| 0x117 | Undefined Access (no effect) Bit 7 |
Undefined Access (no effect) Bit 7 |
| 0x600 | Unused message ID |
Unused message ID |
| 0x601 | DELETE |
DELETE |
| 0x602 | READ_CONTROL |
READ_CONTROL |
| 0x603 | WRITE_DAC |
WRITE_DAC |
| 0x604 | WRITE_OWNER |
WRITE_OWNER |
| 0x605 | SYNCHRONIZE |
SYNCHRONIZE |
| 0x606 | ACCESS_SYS_SEC |
ACCESS_SYS_SEC |
| 0x607 | MAX_ALLOWED |
MAX_ALLOWED |
| 0x610 | Unknown specific access (bit 0) |
Unknown specific access (bit 0) |
| 0x611 | Unknown specific access (bit 1) |
Unknown specific access (bit 1) |
| 0x612 | Unknown specific access (bit 2) |
Unknown specific access (bit 2) |
| 0x613 | Unknown specific access (bit 3) |
Unknown specific access (bit 3) |
| 0x614 | Unknown specific access (bit 4) |
Unknown specific access (bit 4) |
| 0x615 | Unknown specific access (bit 5) |
Unknown specific access (bit 5) |
| 0x616 | Unknown specific access (bit 6) |
Unknown specific access (bit 6) |
| 0x617 | Unknown specific access (bit 7) |
Unknown specific access (bit 7) |
| 0x618 | Unknown specific access (bit 8) |
Unknown specific access (bit 8) |
| 0x619 | Unknown specific access (bit 9) |
Unknown specific access (bit 9) |
| 0x61A | Unknown specific access (bit 10) |
Unknown specific access (bit 10) |
| 0x61B | Unknown specific access (bit 11) |
Unknown specific access (bit 11) |
| 0x61C | Unknown specific access (bit 12) |
Unknown specific access (bit 12) |
| 0x61D | Unknown specific access (bit 13) |
Unknown specific access (bit 13) |
| 0x61E | Unknown specific access (bit 14) |
Unknown specific access (bit 14) |
| 0x61F | Unknown specific access (bit 15) |
Unknown specific access (bit 15) |
| 0x641 | Not used |
Not used |
| 0x643 | Assign Primary Token Privilege |
Assign Primary Token Privilege |
| 0x644 | Lock Memory Privilege |
Lock Memory Privilege |
| 0x645 | Increase Memory Quota Privilege |
Increase Memory Quota Privilege |
| 0x646 | Unsolicited Input Privilege |
Unsolicited Input Privilege |
| 0x647 | Trusted Computer Base Privilege |
Trusted Computer Base Privilege |
| 0x648 | Security Privilege |
Security Privilege |
| 0x649 | Take Ownership Privilege |
Take Ownership Privilege |
| 0x64A | Load/Unload Driver Privilege |
Load/Unload Driver Privilege |
| 0x64B | Profile System Privilege |
Profile System Privilege |
| 0x64C | Set System Time Privilege |
Set System Time Privilege |
| 0x64D | Profile Single Process Privilege |
Profile Single Process Privilege |
| 0x64E | Increment Base Priority Privilege |
Increment Base Priority Privilege |
| 0x64F | Create Pagefile Privilege |
Create Pagefile Privilege |
| 0x650 | Create Permanent Object Privilege |
Create Permanent Object Privilege |
| 0x651 | Backup Privilege |
Backup Privilege |
| 0x652 | Restore From Backup Privilege |
Restore From Backup Privilege |
| 0x653 | Shutdown System Privilege |
Shutdown System Privilege |
| 0x654 | Debug Privilege |
Debug Privilege |
| 0x655 | View or Change Audit Log Privilege |
View or Change Audit Log Privilege |
| 0x656 | Change Hardware Environment Privilege |
Change Hardware Environment Privilege |
| 0x657 | Change Notify (and Traverse) Privilege |
Change Notify (and Traverse) Privilege |
| 0x658 | Remotely Shut System Down Privilege |
Remotely Shut System Down Privilege |
| 0x700 | |
|
| 0x703 | Enabled |
Enabled |
| 0x704 | Disabled |
Disabled |
| 0x705 | All |
All |
| 0x706 | None |
None |
| 0x707 | Audit Policy query/set API Operation |
Audit Policy query/set API Operation |
| 0x709 | Granted by |
Granted by |
| 0x70A | Denied by |
Denied by |
| 0x70B | Denied by Integrity Policy check |
Denied by Integrity Policy check |
| 0x70C | Granted by Ownership |
Granted by Ownership |
| 0x70D | Not granted |
Not granted |
| 0x70E | Granted by NULL DACL |
Granted by NULL DACL |
| 0x70F | Denied by Empty DACL |
Denied by Empty DACL |
| 0x710 | Granted by NULL Security Descriptor |
Granted by NULL Security Descriptor |
| 0x711 | Unknown or unchecked |
Unknown or unchecked |
| 0x712 | Not granted due to missing |
Not granted due to missing |
| 0x713 | Granted by ACE on parent folder |
Granted by ACE on parent folder |
| 0x714 | Denied by ACE on parent folder |
Denied by ACE on parent folder |
| 0x715 | Granted by Central Access Rule |
Granted by Central Access Rule |
| 0x716 | NOT Granted by Central Access Rule |
NOT Granted by Central Access Rule |
| 0x717 | Granted by parent folder's Central Access Rule |
Granted by parent folder's Central Access Rule |
| 0x718 | NOT Granted by parent folder's Central Access Rule |
NOT Granted by parent folder's Central Access Rule |
| 0x719 | Unknown Type |
Unknown Type |
| 0x71A | String |
String |
| 0x71B | Unsigned 64-bit Integer |
Unsigned 64-bit Integer |
| 0x71C | 64-bit Integer |
64-bit Integer |
| 0x71D | FQBN |
FQBN |
| 0x71E | Blob |
Blob |
| 0x71F | Sid |
Sid |
| 0x720 | Boolean |
Boolean |
| 0x721 | True |
True |
| 0x722 | False |
False |
| 0x723 | Invalid |
Invalid |
| 0x724 | an ACE too long to display |
an ACE too long to display |
