proto_tree_add_text -> proto_tree_add_subtree[_format] for DCE/RPC dissectors.

Change-Id: I84755d059ef70ca98b0e7626b6425360daf0529d
Reviewed-on: https://code.wireshark.org/review/4199
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

33 files changed, 6843 insertions, 7080 deletions

diff --git a/epan/dissectors/packet-dcerpc-atsvc.c b/epan/dissectors/packet-dcerpc-atsvc.c
index 2e69ba1e7a..6e98f092bd 100644
--- a/epan/dissectors/packet-dcerpc-atsvc.c
+++ b/epan/dissectors/packet-dcerpc-atsvc.c
@@ -37,72 +37,72 @@ static gint ett_atsvc_atsvc_enum_ctr = -1;
 
 
 /* Header field declarations */
-static gint hf_atsvc_atsvc_Flags_JOB_EXEC_ERROR = -1;
+static gint hf_atsvc_atsvc_JobEnumInfo_days_of_month = -1;
+static gint hf_atsvc_atsvc_JobInfo_days_of_month = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Seventh = -1;
+static gint hf_atsvc_atsvc_Flags_JOB_RUNS_TODAY = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Second = -1;
+static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_FRIDAY = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Fifth = -1;
+static gint hf_atsvc_atsvc_JobEnum_ctr = -1;
+static gint hf_atsvc_atsvc_JobEnumInfo_command = -1;
 static gint hf_atsvc_atsvc_JobInfo_job_time = -1;
-static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_WEDNESDAY = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Thirtyfirst = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twentysixth = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twentyseventh = -1;
-static gint hf_atsvc_atsvc_Flags_JOB_RUN_PERIODICALLY = -1;
-static gint hf_atsvc_atsvc_JobDel_max_job_id = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twentyeighth = -1;
+static gint hf_atsvc_job_info = -1;
+static gint hf_atsvc_atsvc_JobInfo_command = -1;
 static gint hf_atsvc_atsvc_JobEnumInfo_flags = -1;
+static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_MONDAY = -1;
 static gint hf_atsvc_atsvc_JobEnum_total_entries = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Thitteenth = -1;
-static gint hf_atsvc_atsvc_enum_ctr_first_entry = -1;
-static gint hf_atsvc_atsvc_JobInfo_flags = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_First = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twentyseventh = -1;
 static gint hf_atsvc_opnum = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twentyeighth = -1;
-static gint hf_atsvc_atsvc_Flags_JOB_NONINTERACTIVE = -1;
-static gint hf_atsvc_atsvc_Flags_JOB_ADD_CURRENT_DATE = -1;
-static gint hf_atsvc_atsvc_JobEnumInfo_days_of_month = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Fifteenth = -1;
+static gint hf_atsvc_atsvc_enum_ctr_entries_read = -1;
 static gint hf_atsvc_atsvc_DaysOfMonth_Twentyfourth = -1;
-static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_SUNDAY = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Fourth = -1;
-static gint hf_atsvc_atsvc_Flags_JOB_RUNS_TODAY = -1;
-static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_FRIDAY = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Sixteenth = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_First = -1;
+static gint hf_atsvc_atsvc_JobEnumInfo_days_of_week = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twentythird = -1;
+static gint hf_atsvc_atsvc_Flags_JOB_ADD_CURRENT_DATE = -1;
+static gint hf_atsvc_servername = -1;
+static gint hf_atsvc_atsvc_JobDel_min_job_id = -1;
 static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_TUESDAY = -1;
 static gint hf_atsvc_atsvc_DaysOfMonth_Twentyninth = -1;
-static gint hf_atsvc_atsvc_JobInfo_days_of_month = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Thirtyfirst = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twentyfifth = -1;
+static gint hf_atsvc_atsvc_JobInfo_flags = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Tenth = -1;
 static gint hf_atsvc_atsvc_JobEnumInfo_job_time = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Eighteenth = -1;
+static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_WEDNESDAY = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Third = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Sixteenth = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Eleventh = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Seventeenth = -1;
 static gint hf_atsvc_atsvc_DaysOfMonth_Ninteenth = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twentyfirst = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Fourteenth = -1;
+static gint hf_atsvc_status = -1;
+static gint hf_atsvc_atsvc_JobEnum_resume_handle = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twelfth = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Sixth = -1;
+static gint hf_atsvc_atsvc_JobDel_max_job_id = -1;
 static gint hf_atsvc_atsvc_DaysOfMonth_Thirtieth = -1;
+static gint hf_atsvc_atsvc_Flags_JOB_EXEC_ERROR = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twentysixth = -1;
 static gint hf_atsvc_atsvc_DaysOfMonth_Ninth = -1;
-static gint hf_atsvc_atsvc_enum_ctr_entries_read = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Eleventh = -1;
-static gint hf_atsvc_job_info = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Sixth = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Fifth = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twentysecond = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twentythird = -1;
-static gint hf_atsvc_atsvc_JobEnum_ctr = -1;
-static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_MONDAY = -1;
+static gint hf_atsvc_atsvc_Flags_JOB_RUN_PERIODICALLY = -1;
+static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_SUNDAY = -1;
+static gint hf_atsvc_atsvc_Flags_JOB_NONINTERACTIVE = -1;
+static gint hf_atsvc_atsvc_enum_ctr_first_entry = -1;
+static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_THURSDAY = -1;
 static gint hf_atsvc_atsvc_JobInfo_days_of_week = -1;
-static gint hf_atsvc_atsvc_JobEnumInfo_days_of_week = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twentyfifth = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Fifteenth = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Third = -1;
-static gint hf_atsvc_servername = -1;
-static gint hf_atsvc_status = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Eighteenth = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Fourteenth = -1;
-static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_SATURDAY = -1;
 static gint hf_atsvc_job_id = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Tenth = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twentyth = -1;
 static gint hf_atsvc_atsvc_JobEnum_preferred_max_len = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twentyfirst = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twelfth = -1;
-static gint hf_atsvc_atsvc_JobInfo_command = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Seventh = -1;
-static gint hf_atsvc_atsvc_JobDel_min_job_id = -1;
-static gint hf_atsvc_atsvc_JobEnum_resume_handle = -1;
 static gint hf_atsvc_atsvc_DaysOfMonth_Eight = -1;
-static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_THURSDAY = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Second = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Twentyth = -1;
-static gint hf_atsvc_atsvc_JobEnumInfo_command = -1;
-static gint hf_atsvc_atsvc_DaysOfMonth_Seventeenth = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Thitteenth = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Twentysecond = -1;
+static gint hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_SATURDAY = -1;
+static gint hf_atsvc_atsvc_DaysOfMonth_Fourth = -1;
 
