATION_BASIC

• LSA_MODE_PASSWORD_PROTECTED
• MSV1_0_AVID
• MSV1_0_LOGON_SUBMIT_TYPE
• MSV1_0_PROFILE_BUFFER_TYPE
• MSV1_0_PROTOCOL_MESSAGE_TYPE
• POLICY_AUDIT_EVENT_TYPE
• POLICY_DOMAIN_INFORMATION_CLASS
• POLICY_INFORMATION_CLASS
• POLICY_LOCAL_INFORMATION_CLASS
• POLICY_LOCATION_LOCAL
• POLICY_LSA_SERVER_ROLE
• POLICY_MACHINE_POLICY_LOCAL
• POLICY_SERVER_ENABLE_STATE
• SECURITY_LOGON_TYPE
• TRUSTED_INFORMATION_CLASS
• TRUST_ATTRIBUTE_NON_TRANSITIVE
• TRUST_AUTH_TYPE_NONE
• TRUST_DIRECTION_DISABLED
• TRUST_TYPE_DOWNLEVEL

• LSA_SUCCESS
• LsaAddAccountRights
• LsaCallAuthenticationPackage
• LsaClose
• LsaConnectUntrusted
• LsaCreateTrustedDomainEx
• LsaDeleteTrustedDomain
• LsaDeregisterLogonProcess
• LsaEnumerateAccountRights
• LsaEnumerateAccountsWithUserRight
• LsaEnumerateTrustedDomains
• LsaEnumerateTrustedDomainsEx
• LsaFreeMemory
• LsaFreeReturnBuffer
• LsaLogonUser
• LsaLookupAuthenticationPackage
• LsaLookupNames
• LsaLookupSids

• __anonymous

• DOMAIN_PASSWORD_INFORMATION
• LSA_AUTH_INFORMATION
• LSA_ENUMERATION_INFORMATION
• LSA_REFERENCED_DOMAIN_LIST
• LSA_TRANSLATED_NAME
• LSA_TRANSLATED_SID
• LSA_TRUST_INFORMATION
• MSV1_0_AV_PAIR
• MSV1_0_CHANGEPASSWORD_REQUEST
• MSV1_0_CHANGEPASSWORD_RESPONSE
• MSV1_0_DERIVECRED_REQUEST
• MSV1_0_DERIVECRED_RESPONSE
• MSV1_0_INTERACTIVE_LOGON
• MSV1_0_INTERACTIVE_PROFILE
• MSV1_0_LM20_LOGON
• MSV1_0_LM20_LOGON_PROFILE
• MSV1_0_NTLM3_RESPONSE
• MSV1_0_SUBAUTH_LOGON
• MSV1_0_SUBAUTH_REQUEST
• MSV1_0_SUBAUTH_RESPONSE
• MSV1_0_SUPPLEMENTAL_CREDENTIAL
• POLICY_ACCOUNT_DOMAIN_INFO
• POLICY_AUDIT_EVENTS_INFO
• POLICY_AUDIT_FULL_QUERY_INFO
• POLICY_AUDIT_FULL_SET_INFO
• POLICY_AUDIT_LOG_INFO
• POLICY_DEFAULT_QUOTA_INFO
• POLICY_DNS_DOMAIN_INFO
• POLICY_DOMAIN_KERBEROS_TICKET_INFO
• POLICY_DOMAIN_LOCKOUT_INFO
• POLICY_DOMAIN_PASSWORD_INFO
• POLICY_DOMAIN_PUBLIC_KEY_INFO
• POLICY_EFS_INFO
• POLICY_LOCAL_IPSEC_REFERENCE_INFO
• POLICY_LOCAL_MACHINE_PASSWORD_INFO
• POLICY_LOCAL_POLICY_LOCATION_INFO
• POLICY_LOCAL_QUALITY_OF_SERVICE_INFO
• POLICY_LSA_SERVER_ROLE_INFO
• POLICY_MODIFICATION_INFO
• POLICY_PD_ACCOUNT_INFO
• POLICY_PRIMARY_DOMAIN_INFO
• POLICY_PRIVILEGE_DEFINITION
• POLICY_REPLICA_SOURCE_INFO
• TRUSTED_CONTROLLERS_INFO
• TRUSTED_DOMAIN_AUTH_INFORMATION
• TRUSTED_DOMAIN_FULL_INFORMATION
• TRUSTED_DOMAIN_INFORMATION_EX
• TRUSTED_DOMAIN_NAME_INFO
• TRUSTED_PASSWORD_INFO
• TRUSTED_POSIX_OFFSET_INFO

