diff --git a/mingw-w64-headers/include/ntsecapi.h b/mingw-w64-headers/include/ntsecapi.h
index 2d4f141..edef4d5 100644
--- a/mingw-w64-headers/include/ntsecapi.h
+++ b/mingw-w64-headers/include/ntsecapi.h
@@ -3,6 +3,485 @@
  * This file is part of the mingw-w64 runtime package.
  * No warranty is given; refer to the file DISCLAIMER.PD within this package.
  */
+
+#ifdef DEFINE_GUID
+
+#if !defined(INITGUID) || !defined(Audit_System_SecurityStateChange_defined)
+DEFINE_GUID(Audit_System_SecurityStateChange, 0x0cce9210, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_System_SecurityStateChange_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_System_SecuritySubsystemExtension_defined)
+DEFINE_GUID(Audit_System_SecuritySubsystemExtension, 0x0cce9211, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_System_SecuritySubsystemExtension_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_System_Integrity_defined)
+DEFINE_GUID(Audit_System_Integrity, 0x0cce9212, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_System_Integrity_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_System_IPSecDriverEvents_defined)
+DEFINE_GUID(Audit_System_IPSecDriverEvents, 0x0cce9213, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_System_IPSecDriverEvents_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_System_Others_defined)
+DEFINE_GUID(Audit_System_Others, 0x0cce9214, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_System_Others_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_Logon_defined)
+DEFINE_GUID(Audit_Logon_Logon, 0x0cce9215, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_Logon_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_Logoff_defined)
+DEFINE_GUID(Audit_Logon_Logoff, 0x0cce9216, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_Logoff_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_AccountLockout_defined)
+DEFINE_GUID(Audit_Logon_AccountLockout, 0x0cce9217, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_AccountLockout_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_IPSecMainMode_defined)
+DEFINE_GUID(Audit_Logon_IPSecMainMode, 0x0cce9218, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_IPSecMainMode_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_IPSecQuickMode_defined)
+DEFINE_GUID(Audit_Logon_IPSecQuickMode, 0x0cce9219, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_IPSecQuickMode_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_IPSecUserMode_defined)
+DEFINE_GUID(Audit_Logon_IPSecUserMode, 0x0cce921a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_IPSecUserMode_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_SpecialLogon_defined)
+DEFINE_GUID(Audit_Logon_SpecialLogon, 0x0cce921b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_SpecialLogon_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_Others_defined)
+DEFINE_GUID(Audit_Logon_Others, 0x0cce921c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_Others_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FileSystem_defined)
+DEFINE_GUID(Audit_ObjectAccess_FileSystem, 0x0cce921d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_FileSystem_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Registry_defined)
+DEFINE_GUID(Audit_ObjectAccess_Registry, 0x0cce921e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_Registry_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Kernel_defined)
+DEFINE_GUID(Audit_ObjectAccess_Kernel, 0x0cce921f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_Kernel_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Sam_defined)
+DEFINE_GUID(Audit_ObjectAccess_Sam, 0x0cce9220, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_Sam_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_CertificationServices_defined)
+DEFINE_GUID(Audit_ObjectAccess_CertificationServices, 0x0cce9221, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_CertificationServices_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_ApplicationGenerated_defined)
+DEFINE_GUID(Audit_ObjectAccess_ApplicationGenerated, 0x0cce9222, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_ApplicationGenerated_defined
+#endif
+#endif
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Handle_defined)
+DEFINE_GUID(Audit_ObjectAccess_Handle, 0x0cce9223, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_Handle_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Share_defined)
+DEFINE_GUID(Audit_ObjectAccess_Share, 0x0cce9224, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_Share_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FirewallPacketDrops_defined)
+DEFINE_GUID(Audit_ObjectAccess_FirewallPacketDrops, 0x0cce9225, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_FirewallPacketDrops_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FirewallConnection_defined)
+DEFINE_GUID(Audit_ObjectAccess_FirewallConnection, 0x0cce9226, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_FirewallConnection_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Other_defined)
+DEFINE_GUID(Audit_ObjectAccess_Other, 0x0cce9227, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_Other_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_Sensitive_defined)
+DEFINE_GUID(Audit_PrivilegeUse_Sensitive, 0x0cce9228, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PrivilegeUse_Sensitive_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_NonSensitive_defined)
+DEFINE_GUID(Audit_PrivilegeUse_NonSensitive, 0x0cce9229, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PrivilegeUse_NonSensitive_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_Others_defined)
+DEFINE_GUID(Audit_PrivilegeUse_Others, 0x0cce922a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PrivilegeUse_Others_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DetailedTracking_ProcessCreation_defined)
+DEFINE_GUID(Audit_DetailedTracking_ProcessCreation, 0x0cce922b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DetailedTracking_ProcessCreation_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DetailedTracking_ProcessTermination_defined)
+DEFINE_GUID(Audit_DetailedTracking_ProcessTermination, 0x0cce922c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DetailedTracking_ProcessTermination_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DetailedTracking_DpapiActivity_defined)
+DEFINE_GUID(Audit_DetailedTracking_DpapiActivity, 0x0cce922d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DetailedTracking_DpapiActivity_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DetailedTracking_RpcCall_defined)
+DEFINE_GUID(Audit_DetailedTracking_RpcCall, 0x0cce922e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DetailedTracking_RpcCall_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuditPolicy_defined)
+DEFINE_GUID(Audit_PolicyChange_AuditPolicy, 0x0cce922f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PolicyChange_AuditPolicy_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuthenticationPolicy_defined)
+DEFINE_GUID(Audit_PolicyChange_AuthenticationPolicy, 0x0cce9230, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PolicyChange_AuthenticationPolicy_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuthorizationPolicy_defined)
+DEFINE_GUID(Audit_PolicyChange_AuthorizationPolicy, 0x0cce9231, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PolicyChange_AuthorizationPolicy_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PolicyChange_MpsscvRulePolicy_defined)
+DEFINE_GUID(Audit_PolicyChange_MpsscvRulePolicy, 0x0cce9232, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PolicyChange_MpsscvRulePolicy_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PolicyChange_WfpIPSecPolicy_defined)
+DEFINE_GUID(Audit_PolicyChange_WfpIPSecPolicy, 0x0cce9233, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PolicyChange_WfpIPSecPolicy_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PolicyChange_Others_defined)
+DEFINE_GUID(Audit_PolicyChange_Others, 0x0cce9234, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PolicyChange_Others_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountManagement_UserAccount_defined)
+DEFINE_GUID(Audit_AccountManagement_UserAccount, 0x0cce9235, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountManagement_UserAccount_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountManagement_ComputerAccount_defined)
+DEFINE_GUID(Audit_AccountManagement_ComputerAccount, 0x0cce9236, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountManagement_ComputerAccount_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountManagement_SecurityGroup_defined)
+DEFINE_GUID(Audit_AccountManagement_SecurityGroup, 0x0cce9237, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountManagement_SecurityGroup_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountManagement_DistributionGroup_defined)
+DEFINE_GUID(Audit_AccountManagement_DistributionGroup, 0x0cce9238, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountManagement_DistributionGroup_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountManagement_ApplicationGroup_defined)
+DEFINE_GUID(Audit_AccountManagement_ApplicationGroup, 0x0cce9239, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountManagement_ApplicationGroup_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountManagement_Others_defined)
+DEFINE_GUID(Audit_AccountManagement_Others, 0x0cce923a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountManagement_Others_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DSAccess_DSAccess_defined)
+DEFINE_GUID(Audit_DSAccess_DSAccess, 0x0cce923b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DSAccess_DSAccess_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DsAccess_AdAuditChanges_defined)
+DEFINE_GUID(Audit_DsAccess_AdAuditChanges, 0x0cce923c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DsAccess_AdAuditChanges_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Ds_Replication_defined)
+DEFINE_GUID(Audit_Ds_Replication, 0x0cce923d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Ds_Replication_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Ds_DetailedReplication_defined)
+DEFINE_GUID(Audit_Ds_DetailedReplication, 0x0cce923e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Ds_DetailedReplication_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountLogon_CredentialValidation_defined)
+DEFINE_GUID(Audit_AccountLogon_CredentialValidation, 0x0cce923f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountLogon_CredentialValidation_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountLogon_Kerberos_defined)
+DEFINE_GUID(Audit_AccountLogon_Kerberos, 0x0cce9240, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountLogon_Kerberos_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountLogon_Others_defined)
+DEFINE_GUID(Audit_AccountLogon_Others, 0x0cce9241, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountLogon_Others_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountLogon_KerbCredentialValidation_defined)
+DEFINE_GUID(Audit_AccountLogon_KerbCredentialValidation, 0x0cce9242, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountLogon_KerbCredentialValidation_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_NPS_defined)
+DEFINE_GUID(Audit_Logon_NPS, 0x0cce9243, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_NPS_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_DetailedFileShare_defined)
+DEFINE_GUID(Audit_ObjectAccess_DetailedFileShare, 0x0cce9244, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_DetailedFileShare_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_RemovableStorage_defined)
+DEFINE_GUID(Audit_ObjectAccess_RemovableStorage, 0x0cce9245, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_RemovableStorage_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_CbacStaging_defined)
+DEFINE_GUID(Audit_ObjectAccess_CbacStaging, 0x0cce9246, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_CbacStaging_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_Claims_defined)
+DEFINE_GUID(Audit_Logon_Claims, 0x0cce9247, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_Claims_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DetailedTracking_PnpActivity_defined)
+DEFINE_GUID(Audit_DetailedTracking_PnpActivity, 0x0cce9248, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DetailedTracking_PnpActivity_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_Groups_defined)
+DEFINE_GUID(Audit_Logon_Groups, 0x0cce9249, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_Groups_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DetailedTracking_TokenRightAdjusted_defined)
+DEFINE_GUID(Audit_DetailedTracking_TokenRightAdjusted, 0x0cce924a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DetailedTracking_TokenRightAdjusted_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_System_defined)
+DEFINE_GUID(Audit_System, 0x69979848, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_System_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_Logon_defined)
+DEFINE_GUID(Audit_Logon, 0x69979849, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_Logon_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_ObjectAccess_defined)
+DEFINE_GUID(Audit_ObjectAccess, 0x6997984a, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_ObjectAccess_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_defined)
+DEFINE_GUID(Audit_PrivilegeUse, 0x6997984b, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PrivilegeUse_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DetailedTracking_defined)
+DEFINE_GUID(Audit_DetailedTracking, 0x6997984c, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DetailedTracking_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_PolicyChange_defined)
+DEFINE_GUID(Audit_PolicyChange, 0x6997984d, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_PolicyChange_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountManagement_defined)
+DEFINE_GUID(Audit_AccountManagement, 0x6997984e, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountManagement_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_DirectoryServiceAccess_defined)
+DEFINE_GUID(Audit_DirectoryServiceAccess, 0x6997984f, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_DirectoryServiceAccess_defined
+#endif
+#endif
+
+#if !defined(INITGUID) || !defined(Audit_AccountLogon_defined)
+DEFINE_GUID(Audit_AccountLogon, 0x69979850, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30);
+#ifdef INITGUID
+#define Audit_AccountLogon_defined
+#endif
+#endif
+#endif
+
 #ifndef _NTSECAPI_
 #define _NTSECAPI_
 
