Display Filter Reference: Microsoft Local Security Architecture

Protocol field name: lsa

Versions: 1.0.0 to 1.0.16

Back to Display Filter Reference

Field name Description Type Versions
lsa.access_mask Access Mask Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.access_mask.audit_log_admin Administer audit log attributes Boolean 1.0.0 to 1.0.16
lsa.access_mask.create_account Create special accounts (for assignment of user rights) Boolean 1.0.0 to 1.0.16
lsa.access_mask.create_priv Create a privilege Boolean 1.0.0 to 1.0.16
lsa.access_mask.create_secret Create a secret object Boolean 1.0.0 to 1.0.16
lsa.access_mask.get_privateinfo Get sensitive policy information Boolean 1.0.0 to 1.0.16
lsa.access_mask.lookup_names Lookup Names/SIDs Boolean 1.0.0 to 1.0.16
lsa.access_mask.server_admin Enable/Disable LSA Boolean 1.0.0 to 1.0.16
lsa.access_mask.set_audit_requirements Change system audit requirements Boolean 1.0.0 to 1.0.16
lsa.access_mask.set_default_quota_limits Set default quota limits Boolean 1.0.0 to 1.0.16
lsa.access_mask.trust_admin Modify domain trust relationships Boolean 1.0.0 to 1.0.16
lsa.access_mask.view_audit_info View system audit requirements Boolean 1.0.0 to 1.0.16
lsa.access_mask.view_local_info View non-sensitive policy information Boolean 1.0.0 to 1.0.16
lsa.acct Account Character string 1.0.0 to 1.0.16
lsa.attr Attr Unsigned integer (8 bytes) 1.0.0 to 1.0.16
lsa.auth.blob Auth blob Byte sequence 1.0.0 to 1.0.16
lsa.auth.len Auth Len Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.auth.type Auth Type Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.auth.update Update Unsigned integer (8 bytes) 1.0.0 to 1.0.16
lsa.controller Controller Character string 1.0.0 to 1.0.16
lsa.count Count Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.cur.mtime Current MTime Date and time 1.0.0 to 1.0.16
lsa.domain Domain Character string 1.0.0 to 1.0.16
lsa.flat_name Flat Name Character string 1.0.0 to 1.0.16
lsa.forest Forest Character string 1.0.0 to 1.0.16
lsa.fqdn_domain FQDN Character string 1.0.0 to 1.0.16
lsa.hnd Context Handle Byte sequence 1.0.0 to 1.0.16
lsa.index Index Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.info.level Level Unsigned integer (2 bytes) 1.0.0 to 1.0.16
lsa.info_type Info Type Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.key Key Character string 1.0.0 to 1.0.16
lsa.max_count Max Count Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.mod.mtime MTime Date and time 1.0.0 to 1.0.16
lsa.mod.seq_no Seq No Unsigned integer (8 bytes) 1.0.0 to 1.0.16
lsa.name Name Character string 1.0.0 to 1.0.16
lsa.new_pwd New Password Byte sequence 1.0.0 to 1.0.16
lsa.num_mapped Num Mapped Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.obj_attr Attributes Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.obj_attr.len Length Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.obj_attr.name Name Character string 1.0.0 to 1.0.16
lsa.old.mtime Old MTime Date and time 1.0.0 to 1.0.16
lsa.old_pwd Old Password Byte sequence 1.0.0 to 1.0.16
lsa.opnum Operation Unsigned integer (2 bytes) 1.0.0 to 1.0.16
lsa.paei.enabled Auditing enabled Unsigned integer (1 byte) 1.0.0 to 1.0.16
lsa.paei.settings Settings Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.pali.log_size Log Size Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.pali.next_audit_record Next Audit Record Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.pali.percent_full Percent Full Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.pali.retention_period Retention Period Time offset 1.0.0 to 1.0.16
lsa.pali.shutdown_in_progress Shutdown in progress Unsigned integer (1 byte) 1.0.0 to 1.0.16
lsa.pali.time_to_shutdown Time to shutdown Time offset 1.0.0 to 1.0.16
lsa.policy.info Info Class Unsigned integer (2 bytes) 1.0.0 to 1.0.16
lsa.policy_information POLICY INFO Label 1.0.0 to 1.0.16
lsa.privilege.display__name.size Size Needed Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.privilege.display_name Display Name Character string 1.0.0 to 1.0.16
lsa.privilege.name Name Character string 1.0.0 to 1.0.16
lsa.qos.effective_only Effective only Unsigned integer (1 byte) 1.0.0 to 1.0.16
lsa.qos.imp_lev Impersonation level Unsigned integer (2 bytes) 1.0.0 to 1.0.16
lsa.qos.len Length Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.qos.track_ctx Context Tracking Unsigned integer (1 byte) 1.0.0 to 1.0.16
lsa.quota.max_wss Max WSS Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.quota.min_wss Min WSS Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.quota.non_paged_pool Non Paged Pool Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.quota.paged_pool Paged Pool Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.quota.pagefile Pagefile Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.rc Return code Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.remove_all Remove All Unsigned integer (1 byte) 1.0.0 to 1.0.16
lsa.resume_handle Resume Handle Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.rid RID Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.rid.offset RID Offset Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.rights Rights Character string 1.0.0 to 1.0.16
lsa.sd_size Size Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.secret LSA Secret Byte sequence 1.0.0 to 1.0.16
lsa.server Server Character string 1.0.0 to 1.0.16
lsa.server_role Role Unsigned integer (2 bytes) 1.0.0 to 1.0.16
lsa.sid_type SID Type Unsigned integer (2 bytes) 1.0.0 to 1.0.16
lsa.size Size Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.source Source Character string 1.0.0 to 1.0.16
lsa.trust.attr Trust Attr Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.trust.attr.non_trans Non Transitive Boolean 1.0.0 to 1.0.16
lsa.trust.attr.tree_parent Tree Parent Boolean 1.0.0 to 1.0.16
lsa.trust.attr.tree_root Tree Root Boolean 1.0.0 to 1.0.16
lsa.trust.attr.uplevel_only Upleve only Boolean 1.0.0 to 1.0.16
lsa.trust.direction Trust Direction Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.trust.type Trust Type Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.trusted.info_level Info Level Unsigned integer (2 bytes) 1.0.0 to 1.0.16
lsa.unknown.char Unknown char Unsigned integer (1 byte) 1.0.0 to 1.0.16
lsa.unknown.hyper Unknown hyper Unsigned integer (8 bytes) 1.0.0 to 1.0.16
lsa.unknown.long Unknown long Unsigned integer (4 bytes) 1.0.0 to 1.0.16
lsa.unknown.short Unknown short Unsigned integer (2 bytes) 1.0.0 to 1.0.16
lsa.unknown_string Unknown string Character string 1.0.0 to 1.0.16
nt.luid.high High Unsigned integer (4 bytes) 1.0.0 to 1.0.16
nt.luid.low Low Unsigned integer (4 bytes) 1.0.0 to 1.0.16