Field

Field Name

Type

netlogon.site_name

Site Name

String

netlogon.sync_context

Sync Context

Unsigned 32-bit integer

netlogon.system_flags

System Flags

Unsigned 32-bit integer

netlogon.tc_connection_statusTC Connection Status

Unsigned 32-bit integer

netlogon.time_limit

Time Limit

Time duration

netlogon.timestamp

Timestamp

Date/Time stamp

netlogon.trusted_dc

Trusted DC

String

netlogon.trusted_domain

Trusted Domain

String

netlogon.unknown.char

Unknown char

Unsigned 8-bit integer

netlogon.unknown.long

Unknown long

Unsigned 32-bit integer

netlogon.unknown.short

Unknown short

Unsigned 16-bit integer

netlogon.unknown.time

Unknown time

Date/Time stamp

netlogon.unknown_string

Unknown string

String

netlogon.user_flags

User Flags

Unsigned 32-bit integer

netlogon.user_session_key

User Session Key

Byte array

netlogon.validation_level

Validation Level

Unsigned 16-bit integer

netlogon.wkst.fqdn

Wkst FQDN

String

netlogon.wkst.name

Wkst Name

String

netlogon.wkst.os

Wkst OS

String

netlogon.wkst.site_name

Wkst Site Name

String

netlogon.wksts

Workstations

String

Field

Field Name

Type

reg.access_mask

Access mask

Unsigned 32-bit integer

reg.hnd

Context handle

Byte array

reg.keyname

Key name

String

reg.openentry.unknown1

Unknown 1

Unsigned 32-bit integer

reg.openhklm.unknown1

Unknown 1

Unsigned 16-bit integer

reg.openhklm.unknown2

Unknown 2

Unsigned 16-bit integer

reg.opnum

Operation

Unsigned 16-bit integer

reg.querykey.class

Class

String

Field

Field Name

Type

reg.querykey.max_subkey_

lenMax subkey len

Unsigned 32-bit integer

reg.querykey.max_valbuf_sizeMax valbuf size

Unsigned 32-bit integer

reg.querykey.max_valname_Maxlen valnum len

Unsigned 32-bit integer

reg.querykey.modtime

Mod time

Date/Time stamp

reg.querykey.num_subkeys

Num subkeys

Unsigned 32-bit integer

reg.querykey.num_values

Num values

Unsigned 32-bit integer

reg.querykey.reserved

Reserved

Unsigned 32-bit integer

reg.querykey.secdesc

Secdesc

Unsigned 32-bit integer

reg.rc

Return code

Unsigned 32-bit integer

reg.unknown1A.unknown1 Unknown 1

Unsigned 32-bit integer

Field

Field Name

Type

nt.acct_ctrl

Acct Ctrl

Unsigned 32-bit integer

nt.str.len

Length

Unsigned 32-bit integer

nt.str.max_len

Max Length

Unsigned 32-bit integer

nt.str.offset

Offset

Unsigned 32-bit integer

nt.string.length

Length

Unsigned 16-bit integer

nt.string.size

Size

Unsigned 16-bit integer

samr.access

Access Mask

Unsigned 32-bit integer

samr.acct_desc

Account Desc

String

samr.acct_expiry_time

Acct Expiry

Date/Time stamp

samr.acct_name

Account Name

String

samr.alias

Alias

Unsigned 32-bit integer

samr.alias_name

Alias Name

String

samr.attr

Attributes

Unsigned 32-bit integer

samr.bad_pwd_count

Bad Pwd Count

Unsigned 16-bit integer

samr.codepage

Codepage

