#pragma classflags(64)
#pragma namespace("\\\\.\\root\\wmi")
instance of __namespace{ name="ms_409";};
#pragma namespace("\\\\.\\root\\wmi\\ms_409")

[Description("File Kernel Trace; Operation Set 1") : Amended,AMENDMENT, LOCALE(0x0409)] 
class MSNT_FileBaseTrace_Set1 : EventTrace
{
  [Description("Enable Flags") : Amended,ValueDescriptions{"Create", "Create Named Pipe", "Close", "Read", "Write", "Query Information", "Set Information", "Query EA", "Set EA", "Flush Buffers", "Query Volume Information", "Set Volume Information", "Directory Control", "File System Control", "Device Control", "Internal Device Control", "Shutdown", "Lock Control", "Cleanup", "Create Mailslot", "Query Security", "Set Security", "Power", "System Control", "Device Change", "Query Quota", "Set Quota", "PNP"} : Amended] uint32 Flags;
};

[Description("File Kernel Trace; Operation Set 2") : Amended,AMENDMENT, LOCALE(0x0409)] 
class MSNT_FileBaseTrace_Set2 : EventTrace
{
  [Description("Enable Flags") : Amended,ValueDescriptions{"Acquire For Section Synchronization", "Release For Section Synchronization", "Acquire For Mod Write", "Release For Mod Write", "Acquire For CC Flush", "Release For CC Flush", "Notify Stream File Object", "Fast IO Check If Possible", "Network Query Open", "MDL Read", "MDL Read Complete", "Prepare MDL Write", "MDL Write Complete", "Volume Mount", "Volume Dismount"} : Amended] uint32 Flags;
};

[Description("File Kernel Trace; Optional Data") : Amended,AMENDMENT, LOCALE(0x0409)] 
class MSNT_FileBaseTrace_OptionalData : EventTrace
{
  [Description("Enable Flags") : Amended,ValueDescriptions{"User Context", "Session Id", "Last Access Time", "Call Parameters", "Call Result Data", "Previous Data", "Create On Existing File", "Process Window Station", "Block Paging IO"} : Amended] uint32 Flags;
};

[Description("File Kernel Trace; Volume To Log") : Amended,AMENDMENT, LOCALE(0x0409)] 
class MSNT_FileBaseTrace_VolumeToLog : EventTrace
{
  [Description("Enable Flags") : Amended,ValueDescriptions{"A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "All", "Local", "Network"} : Amended] uint32 Flags;
};

[Description("File Trace") : Amended,DisplayName("File Trace") : Amended,AMENDMENT, LOCALE(0x0409)] 
class FileTrace : MSNT_FileBaseTrace_Set1
{
};

[Description("File Trace Event") : Amended,AMENDMENT, LOCALE(0x0409)] 
class FileOperation : FileTrace
{
  [Description("Status") : Amended] uint32 Status;
  [Description("Operation") : Amended] uint8 Operation;
  [Description("Minor operation") : Amended] uint8 MinorOperation;
  [Description("SequenceNumber") : Amended] uint32 SequenceNumber;
  [Description("Is this a paging operation") : Amended] uint8 IsPagingIO;
  [Description("Is this a fast IO operation") : Amended] uint8 IsFastIO;
  [Description("IsDirectory") : Amended] uint8 IsDirectory;
  [Description("Create called on existing file") : Amended] uint8 CreateOnExisting;
  [Description("The time the operation started") : Amended] sint64 StartTime;
  [Description("Id of the operation's process") : Amended] uint32 ProcessId;
  [Description("The time the process was created") : Amended] sint64 ProcessCreateTime;
  [Description("File Object") : Amended] uint64 FileObject;
  [Description("File last access time") : Amended] sint64 LastAccessTime;
  [Description("Session Id") : Amended] uint32 SessionId;
  [Description("Window Station") : Amended] uint64 WindowStation;
  [Description("Acess token address") : Amended] uint32 AccessToken;
  [Description("User Sid Data Length") : Amended] uint32 SidLength;
  [Description("Parameters Data Length") : Amended] uint32 ParametersLength;
  [Description("Result Data Length") : Amended] uint32 ResultLength;
  [Description("Previous Value Length") : Amended] uint32 PreviousValueLength;
  [Description("User Sid") : Amended] object UserSID;
  [description("Operational Parameters") : Amended] uint8 OperationalParameters[];
  [description("Query Result Data") : Amended] uint8 ResultData[];
  [description("Previous Value") : Amended] uint8 PreviousValue[];
  [Description("File Name") : Amended] string FileName;
  [Description("Volume Dos Name") : Amended] string VolumeDosName;
  [Description("Volume Guid Name") : Amended] string VolumeGuidName;
  [Description("Volume Name") : Amended] string VolumeName;
};