@@ -414,9 +893,19 @@
   typedef PVOID LSA_HANDLE,*PLSA_HANDLE;
 
   typedef enum _TRUSTED_INFORMATION_CLASS {
-    TrustedDomainNameInformation = 1,TrustedControllersInformation,TrustedPosixOffsetInformation,TrustedPasswordInformation,
-    TrustedDomainInformationBasic,TrustedDomainInformationEx,TrustedDomainAuthInformation,TrustedDomainFullInformation,
-    TrustedDomainAuthInformationInternal,TrustedDomainFullInformationInternal,TrustedDomainInformationEx2Internal,TrustedDomainFullInformation2Internal
+    TrustedDomainNameInformation = 1,
+    TrustedControllersInformation,
+    TrustedPosixOffsetInformation,
+    TrustedPasswordInformation,
+    TrustedDomainInformationBasic,
+    TrustedDomainInformationEx,
+    TrustedDomainAuthInformation,
+    TrustedDomainFullInformation,
+    TrustedDomainAuthInformationInternal,
+    TrustedDomainFullInformationInternal,
+    TrustedDomainInformationEx2Internal,
+    TrustedDomainFullInformation2Internal,
+    TrustedDomainSupportedEncryptionTypes
   } TRUSTED_INFORMATION_CLASS,*PTRUSTED_INFORMATION_CLASS;
 
   typedef struct _TRUSTED_DOMAIN_NAME_INFO {
@@ -456,7 +945,20 @@
 #define TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0x00000010
 #define TRUST_ATTRIBUTE_WITHIN_FOREST 0x00000020
 #define TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0x00000040
+
+#if _WIN32_WINNT >= 0x0600
 #define TRUST_ATTRIBUTE_TRUST_USES_RC4_ENCRYPTION 0x00000080
+#define TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS 0x00000100
+#endif
+
+#if _WIN32_WINNT >= 0x0602
+#define TRUST_ATTRIBUTE_CROSS_ORGANIZATION_NO_TGT_DELEGATION 0x00000200
+#define TRUST_ATTRIBUTE_PIM_TRUST 0x00000400
+#endif
+
+#if _WIN32_WINNT >= 0x0603
+#define TRUST_ATTRIBUTE_CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION 0x00000800
+#endif
 
 #define TRUST_ATTRIBUTES_VALID 0xFF03FFFF
 #define TRUST_ATTRIBUTES_USER 0xFF000000
@@ -514,6 +1016,10 @@
     TRUSTED_DOMAIN_AUTH_INFORMATION AuthInformation;
   } TRUSTED_DOMAIN_FULL_INFORMATION2,*PTRUSTED_DOMAIN_FULL_INFORMATION2;
 