Unsigned 16-bit integer

samr.comment

Comment

String

Field

Field Name

Type

samr.count

Count

Unsigned 32-bit integer

samr.country

Country

Unsigned 16-bit integer

samr.crypt_hash

Hash

Byte array

samr.crypt_password

Password

Byte array

samr.dc

DC

String

samr.divisions

Divisions

Unsigned 16-bit integer

samr.domain

Domain

String

samr.entries

Entries

Unsigned 32-bit integer

samr.full_name

Full Name

String

samr.group

Group

Unsigned 32-bit integer

samr.group_name

Group Name

String

samr.hnd

Context Handle

Byte array

samr.home

Home

String

samr.home_drive

Home Drive

String

samr.index

Index

Unsigned 32-bit integer

samr.info_type

Info Type

Unsigned 32-bit integer

samr.kickoff_time

Kickoff Time

Date/Time stamp

samr.level

Level

Unsigned 16-bit integer

samr.lm_change

LM Change

Unsigned 8-bit integer

samr.lm_pwd_set

LM Pwd Set

Unsigned 8-bit integer

samr.logoff_time

Logoff Time

Date/Time stamp

samr.logon_count

Logon Count

Unsigned 16-bit integer

samr.logon_time

Logon Time

Date/Time stamp

samr.mask

Mask

Unsigned 32-bit integer

samr.max_entries

Max Entries

Unsigned 32-bit integer

samr.max_pwd_age

Max Pwd Age

Time duration

samr.min_pwd_age

Min Pwd Age

Time duration

samr.min_pwd_len

Min Pwd Len

Unsigned 16-bit integer

samr.nt_pwd_set

NT Pwd Set

Unsigned 8-bit integer

samr.num_aliases

Num Aliases

Unsigned 32-bit integer

samr.num_groups

Num Groups

Unsigned 32-bit integer

samr.num_users

Num Users

Unsigned 32-bit integer

samr.opnum

Operation

Unsigned 16-bit integer

samr.parameters

Parameters

String

samr.pref_maxsize

Pref MaxSize

Unsigned 32-bit integer

samr.profile

Profile

String

Field

Field Name

Type

samr.pwd_Expired

Expired flag

Unsigned 8-bit integer

samr.pwd_can_change_timePWD Can Change

Date/Time stamp

samr.pwd_history_len

Pwd History Len

Unsigned 16-bit integer

samr.pwd_last_set_time

PWD Last Set

Date/Time stamp

samr.pwd_must_change_timePWD Must Change

Date/Time stamp

samr.rc

Return code

Unsigned 32-bit integer

samr.resume_hnd

Resume Hnd

Unsigned 32-bit integer

samr.ret_size

Returned Size

Unsigned 32-bit integer

samr.revision

Revision

samr.rid

Rid

Unsigned 32-bit integer

samr.rid.attrib

Rid Attrib

Unsigned 32-bit integer

samr.script

Script

String

samr.server

Server

String

samr.start_idx

Start Idx

Unsigned 32-bit integer

samr.total_size

Total Size

Unsigned 32-bit integer

samr.type

Type

Unsigned 32-bit integer

samr.unknown.char

Unknown char

Unsigned 8-bit integer

samr.unknown.hyper

Unknown hyper

samr.unknown.long

Unknown long

Unsigned 32-bit integer

samr.unknown.short

Unknown short

Unsigned 16-bit integer

samr.unknown_string

Unknown string

String

samr.unknown_time

Unknown time

Date/Time stamp

samr.workstations

Workstations

String

Field

Field Name

Type

srvsvc.