 static gint proto_dcerpc_atsvc = -1;
 /* Version information */
@@ -813,7 +813,7 @@ atsvc_dissect_bitmap_DaysOfWeek(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 /* IDL: 	atsvc_DaysOfMonth days_of_month; */
 /* IDL: 	atsvc_DaysOfWeek days_of_week; */
 /* IDL: 	atsvc_Flags flags; */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *command; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *command; */
 /* IDL: } */
 
 static int
@@ -911,7 +911,7 @@ atsvc_dissect_struct_JobInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pin
 /* IDL: 	atsvc_DaysOfMonth days_of_month; */
 /* IDL: 	atsvc_DaysOfWeek days_of_week; */
 /* IDL: 	atsvc_Flags flags; */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *command; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *command; */
 /* IDL: } */
 
 static int
@@ -1015,7 +1015,7 @@ atsvc_dissect_struct_JobEnumInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 /* IDL: struct { */
 /* IDL: 	uint32 entries_read; */
-/* IDL: 	[unique(1)] [size_is(entries_read)] atsvc_JobEnumInfo *first_entry; */
+/* IDL: 	[size_is(entries_read)] [unique(1)] atsvc_JobEnumInfo *first_entry; */
 /* IDL: } */
 
 static int
@@ -1133,9 +1133,9 @@ atsvc_dissect_element_JobAdd_job_id_(tvbuff_t *tvb _U_, int offset _U_, packet_i
 }
 