+  typedef struct _TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES {
+    ULONG SupportedEncryptionTypes;
+  } TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,*PTRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES;
+
   typedef enum {
     ForestTrustTopLevelName,ForestTrustTopLevelNameEx,ForestTrustDomainInfo,ForestTrustRecordTypeLast = ForestTrustDomainInfo
   } LSA_FOREST_TRUST_RECORD_TYPE;
@@ -592,7 +1098,7 @@
     ULONG FailedAttemptCountSinceLastSuccessfulLogon;
   } LSA_LAST_INTER_LOGON_INFO,*PLSA_LAST_INTER_LOGON_INFO;
   #endif
-  
+
   typedef struct _SECURITY_LOGON_SESSION_DATA {
     ULONG Size;
     LUID LogonId;
@@ -634,6 +1140,52 @@
   NTSTATUS NTAPI LsaLookupNames(LSA_HANDLE PolicyHandle,ULONG Count,PLSA_UNICODE_STRING Names,PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,PLSA_TRANSLATED_SID *Sids);
   NTSTATUS NTAPI LsaLookupNames2(LSA_HANDLE PolicyHandle,ULONG Flags,ULONG Count,PLSA_UNICODE_STRING Names,PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,PLSA_TRANSLATED_SID2 *Sids);
   NTSTATUS NTAPI LsaLookupSids(LSA_HANDLE PolicyHandle,ULONG Count,PSID *Sids,PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,PLSA_TRANSLATED_NAME *Names);
+  NTSTATUS NTAPI LsaLookupSids2(LSA_HANDLE PolicyHandle,ULONG LookupOptions,ULONG Count,PSID *Sids,PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,PLSA_TRANSLATED_NAME *Names);
+  NTSTATUS NTAPI LsaSetCAPs(PLSA_UNICODE_STRING CAPDNs,ULONG CAPDNCount,ULONG Flags);
+  NTSTATUS NTAPI LsaGetAppliedCAPIDs(PLSA_UNICODE_STRING SystemName,PSID **CAPIDs,PULONG CAPIDCount);
+
+  #define MAXIMUM_CAPES_PER_CAP 0x7f
+
+  #define CENTRAL_ACCESS_POLICY_OWNER_RIGHTS_PRESENT_FLAG 0x00000001
+  #define CENTRAL_ACCESS_POLICY_STAGED_OWNER_RIGHTS_PRESENT_FLAG 0x00000100
+  #define CENTRAL_ACCESS_POLICY_STAGED_FLAG 0x00010000
+  #define STAGING_FLAG(Effective) ((Effective & 0xf) << 8)
+
+  #define CENTRAL_ACCESS_POLICY_VALID_FLAG_MASK (CENTRAL_ACCESS_POLICY_OWNER_RIGHTS_PRESENT_FLAG | \
+                                                 CENTRAL_ACCESS_POLICY_STAGED_OWNER_RIGHTS_PRESENT_FLAG  | \
+                                                 CENTRAL_ACCESS_POLICY_STAGED_FLAG)
+
+  #define LSASETCAPS_RELOAD_FLAG 0x00000001
+  #define LSASETCAPS_VALID_FLAG_MASK LSASETCAPS_RELOAD_FLAG
+
+  typedef struct _CENTRAL_ACCESS_POLICY_ENTRY {
+    LSA_UNICODE_STRING Name;
+    LSA_UNICODE_STRING Description;
+    LSA_UNICODE_STRING ChangeId;
+    ULONG LengthAppliesTo;
+    PUCHAR AppliesTo;
+    ULONG LengthSD;
+    PSECURITY_DESCRIPTOR SD;
+    ULONG LengthStagedSD;
+    PSECURITY_DESCRIPTOR StagedSD;
+    ULONG Flags;
+  } CENTRAL_ACCESS_POLICY_ENTRY, *PCENTRAL_ACCESS_POLICY_ENTRY;
+
+  typedef const CENTRAL_ACCESS_POLICY_ENTRY *PCCENTRAL_ACCESS_POLICY_ENTRY;
+
+  typedef struct _CENTRAL_ACCESS_POLICY {
+    PSID CAPID;
+    LSA_UNICODE_STRING Name;
+    LSA_UNICODE_STRING Description;
+    LSA_UNICODE_STRING ChangeId;
+    ULONG Flags;
+    ULONG CAPECount;
+    PCENTRAL_ACCESS_POLICY_ENTRY *CAPEs;
+  } CENTRAL_ACCESS_POLICY, *PCENTRAL_ACCESS_POLICY;
+
+  typedef const CENTRAL_ACCESS_POLICY *PCCENTRAL_ACCESS_POLICY;
+
+  NTSTATUS NTAPI LsaQueryCAPs(PSID *CAPIDs,ULONG CAPIDCount,PCENTRAL_ACCESS_POLICY *CAPs,PULONG CAPCount);
 
 #define SE_INTERACTIVE_LOGON_NAME TEXT("SeInteractiveLogonRight")
 #define SE_NETWORK_LOGON_NAME TEXT("SeNetworkLogonRight")
@@ -674,7 +1226,11 @@
 #endif
 
   enum NEGOTIATE_MESSAGES {
-    NegEnumPackagePrefixes = 0,NegGetCallerName = 1,NegCallPackageMax
+    NegEnumPackagePrefixes = 0,
+    NegGetCallerName = 1,
+    NegTransferCredentials = 2,
+    NegMsgReserved1 = 3,
+    NegCallPackageMax
   };
 
 #define NEGOTIATE_MAX_PREFIX 32
@@ -733,6 +1289,10 @@
 #define DOMAIN_PASSWORD_STORE_CLEARTEXT __MSABI_LONG(0x00000010)
 #define DOMAIN_REFUSE_PASSWORD_CHANGE __MSABI_LONG(0x00000020)
 
+#if _WIN32_WINNT >= 0x0502
+#define DOMAIN_NO_LM_OWF_CHANGE __MSABI_LONG(0x00000040)
+#endif
+
 #ifndef _PASSWORD_NOTIFICATION_DEFINED
 #define _PASSWORD_NOTIFICATION_DEFINED
   typedef NTSTATUS (*PSAM_PASSWORD_NOTIFICATION_ROUTINE)(PUNICODE_STRING UserName,ULONG RelativeId,PUNICODE_STRING NewPassword);
@@ -755,7 +1315,15 @@
 #define MSV1_0_SUBAUTHENTICATION_VALUE "Auth"
 
   typedef enum _MSV1_0_LOGON_SUBMIT_TYPE {
-    MsV1_0InteractiveLogon = 2,MsV1_0Lm20Logon,MsV1_0NetworkLogon,MsV1_0SubAuthLogon,MsV1_0WorkstationUnlockLogon = 7
+    MsV1_0InteractiveLogon = 2,
+    MsV1_0Lm20Logon,
+    MsV1_0NetworkLogon,
+    MsV1_0SubAuthLogon,
+    MsV1_0WorkstationUnlockLogon = 7,
+    MsV1_0S4ULogon = 12,
+    MsV1_0VirtualLogon = 82,
+    MsV1_0NoElevationLogon,
+    MsV1_0LuidLogon
   } MSV1_0_LOGON_SUBMIT_TYPE,*PMSV1_0_LOGON_SUBMIT_TYPE;
 
   typedef enum _MSV1_0_PROFILE_BUFFER_TYPE {
@@ -811,6 +1379,15 @@
 #define MSV1_0_SUBAUTHENTICATION_DLL_EX 0x00100000
 #define MSV1_0_ALLOW_MSVCHAPV2 0x00010000
 
+#if _WIN32_WINNT >= 0x0600
+#define MSV1_0_S4U2SELF 0x00020000
+#define MSV1_0_CHECK_LOGONHOURS_FOR_S4U 0x00040000
+#endif
+
+#if _WIN32_WINNT >= 0x0602
+#define MSV1_0_INTERNET_DOMAIN 0x00080000
+#endif
+
 #define MSV1_0_SUBAUTHENTICATION_DLL 0xFF000000
 #define MSV1_0_SUBAUTHENTICATION_DLL_SHIFT 24
 #define MSV1_0_MNS_LOGON 0x01000000
@@ -841,6 +1418,19 @@
     ULONG SubAuthPackageId;
   } MSV1_0_SUBAUTH_LOGON,*PMSV1_0_SUBAUTH_LOGON;
 
+#if _WIN32_WINNT >= 0x0600
+
+#define MSV1_0_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2
+
+  typedef struct _MSV1_0_S4U_LOGON {
+    MSV1_0_LOGON_SUBMIT_TYPE MessageType;
+    ULONG Flags;
+    UNICODE_STRING UserPrincipalName;
+    UNICODE_STRING DomainName;
+  } MSV1_0_S4U_LOGON, *PMSV1_0_S4U_LOGON;
+
+#endif
+
 #define LOGON_GUEST 0x01
 #define LOGON_NOENCRYPTION 0x02
 #define LOGON_CACHED_ACCOUNT 0x04
@@ -851,6 +1441,21 @@
 #define LOGON_NTLMV2_ENABLED 0x100
 #define LOGON_RESOURCE_GROUPS 0x200
 #define LOGON_PROFILE_PATH_RETURNED 0x400
+#define LOGON_NT_V2 0x800
+#define LOGON_LM_V2 0x1000
+#define LOGON_NTLM_V2 0x2000
+
+#if _WIN32_WINNT >= 0x0600
+#define LOGON_OPTIMIZED 0x4000
+#define LOGON_WINLOGON 0x8000
+#define LOGON_PKINIT 0x10000
+#define LOGON_NO_OPTIMIZED 0x20000
+#endif
+
+#if _WIN32_WINNT >= 0x0602
+#define LOGON_NO_ELEVATION 0x40000
+#define LOGON_MANAGED_SERVICE 0x80000
+#endif
 