| 0x725 | a Security Descriptor too long to display |
a Security Descriptor too long to display |
| 0x726 | Not granted to AppContainers |
Not granted to AppContainers |
| 0x727 | ... |
... |
| 0x728 | Identification |
Identification |
| 0x729 | Impersonation |
Impersonation |
| 0x730 | Delegation |
Delegation |
| 0x731 | Denied by Process Trust Label ACE |
Denied by Process Trust Label ACE |
| 0x732 | Yes |
Yes |
| 0x733 | No |
No |
| 0x734 | System |
System |
| 0x735 | Not Available |
Not Available |
| 0x736 | Default |
Default |
| 0x737 | DisallowMmConfig |
DisallowMmConfig |
| 0x738 | Off |
Off |
| 0x739 | Auto |
Auto |
| 0x740 | Denied by Access Filter Ace |
Denied by Access Filter Ace |
| 0x750 | REG_NONE |
REG_NONE |
| 0x751 | REG_SZ |
REG_SZ |
| 0x752 | REG_EXPAND_SZ |
REG_EXPAND_SZ |
| 0x753 | REG_BINARY |
REG_BINARY |
| 0x754 | REG_DWORD |
REG_DWORD |
| 0x755 | REG_DWORD_BIG_ENDIAN |
REG_DWORD_BIG_ENDIAN |
| 0x756 | REG_LINK |
REG_LINK |
| 0x757 | REG_MULTI_SZ (New lines are replaced with *. A * is replaced with **) |
REG_MULTI_SZ (New lines are replaced with *. A * is replaced with **) |
| 0x758 | REG_RESOURCE_LIST |
REG_RESOURCE_LIST |
| 0x759 | REG_FULL_RESOURCE_DESCRIPTOR |
REG_FULL_RESOURCE_DESCRIPTOR |
| 0x75A | REG_RESOURCE_REQUIREMENTS_LIST |
REG_RESOURCE_REQUIREMENTS_LIST |
| 0x75B | REG_QWORD |
REG_QWORD |
| 0x770 | New registry value created |
New registry value created |
| 0x771 | Existing registry value modified |
Existing registry value modified |
| 0x772 | Registry value deleted |
Registry value deleted |
| 0x780 | Sunday |
Sunday |
| 0x781 | Monday |
Monday |
| 0x782 | Tuesday |
Tuesday |
| 0x783 | Wednesday |
Wednesday |
| 0x784 | Thursday |
Thursday |
| 0x785 | Friday |
Friday |
| 0x786 | Saturday |
Saturday |
| 0x790 | TokenElevationTypeDefault (1) |
TokenElevationTypeDefault (1) |
| 0x791 | TokenElevationTypeFull (2) |
TokenElevationTypeFull (2) |
| 0x792 | TokenElevationTypeLimited (3) |
TokenElevationTypeLimited (3) |
| 0x800 | Account Enabled |
Account Enabled |
| 0x801 | 'Home Directory Required' - Disabled |
'Home Directory Required' - Disabled |
| 0x802 | 'Password Not Required' - Disabled |
'Password Not Required' - Disabled |
| 0x803 | 'Temp Duplicate Account' - Disabled |
'Temp Duplicate Account' - Disabled |
| 0x804 | 'Normal Account' - Disabled |
'Normal Account' - Disabled |
| 0x805 | 'MNS Logon Account' - Disabled |
'MNS Logon Account' - Disabled |
| 0x806 | 'Interdomain Trust Account' - Disabled |
'Interdomain Trust Account' - Disabled |
| 0x807 | 'Workstation Trust Account' - Disabled |
'Workstation Trust Account' - Disabled |
| 0x808 | 'Server Trust Account' - Disabled |
'Server Trust Account' - Disabled |
| 0x809 | 'Don't Expire Password' - Disabled |
'Don't Expire Password' - Disabled |
| 0x80A | Account Unlocked |
Account Unlocked |
| 0x80B | 'Encrypted Text Password Allowed' - Disabled |
'Encrypted Text Password Allowed' - Disabled |
| 0x80C | 'Smartcard Required' - Disabled |
'Smartcard Required' - Disabled |
| 0x80D | 'Trusted For Delegation' - Disabled |
'Trusted For Delegation' - Disabled |
| 0x80E | 'Not Delegated' - Disabled |
'Not Delegated' - Disabled |
| 0x80F | 'Use DES Key Only' - Disabled |
'Use DES Key Only' - Disabled |
| 0x810 | 'Don't Require Preauth' - Disabled |
'Don't Require Preauth' - Disabled |
| 0x811 | 'Password Expired' - Disabled |
'Password Expired' - Disabled |
| 0x812 | 'Trusted To Authenticate For Delegation' - Disabled |
'Trusted To Authenticate For Delegation' - Disabled |
| 0x813 | 'Exclude Authorization Information' - Disabled |
'Exclude Authorization Information' - Disabled |
| 0x814 | 'Undefined UserAccountControl Bit 20' - Disabled |
'Undefined UserAccountControl Bit 20' - Disabled |
| 0x815 | 'Protect Kerberos Service Tickets with AES Keys' - Disabled |
'Protect Kerberos Service Tickets with AES Keys' - Disabled |
| 0x816 | 'Undefined UserAccountControl Bit 22' - Disabled |
'Undefined UserAccountControl Bit 22' - Disabled |
| 0x817 | 'Undefined UserAccountControl Bit 23' - Disabled |
'Undefined UserAccountControl Bit 23' - Disabled |
| 0x818 | 'Undefined UserAccountControl Bit 24' - Disabled |
'Undefined UserAccountControl Bit 24' - Disabled |
| 0x819 | 'Undefined UserAccountControl Bit 25' - Disabled |
'Undefined UserAccountControl Bit 25' - Disabled |
| 0x81A | 'Undefined UserAccountControl Bit 26' - Disabled |
'Undefined UserAccountControl Bit 26' - Disabled |
| 0x81B | 'Undefined UserAccountControl Bit 27' - Disabled |
'Undefined UserAccountControl Bit 27' - Disabled |
| 0x81C | 'Undefined UserAccountControl Bit 28' - Disabled |
'Undefined UserAccountControl Bit 28' - Disabled |
| 0x81D | 'Undefined UserAccountControl Bit 29' - Disabled |
'Undefined UserAccountControl Bit 29' - Disabled |
| 0x81E | 'Undefined UserAccountControl Bit 30' - Disabled |
'Undefined UserAccountControl Bit 30' - Disabled |
| 0x81F | 'Undefined UserAccountControl Bit 31' - Disabled |
'Undefined UserAccountControl Bit 31' - Disabled |