 /* IDL: NTSTATUS atsvc_JobAdd( */
-/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *servername, */
+/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *servername, */
 /* IDL: [ref] [in] atsvc_JobInfo *job_info, */
-/* IDL: [out] [ref] uint32 *job_id */
+/* IDL: [ref] [out] uint32 *job_id */
 /* IDL: ); */
 
 static int
@@ -1202,7 +1202,7 @@ atsvc_dissect_element_JobDel_max_job_id(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: NTSTATUS atsvc_JobDel( */
-/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *servername, */
+/* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *servername, */
 /* IDL: [in] uint32 min_job_id, */
 /* IDL: [in] uint32 max_job_id */
 /* IDL: ); */
@@ -1310,11 +1310,11 @@ atsvc_dissect_element_JobEnum_resume_handle_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS atsvc_JobEnum( */
-/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *servername, */
-/* IDL: [out] [in] [ref] atsvc_enum_ctr *ctr, */
+/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *servername, */
+/* IDL: [ref] [out] [in] atsvc_enum_ctr *ctr, */
 /* IDL: [in] uint32 preferred_max_len, */
 /* IDL: [ref] [out] uint32 *total_entries, */
-/* IDL: [unique(1)] [out] [in] uint32 *resume_handle */
+/* IDL: [out] [in] [unique(1)] uint32 *resume_handle */
 /* IDL: ); */
 
 static int
@@ -1407,7 +1407,7 @@ atsvc_dissect_element_JobGetInfo_job_info__(tvbuff_t *tvb _U_, int offset _U_, p
 }
 
