Alex Ionescu wrote: > 2) How you knew that the third member of that structure (or that it even > exists) is an ACCESS_MASK called AccessesToAudit. If you know, why shouldn't he know? From what I understand the entire structure is opaque, so my guess is that the names are just guessed, based on the obviously known layout. Thomas