| 0x820 | Account Disabled |
Account Disabled |
| 0x821 | 'Home Directory Required' - Enabled |
'Home Directory Required' - Enabled |
| 0x822 | 'Password Not Required' - Enabled |
'Password Not Required' - Enabled |
| 0x823 | 'Temp Duplicate Account' - Enabled |
'Temp Duplicate Account' - Enabled |
| 0x824 | 'Normal Account' - Enabled |
'Normal Account' - Enabled |
| 0x825 | 'MNS Logon Account' - Enabled |
'MNS Logon Account' - Enabled |
| 0x826 | 'Interdomain Trust Account' - Enabled |
'Interdomain Trust Account' - Enabled |
| 0x827 | 'Workstation Trust Account' - Enabled |
'Workstation Trust Account' - Enabled |
| 0x828 | 'Server Trust Account' - Enabled |
'Server Trust Account' - Enabled |
| 0x829 | 'Don't Expire Password' - Enabled |
'Don't Expire Password' - Enabled |
| 0x82A | Account Locked |
Account Locked |
| 0x82B | 'Encrypted Text Password Allowed' - Enabled |
'Encrypted Text Password Allowed' - Enabled |
| 0x82C | 'Smartcard Required' - Enabled |
'Smartcard Required' - Enabled |
| 0x82D | 'Trusted For Delegation' - Enabled |
'Trusted For Delegation' - Enabled |
| 0x82E | 'Not Delegated' - Enabled |
'Not Delegated' - Enabled |
| 0x82F | 'Use DES Key Only' - Enabled |
'Use DES Key Only' - Enabled |
| 0x830 | 'Don't Require Preauth' - Enabled |
'Don't Require Preauth' - Enabled |
| 0x831 | 'Password Expired' - Enabled |
'Password Expired' - Enabled |
| 0x832 | 'Trusted To Authenticate For Delegation' - Enabled |
'Trusted To Authenticate For Delegation' - Enabled |
| 0x833 | 'Exclude Authorization Information' - Enabled |
'Exclude Authorization Information' - Enabled |
| 0x834 | 'Undefined UserAccountControl Bit 20' - Enabled |
'Undefined UserAccountControl Bit 20' - Enabled |
| 0x835 | 'Protect Kerberos Service Tickets with AES Keys' - Enabled |
'Protect Kerberos Service Tickets with AES Keys' - Enabled |
| 0x836 | 'Undefined UserAccountControl Bit 22' - Enabled |
'Undefined UserAccountControl Bit 22' - Enabled |
| 0x837 | 'Undefined UserAccountControl Bit 23' - Enabled |
'Undefined UserAccountControl Bit 23' - Enabled |
| 0x838 | 'Undefined UserAccountControl Bit 24' - Enabled |
'Undefined UserAccountControl Bit 24' - Enabled |
| 0x839 | 'Undefined UserAccountControl Bit 25' - Enabled |
'Undefined UserAccountControl Bit 25' - Enabled |
| 0x83A | 'Undefined UserAccountControl Bit 26' - Enabled |
'Undefined UserAccountControl Bit 26' - Enabled |
| 0x83B | 'Undefined UserAccountControl Bit 27' - Enabled |
'Undefined UserAccountControl Bit 27' - Enabled |
| 0x83C | 'Undefined UserAccountControl Bit 28' - Enabled |
'Undefined UserAccountControl Bit 28' - Enabled |
| 0x83D | 'Undefined UserAccountControl Bit 29' - Enabled |
'Undefined UserAccountControl Bit 29' - Enabled |
| 0x83E | 'Undefined UserAccountControl Bit 30' - Enabled |
'Undefined UserAccountControl Bit 30' - Enabled |
| 0x83F | 'Undefined UserAccountControl Bit 31' - Enabled |
'Undefined UserAccountControl Bit 31' - Enabled |
| 0x900 | An Error occured during Logon. |
An Error occured during Logon. |
| 0x901 | The specified user account has expired. |
The specified user account has expired. |
| 0x902 | The NetLogon component is not active. |
The NetLogon component is not active. |
| 0x903 | Account locked out. |
Account locked out. |
| 0x904 | The user has not been granted the requested logon type at this machine. |
The user has not been granted the requested logon type at this machine. |
| 0x905 | The specified account's password has expired. |
The specified account's password has expired. |
| 0x906 | Account currently disabled. |
Account currently disabled. |
| 0x907 | Account logon time restriction violation. |
Account logon time restriction violation. |
| 0x908 | User not allowed to logon at this computer. |
User not allowed to logon at this computer. |
| 0x909 | Unknown user name or bad password. |
Unknown user name or bad password. |
| 0x90A | Domain sid inconsistent. |
Domain sid inconsistent. |
| 0x90B | Smartcard logon is required and was not used. |
Smartcard logon is required and was not used. |
| 0x980 | Not Available. |
Not Available. |
| 0x984 | Random number generator failure. |
Random number generator failure. |
| 0x985 | Random number generation failed FIPS-140 pre-hash check. |
Random number generation failed FIPS-140 pre-hash check. |
| 0x986 | Failed to zero secret data. |
Failed to zero secret data. |
| 0x987 | Key failed pair wise consistency check. |
Key failed pair wise consistency check. |
| 0x990 | Failed to unprotect persistent cryptographic key. |
Failed to unprotect persistent cryptographic key. |
| 0x991 | Key export checks failed. |
Key export checks failed. |
| 0x992 | Validation of public key failed. |
Validation of public key failed. |
| 0x993 | Signature verification failed. |
Signature verification failed. |
| 0x998 | Open key file. |
Open key file. |
| 0x999 | Delete key file. |
Delete key file. |
| 0x99A | Read persisted key from file. |
Read persisted key from file. |
| 0x99B | Write persisted key to file. |