 /* IDL: NTSTATUS atsvc_JobGetInfo( */
-/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *servername, */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *servername, */
 /* IDL: [in] uint32 job_id, */
 /* IDL: [ref] [out] atsvc_JobInfo **job_info */
 /* IDL: ); */
@@ -1456,138 +1456,138 @@ static dcerpc_sub_dissector atsvc_dissectors[] = {
 void proto_register_dcerpc_atsvc(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_atsvc_atsvc_Flags_JOB_EXEC_ERROR,
-	  { "Job Exec Error", "atsvc.atsvc_Flags.JOB_EXEC_ERROR", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_EXEC_ERROR_tfs), ( 0x02 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_JobEnumInfo_days_of_month,
+		{ "Days Of Month", "atsvc.atsvc_JobEnumInfo.days_of_month", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_JobInfo_days_of_month,
+		{ "Days Of Month", "atsvc.atsvc_JobInfo.days_of_month", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Seventh,
+		{ "Seventh", "atsvc.atsvc_DaysOfMonth.Seventh", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Seventh_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_Flags_JOB_RUNS_TODAY,
+		{ "Job Runs Today", "atsvc.atsvc_Flags.JOB_RUNS_TODAY", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_RUNS_TODAY_tfs), ( 0x04 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Second,
+		{ "Second", "atsvc.atsvc_DaysOfMonth.Second", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Second_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_FRIDAY,
+		{ "Daysofweek Friday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_FRIDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_FRIDAY_tfs), ( 0x10 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Fifth,
+		{ "Fifth", "atsvc.atsvc_DaysOfMonth.Fifth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Fifth_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_JobEnum_ctr,
+		{ "Ctr", "atsvc.atsvc_JobEnum.ctr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_JobEnumInfo_command,
+		{ "Command", "atsvc.atsvc_JobEnumInfo.command", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_atsvc_atsvc_JobInfo_job_time,
-	  { "Job Time", "atsvc.atsvc_JobInfo.job_time", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_WEDNESDAY,
-	  { "Daysofweek Wednesday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_WEDNESDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_WEDNESDAY_tfs), ( 0x04 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Thirtyfirst,
-	  { "Thirtyfirst", "atsvc.atsvc_DaysOfMonth.Thirtyfirst", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Thirtyfirst_tfs), ( 0x40000000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twentysixth,
-	  { "Twentysixth", "atsvc.atsvc_DaysOfMonth.Twentysixth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentysixth_tfs), ( 0x02000000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyseventh,
-	  { "Twentyseventh", "atsvc.atsvc_DaysOfMonth.Twentyseventh", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyseventh_tfs), ( 0x04000000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_Flags_JOB_RUN_PERIODICALLY,
-	  { "Job Run Periodically", "atsvc.atsvc_Flags.JOB_RUN_PERIODICALLY", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_RUN_PERIODICALLY_tfs), ( 0x01 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobDel_max_job_id,
-	  { "Max Job Id", "atsvc.atsvc_JobDel.max_job_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Job Time", "atsvc.atsvc_JobInfo.job_time", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyeighth,
+		{ "Twentyeighth", "atsvc.atsvc_DaysOfMonth.Twentyeighth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyeighth_tfs), ( 0x08000000 ), NULL, HFILL }},
+	{ &hf_atsvc_job_info,
+		{ "JobInfo", "atcvs.job_info", FT_NONE, BASE_NONE, NULL, 0, "JobInfo structure", HFILL }},
+	{ &hf_atsvc_atsvc_JobInfo_command,
+		{ "Command", "atsvc.atsvc_JobInfo.command", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_atsvc_atsvc_JobEnumInfo_flags,
-	  { "Flags", "atsvc.atsvc_JobEnumInfo.flags", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Flags", "atsvc.atsvc_JobEnumInfo.flags", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_MONDAY,
+		{ "Daysofweek Monday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_MONDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_MONDAY_tfs), ( 0x01 ), NULL, HFILL }},
 	{ &hf_atsvc_atsvc_JobEnum_total_entries,
-	  { "Total Entries", "atsvc.atsvc_JobEnum.total_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Thitteenth,
-	  { "Thitteenth", "atsvc.atsvc_DaysOfMonth.Thitteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Thitteenth_tfs), ( 0x00001000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_enum_ctr_first_entry,
-	  { "First Entry", "atsvc.atsvc_enum_ctr.first_entry", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobInfo_flags,
-	  { "Flags", "atsvc.atsvc_JobInfo.flags", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_First,
-	  { "First", "atsvc.atsvc_DaysOfMonth.First", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_First_tfs), ( 0x00000001 ), NULL, HFILL }},
+		{ "Total Entries", "atsvc.atsvc_JobEnum.total_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyseventh,
+		{ "Twentyseventh", "atsvc.atsvc_DaysOfMonth.Twentyseventh", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyseventh_tfs), ( 0x04000000 ), NULL, HFILL }},
 	{ &hf_atsvc_opnum,
-	  { "Operation", "atsvc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyeighth,
