1 /** 2 * This file has no copyright assigned and is placed in the Public Domain. 3 * This file is part of the mingw-w64 runtime package. 4 * No warranty is given; refer to the file DISCLAIMER.PD within this package. 5 */ 6 #ifndef _ADTGEN_H 7 #define _ADTGEN_H 8 9 #define AUDIT_TYPE_LEGACY 1 10 #define AUDIT_TYPE_WMI 2 11 12 typedef enum _AUDIT_PARAM_TYPE { 13 APT_None = 1, 14 APT_String,APT_Ulong, 15 APT_Pointer, 16 APT_Sid, 17 APT_LogonId, 18 APT_ObjectTypeList, 19 APT_Luid, 20 APT_Guid, 21 APT_Time, 22 APT_Int64 23 } AUDIT_PARAM_TYPE; 24 25 #define AP_ParamTypeBits 8 26 #define AP_ParamTypeMask __MSABI_LONG(0x000000ff) 27 28 #define AP_FormatHex (__MSABI_LONG(0x0001) << AP_ParamTypeBits) 29 #define AP_AccessMask (__MSABI_LONG(0x0002) << AP_ParamTypeBits) 30 #define AP_Filespec (__MSABI_LONG(0x0001) << AP_ParamTypeBits) 31 #define AP_PrimaryLogonId (__MSABI_LONG(0x0001) << AP_ParamTypeBits) 32 #define AP_ClientLogonId (__MSABI_LONG(0x0002) << AP_ParamTypeBits) 33 34 #define ApExtractType(TypeFlags) ((AUDIT_PARAM_TYPE)(TypeFlags & AP_ParamTypeMask)) 35 #define ApExtractFlags(TypeFlags) ((TypeFlags & ~AP_ParamTypeMask)) 36 37 typedef struct _AUDIT_OBJECT_TYPE { 38 GUID ObjectType; 39 USHORT Flags; 40 USHORT Level; 41 ACCESS_MASK AccessMask; 42 } AUDIT_OBJECT_TYPE,*PAUDIT_OBJECT_TYPE; 43 44 typedef struct _AUDIT_OBJECT_TYPES { 45 USHORT Count; 46 USHORT Flags; 47 AUDIT_OBJECT_TYPE *pObjectTypes; 48 } AUDIT_OBJECT_TYPES,*PAUDIT_OBJECT_TYPES; 49 50 typedef struct _AUDIT_PARAM { 51 AUDIT_PARAM_TYPE Type; 52 ULONG Length; 53 DWORD Flags; 54 __C89_NAMELESS union { 55 ULONG_PTR Data0; 56 PWSTR String; 57 ULONG_PTR u; 58 SID *psid; 59 GUID *pguid; 60 ULONG LogonId_LowPart; 61 AUDIT_OBJECT_TYPES *pObjectTypes; 62 }; 63 __C89_NAMELESS union { 64 ULONG_PTR Data1; 65 LONG LogonId_HighPart; 66 }; 67 } AUDIT_PARAM,*PAUDIT_PARAM; 68 69 #define APF_AuditFailure 0x00000000 70 #define APF_AuditSuccess 0x00000001 71 72 #define APF_ValidFlags (APF_AuditSuccess) 73 74 typedef struct _AUDIT_PARAMS { 75 ULONG Length; 76 DWORD Flags; 77 USHORT Count; 78 AUDIT_PARAM *Parameters; 79 } AUDIT_PARAMS,*PAUDIT_PARAMS; 80 81 typedef struct _AUTHZ_AUDIT_EVENT_TYPE_LEGACY { 82 USHORT CategoryId; 83 USHORT AuditId; 84 USHORT ParameterCount; 85 } AUTHZ_AUDIT_EVENT_TYPE_LEGACY,*PAUTHZ_AUDIT_EVENT_TYPE_LEGACY; 86 87 typedef union _AUTHZ_AUDIT_EVENT_TYPE_UNION { 88 AUTHZ_AUDIT_EVENT_TYPE_LEGACY Legacy; 89 } AUTHZ_AUDIT_EVENT_TYPE_UNION,*PAUTHZ_AUDIT_EVENT_TYPE_UNION; 90 91 typedef struct _AUTHZ_AUDIT_EVENT_TYPE_OLD { 92 ULONG Version; 93 DWORD dwFlags; 94 LONG RefCount; 95 ULONG_PTR hAudit; 96 LUID LinkId; 97 AUTHZ_AUDIT_EVENT_TYPE_UNION u; 98 } AUTHZ_AUDIT_EVENT_TYPE_OLD; 99 100 typedef AUTHZ_AUDIT_EVENT_TYPE_OLD *PAUTHZ_AUDIT_EVENT_TYPE_OLD; 101 typedef PVOID AUDIT_HANDLE,*PAUDIT_HANDLE; 102 103 #define AUTHZ_ALLOW_MULTIPLE_SOURCE_INSTANCES 0x1 104 #define AUTHZ_AUDIT_INSTANCE_INFORMATION 0x2 105 106 #endif 107