 #define MSV1_0_SUBAUTHENTICATION_FLAGS 0xFF000000
 
@@ -869,9 +1474,34 @@
   } MSV1_0_LM20_LOGON_PROFILE,*PMSV1_0_LM20_LOGON_PROFILE;
 
 #define MSV1_0_OWF_PASSWORD_LENGTH 16
+#define MSV1_0_SHA_PASSWORD_LENGTH 20
+#define MSV1_0_CREDENTIAL_KEY_LENGTH 20
 #define MSV1_0_CRED_LM_PRESENT 0x1
 #define MSV1_0_CRED_NT_PRESENT 0x2
+#define MSV1_0_CRED_REMOVED 0x4
+#define MSV1_0_CRED_CREDKEY_PRESENT 0x8
+#define MSV1_0_CRED_SHA_PRESENT 0x10
+
 #define MSV1_0_CRED_VERSION 0
+#define MSV1_0_CRED_VERSION_V2 2
+#define MSV1_0_CRED_VERSION_V3 4
+#define MSV1_0_CRED_VERSION_IUM 0xffff0001
+#define MSV1_0_CRED_VERSION_REMOTE 0xffff0002
+#define MSV1_0_CRED_VERSION_ARSO 0xffff0003
+#define MSV1_0_CRED_VERSION_RESERVED_1 0xfffffffe
+#define MSV1_0_CRED_VERSION_INVALID 0xffffffff
+
+  typedef enum _MSV1_0_CREDENTIAL_KEY_TYPE {
+    InvalidCredKey,
+    DeprecatedIUMCredKey,
+    DomainUserCredKey,
+    LocalUserCredKey,
+    ExternallySuppliedCredKey
+  } MSV1_0_CREDENTIAL_KEY_TYPE;
+
+  typedef struct _MSV1_0_CREDENTIAL_KEY {
+    UCHAR Data[MSV1_0_CREDENTIAL_KEY_LENGTH];
+  } MSV1_0_CREDENTIAL_KEY, *PMSV1_0_CREDENTIAL_KEY;
 
   typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL {
     ULONG Version;
@@ -880,6 +1510,40 @@
     UCHAR NtPassword[MSV1_0_OWF_PASSWORD_LENGTH];
   } MSV1_0_SUPPLEMENTAL_CREDENTIAL,*PMSV1_0_SUPPLEMENTAL_CREDENTIAL;
 
+  typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL_V2 {
+    ULONG Version;
+    ULONG Flags;
+    UCHAR NtPassword[MSV1_0_OWF_PASSWORD_LENGTH];
+    MSV1_0_CREDENTIAL_KEY CredentialKey;
+  } MSV1_0_SUPPLEMENTAL_CREDENTIAL_V2, *PMSV1_0_SUPPLEMENTAL_CREDENTIAL_V2;
+
+  typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL_V3 {
+    ULONG Version;
+    ULONG Flags;
+    MSV1_0_CREDENTIAL_KEY_TYPE CredentialKeyType;
+    UCHAR NtPassword[MSV1_0_OWF_PASSWORD_LENGTH];
+    MSV1_0_CREDENTIAL_KEY CredentialKey;
+    UCHAR ShaPassword[MSV1_0_SHA_PASSWORD_LENGTH];
+  } MSV1_0_SUPPLEMENTAL_CREDENTIAL_V3, *PMSV1_0_SUPPLEMENTAL_CREDENTIAL_V3;
+
+  typedef struct _MSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL {
+    ULONG Version;
+    ULONG EncryptedCredsSize;
+    UCHAR EncryptedCreds[1];
+  } MSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL, *PMSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL;
+
+#define MSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL_SIZE(Creds) \
+  (FIELD_OFFSET(MSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL, EncryptedCreds) + (Creds)->EncryptedCredsSize)
+
+  typedef struct _MSV1_0_REMOTE_SUPPLEMENTAL_CREDENTIAL {
+    ULONG Version;
+    ULONG Flags;
+    MSV1_0_CREDENTIAL_KEY CredentialKey;
+    MSV1_0_CREDENTIAL_KEY_TYPE CredentialKeyType;
+    ULONG EncryptedCredsSize;
+    UCHAR EncryptedCreds[1];
+  } MSV1_0_REMOTE_SUPPLEMENTAL_CREDENTIAL, *PMSV1_0_REMOTE_SUPPLEMENTAL_CREDENTIAL;
+
 #define MSV1_0_NTLM3_RESPONSE_LENGTH 16
 #define MSV1_0_NTLM3_OWF_LENGTH 16
 
@@ -888,6 +1552,14 @@
 
 #define MSV1_0_AV_FLAG_FORCE_GUEST 0x00000001
 
+#if _WIN32_WINNT >= 0x0600
+#define MSV1_0_AV_FLAG_MIC_HANDSHAKE_MESSAGES 0x00000002
+#endif
+
+#if _WIN32_WINNT >= 0x0601
+#define MSV1_0_AV_FLAG_UNVERIFIED_TARGET 0x00000004
+#endif
+
   typedef struct _MSV1_0_NTLM3_RESPONSE {
     UCHAR Response[MSV1_0_NTLM3_RESPONSE_LENGTH];
     UCHAR RespType;
@@ -924,13 +1596,44 @@
   typedef struct _MSV1_0_AV_PAIR {
     USHORT AvId;
     USHORT AvLen;
-
   } MSV1_0_AV_PAIR,*PMSV1_0_AV_PAIR;
 
   typedef enum _MSV1_0_PROTOCOL_MESSAGE_TYPE {
-    MsV1_0Lm20ChallengeRequest = 0,MsV1_0Lm20GetChallengeResponse,MsV1_0EnumerateUsers,MsV1_0GetUserInfo,MsV1_0ReLogonUsers,MsV1_0ChangePassword,
-    MsV1_0ChangeCachedPassword,MsV1_0GenericPassthrough,MsV1_0CacheLogon,MsV1_0SubAuth,MsV1_0DeriveCredential,MsV1_0CacheLookup,
-    MsV1_0SetProcessOption
+    MsV1_0Lm20ChallengeRequest = 0,
+    MsV1_0Lm20GetChallengeResponse,
+    MsV1_0EnumerateUsers,
+    MsV1_0GetUserInfo,
+    MsV1_0ReLogonUsers,
+    MsV1_0ChangePassword,
+    MsV1_0ChangeCachedPassword,
+    MsV1_0GenericPassthrough,
+    MsV1_0CacheLogon,
+    MsV1_0SubAuth,
+    MsV1_0DeriveCredential,
+    MsV1_0CacheLookup,
+#if _WIN32_WINNT >= 0x0501
+    MsV1_0SetProcessOption,
+#endif
+#if _WIN32_WINNT >= 0x0600
+    MsV1_0ConfigLocalAliases,
+    MsV1_0ClearCachedCredentials,
+#endif
+#if _WIN32_WINNT >= 0x0601
+    MsV1_0LookupToken,
+#endif
+#if _WIN32_WINNT >= 0x0602
+    MsV1_0ValidateAuth,
+    MsV1_0CacheLookupEx,
+    MsV1_0GetCredentialKey,
+    MsV1_0SetThreadOption,
+#endif
+#if _WIN32_WINNT >= 0x0A00
+    MsV1_0DecryptDpapiMasterKey,
+    MsV1_0GetStrongCredentialKey,
+    MsV1_0TransferCred,
+    MsV1_0ProvisionTbal,
+    MsV1_0DeleteTbalSecrets
+#endif
   } MSV1_0_PROTOCOL_MESSAGE_TYPE,*PMSV1_0_PROTOCOL_MESSAGE_TYPE;
 
   typedef struct _MSV1_0_CHANGEPASSWORD_REQUEST {
@@ -986,6 +1689,7 @@
 #define RTL_ENCRYPT_MEMORY_SIZE 8
 #define RTL_ENCRYPT_OPTION_CROSS_PROCESS 0x01
 #define RTL_ENCRYPT_OPTION_SAME_LOGON 0x02
+#define RTL_ENCRYPT_OPTION_FOR_SYSTEM 0x04
 
