NTLSA.H

The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the NTLSA.H header at

d:\th.public.fre\sdk\inc\minwin

and draws from it the type definitions that are tabulated below.

Nowadays, NTLSA.H is among the headers in the Software Development Kit (SDK) for Windows 10. It is there in the “um” subdirectory with many other headers that are intended only for user-mode programming. Before the SDK for Windows 8, it is instead in the Windows Driver Kit (WDK). It dates from WIndows Vista. Much of its content has earlier history back to at least the DDK for Windows NT 3.51 but in a header named NTSECAPI.H.

Line Number Type
951 enum _POLICY_AUDIT_EVENT_TYPE
2735 enum LSA_FOREST_TRUST_RECORD_TYPE