public Interface WinNT

Failure Audit event

The log is read in reverse chronological order (newest to oldest).

The log is read in chronological order (oldest to newest).

Begin reading from the record specified in the dwRecordOffset parameter.

Information event

Flag identifying hyperthreading / simultaneous multithreading (SMT)

To coalesce two adjacent placeholders, specify MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS.

Decommits the specified region of committed pages.

Indicates that the memory pages within the region are mapped into the view of an image section.

Indicates that the memory pages within the region are mapped into the view of a section.

Frees an allocation back to a placeholder (after you've replaced a placeholder with a private allocation using VirtualAlloc2 or Virtual2AllocFromApp).

Releases the specified region of pages, or placeholder (for a placeholder, the address space is released and available for other allocations).

Indicates that data in the memory range specified by lpAddress and dwSize is no longer of interest.

Allocates memory at the highest possible address.

Enables execute access to the committed region of pages.

Enables execute, read-only, or read/write access to the committed region of pages.

Disables all access to the committed region of pages.

Enables read-only or read/write access to the committed region of pages.

All possible access rights for a process object.

Required to create a thread.

Required for getting process exe path in native system path format Kernel32.QueryFullProcessImageName().

Required to retrieve certain information about a process (see Kernel32#GetExitCodeProcess , Kernel32#GetPriorityClass, Kernel32#IsProcessInJob, Kernel32.QueryFullProcessImageName).

Required to set memory limits using Kernel32.SetProcessWorkingSetSize().

Required to wait for the process to terminate using the wait functions.

Required to perform an operation on the address space of a process (see Kernel32.VirtualProtectEx() and Kernel32#WriteProcessMemory ).

Required to write to memory in a process using Kernel32#WriteProcessMemory .

Loads the hive visible to the calling process.

New Registry Key created.

32-bit number.

Unicode null-terminated string with environment variable references.

Grow hive file in exact 4k increments.

Legacy single logging is used for this hive.

Symbolic link (unicode).

No value type.

Existing Key opened.

Created key is a symbolic link.

Open symbolic link.

Key is not preserved when system is rebooted.

64-bit number.

Unwind changes to last flush.

Starts Hive Journal.

Restore whole hive volatile.

Current SID revision level.

Required to change the default owner, primary group, or DACL of an access token.

Required to enable or disable the privileges in an access token.

Combines all possible access rights for a token.

Required to attach a primary token to a process.

Combines STANDARD_RIGHTS_EXECUTE and TOKEN_IMPERSONATE.

Required to query an access token.

Combines STANDARD_RIGHTS_READ and TOKEN_QUERY.