   NTSTATUS WINAPI RtlEncryptMemory(PVOID Memory,ULONG MemorySize,ULONG OptionFlags);
   NTSTATUS WINAPI RtlDecryptMemory(PVOID Memory,ULONG MemorySize,ULONG OptionFlags);
@@ -997,6 +1701,8 @@
 #define KERB_ETYPE_DES_CBC_CRC 1
 #define KERB_ETYPE_DES_CBC_MD4 2
 #define KERB_ETYPE_DES_CBC_MD5 3
+#define KERB_ETYPE_AES128_CTS_HMAC_SHA1_96 17
+#define KERB_ETYPE_AES256_CTS_HMAC_SHA1_96 18
 
 #define KERB_ETYPE_RC4_MD4 -128
 #define KERB_ETYPE_RC4_PLAIN2 -129
@@ -1009,6 +1715,8 @@
 #define KERB_ETYPE_RC4_PLAIN_OLD_EXP -136
 #define KERB_ETYPE_RC4_PLAIN -140
 #define KERB_ETYPE_RC4_PLAIN_EXP -141
+#define KERB_ETYPE_AES128_CTS_HMAC_SHA1_96_PLAIN -148
+#define KERB_ETYPE_AES256_CTS_HMAC_SHA1_96_PLAIN -149
 
 #define KERB_ETYPE_DSA_SHA1_CMS 9
 #define KERB_ETYPE_RSA_MD5_CMS 10
@@ -1040,6 +1748,9 @@
 #define KERB_CHECKSUM_KRB_DES_MAC_K 5
 #define KERB_CHECKSUM_MD5 7
 #define KERB_CHECKSUM_MD5_DES 8
+#define KERB_CHECKSUM_SHA1_NEW 14
+#define KERB_CHECKSUM_HMAC_SHA1_96_AES128 15
+#define KERB_CHECKSUM_HMAC_SHA1_96_AES256 16
 
 #define KERB_CHECKSUM_LM -130
 #define KERB_CHECKSUM_SHA1 -131
@@ -1050,6 +1761,8 @@
 #define KERB_CHECKSUM_RC4_MD5 -136
 #define KERB_CHECKSUM_MD5_HMAC -137
 #define KERB_CHECKSUM_HMAC_MD5 -138
+#define KERB_CHECKSUM_HMAC_SHA1_96_AES128_Ki -150
+#define KERB_CHECKSUM_HMAC_SHA1_96_AES256_Ki -151
 
 #define AUTH_REQ_ALLOW_FORWARDABLE 0x00000001
 #define AUTH_REQ_ALLOW_PROXIABLE 0x00000002
@@ -1080,6 +1793,10 @@
 #define KERB_TICKET_FLAGS_hw_authent 0x00100000
 #define KERB_TICKET_FLAGS_ok_as_delegate 0x00040000
 #define KERB_TICKET_FLAGS_name_canonicalize 0x00010000
+#if _WIN32_WINNT == 0x0501
+#define KERB_TICKET_FLAGS_cname_in_pa_data 0x00040000
+#endif
+#define KERB_TICKET_FLAGS_enc_pa_rep 0x00010000
 #define KERB_TICKET_FLAGS_reserved1 0x00000001
 
 #define KRB_NT_UNKNOWN 0
@@ -1091,12 +1808,21 @@
 #define KRB_NT_SRV_XHST 4
 #define KRB_NT_UID 5
 #define KRB_NT_ENTERPRISE_PRINCIPAL 10
+#define KRB_NT_WELLKNOWN 11
+#define KRB_NT_MS_BRANCH_ID -133
 #define KRB_NT_ENT_PRINCIPAL_AND_ID -130
 #define KRB_NT_MS_PRINCIPAL -128
 #define KRB_NT_MS_PRINCIPAL_AND_ID -129
 
 #define KERB_IS_MS_PRINCIPAL(_x_) (((_x_) <= KRB_NT_MS_PRINCIPAL) || ((_x_) >= KRB_NT_ENTERPRISE_PRINCIPAL))
 
+#if _WIN32_WINNT >= 0x0600
+#define KRB_NT_X500_PRINCIPAL 6
+#endif
+
+#define KRB_WELLKNOWN_STRING L"WELLKNOWN"
+#define KRB_ANONYMOUS_STRING L"ANONYMOUS"
+
 #ifndef MICROSOFT_KERBEROS_NAME_A
 
 #define MICROSOFT_KERBEROS_NAME_A "Kerberos"
@@ -1111,12 +1837,22 @@
 #define KERB_WRAP_NO_ENCRYPT 0x80000001
 
   typedef enum _KERB_LOGON_SUBMIT_TYPE {
-    KerbInteractiveLogon = 2,KerbSmartCardLogon = 6,KerbWorkstationUnlockLogon = 7,KerbSmartCardUnlockLogon = 8,KerbProxyLogon = 9,
-    KerbTicketLogon = 10,KerbTicketUnlockLogon = 11,KerbS4ULogon = 12
+    KerbInteractiveLogon = 2,
+    KerbSmartCardLogon = 6,
+    KerbWorkstationUnlockLogon = 7,
+    KerbSmartCardUnlockLogon = 8,
+    KerbProxyLogon = 9,
+    KerbTicketLogon = 10,
+    KerbTicketUnlockLogon = 11,
+    KerbS4ULogon = 12,
 #if (_WIN32_WINNT >= 0x0600)
-   ,KerbCertificateLogon         = 13,
-    KerbCertificateS4ULogon      = 14,
-    KerbCertificateUnlockLogon   = 15 
+    KerbCertificateLogon = 13,
+    KerbCertificateS4ULogon = 14,
+    KerbCertificateUnlockLogon = 15,
+#endif
+#if (_WIN32_WINNT >= 0x0602)
+    KerbNoElevationLogon = 83,
+    KerbLuidLogon = 84
 #endif
   } KERB_LOGON_SUBMIT_TYPE,*PKERB_LOGON_SUBMIT_TYPE;
 
@@ -1154,12 +1890,18 @@
   } KERB_TICKET_LOGON,*PKERB_TICKET_LOGON;
 
 #define KERB_LOGON_FLAG_ALLOW_EXPIRED_TICKET 0x1
+#define KERB_LOGON_FLAG_REDIRECTED 0x2
 
   typedef struct _KERB_TICKET_UNLOCK_LOGON {
     KERB_TICKET_LOGON Logon;
     LUID LogonId;
   } KERB_TICKET_UNLOCK_LOGON,*PKERB_TICKET_UNLOCK_LOGON;
 
+#if _WIN32_WINNT >= 0x0600
+#define KERB_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2
+#define KERB_S4U_LOGON_FLAG_IDENTIFY 0x8
+#endif
+
   typedef struct _KERB_S4U_LOGON {
     KERB_LOGON_SUBMIT_TYPE MessageType;
     ULONG Flags;
@@ -1202,17 +1944,63 @@
     PUCHAR Value;
   } KERB_CRYPTO_KEY,*PKERB_CRYPTO_KEY;
 