Write persisted key to file. |
| 0x9A0 | Export of persistent cryptographic key. |
Export of persistent cryptographic key. |
| 0x9A1 | Import of persistent cryptographic key. |
Import of persistent cryptographic key. |
| 0x9B0 | Open Key. |
Open Key. |
| 0x9B1 | Create Key. |
Create Key. |
| 0x9B2 | Delete Key. |
Delete Key. |
| 0x9B3 | Encrypt. |
Encrypt. |
| 0x9B4 | Decrypt. |
Decrypt. |
| 0x9B5 | Sign hash. |
Sign hash. |
| 0x9B6 | Secret agreement. |
Secret agreement. |
| 0x9B7 | Domain settings |
Domain settings |
| 0x9B8 | Local settings |
Local settings |
| 0x9B9 | Add provider. |
Add provider. |
| 0x9BA | Remove provider. |
Remove provider. |
| 0x9BB | Add context. |
Add context. |
| 0x9BC | Remove context. |
Remove context. |
| 0x9BD | Add function. |
Add function. |
| 0x9BE | Remove function. |
Remove function. |
| 0x9BF | Add function provider. |
Add function provider. |
| 0x9C0 | Remove function provider. |
Remove function provider. |
| 0x9C1 | Add function property. |
Add function property. |
| 0x9C2 | Remove function property. |
Remove function property. |
| 0x9C3 | Machine key. |
Machine key. |
| 0x9C4 | User key. |
User key. |
| 0x9C5 | Key Derivation. |
Key Derivation. |
| 0x1100 | Device Access Bit 0 |
Device Access Bit 0 |
| 0x1101 | Device Access Bit 1 |
Device Access Bit 1 |
| 0x1102 | Device Access Bit 2 |
Device Access Bit 2 |
| 0x1103 | Device Access Bit 3 |
Device Access Bit 3 |
| 0x1104 | Device Access Bit 4 |
Device Access Bit 4 |
| 0x1105 | Device Access Bit 5 |
Device Access Bit 5 |
| 0x1106 | Device Access Bit 6 |
Device Access Bit 6 |
| 0x1107 | Device Access Bit 7 |
Device Access Bit 7 |
| 0x1108 | Device Access Bit 8 |
Device Access Bit 8 |
| 0x1109 | Undefined Access (no effect) Bit 9 |
Undefined Access (no effect) Bit 9 |
| 0x110A | Undefined Access (no effect) Bit 10 |
Undefined Access (no effect) Bit 10 |
| 0x110B | Undefined Access (no effect) Bit 11 |
Undefined Access (no effect) Bit 11 |
| 0x110C | Undefined Access (no effect) Bit 12 |
Undefined Access (no effect) Bit 12 |
| 0x110D | Undefined Access (no effect) Bit 13 |
Undefined Access (no effect) Bit 13 |
| 0x110E | Undefined Access (no effect) Bit 14 |
Undefined Access (no effect) Bit 14 |
| 0x110F | Undefined Access (no effect) Bit 15 |
Undefined Access (no effect) Bit 15 |
| 0x1110 | Query directory |
Query directory |
| 0x1111 | Traverse |
Traverse |
| 0x1112 | Create object in directory |
Create object in directory |
| 0x1113 | Create sub-directory |
Create sub-directory |
| 0x1114 | Undefined Access (no effect) Bit 4 |
Undefined Access (no effect) Bit 4 |
| 0x1115 | Undefined Access (no effect) Bit 5 |
Undefined Access (no effect) Bit 5 |
| 0x1116 | Undefined Access (no effect) Bit 6 |
Undefined Access (no effect) Bit 6 |
| 0x1118 | Undefined Access (no effect) Bit 8 |
Undefined Access (no effect) Bit 8 |
| 0x1120 | Query event state |
Query event state |
| 0x1121 | Modify event state |
Modify event state |
| 0x1122 | Undefined Access (no effect) Bit 2 |
Undefined Access (no effect) Bit 2 |
| 0x1123 | Undefined Access (no effect) Bit 3 |
Undefined Access (no effect) Bit 3 |
| 0x1140 | ReadData (or ListDirectory) |
ReadData (or ListDirectory) |
| 0x1141 | WriteData (or AddFile) |
WriteData (or AddFile) |
| 0x1142 | AppendData (or AddSubdirectory or CreatePipeInstance) |
AppendData (or AddSubdirectory or CreatePipeInstance) |
| 0x1143 | ReadEA |
ReadEA |
| 0x1144 | WriteEA |
WriteEA |
| 0x1145 | Execute/Traverse |
Execute/Traverse |
| 0x1146 | DeleteChild |
DeleteChild |
| 0x1147 | ReadAttributes |
ReadAttributes |
| 0x1148 | WriteAttributes |
WriteAttributes |
| 0x1150 | Query key value |
Query key value |
| 0x1151 | Set key value |
Set key value |
| 0x1152 | Create sub-key |
Create sub-key |
| 0x1153 | Enumerate sub-keys |
Enumerate sub-keys |
| 0x1154 | Notify about changes to keys |
Notify about changes to keys |
| 0x1155 | Create Link |
Create Link |
| 0x1158 | Enable 64(or 32) bit application to open 64 bit key |
Enable 64(or 32) bit application to open 64 bit key |
| 0x1159 | Enable 64(or 32) bit application to open 32 bit key |
Enable 64(or 32) bit application to open 32 bit key |
| 0x1160 | Query mutant state |
Query mutant state |
| 0x1161 | Undefined Access (no effect) Bit 1 |
Undefined Access (no effect) Bit 1 |
| 0x1170 | Communicate using port |
Communicate using port |
| 0x1180 | Force process termination |
Force process termination |
| 0x1181 | Create new thread in process |
Create new thread in process |
| 0x1182 | Set process session ID |
Set process session ID |
| 0x1183 | Perform virtual memory operation |
Perform virtual memory operation |
| 0x1184 | Read from process memory |
Read from process memory |
| 0x1185 | Write to process memory |
Write to process memory |
| 0x1186 | Duplicate handle into or out of process |
Duplicate handle into or out of process |
| 0x1187 | Create a subprocess of process |
Create a subprocess of process |
| 0x1188 | Set process quotas |
Set process quotas |
