Wireshark
the world's foremost network protocol analyzer
Display Filter Reference: Microsoft Local Security Architecture
Protocol field name: lsa
Versions: 1.0.0 to 1.0.16
Back to Display Filter Reference
| Field name | Type | Description | Versions |
|---|---|---|---|
| lsa.access_mask | Unsigned integer, 4 bytes | Access Mask | 1.0.0 to 1.0.16 |
| lsa.access_mask.audit_log_admin | Boolean | Administer audit log attributes | 1.0.0 to 1.0.16 |
| lsa.access_mask.create_account | Boolean | Create special accounts (for assignment of user rights) | 1.0.0 to 1.0.16 |
| lsa.access_mask.create_priv | Boolean | Create a privilege | 1.0.0 to 1.0.16 |
| lsa.access_mask.create_secret | Boolean | Create a secret object | 1.0.0 to 1.0.16 |
| lsa.access_mask.get_privateinfo | Boolean | Get sensitive policy information | 1.0.0 to 1.0.16 |
| lsa.access_mask.lookup_names | Boolean | Lookup Names/SIDs | 1.0.0 to 1.0.16 |
| lsa.access_mask.server_admin | Boolean | Enable/Disable LSA | 1.0.0 to 1.0.16 |
| lsa.access_mask.set_audit_requirements | Boolean | Change system audit requirements | 1.0.0 to 1.0.16 |
| lsa.access_mask.set_default_quota_limits | Boolean | Set default quota limits | 1.0.0 to 1.0.16 |
| lsa.access_mask.trust_admin | Boolean | Modify domain trust relationships | 1.0.0 to 1.0.16 |
| lsa.access_mask.view_audit_info | Boolean | View system audit requirements | 1.0.0 to 1.0.16 |
| lsa.access_mask.view_local_info | Boolean | View non-sensitive policy information | 1.0.0 to 1.0.16 |
| lsa.acct | Character string | Account | 1.0.0 to 1.0.16 |
| lsa.attr | Unsigned integer, 8 bytes | Attr | 1.0.0 to 1.0.16 |
| lsa.auth.blob | Sequence of bytes | Auth blob | 1.0.0 to 1.0.16 |
| lsa.auth.len | Unsigned integer, 4 bytes | Auth Len | 1.0.0 to 1.0.16 |
| lsa.auth.type | Unsigned integer, 4 bytes | Auth Type | 1.0.0 to 1.0.16 |
| lsa.auth.update | Unsigned integer, 8 bytes | Update | 1.0.0 to 1.0.16 |
| lsa.controller | Character string | Controller | 1.0.0 to 1.0.16 |
| lsa.count | Unsigned integer, 4 bytes | Count | 1.0.0 to 1.0.16 |
| lsa.cur.mtime | Date and time | Current MTime | 1.0.0 to 1.0.16 |
| lsa.domain | Character string | Domain | 1.0.0 to 1.0.16 |
| lsa.flat_name | Character string | Flat Name | 1.0.0 to 1.0.16 |
| lsa.forest | Character string | Forest | 1.0.0 to 1.0.16 |
| lsa.fqdn_domain | Character string | FQDN | 1.0.0 to 1.0.16 |
| lsa.hnd | Sequence of bytes | Context Handle | 1.0.0 to 1.0.16 |
| lsa.index | Unsigned integer, 4 bytes | Index | 1.0.0 to 1.0.16 |
| lsa.info.level | Unsigned integer, 2 bytes | Level | 1.0.0 to 1.0.16 |
| lsa.info_type | Unsigned integer, 4 bytes | Info Type | 1.0.0 to 1.0.16 |
| lsa.key | Character string | Key | 1.0.0 to 1.0.16 |
| lsa.max_count | Unsigned integer, 4 bytes | Max Count | 1.0.0 to 1.0.16 |
| lsa.mod.mtime | Date and time | MTime | 1.0.0 to 1.0.16 |
| lsa.mod.seq_no | Unsigned integer, 8 bytes | Seq No | 1.0.0 to 1.0.16 |
| lsa.name | Character string | Name | 1.0.0 to 1.0.16 |
| lsa.new_pwd | Sequence of bytes | New Password | 1.0.0 to 1.0.16 |
| lsa.num_mapped | Unsigned integer, 4 bytes | Num Mapped | 1.0.0 to 1.0.16 |
| lsa.obj_attr | Unsigned integer, 4 bytes | Attributes | 1.0.0 to 1.0.16 |
| lsa.obj_attr.len | Unsigned integer, 4 bytes | Length | 1.0.0 to 1.0.16 |
| lsa.obj_attr.name | Character string | Name | 1.0.0 to 1.0.16 |
| lsa.old.mtime | Date and time | Old MTime | 1.0.0 to 1.0.16 |
| lsa.old_pwd | Sequence of bytes | Old Password | 1.0.0 to 1.0.16 |
| lsa.opnum | Unsigned integer, 2 bytes | Operation | 1.0.0 to 1.0.16 |
| lsa.paei.enabled | Unsigned integer, 1 byte | Auditing enabled | 1.0.0 to 1.0.16 |
| lsa.paei.settings | Unsigned integer, 4 bytes | Settings | 1.0.0 to 1.0.16 |