+  typedef struct KERB_CRYPTO_KEY32 {
+    LONG KeyType;
+    ULONG Length;
+    ULONG Offset;
+  } KERB_CRYPTO_KEY32,*PKERB_CRYPTO_KEY32;
+
   typedef struct _KERB_TICKET_PROFILE {
     KERB_INTERACTIVE_PROFILE Profile;
     KERB_CRYPTO_KEY SessionKey;
   } KERB_TICKET_PROFILE,*PKERB_TICKET_PROFILE;
 
   typedef enum _KERB_PROTOCOL_MESSAGE_TYPE {
-    KerbDebugRequestMessage = 0,KerbQueryTicketCacheMessage,KerbChangeMachinePasswordMessage,KerbVerifyPacMessage,KerbRetrieveTicketMessage,
-    KerbUpdateAddressesMessage,KerbPurgeTicketCacheMessage,KerbChangePasswordMessage,KerbRetrieveEncodedTicketMessage,KerbDecryptDataMessage,
-    KerbAddBindingCacheEntryMessage,KerbSetPasswordMessage,KerbSetPasswordExMessage,KerbVerifyCredentialsMessage,KerbQueryTicketCacheExMessage,
-    KerbPurgeTicketCacheExMessage,KerbRefreshSmartcardCredentialsMessage,KerbAddExtraCredentialsMessage,KerbQuerySupplementalCredentialsMessage,
-    KerbTransferCredentialsMessage,KerbQueryTicketCacheEx2Message
+    KerbDebugRequestMessage = 0,
+    KerbQueryTicketCacheMessage,
+    KerbChangeMachinePasswordMessage,
+    KerbVerifyPacMessage,
+    KerbRetrieveTicketMessage,
+    KerbUpdateAddressesMessage,
+    KerbPurgeTicketCacheMessage,
+    KerbChangePasswordMessage,
+    KerbRetrieveEncodedTicketMessage,
+    KerbDecryptDataMessage,
+    KerbAddBindingCacheEntryMessage,
+    KerbSetPasswordMessage,
+    KerbSetPasswordExMessage,
+#if _WIN32_WINNT >= 0x0501
+    KerbVerifyCredentialsMessage,
+    KerbQueryTicketCacheExMessage,
+    KerbPurgeTicketCacheExMessage,
+#endif
+#if _WIN32_WINNT >= 0x0502
+    KerbRefreshSmartcardCredentialsMessage,
+    KerbAddExtraCredentialsMessage,
+    KerbQuerySupplementalCredentialsMessage,
+#endif
+#if _WIN32_WINNT >= 0x0600
+    KerbTransferCredentialsMessage,
+    KerbQueryTicketCacheEx2Message,
+    KerbSubmitTicketMessage,
+    KerbAddExtraCredentialsExMessage,
+#endif
+#if _WIN32_WINNT >= 0x0602
+    KerbQueryKdcProxyCacheMessage,
+    KerbPurgeKdcProxyCacheMessage,
+    KerbQueryTicketCacheEx3Message,
+    KerbCleanupMachinePkinitCredsMessage,
+    KerbAddBindingCacheEntryExMessage,
+    KerbQueryBindingCacheMessage,
+    KerbPurgeBindingCacheMessage,
+    KerbPinKdcMessage,
+    KerbUnpinAllKdcsMessage,
+    KerbQueryDomainExtendedPoliciesMessage,
+    KerbQueryS4U2ProxyCacheMessage,
+#endif
+#if _WIN32_WINNT >= 0x0A00
+    KerbRetrieveKeyTabMessage
+#endif
   } KERB_PROTOCOL_MESSAGE_TYPE,*PKERB_PROTOCOL_MESSAGE_TYPE;
 
   typedef struct _KERB_QUERY_TKT_CACHE_REQUEST {
@@ -1255,6 +2043,24 @@
     ULONG SessionKeyType;
   } KERB_TICKET_CACHE_INFO_EX2,*PKERB_TICKET_CACHE_INFO_EX2;
 
+#if _WIN32_WINNT >= 0x0602
+  typedef struct _KERB_TICKET_CACHE_INFO_EX3 {
+    UNICODE_STRING ClientName;
+    UNICODE_STRING ClientRealm;
+    UNICODE_STRING ServerName;
+    UNICODE_STRING ServerRealm;
+    LARGE_INTEGER StartTime;
+    LARGE_INTEGER EndTime;
+    LARGE_INTEGER RenewTime;
+    LONG EncryptionType;
+    ULONG TicketFlags;
+    ULONG SessionKeyType;
+    ULONG BranchId;
+    ULONG CacheFlags;
+    UNICODE_STRING KdcCalled;
+  } KERB_TICKET_CACHE_INFO_EX3, *PKERB_TICKET_CACHE_INFO_EX3;
+#endif
+
   typedef struct _KERB_QUERY_TKT_CACHE_RESPONSE {
     KERB_PROTOCOL_MESSAGE_TYPE MessageType;
     ULONG CountOfTickets;
@@ -1273,6 +2079,14 @@
     KERB_TICKET_CACHE_INFO_EX2 Tickets[ANYSIZE_ARRAY];
   } KERB_QUERY_TKT_CACHE_EX2_RESPONSE,*PKERB_QUERY_TKT_CACHE_EX2_RESPONSE;
 
+#if _WIN32_WINNT >= 0x0602
+  typedef struct _KERB_QUERY_TKT_CACHE_EX3_RESPONSE {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG CountOfTickets;
+    KERB_TICKET_CACHE_INFO_EX3 Tickets[ANYSIZE_ARRAY];
+  } KERB_QUERY_TKT_CACHE_EX3_RESPONSE, *PKERB_QUERY_TKT_CACHE_EX3_RESPONSE;
+#endif
+
 #ifndef __SECHANDLE_DEFINED__
   typedef struct _SecHandle {
     ULONG_PTR dwLower;
@@ -1290,7 +2104,14 @@
 #define KERB_RETRIEVE_TICKET_USE_CREDHANDLE 0x4
 #define KERB_RETRIEVE_TICKET_AS_KERB_CRED 0x8
 #define KERB_RETRIEVE_TICKET_WITH_SEC_CRED 0x10
+
+#if _WIN32_WINNT >= 0x0600
 #define KERB_RETRIEVE_TICKET_CACHE_TICKET 0x20
+#endif
+
+#if _WIN32_WINNT >= 0x0601
+#define KERB_RETRIEVE_TICKET_MAX_LIFETIME 0x40
+#endif
 
 #define KERB_ETYPE_DEFAULT 0x0
 
@@ -1366,6 +2187,105 @@
     KERB_TICKET_CACHE_INFO_EX TicketTemplate;
   } KERB_PURGE_TKT_CACHE_EX_REQUEST,*PKERB_PURGE_TKT_CACHE_EX_REQUEST;
 