| 0x1189 | Set process information |
Set process information |
| 0x118A | Query process information |
Query process information |
| 0x118B | Set process termination port |
Set process termination port |
| 0x1190 | Control profile |
Control profile |
| 0x11A0 | Query section state |
Query section state |
| 0x11A1 | Map section for write |
Map section for write |
| 0x11A2 | Map section for read |
Map section for read |
| 0x11A3 | Map section for execute |
Map section for execute |
| 0x11A4 | Extend size |
Extend size |
| 0x11B0 | Query semaphore state |
Query semaphore state |
| 0x11B1 | Modify semaphore state |
Modify semaphore state |
| 0x11C0 | Use symbolic link |
Use symbolic link |
| 0x11D0 | Force thread termination |
Force thread termination |
| 0x11D1 | Suspend or resume thread |
Suspend or resume thread |
| 0x11D2 | Send an alert to thread |
Send an alert to thread |
| 0x11D3 | Get thread context |
Get thread context |
| 0x11D4 | Set thread context |
Set thread context |
| 0x11D5 | Set thread information |
Set thread information |
| 0x11D6 | Query thread information |
Query thread information |
| 0x11D7 | Assign a token to the thread |
Assign a token to the thread |
| 0x11D8 | Cause thread to directly impersonate another thread |
Cause thread to directly impersonate another thread |
| 0x11D9 | Directly impersonate this thread |
Directly impersonate this thread |
| 0x11E0 | Query timer state |
Query timer state |
| 0x11E1 | Modify timer state |
Modify timer state |
| 0x11F0 | AssignAsPrimary |
AssignAsPrimary |
| 0x11F1 | Duplicate |
Duplicate |
| 0x11F2 | Impersonate |
Impersonate |
| 0x11F3 | Query |
Query |
| 0x11F4 | QuerySource |
QuerySource |
| 0x11F5 | AdjustPrivileges |
AdjustPrivileges |
| 0x11F6 | AdjustGroups |
AdjustGroups |
| 0x11F7 | AdjustDefaultDacl |
AdjustDefaultDacl |
| 0x11F8 | AdjustSessionID |
AdjustSessionID |
| 0x1200 | Create instance of object type |
Create instance of object type |
| 0x1300 | Query State |
Query State |
| 0x1301 | Modify State |
Modify State |
| 0x1400 | Channel read message |
Channel read message |
| 0x1401 | Channel write message |
Channel write message |
| 0x1402 | Channel query information |
Channel query information |
| 0x1403 | Channel set information |
Channel set information |
| 0x1410 | Assign process |
Assign process |
| 0x1411 | Set Attributes |
Set Attributes |
| 0x1412 | Query Attributes |
Query Attributes |
| 0x1413 | Terminate Job |
Terminate Job |
| 0x1414 | Set Security Attributes |
Set Security Attributes |
| 0x1500 | ConnectToServer |
ConnectToServer |
| 0x1501 | ShutdownServer |
ShutdownServer |
| 0x1502 | InitializeServer |
InitializeServer |
| 0x1503 | CreateDomain |
CreateDomain |
| 0x1504 | EnumerateDomains |
EnumerateDomains |
| 0x1505 | LookupDomain |
LookupDomain |
| 0x1510 | ReadPasswordParameters |
ReadPasswordParameters |
| 0x1511 | WritePasswordParameters |
WritePasswordParameters |
| 0x1512 | ReadOtherParameters |
ReadOtherParameters |
| 0x1513 | WriteOtherParameters |
WriteOtherParameters |
| 0x1514 | CreateUser |
CreateUser |
| 0x1515 | CreateGlobalGroup |
CreateGlobalGroup |
| 0x1516 | CreateLocalGroup |
CreateLocalGroup |
| 0x1517 | GetLocalGroupMembership |
GetLocalGroupMembership |
| 0x1518 | ListAccounts |
ListAccounts |
| 0x1519 | LookupIDs |
LookupIDs |
| 0x151A | AdministerServer |
AdministerServer |
| 0x1520 | ReadInformation |
ReadInformation |
| 0x1521 | WriteAccount |
WriteAccount |
| 0x1522 | AddMember |
AddMember |
| 0x1523 | RemoveMember |
RemoveMember |
| 0x1524 | ListMembers |
ListMembers |
| 0x1540 | ReadGeneralInformation |
ReadGeneralInformation |
| 0x1541 | ReadPreferences |
ReadPreferences |
| 0x1542 | WritePreferences |
WritePreferences |
| 0x1543 | ReadLogon |
ReadLogon |
| 0x1544 | ReadAccount |
ReadAccount |
| 0x1546 | ChangePassword (with knowledge of old password) |
ChangePassword (with knowledge of old password) |
| 0x1547 | SetPassword (without knowledge of old password) |
SetPassword (without knowledge of old password) |
| 0x1548 | ListGroups |
ListGroups |
| 0x1549 | ReadGroupMembership |
ReadGroupMembership |
| 0x154A | ChangeGroupMembership |
ChangeGroupMembership |
| 0x1600 | View non-sensitive policy information |
View non-sensitive policy information |
| 0x1601 | View system audit requirements |
View system audit requirements |
| 0x1602 | Get sensitive policy information |
Get sensitive policy information |
| 0x1603 | Modify domain trust relationships |
Modify domain trust relationships |
| 0x1604 | Create special accounts (for assignment of user rights) |
Create special accounts (for assignment of user rights) |
| 0x1605 | Create a secret object |
Create a secret object |
| 0x1606 | Create a privilege |
Create a privilege |
| 0x1607 | Set default quota limits |
Set default quota limits |
| 0x1608 | Change system audit requirements |
Change system audit requirements |
| 0x1609 | Administer audit log attributes |
Administer audit log attributes |
| 0x160A | Enable/Disable LSA |
Enable/Disable LSA |