Max Raw Buf Len

Unsigned 32-bit integer

srvsvc.acceptdownlevelapisAccept

Downlevel APIs

Unsigned 32-bit integer

srvsvc.accessalert

Access Alerts

Unsigned 32-bit integer

srvsvc.activelocks

Active Locks

Unsigned 32-bit integer

Field

Field Name

Type

srvsvc.alerts

Alerts

String

srvsvc.alertsched

Alert Sched

Unsigned 32-bit integer

srvsvc.alist_mtime

Alist mtime

Unsigned 32-bit integer

srvsvc.ann_delta

Announce Delta

Unsigned 32-bit integer

srvsvc.announce

Announce

Unsigned 32-bit integer

srvsvc.auditedevents

Audited Events

Unsigned 32-bit integer

srvsvc.auditprofile

Audit Profile

Unsigned 32-bit integer

srvsvc.autopath

Autopath

String

srvsvc.chdevjobs

Char Dev Jobs

Unsigned 32-bit integer

srvsvc.chdevqs

Char Devqs

Unsigned 32-bit integer

srvsvc.chdevs

Char Devs

Unsigned 32-bit integer

srvsvc.chrdev

Char Device

String

srvsvc.chrdev_opcode

Opcode

Unsigned 32-bit integer

srvsvc.chrdev_status

Status

Unsigned 32-bit integer

srvsvc.chrdev_time

Time

Unsigned 32-bit integer

srvsvc.chrdevq

Device Queue

String

srvsvc.chrqdev_numahead

Num Ahead

Unsigned 32-bit integer

srvsvc.chrqdev_numusers

Num Users

Unsigned 32-bit integer

srvsvc.chrqdev_pri

Priority

Unsigned 32-bit integer

srvsvc.client.type

Client Type

String

srvsvc.comment

Comment

String

srvsvc.computer

Computer

String

srvsvc.con_id

Connection ID

Unsigned 32-bit integer

srvsvc.con_num_opens

Num Opens

Unsigned 32-bit integer

srvsvc.con_time

Connection Time

Unsigned 32-bit integer

srvsvc.con_type

Connection Type

Unsigned 32-bit integer

srvsvc.connections

Connections

Unsigned 32-bit integer

srvsvc.cur_uses

Current Uses

Unsigned 32-bit integer

srvsvc.disc

Disc

Unsigned 32-bit integer

srvsvc.disk_name

Disk Name

String

srvsvc.disk_name_len

Disk Name Length

Unsigned 32-bit integer

srvsvc.diskalert

Disk Alerts

Unsigned 32-bit integer

srvsvc.diskspacetreshold

Diskspace Treshold

Unsigned 32-bit integer

srvsvc.domain

Domain

String

srvsvc.emulated_server

Emulated Server

String

Field

Field Name

Type

srvsvc.enablefcbopens

Enable FCB Opens

Unsigned 32-bit integer

srvsvc.enableforcedlogoff

Enable Forced Logoff

Unsigned 32-bit integer

srvsvc.enableoplockforcecloseEnable

Oplock Force Close

Unsigned 32-bit integer

srvsvc.enableoplocks

Enable Oplocks

Unsigned 32-bit integer

srvsvc.enableraw

Enable RAW

Unsigned 32-bit integer

srvsvc.enablesharednetdrivesEnable

Shared Net Drives

Unsigned 32-bit integer

srvsvc.enablesoftcompat

Enable Soft Compat

Unsigned 32-bit integer

srvsvc.enum_hnd

Enumeration handle

Byte array

srvsvc.erroralert

Error Alerts

Unsigned 32-bit integer

srvsvc.errortreshold

Error Treshold

Unsigned 32-bit integer

srvsvc.file_id

File ID

Unsigned 32-bit integer

srvsvc.file_num_locks

Num Locks

Unsigned 32-bit integer

srvsvc.glist_mtime

Glist mtime

Unsigned 32-bit integer

srvsvc.guest

Guest Account

String

srvsvc.hidden

Hidden

Unsigned 32-bit integer

srvsvc.hnd

Context Handle

Byte array

srvsvc.info.platform_id

Platform ID

Unsigned 32-bit integer

srvsvc.initconntable

Init Connection Table

Unsigned 32-bit integer