+  typedef struct _KERB_SUBMIT_TKT_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    LUID LogonId;
+    ULONG Flags;
+    KERB_CRYPTO_KEY32 Key;
+    ULONG KerbCredSize;
+    ULONG KerbCredOffset;
+  } KERB_SUBMIT_TKT_REQUEST, *PKERB_SUBMIT_TKT_REQUEST;
+
+#if _WIN32_WINNT >= 0x0602
+
+  typedef struct _KERB_QUERY_KDC_PROXY_CACHE_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG Flags;
+    LUID LogonId;
+  } KERB_QUERY_KDC_PROXY_CACHE_REQUEST, *PKERB_QUERY_KDC_PROXY_CACHE_REQUEST;
+
+  typedef struct _KDC_PROXY_CACHE_ENTRY_DATA {
+    ULONG64 SinceLastUsed;
+    UNICODE_STRING DomainName;
+    UNICODE_STRING ProxyServerName;
+    UNICODE_STRING ProxyServerVdir;
+    USHORT ProxyServerPort;
+    LUID LogonId;
+    UNICODE_STRING CredUserName;
+    UNICODE_STRING CredDomainName;
+    BOOLEAN GlobalCache;
+  } KDC_PROXY_CACHE_ENTRY_DATA, *PKDC_PROXY_CACHE_ENTRY_DATA;
+
+  typedef struct _KERB_QUERY_KDC_PROXY_CACHE_RESPONSE {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG CountOfEntries;
+    PKDC_PROXY_CACHE_ENTRY_DATA Entries;
+  } KERB_QUERY_KDC_PROXY_CACHE_RESPONSE, *PKERB_QUERY_KDC_PROXY_CACHE_RESPONSE;
+
+  typedef struct _KERB_PURGE_KDC_PROXY_CACHE_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG Flags;
+    LUID LogonId;
+  } KERB_PURGE_KDC_PROXY_CACHE_REQUEST, *PKERB_PURGE_KDC_PROXY_CACHE_REQUEST;
+
+  typedef struct _KERB_PURGE_KDC_PROXY_CACHE_RESPONSE {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG CountOfPurged;
+  } KERB_PURGE_KDC_PROXY_CACHE_RESPONSE, *PKERB_PURGE_KDC_PROXY_CACHE_RESPONSE;
+
+#define KERB_S4U2PROXY_CACHE_ENTRY_INFO_FLAG_NEGATIVE 0x1
+
+  typedef struct _KERB_S4U2PROXY_CACHE_ENTRY_INFO {
+    UNICODE_STRING ServerName;
+    ULONG Flags;
+    NTSTATUS LastStatus;
+    LARGE_INTEGER  Expiry;
+  } KERB_S4U2PROXY_CACHE_ENTRY_INFO, *PKERB_S4U2PROXY_CACHE_ENTRY_INFO;
+
+#define KERB_S4U2PROXY_CRED_FLAG_NEGATIVE 0x1
+
+  typedef struct _KERB_S4U2PROXY_CRED {
+    UNICODE_STRING UserName;
+    UNICODE_STRING DomainName;
+    ULONG Flags;
+    NTSTATUS LastStatus;
+    LARGE_INTEGER Expiry;
+    ULONG CountOfEntries;
+    PKERB_S4U2PROXY_CACHE_ENTRY_INFO Entries;
+  } KERB_S4U2PROXY_CRED, *PKERB_S4U2PROXY_CRED;
+
+  typedef struct _KERB_QUERY_S4U2PROXY_CACHE_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG Flags;
+    LUID LogonId;
+  } KERB_QUERY_S4U2PROXY_CACHE_REQUEST, *PKERB_QUERY_S4U2PROXY_CACHE_REQUEST;
+
+  typedef struct _KERB_QUERY_S4U2PROXY_CACHE_RESPONSE {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG CountOfCreds;
+    PKERB_S4U2PROXY_CRED Creds;
+  } KERB_QUERY_S4U2PROXY_CACHE_RESPONSE, *PKERB_QUERY_S4U2PROXY_CACHE_RESPONSE;
+
+#endif
+
+#if _WIN32_WINNT >= 0x0A00
+
+  typedef struct _KERB_RETRIEVE_KEY_TAB_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG Flags;
+    UNICODE_STRING UserName;
+    UNICODE_STRING DomainName;
+    UNICODE_STRING Password;
+  } KERB_RETRIEVE_KEY_TAB_REQUEST, *PKERB_RETRIEVE_KEY_TAB_REQUEST;
+
+  typedef struct _KERB_RETRIEVE_KEY_TAB_RESPONSE {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG KeyTabLength;
+    PUCHAR KeyTab;
+  } KERB_RETRIEVE_KEY_TAB_RESPONSE, *PKERB_RETRIEVE_KEY_TAB_RESPONSE;
+
+#endif
+
   typedef struct _KERB_CHANGEPASSWORD_REQUEST {
     KERB_PROTOCOL_MESSAGE_TYPE MessageType;
     UNICODE_STRING DomainName;
@@ -1453,6 +2373,16 @@
 #define KERB_REQUEST_REPLACE_CREDENTIAL 2
 #define KERB_REQUEST_REMOVE_CREDENTIAL 4
 
+#if _WIN32_WINNT >= 0x0600
+
+  typedef struct _KERB_ADD_CREDENTIALS_REQUEST_EX {
+    KERB_ADD_CREDENTIALS_REQUEST Credentials;
+    ULONG PrincipalNameCount;
+    UNICODE_STRING PrincipalNames[1];
+  } KERB_ADD_CREDENTIALS_REQUEST_EX, *PKERB_ADD_CREDENTIALS_REQUEST_EX;
+
+#endif
+
   typedef struct _KERB_TRANSFER_CRED_REQUEST {
     KERB_PROTOCOL_MESSAGE_TYPE MessageType;
     LUID OriginLogonId;
@@ -1460,7 +2390,79 @@
     ULONG Flags;
   } KERB_TRANSFER_CRED_REQUEST,*PKERB_TRANSFER_CRED_REQUEST;
 
-#if (_WIN32_WINNT >= 0x0600)
+#define KERB_TRANSFER_CRED_WITH_TICKETS 1
+#define KERB_TRANSFER_CRED_CLEANUP_CREDENTIALS 2
+
+#if _WIN32_WINNT >= 0x0602
+
+  typedef struct _KERB_CLEANUP_MACHINE_PKINIT_CREDS_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    LUID LogonId;
+  } KERB_CLEANUP_MACHINE_PKINIT_CREDS_REQUEST, *PKERB_CLEANUP_MACHINE_PKINIT_CREDS_REQUEST;
+
+  typedef struct _KERB_BINDING_CACHE_ENTRY_DATA {
+    ULONG64 DiscoveryTime;
+    UNICODE_STRING RealmName;
+    UNICODE_STRING KdcAddress;
+    ULONG AddressType;
+    ULONG Flags;
+    ULONG DcFlags;
+    ULONG CacheFlags;
+    UNICODE_STRING KdcName;
+  } KERB_BINDING_CACHE_ENTRY_DATA, *PKERB_BINDING_CACHE_ENTRY_DATA;
+
+  typedef struct _KERB_QUERY_BINDING_CACHE_RESPONSE {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG CountOfEntries;
+    PKERB_BINDING_CACHE_ENTRY_DATA Entries;
+  } KERB_QUERY_BINDING_CACHE_RESPONSE, *PKERB_QUERY_BINDING_CACHE_RESPONSE;
+
+  typedef struct _KERB_ADD_BINDING_CACHE_ENTRY_EX_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    UNICODE_STRING RealmName;
+    UNICODE_STRING KdcAddress;
+    ULONG AddressType;
+    ULONG DcFlags;
+  } KERB_ADD_BINDING_CACHE_ENTRY_EX_REQUEST, *PKERB_ADD_BINDING_CACHE_ENTRY_EX_REQUEST;
+
+  typedef struct _KERB_QUERY_BINDING_CACHE_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+  } KERB_QUERY_BINDING_CACHE_REQUEST, *PKERB_QUERY_BINDING_CACHE_REQUEST;
+
+  typedef struct _KERB_PURGE_BINDING_CACHE_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+  } KERB_PURGE_BINDING_CACHE_REQUEST, *PKERB_PURGE_BINDING_CACHE_REQUEST;
+
+  typedef struct _KERB_QUERY_DOMAIN_EXTENDED_POLICIES_REQUEST {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG Flags;
+    UNICODE_STRING DomainName;
+  } KERB_QUERY_DOMAIN_EXTENDED_POLICIES_REQUEST, *PKERB_QUERY_DOMAIN_EXTENDED_POLICIES_REQUEST;
+
+#define KERB_QUERY_DOMAIN_EXTENDED_POLICIES_RESPONSE_FLAG_DAC_DISABLED 1
+
+  typedef struct _KERB_QUERY_DOMAIN_EXTENDED_POLICIES_RESPONSE {
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG Flags;
+    ULONG ExtendedPolicies;
+    ULONG DsFlags;
+  } KERB_QUERY_DOMAIN_EXTENDED_POLICIES_RESPONSE, *PKERB_QUERY_DOMAIN_EXTENDED_POLICIES_RESPONSE;
+
+  typedef enum _KERB_CERTIFICATE_INFO_TYPE {
+    CertHashInfo = 1,
+  } KERB_CERTIFICATE_INFO_TYPE, *PKERB_CERTIFICATE_INFO_TYPE;
+
+  typedef struct _KERB_CERTIFICATE_HASHINFO {
+    USHORT StoreNameLength;
+    USHORT HashLength;
+  } KERB_CERTIFICATE_HASHINFO, *PKERB_CERTIFICATE_HASHINFO;
+
+  typedef struct _KERB_CERTIFICATE_INFO {
+    ULONG CertInfoSize;
+    ULONG InfoType;
+  } KERB_CERTIFICATE_INFO, *PKERB_CERTIFICATE_INFO;
+
+#endif
 