| lsa.pali.log_size | Unsigned integer, 4 bytes | Log Size | 1.0.0 to 1.0.16 |
| lsa.pali.next_audit_record | Unsigned integer, 4 bytes | Next Audit Record | 1.0.0 to 1.0.16 |
| lsa.pali.percent_full | Unsigned integer, 4 bytes | Percent Full | 1.0.0 to 1.0.16 |
| lsa.pali.retention_period | Time offset | Retention Period | 1.0.0 to 1.0.16 |
| lsa.pali.shutdown_in_progress | Unsigned integer, 1 byte | Shutdown in progress | 1.0.0 to 1.0.16 |
| lsa.pali.time_to_shutdown | Time offset | Time to shutdown | 1.0.0 to 1.0.16 |
| lsa.policy.info | Unsigned integer, 2 bytes | Info Class | 1.0.0 to 1.0.16 |
| lsa.policy_information | Label | POLICY INFO | 1.0.0 to 1.0.16 |
| lsa.privilege.display__name.size | Unsigned integer, 4 bytes | Size Needed | 1.0.0 to 1.0.16 |
| lsa.privilege.display_name | Character string | Display Name | 1.0.0 to 1.0.16 |
| lsa.privilege.name | Character string | Name | 1.0.0 to 1.0.16 |
| lsa.qos.effective_only | Unsigned integer, 1 byte | Effective only | 1.0.0 to 1.0.16 |
| lsa.qos.imp_lev | Unsigned integer, 2 bytes | Impersonation level | 1.0.0 to 1.0.16 |
| lsa.qos.len | Unsigned integer, 4 bytes | Length | 1.0.0 to 1.0.16 |
| lsa.qos.track_ctx | Unsigned integer, 1 byte | Context Tracking | 1.0.0 to 1.0.16 |
| lsa.quota.max_wss | Unsigned integer, 4 bytes | Max WSS | 1.0.0 to 1.0.16 |
| lsa.quota.min_wss | Unsigned integer, 4 bytes | Min WSS | 1.0.0 to 1.0.16 |
| lsa.quota.non_paged_pool | Unsigned integer, 4 bytes | Non Paged Pool | 1.0.0 to 1.0.16 |
| lsa.quota.paged_pool | Unsigned integer, 4 bytes | Paged Pool | 1.0.0 to 1.0.16 |
| lsa.quota.pagefile | Unsigned integer, 4 bytes | Pagefile | 1.0.0 to 1.0.16 |
| lsa.rc | Unsigned integer, 4 bytes | Return code | 1.0.0 to 1.0.16 |
| lsa.remove_all | Unsigned integer, 1 byte | Remove All | 1.0.0 to 1.0.16 |
| lsa.resume_handle | Unsigned integer, 4 bytes | Resume Handle | 1.0.0 to 1.0.16 |
| lsa.rid | Unsigned integer, 4 bytes | RID | 1.0.0 to 1.0.16 |
| lsa.rid.offset | Unsigned integer, 4 bytes | RID Offset | 1.0.0 to 1.0.16 |
| lsa.rights | Character string | Rights | 1.0.0 to 1.0.16 |
| lsa.sd_size | Unsigned integer, 4 bytes | Size | 1.0.0 to 1.0.16 |
| lsa.secret | Sequence of bytes | LSA Secret | 1.0.0 to 1.0.16 |
| lsa.server | Character string | Server | 1.0.0 to 1.0.16 |
| lsa.server_role | Unsigned integer, 2 bytes | Role | 1.0.0 to 1.0.16 |
| lsa.sid_type | Unsigned integer, 2 bytes | SID Type | 1.0.0 to 1.0.16 |
| lsa.size | Unsigned integer, 4 bytes | Size | 1.0.0 to 1.0.16 |
| lsa.source | Character string | Source | 1.0.0 to 1.0.16 |
| lsa.trust.attr | Unsigned integer, 4 bytes | Trust Attr | 1.0.0 to 1.0.16 |
| lsa.trust.attr.non_trans | Boolean | Non Transitive | 1.0.0 to 1.0.16 |
| lsa.trust.attr.tree_parent | Boolean | Tree Parent | 1.0.0 to 1.0.16 |
| lsa.trust.attr.tree_root | Boolean | Tree Root | 1.0.0 to 1.0.16 |
| lsa.trust.attr.uplevel_only | Boolean | Upleve only | 1.0.0 to 1.0.16 |
| lsa.trust.direction | Unsigned integer, 4 bytes | Trust Direction | 1.0.0 to 1.0.16 |
| lsa.trust.type | Unsigned integer, 4 bytes | Trust Type | 1.0.0 to 1.0.16 |
| lsa.trusted.info_level | Unsigned integer, 2 bytes | Info Level | 1.0.0 to 1.0.16 |
| lsa.unknown.char | Unsigned integer, 1 byte | Unknown char | 1.0.0 to 1.0.16 |
| lsa.unknown.hyper | Unsigned integer, 8 bytes | Unknown hyper | 1.0.0 to 1.0.16 |
| lsa.unknown.long | Unsigned integer, 4 bytes | Unknown long | 1.0.0 to 1.0.16 |
| lsa.unknown.short | Unsigned integer, 2 bytes | Unknown short | 1.0.0 to 1.0.16 |
| lsa.unknown_string | Character string | Unknown string | 1.0.0 to 1.0.16 |
| nt.luid.high | Unsigned integer, 4 bytes | High | 1.0.0 to 1.0.16 |
| nt.luid.low | Unsigned integer, 4 bytes | Low | 1.0.0 to 1.0.16 |