srvsvc.initfiletable

Init File Table

Unsigned 32-bit integer

srvsvc.initsearchtable

Init Search Table

Unsigned 32-bit integer

srvsvc.initsesstable

Init Session Table

Unsigned 32-bit integer

srvsvc.initworkitems

Init Workitems

Unsigned 32-bit integer

srvsvc.irpstacksize

Irp Stack Size

Unsigned 32-bit integer

srvsvc.lanmask

LANMask

Unsigned 32-bit integer

srvsvc.licences

Licences

Unsigned 32-bit integer

srvsvc.linkinfovalidtime

Link Info Valid Time

Unsigned 32-bit integer

srvsvc.lmannounce

LM Announce

Unsigned 32-bit integer

srvsvc.logonalert

Logon Alerts

Unsigned 32-bit integer

srvsvc.max_uses

Max Uses

Unsigned 32-bit integer

srvsvc.maxaudits

Max Audits

Unsigned 32-bit integer

srvsvc.maxcopyreadlen

Max Copy Read Len

Unsigned 32-bit integer

srvsvc.maxcopywritelen

Max Copy Write Len

Unsigned 32-bit integer

srvsvc.maxfreeconnections

Max Free Conenctions

Unsigned 32-bit integer

Field

Field Name

Type

srvsvc.maxkeepcomplsearchMax

Keep Compl Search

Unsigned 32-bit integer

srvsvc.maxkeepsearch

Max Keep Search

Unsigned 32-bit integer

srvsvc.maxlinkdelay

Max Link Delay

Unsigned 32-bit integer

srvsvc.maxmpxct

MaxMpxCt

Unsigned 32-bit integer

srvsvc.maxnonpagedmemoryusageMax

Non-Paged Memory

Unsigned 32-bit integer

Usage

srvsvc.maxpagedmemoryusageMax

Paged Memory Usage

Unsigned 32-bit integer

srvsvc.maxworkitemidletimeMax

Workitem Idle Time

Unsigned 32-bit integer

srvsvc.maxworkitems

Max Workitems

Unsigned 32-bit integer

srvsvc.minfreeconnections

Min Free Conenctions

Unsigned 32-bit integer

srvsvc.minfreeworkitems

Min Free Workitems

Unsigned 32-bit integer

srvsvc.minkeepcomplsearchMin

Keep Compl Search

Unsigned 32-bit integer

srvsvc.minkeepsearch

Min Keep Search

Unsigned 32-bit integer

srvsvc.minlinkthroughput

Min Link Throughput

Unsigned 32-bit integer

srvsvc.minrcvqueue

Min Rcv Queue

Unsigned 32-bit integer

srvsvc.netioalert

Net I/O Alerts

Unsigned 32-bit integer

srvsvc.networkerrortresholdNetwork

Error Treshold

Unsigned 32-bit integer

srvsvc.num_admins

Num Admins

Unsigned 32-bit integer

srvsvc.numbigbufs

Num Big Bufs

Unsigned 32-bit integer

srvsvc.numblockthreads

Num Block Threads

Unsigned 32-bit integer

srvsvc.numfiletasks

Num Filetasks

Unsigned 32-bit integer

srvsvc.openfiles

Open Files

Unsigned 32-bit integer

srvsvc.opensearch

Open Search

Unsigned 32-bit integer

srvsvc.oplockbreakresponsewaitOplock

Break Response

Unsigned 32-bit integer

wait

srvsvc.oplockbreakwait

Oplock Break Wait

Unsigned 32-bit integer

srvsvc.opnum

Operation

Unsigned 16-bit integer

srvsvc.outbuflen

OutBufLen

Unsigned 32-bit integer

srvsvc.parm_error

Parameter Error

Unsigned 32-bit integer

srvsvc.path

Path

String

srvsvc.path_flags

Flags

Unsigned 32-bit integer

srvsvc.path_len

Len

Unsigned 32-bit integer

srvsvc.path_type

Type

Unsigned 32-bit integer

Field

Field Name

Type

srvsvc.perm

Permissions

Unsigned 32-bit integer

srvsvc.preferred_len

Preferred length

Unsigned 32-bit integer

srvsvc.prefix

Prefix

String

srvsvc.qualifier

Qualifier

String

srvsvc.rawworkitems

Raw Workitems

Unsigned 32-bit integer

srvsvc.rc