• KERB_WRAP_NO_ENCRYPT
• LOGON_CACHED_ACCOUNT
• LOGON_EXTRA_SIDS
• LOGON_GRACE_LOGON
• LOGON_GUEST
• LOGON_NOENCRYPTION
• LOGON_NTLMV2_ENABLED
• LOGON_PROFILE_PATH_RETURNED
• LOGON_RESOURCE_GROUPS
• LOGON_SERVER_TRUST_ACCOUNT
• LOGON_SUBAUTH_SESSION_KEY
• LOGON_USED_LM_PASSWORD
• MICROSOFT_KERBEROS_NAME_A
• MICROSOFT_KERBEROS_NAME_W
• MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT
• MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT
• MSV1_0_CHALLENGE_LENGTH
• MSV1_0_CLEARTEXT_PASSWORD_ALLOWED
• MSV1_0_CRED_LM_PRESENT
• MSV1_0_CRED_NT_PRESENT
• MSV1_0_CRED_VERSION
• MSV1_0_DERIVECRED_TYPE_SHA1
• MSV1_0_DONT_TRY_GUEST_ACCOUNT
• MSV1_0_LANMAN_SESSION_KEY_LENGTH
• MSV1_0_MAX_AVL_SIZE
• MSV1_0_MAX_NTLM3_LIFE
• MSV1_0_MNS_LOGON
• MSV1_0_NTLM3_INPUT_LENGTH
• MSV1_0_NTLM3_OWF_LENGTH
• MSV1_0_NTLM3_RESPONSE_LENGTH
• MSV1_0_OWF_PASSWORD_LENGTH
• MSV1_0_PACKAGE_NAME
• MSV1_0_PACKAGE_NAMEW
• MSV1_0_PACKAGE_NAMEW_LENGTH
• MSV1_0_RETURN_PASSWORD_EXPIRY
• MSV1_0_RETURN_PROFILE_PATH
• MSV1_0_RETURN_USER_PARAMETERS
• MSV1_0_SUBAUTHENTICATION_DLL
• MSV1_0_SUBAUTHENTICATION_DLL_EX
• MSV1_0_SUBAUTHENTICATION_DLL_IIS
• MSV1_0_SUBAUTHENTICATION_DLL_RAS
• MSV1_0_SUBAUTHENTICATION_DLL_SHIFT
• MSV1_0_SUBAUTHENTICATION_FLAGS
• MSV1_0_SUBAUTHENTICATION_KEY
• MSV1_0_SUBAUTHENTICATION_VALUE
• MSV1_0_TRY_GUEST_ACCOUNT_ONLY
• MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY
• MSV1_0_UPDATE_LOGON_STATISTICS
• MSV1_0_USER_SESSION_KEY_LENGTH
• MSV1_0_USE_CLIENT_CHALLENGE
• POLICY_ALL_ACCESS
• POLICY_AUDIT_EVENT_FAILURE
• POLICY_AUDIT_EVENT_MASK
• POLICY_AUDIT_EVENT_NONE
• POLICY_AUDIT_EVENT_SUCCESS
• POLICY_AUDIT_EVENT_UNCHANGED
• POLICY_AUDIT_LOG_ADMIN
• POLICY_CREATE_ACCOUNT
• POLICY_CREATE_PRIVILEGE
• POLICY_CREATE_SECRET
• POLICY_EXECUTE
• POLICY_GET_PRIVATE_INFORMATION
• POLICY_KERBEROS_FORWARDABLE
• POLICY_KERBEROS_POSTDATEABLE
• POLICY_KERBEROS_PROXYABLE
• POLICY_KERBEROS_RENEWABLE
• POLICY_LOOKUP_NAMES
• POLICY_QOS_ALLOW_LOCAL_ROOT_CERT_STORE
• POLICY_QOS_DHCP_SERVER_ALLOWD
• POLICY_QOS_INBOUND_CONFIDENTIALITY
• POLICY_QOS_INBOUND_INTEGREITY
• POLICY_QOS_OUTBOUND_CONFIDENTIALITY
• POLICY_QOS_OUTBOUND_INTEGRITY
• POLICY_QOS_RAS_SERVER_ALLOWED
• POLICY_QOS_SCHANEL_REQUIRED
• POLICY_READ
• POLICY_SERVER_ADMIN
• POLICY_SET_AUDIT_REQUIREMENTS
• POLICY_SET_DEFAULT_QUOTA_LIMITS
• POLICY_TRUST_ADMIN
• POLICY_VIEW_AUDIT_INFORMATION
• POLICY_VIEW_LOCAL_INFORMATION
• POLICY_WRITE
• SAM_INIT_NOTIFICATION_ROUTINE
• SAM_PASSWORD_CHANGE_NOTIFY_ROUTINE
• SAM_PASSWORD_FILTER_ROUTINE
• SE_BATCH_LOGON_NAME
• SE_INTERACTIVE_LOGON_NAME
• SE_NETWORK_LOGON_NAME
• SE_SERVICE_LOGON_NAME