 #define PER_USER_POLICY_UNCHANGED 0x00
 #define PER_USER_AUDIT_SUCCESS_INCLUDE 0x01
@@ -1478,11 +2480,36 @@
   } AUDIT_POLICY_INFORMATION, *PAUDIT_POLICY_INFORMATION;
   typedef const PAUDIT_POLICY_INFORMATION PCAUDIT_POLICY_INFORMATION, LPCAUDIT_POLICY_INFORMATION;
 
+#define AUDIT_SET_SYSTEM_POLICY 0x0001
+#define AUDIT_QUERY_SYSTEM_POLICY 0x0002
+#define AUDIT_SET_USER_POLICY 0x0004
+#define AUDIT_QUERY_USER_POLICY 0x0008
+#define AUDIT_ENUMERATE_USERS 0x0010
+#define AUDIT_SET_MISC_POLICY 0x0020
+#define AUDIT_QUERY_MISC_POLICY 0x0040
+
+#define AUDIT_GENERIC_ALL (STANDARD_RIGHTS_REQUIRED | AUDIT_SET_SYSTEM_POLICY | AUDIT_QUERY_SYSTEM_POLICY | \
+                           AUDIT_SET_USER_POLICY | AUDIT_QUERY_USER_POLICY | AUDIT_ENUMERATE_USERS | \
+                           AUDIT_SET_MISC_POLICY | AUDIT_QUERY_MISC_POLICY)
+
+#define AUDIT_GENERIC_READ (STANDARD_RIGHTS_READ | AUDIT_QUERY_SYSTEM_POLICY | AUDIT_QUERY_USER_POLICY | \
+                            AUDIT_ENUMERATE_USERS | AUDIT_QUERY_MISC_POLICY)
+
+#define AUDIT_GENERIC_WRITE (STANDARD_RIGHTS_WRITE | AUDIT_SET_USER_POLICY | AUDIT_SET_MISC_POLICY | \
+                             AUDIT_SET_SYSTEM_POLICY)
+
+#define AUDIT_GENERIC_EXECUTE STANDARD_RIGHTS_EXECUTE
+
   typedef struct _POLICY_AUDIT_SID_ARRAY {
     ULONG UsersCount;
     PSID  *UserSidArray;
   } POLICY_AUDIT_SID_ARRAY, *PPOLICY_AUDIT_SID_ARRAY;
 
+#if _WIN32_WINNT >= 0x0600
+
+#define KERB_CERTIFICATE_LOGON_FLAG_CHECK_DUPLICATES 0x1
+#define KERB_CERTIFICATE_LOGON_FLAG_USE_CERTIFICATE_INFO 0x2
+
   typedef struct _KERB_CERTIFICATE_LOGON {
     KERB_LOGON_SUBMIT_TYPE MessageType;
     UNICODE_STRING         DomainName;
@@ -1498,6 +2525,20 @@
     LUID                   LogonId;
   } KERB_CERTIFICATE_UNLOCK_LOGON, *PKERB_CERTIFICATE_UNLOCK_LOGON;
 
+#define KERB_CERTIFICATE_S4U_LOGON_FLAG_CHECK_DUPLICATES 0x1
+#define KERB_CERTIFICATE_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2
+#define KERB_CERTIFICATE_S4U_LOGON_FLAG_FAIL_IF_NT_AUTH_POLICY_REQUIRED 0x4
+#define KERB_CERTIFICATE_S4U_LOGON_FLAG_IDENTIFY 0x8
+
+  typedef struct _KERB_CERTIFICATE_S4U_LOGON {
+    KERB_LOGON_SUBMIT_TYPE MessageType;
+    ULONG Flags;
+    UNICODE_STRING UserPrincipalName;
+    UNICODE_STRING DomainName;
+    ULONG CertificateLength;
+    PUCHAR Certificate;
+  } KERB_CERTIFICATE_S4U_LOGON, *PKERB_CERTIFICATE_S4U_LOGON;
+
   typedef struct _KERB_SMARTCARD_CSP_INFO {
     DWORD dwCspInfoLen;
     DWORD MessageType;
@@ -1514,6 +2555,8 @@
     TCHAR bBuffer;
   } KERB_SMARTCARD_CSP_INFO, *PKERB_SMARTCARD_CSP_INFO;
 
+#endif
+
   BOOLEAN WINAPI AuditComputeEffectivePolicyBySid(
     const PSID pSid,
     const GUID *pSubCategoryGuids,
@@ -1615,7 +2658,65 @@
     PSECURITY_DESCRIPTOR pSecurityDescriptor
   );
 
-#endif /*(_WIN32_WINNT >= 0x0600)*/
+  BOOLEAN NTAPI AuditSetGlobalSaclW(
+    PCWSTR ObjectTypeName,
+    PACL Acl
+  );
+
+  BOOLEAN NTAPI AuditSetGlobalSaclA(
+    PCSTR ObjectTypeName,
+    PACL Acl
+  );
+
+#define AuditSetGlobalSacl __MINGW_NAME_AW(AuditSetGlobalSacl)
+
+  BOOLEAN NTAPI AuditQueryGlobalSaclW(
+    PCWSTR ObjectTypeName,
+    PACL *Acl
+  );
+
+  BOOLEAN NTAPI AuditQueryGlobalSaclA(
+    PCSTR ObjectTypeName,
+    PACL *Acl
+  );
+
+#define AuditQueryGlobalSacl __MINGW_NAME_AW(AuditQueryGlobalSacl)
+
+#if _WIN32_WINNT >= 0x0601
+
+#define PKU2U_PACKAGE_NAME_A "pku2u"
+#define PKU2U_PACKAGE_NAME L"pku2u"
+#define PKU2U_PACKAGE_NAME_W PKU2U_PACKAGE_NAME
+
+  typedef struct _PKU2U_CERT_BLOB {
+    ULONG CertOffset;
+    USHORT CertLength;
+  } PKU2U_CERT_BLOB, *PPKU2U_CERT_BLOB;
+
+#define PKU2U_CREDUI_CONTEXT_VERSION 0x4154414454524543
+
+  typedef struct _PKU2U_CREDUI_CONTEXT {
+    ULONG64 Version;
+    USHORT cbHeaderLength;
+    ULONG cbStructureLength;
+    USHORT CertArrayCount;
+    ULONG CertArrayOffset;
+  } PKU2U_CREDUI_CONTEXT, *PPKU2U_CREDUI_CONTEXT;
+
+  typedef enum _PKU2U_LOGON_SUBMIT_TYPE {
+    Pku2uCertificateS4ULogon = 14,
+  } PKU2U_LOGON_SUBMIT_TYPE, *PPKU2U_LOGON_SUBMIT_TYPE;
+
+  typedef struct _PKU2U_CERTIFICATE_S4U_LOGON {
+    PKU2U_LOGON_SUBMIT_TYPE MessageType;
+    ULONG Flags;
+    UNICODE_STRING UserPrincipalName;
+    UNICODE_STRING DomainName;
+    ULONG CertificateLength;
+    PUCHAR Certificate;
+  } PKU2U_CERTIFICATE_S4U_LOGON, *PPKU2U_CERTIFICATE_S4U_LOGON;
+
+#endif
 
 #ifdef __cplusplus
 }