Return code

Unsigned 32-bit integer

srvsvc.reserved

Reserved

Unsigned 32-bit integer

srvsvc.scavqosinfoupdatetimeScav

QoS Info Update

Unsigned 32-bit integer

Time

srvsvc.scavtimeout

Scav Timeout

Unsigned 32-bit integer

srvsvc.security

Security

Unsigned 32-bit integer

srvsvc.server

Server

String

srvsvc.server.type

Server Type

Unsigned 32-bit integer

srvsvc.server_stat.avresponseAvresponse

Unsigned 32-bit integer

srvsvc.server_stat.bigbufneedBig Buf Need

Unsigned 32-bit integer

srvsvc.server_stat.bytesrcvdBytes Rcvd

srvsvc.server_stat.bytessent Bytes Sent

srvsvc.server_stat.devopensDevopens

Unsigned 32-bit integer

srvsvc.server_stat.fopens

Fopens

Unsigned 32-bit integer

srvsvc.server_stat.jobsqueuedJobs Queued

Unsigned 32-bit integer

srvsvc.server_stat.permerrorsPermerrors

Unsigned 32-bit integer

srvsvc.server_stat.pwerrors Pwerrors

Unsigned 32-bit integer

srvsvc.server_stat.reqbufneedReq Buf Need

Unsigned 32-bit integer

srvsvc.server_stat.serrorout Serrorout

Unsigned 32-bit integer

srvsvc.server_stat.sopens

Sopens

Unsigned 32-bit integer

srvsvc.server_stat.start

Start

Unsigned 32-bit integer

srvsvc.server_stat.stimeoutsstimeouts

Unsigned 32-bit integer

srvsvc.server_stat.syserrors Syserrors

Unsigned 32-bit integer

Field

Field Name

Type

srvsvc.service

Service

String

srvsvc.service_bits

Service Bits

Unsigned 32-bit integer

srvsvc.service_bits_of_interestService Bits Of Interest

Unsigned 32-bit integer

srvsvc.service_options

Options

Unsigned 32-bit integer

srvsvc.session

Session

String

srvsvc.session.idle_time

Idle Time

Unsigned 32-bit integer

srvsvc.session.num_opens

Num Opens

Unsigned 32-bit integer

srvsvc.session.time

Time

Unsigned 32-bit integer

srvsvc.session.user_flags

User Flags

Unsigned 32-bit integer

srvsvc.sessopens

Sessions Open

Unsigned 32-bit integer

srvsvc.sessreqs

Sessions Reqs

Unsigned 32-bit integer

srvsvc.sessvcs

Sessions VCs

Unsigned 32-bit integer

srvsvc.share

Share

String

srvsvc.share.num_entries

Number of entries

Unsigned 32-bit integer

srvsvc.share_passwd

Share Passwd

String

srvsvc.share_type

Share Type

Unsigned 32-bit integer

srvsvc.shares

Shares

Unsigned 32-bit integer

srvsvc.sizreqbufs

Siz Req Bufs

Unsigned 32-bit integer

srvsvc.srvheuristics

Server Heuristics

String

srvsvc.threadcountadd

Thread Count Add

Unsigned 32-bit integer

srvsvc.threadpriority

Thread Priority

Unsigned 32-bit integer

srvsvc.timesource

Timesource

Unsigned 32-bit integer

srvsvc.tod.day

Day

Unsigned 32-bit integer

srvsvc.tod.elapsed

Elapsed

Unsigned 32-bit integer

srvsvc.tod.hours

Hours

Unsigned 32-bit integer

srvsvc.tod.hunds

Hunds

Unsigned 32-bit integer

srvsvc.tod.mins

Mins

Unsigned 32-bit integer

srvsvc.tod.month

Month

Unsigned 32-bit integer

srvsvc.tod.msecs

msecs

Unsigned 32-bit integer

srvsvc.tod.secs

Secs

Unsigned 32-bit integer

srvsvc.tod.timezone

Timezone

Unsigned 32-bit integer

srvsvc.tod.tinterval

Tinterval

Unsigned 32-bit integer

srvsvc.tod.weekday

Weekday

Unsigned 32-bit integer

srvsvc.tod.year

Year

Unsigned 32-bit integer

srvsvc.transport

Transport

String