| 0x160B | Lookup Names/SIDs |
Lookup Names/SIDs |
| 0x1610 | Change secret value |
Change secret value |
| 0x1611 | Query secret value |
Query secret value |
| 0x1620 | Query trusted domain name/SID |
Query trusted domain name/SID |
| 0x1621 | Retrieve the controllers in the trusted domain |
Retrieve the controllers in the trusted domain |
| 0x1622 | Change the controllers in the trusted domain |
Change the controllers in the trusted domain |
| 0x1623 | Query the Posix ID offset assigned to the trusted domain |
Query the Posix ID offset assigned to the trusted domain |
| 0x1624 | Change the Posix ID offset assigned to the trusted domain |
Change the Posix ID offset assigned to the trusted domain |
| 0x1630 | Query account information |
Query account information |
| 0x1631 | Change privileges assigned to account |
Change privileges assigned to account |
| 0x1632 | Change quotas assigned to account |
Change quotas assigned to account |
| 0x1633 | Change logon capabilities assigned to account |
Change logon capabilities assigned to account |
| 0x1634 | Change the Posix ID offset assigned to the accounted domain |
Change the Posix ID offset assigned to the accounted domain |
| 0x1640 | KeyedEvent Wait |
KeyedEvent Wait |
| 0x1641 | KeyedEvent Wake |
KeyedEvent Wake |
| 0x1A00 | Enumerate desktops |
Enumerate desktops |
| 0x1A01 | Read attributes |
Read attributes |
| 0x1A02 | Access Clipboard |
Access Clipboard |
| 0x1A03 | Create desktop |
Create desktop |
| 0x1A04 | Write attributes |
Write attributes |
| 0x1A05 | Access global atoms |
Access global atoms |
| 0x1A06 | Exit windows |
Exit windows |
| 0x1A07 | Unused Access Flag |
Unused Access Flag |
| 0x1A08 | Include this windowstation in enumerations |
Include this windowstation in enumerations |
| 0x1A09 | Read screen |
Read screen |
| 0x1A10 | Read Objects |
Read Objects |
| 0x1A11 | Create window |
Create window |
| 0x1A12 | Create menu |
Create menu |
| 0x1A13 | Hook control |
Hook control |
| 0x1A14 | Journal (record) |
Journal (record) |
| 0x1A15 | Journal (playback) |
Journal (playback) |
| 0x1A16 | Include this desktop in enumerations |
Include this desktop in enumerations |
| 0x1A17 | Write objects |
Write objects |
| 0x1A18 | Switch to this desktop |
Switch to this desktop |
| 0x1B00 | Administer print server |
Administer print server |
| 0x1B01 | Enumerate printers |
Enumerate printers |
| 0x1B12 | Full Control |
Full Control |
| 0x1B13 | Print |
Print |
| 0x1B24 | Administer Document |
Administer Document |
| 0x1C00 | Connect to service controller |
Connect to service controller |
| 0x1C01 | Create a new service |
Create a new service |
| 0x1C02 | Enumerate services |
Enumerate services |
| 0x1C03 | Lock service database for exclusive access |
Lock service database for exclusive access |
| 0x1C04 | Query service database lock state |
Query service database lock state |
| 0x1C05 | Set last-known-good state of service database |
Set last-known-good state of service database |
| 0x1C10 | Query service configuration information |
Query service configuration information |
| 0x1C11 | Set service configuration information |
Set service configuration information |
| 0x1C12 | Query status of service |
Query status of service |
| 0x1C13 | Enumerate dependencies of service |
Enumerate dependencies of service |
| 0x1C14 | Start the service |
Start the service |
| 0x1C15 | Stop the service |
Stop the service |
| 0x1C16 | Pause or continue the service |
Pause or continue the service |
| 0x1C17 | Query information from service |
Query information from service |
| 0x1C18 | Issue service-specific control commands |
Issue service-specific control commands |
| 0x1D00 | DDE Share Read |
DDE Share Read |
| 0x1D01 | DDE Share Write |
DDE Share Write |
| 0x1D02 | DDE Share Initiate Static |
DDE Share Initiate Static |
| 0x1D03 | DDE Share Initiate Link |
DDE Share Initiate Link |
| 0x1D04 | DDE Share Request |
DDE Share Request |
| 0x1D05 | DDE Share Advise |
DDE Share Advise |
| 0x1D06 | DDE Share Poke |
DDE Share Poke |
| 0x1D07 | DDE Share Execute |
DDE Share Execute |
| 0x1D08 | DDE Share Add Items |
DDE Share Add Items |
| 0x1D09 | DDE Share List Items |
DDE Share List Items |
| 0x1E00 | Create Child |
Create Child |
| 0x1E01 | Delete Child |
Delete Child |
| 0x1E02 | List Contents |
List Contents |
| 0x1E03 | Write Self |
Write Self |
| 0x1E04 | Read Property |
Read Property |
| 0x1E05 | Write Property |
Write Property |
| 0x1E06 | Delete Tree |
Delete Tree |
| 0x1E07 | List Object |
List Object |
| 0x1E08 | Control Access |
Control Access |
| 0x1F00 | Audit Set System Policy |
Audit Set System Policy |
| 0x1F01 | Audit Query System Policy |
Audit Query System Policy |
| 0x1F02 | Audit Set Per User Policy |
Audit Set Per User Policy |
| 0x1F03 | Audit Query Per User Policy |
Audit Query Per User Policy |
| 0x1F04 | Audit Enumerate Users |
Audit Enumerate Users |
| 0x1F05 | Audit Set Options |
Audit Set Options |
| 0x1F06 | Audit Query Options |
Audit Query Options |
| 0x1F80 | Port sharing (read) |
Port sharing (read) |
| 0x1F81 | Port sharing (write) |
Port sharing (write) |
| 0x1FA0 | Default credentials |
Default credentials |
| 0x1FA1 | Credentials manager |
Credentials manager |
| 0x1FA2 | Fresh credentials |
Fresh credentials |
| 0x2000 | Kerberos |
Kerberos |
| 0x2001 | Preshared key |
Preshared key |
| 0x2002 | Unknown authentication |
Unknown authentication |
| 0x2003 | DES |
DES |
| 0x2004 | 3DES |
3DES |
| 0x2005 | MD5 |
MD5 |
| 0x2006 | SHA1 |
SHA1 |
| 0x2007 | Local computer |
Local computer |
| 0x2008 | Remote computer |
Remote computer |
| 0x2009 | No state |
No state |
| 0x200A | Sent first (SA) payload |
Sent first (SA) payload |
| 0x200B | Sent second (KE) payload |
Sent second (KE) payload |
| 0x200C | Sent third (ID) payload |
Sent third (ID) payload |
| 0x200D | Initiator |
Initiator |
| 0x200E | Responder |
Responder |
| 0x2011 | Sent final payload |
Sent final payload |
| 0x2012 | Complete |
Complete |
| 0x2013 | Unknown |
Unknown |
| 0x2014 | Transport |
Transport |
| 0x2015 | Tunnel |
Tunnel |
| 0x2016 | IKE/AuthIP DoS prevention mode started |
IKE/AuthIP DoS prevention mode started |
| 0x2017 | IKE/AuthIP DoS prevention mode stopped |
IKE/AuthIP DoS prevention mode stopped |
| 0x2019 | Not enabled |
Not enabled |
| 0x201B | Sent first (EM attributes) payload |
Sent first (EM attributes) payload |
| 0x201C | Sent second (SSPI) payload |
Sent second (SSPI) payload |
| 0x201D | Sent third (hash) payload |
Sent third (hash) payload |
| 0x201E | IKEv1 |
IKEv1 |
| 0x201F | AuthIP |
AuthIP |
| 0x2020 | Anonymous |
Anonymous |
| 0x2021 | NTLM V2 |
NTLM V2 |
| 0x2022 | CGA |
CGA |
| 0x2023 | Certificate |
Certificate |
| 0x2024 | SSL |
SSL |
| 0x2026 | DH group 1 |
DH group 1 |
| 0x2027 | DH group 2 |
DH group 2 |
| 0x2028 | DH group 14 |
DH group 14 |
| 0x2029 | DH group ECP 256 |
DH group ECP 256 |
| 0x202A | DH group ECP 384 |
DH group ECP 384 |
| 0x202B | AES-128 |
AES-128 |
| 0x202C | AES-192 |
AES-192 |
| 0x202D | AES-256 |
AES-256 |
| 0x202E | Certificate ECDSA P256 |
Certificate ECDSA P256 |
| 0x202F | Certificate ECDSA P384 |
Certificate ECDSA P384 |
| 0x2030 | SSL ECDSA P256 |
SSL ECDSA P256 |
| 0x2031 | SSL ECDSA P384 |
SSL ECDSA P384 |
| 0x2032 | SHA 256 |
SHA 256 |
| 0x2033 | SHA 384 |
SHA 384 |
| 0x2034 | IKEv2 |
IKEv2 |
| 0x2035 | EAP payload sent |
EAP payload sent |
| 0x2036 | Authentication payload sent |
Authentication payload sent |
| 0x2037 | EAP |
EAP |
| 0x2038 | DH group 24 |
DH group 24 |
| 0x2051 | Logon/Logoff |
Logon/Logoff |
| 0x2052 | Object Access |
Object Access |
| 0x2053 | Privilege Use |
Privilege Use |
| 0x2054 | Detailed Tracking |
Detailed Tracking |
| 0x2055 | Policy Change |
Policy Change |
| 0x2056 | Account Management |
Account Management |
| 0x2057 | DS Access |
DS Access |
| 0x2058 | Account Logon |
Account Logon |
| 0x2100 | Success removed |
Success removed |
| 0x2101 | Success Added |
Success Added |
| 0x2102 | Failure removed |
Failure removed |
| 0x2103 | Failure added |
Failure added |
| 0x2104 | Success include removed |
Success include removed |
| 0x2105 | Success include added |
Success include added |
| 0x2106 | Success exclude removed |
Success exclude removed |
| 0x2107 | Success exclude added |
Success exclude added |
| 0x2108 | Failure include removed |
Failure include removed |
| 0x2109 | Failure include added |
Failure include added |
| 0x210A | Failure exclude removed |
Failure exclude removed |
| 0x210B | Failure exclude added |
Failure exclude added |
| 0x00003000 | Security State Change |
Security State Change |
| 0x00003001 | Security System Extension |
Security System Extension |
| 0x00003002 | System Integrity |
System Integrity |
| 0x00003003 | IPsec Driver |
IPsec Driver |
| 0x00003004 | Other System Events |
Other System Events |
| 0x00003100 | Logon |
Logon |
| 0x00003101 | Logoff |
Logoff |
| 0x00003102 | Account Lockout |
Account Lockout |
| 0x00003103 | IPsec Main Mode |
IPsec Main Mode |
| 0x00003104 | Special Logon |
Special Logon |
| 0x00003105 | IPsec Quick Mode |
IPsec Quick Mode |
| 0x00003106 | IPsec Extended Mode |
IPsec Extended Mode |
| 0x00003107 | Other Logon/Logoff Events |
Other Logon/Logoff Events |
| 0x00003108 | Network Policy Server |
Network Policy Server |
| 0x00003109 | User / Device Claims |
User / Device Claims |
| 0x0000310A | Group Membership |
Group Membership |
| 0x00003200 | File System |
File System |
| 0x00003201 | Registry |
Registry |
| 0x00003202 | Kernel Object |
Kernel Object |
| 0x00003203 | SAM |
SAM |
| 0x00003204 | Other Object Access Events |
Other Object Access Events |
| 0x00003205 | Certification Services |
Certification Services |
| 0x00003206 | Application Generated |
Application Generated |
| 0x00003207 | Handle Manipulation |
Handle Manipulation |
| 0x00003208 | File Share |
File Share |
| 0x00003209 | Filtering Platform Packet Drop |
Filtering Platform Packet Drop |
| 0x0000320A | Filtering Platform Connection |
Filtering Platform Connection |
| 0x0000320B | Detailed File Share |
Detailed File Share |
| 0x0000320C | Removable Storage |
Removable Storage |
| 0x0000320D | Central Policy Staging |
Central Policy Staging |
| 0x00003300 | Sensitive Privilege Use |
Sensitive Privilege Use |
| 0x00003301 | Non Sensitive Privilege Use |
Non Sensitive Privilege Use |
| 0x00003302 | Other Privilege Use Events |
Other Privilege Use Events |
| 0x00003400 | Process Creation |
Process Creation |
| 0x00003401 | Process Termination |
Process Termination |
| 0x00003402 | DPAPI Activity |
DPAPI Activity |
| 0x00003403 | RPC Events |
RPC Events |
| 0x00003404 | Plug and Play Events |
Plug and Play Events |
| 0x00003405 | Token Right Adjusted Events |
Token Right Adjusted Events |
| 0x00003500 | Audit Policy Change |
Audit Policy Change |
| 0x00003501 | Authentication Policy Change |
Authentication Policy Change |
| 0x00003502 | Authorization Policy Change |
Authorization Policy Change |
| 0x00003503 | MPSSVC Rule-Level Policy Change |
MPSSVC Rule-Level Policy Change |
| 0x00003504 | Filtering Platform Policy Change |
Filtering Platform Policy Change |
| 0x00003505 | Other Policy Change Events |
Other Policy Change Events |
| 0x00003600 | User Account Management |
User Account Management |
| 0x00003601 | Computer Account Management |
Computer Account Management |
| 0x00003602 | Security Group Management |
Security Group Management |
| 0x00003603 | Distribution Group Management |
Distribution Group Management |
| 0x00003604 | Application Group Management |
Application Group Management |
| 0x00003605 | Other Account Management Events |
Other Account Management Events |
| 0x00003700 | Directory Service Access |
Directory Service Access |
| 0x00003701 | Directory Service Changes |
Directory Service Changes |
| 0x00003702 | Directory Service Replication |
Directory Service Replication |
| 0x00003703 | Detailed Directory Service Replication |
Detailed Directory Service Replication |
| 0x00003800 | Credential Validation |
Credential Validation |
| 0x00003801 | Kerberos Service Ticket Operations |
Kerberos Service Ticket Operations |
| 0x00003802 | Other Account Logon Events |
Other Account Logon Events |
| 0x00003803 | Kerberos Authentication Service |
Kerberos Authentication Service |
| 0x00003900 | Inbound |
Inbound |
| 0x00003901 | Outbound |
Outbound |
| 0x00003902 | Forward |
Forward |
| 0x00003903 | Bidirectional |
Bidirectional |
| 0x00003904 | IP Packet |
IP Packet |
| 0x00003907 | Stream |
Stream |
| 0x00003908 | Datagram Data |
Datagram Data |
| 0x00003909 | ICMP Error |
ICMP Error |
| 0x0000390A | MAC 802.3 |
MAC 802.3 |
| 0x0000390B | MAC Native |
MAC Native |
| 0x0000390C | vSwitch |
vSwitch |
| 0x00003910 | Resource Assignment |
Resource Assignment |
| 0x00003911 | Listen |
Listen |
| 0x00003912 | Receive/Accept |
Receive/Accept |
| 0x00003913 | Connect |
Connect |
| 0x00003914 | Flow Established |
Flow Established |
| 0x00003916 | Resource Release |
Resource Release |
| 0x00003917 | Endpoint Closure |
Endpoint Closure |
| 0x00003918 | Connect Redirect |
Connect Redirect |
| 0x00003919 | Bind Redirect |
Bind Redirect |
| 0x00003920 | Stream Packet |
Stream Packet |
| 0x00003930 | ICMP Echo-Request |
ICMP Echo-Request |
| 0x00003931 | vSwitch Ingress |
vSwitch Ingress |
| 0x00003932 | vSwitch Egress |
vSwitch Egress |
| 0x00003951 | [NULL] |
[NULL] |
| 0x00003952 | Value Added |
Value Added |
| 0x00003953 | Value Deleted |
Value Deleted |
| 0x00003954 | Active Directory Domain Services |
Active Directory Domain Services |
| 0x00003955 | Active Directory Lightweight Directory Services |
Active Directory Lightweight Directory Services |
| 0x00003958 | Value Added With Expiration Time |
Value Added With Expiration Time |
| 0x00003959 | Value Deleted With Expiration Time |
Value Deleted With Expiration Time |
| 0x00003960 | Value Auto Deleted With Expiration Time |
Value Auto Deleted With Expiration Time |
| 0x00004000 | Add |
Add |
| 0x00004001 | Delete |
Delete |
| 0x00004002 | Boot-time |
Boot-time |
| 0x00004003 | Persistent |
Persistent |
| 0x00004004 | Not persistent |
Not persistent |
| 0x00004005 | Block |
Block |
| 0x00004006 | Permit |
Permit |
| 0x00004007 | Callout |
Callout |
| 0x00004009 | SHA-1 |
SHA-1 |
| 0x0000400A | SHA-256 |
SHA-256 |
| 0x0000400B | AES-GCM 128 |
AES-GCM 128 |
| 0x0000400C | AES-GCM 192 |
AES-GCM 192 |
| 0x0000400D | AES-GCM 256 |
AES-GCM 256 |
| 0x00004017 | AES-GMAC 128 |
AES-GMAC 128 |
| 0x00004018 | AES-GMAC 192 |
AES-GMAC 192 |
| 0x00004019 | AES-GMAC 256 |
AES-GMAC 256 |
| 0x00004020 | AuthNoEncap Transport |
AuthNoEncap Transport |
| 0x00004200 | Enable WMI Account |
Enable WMI Account |
| 0x00004201 | Execute Method |
Execute Method |
| 0x00004202 | Full Write |
Full Write |
| 0x00004203 | Partial Write |
Partial Write |
| 0x00004204 | Provider Write |
Provider Write |
| 0x00004205 | Remote Access |
Remote Access |
| 0x00004206 | Subscribe |
Subscribe |
| 0x00004207 | Publish |
Publish |