-	  { "Twentyeighth", "atsvc.atsvc_DaysOfMonth.Twentyeighth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyeighth_tfs), ( 0x08000000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_Flags_JOB_NONINTERACTIVE,
-	  { "Job Noninteractive", "atsvc.atsvc_Flags.JOB_NONINTERACTIVE", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_NONINTERACTIVE_tfs), ( 0x10 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_Flags_JOB_ADD_CURRENT_DATE,
-	  { "Job Add Current Date", "atsvc.atsvc_Flags.JOB_ADD_CURRENT_DATE", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_ADD_CURRENT_DATE_tfs), ( 0x08 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobEnumInfo_days_of_month,
-	  { "Days Of Month", "atsvc.atsvc_JobEnumInfo.days_of_month", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Operation", "atsvc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Fifteenth,
+		{ "Fifteenth", "atsvc.atsvc_DaysOfMonth.Fifteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Fifteenth_tfs), ( 0x00004000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_enum_ctr_entries_read,
+		{ "Entries Read", "atsvc.atsvc_enum_ctr.entries_read", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyfourth,
-	  { "Twentyfourth", "atsvc.atsvc_DaysOfMonth.Twentyfourth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyfourth_tfs), ( 0x00800000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_SUNDAY,
-	  { "Daysofweek Sunday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_SUNDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_SUNDAY_tfs), ( 0x40 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Fourth,
-	  { "Fourth", "atsvc.atsvc_DaysOfMonth.Fourth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Fourth_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_Flags_JOB_RUNS_TODAY,
-	  { "Job Runs Today", "atsvc.atsvc_Flags.JOB_RUNS_TODAY", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_RUNS_TODAY_tfs), ( 0x04 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_FRIDAY,
-	  { "Daysofweek Friday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_FRIDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_FRIDAY_tfs), ( 0x10 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Sixteenth,
-	  { "Sixteenth", "atsvc.atsvc_DaysOfMonth.Sixteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Sixteenth_tfs), ( 0x00008000 ), NULL, HFILL }},
+		{ "Twentyfourth", "atsvc.atsvc_DaysOfMonth.Twentyfourth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyfourth_tfs), ( 0x00800000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_First,
+		{ "First", "atsvc.atsvc_DaysOfMonth.First", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_First_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_JobEnumInfo_days_of_week,
+		{ "Days Of Week", "atsvc.atsvc_JobEnumInfo.days_of_week", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twentythird,
+		{ "Twentythird", "atsvc.atsvc_DaysOfMonth.Twentythird", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentythird_tfs), ( 0x00400000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_Flags_JOB_ADD_CURRENT_DATE,
+		{ "Job Add Current Date", "atsvc.atsvc_Flags.JOB_ADD_CURRENT_DATE", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_ADD_CURRENT_DATE_tfs), ( 0x08 ), NULL, HFILL }},
+	{ &hf_atsvc_servername,
+		{ "Server", "atsvc.server", FT_STRING, BASE_NONE, NULL, 0, "Name of the server", HFILL }},
+	{ &hf_atsvc_atsvc_JobDel_min_job_id,
+		{ "Min Job Id", "atsvc.atsvc_JobDel.min_job_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_TUESDAY,
-	  { "Daysofweek Tuesday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_TUESDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_TUESDAY_tfs), ( 0x02 ), NULL, HFILL }},
+		{ "Daysofweek Tuesday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_TUESDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_TUESDAY_tfs), ( 0x02 ), NULL, HFILL }},
 	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyninth,
-	  { "Twentyninth", "atsvc.atsvc_DaysOfMonth.Twentyninth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyninth_tfs), ( 0x10000000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobInfo_days_of_month,
-	  { "Days Of Month", "atsvc.atsvc_JobInfo.days_of_month", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Twentyninth", "atsvc.atsvc_DaysOfMonth.Twentyninth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyninth_tfs), ( 0x10000000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Thirtyfirst,
+		{ "Thirtyfirst", "atsvc.atsvc_DaysOfMonth.Thirtyfirst", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Thirtyfirst_tfs), ( 0x40000000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyfifth,
+		{ "Twentyfifth", "atsvc.atsvc_DaysOfMonth.Twentyfifth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyfifth_tfs), ( 0x01000000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_JobInfo_flags,
+		{ "Flags", "atsvc.atsvc_JobInfo.flags", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Tenth,
+		{ "Tenth", "atsvc.atsvc_DaysOfMonth.Tenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Tenth_tfs), ( 0x00000200 ), NULL, HFILL }},
 	{ &hf_atsvc_atsvc_JobEnumInfo_job_time,
-	  { "Job Time", "atsvc.atsvc_JobEnumInfo.job_time", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Job Time", "atsvc.atsvc_JobEnumInfo.job_time", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Eighteenth,
+		{ "Eighteenth", "atsvc.atsvc_DaysOfMonth.Eighteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Eighteenth_tfs), ( 0x00020000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_WEDNESDAY,
+		{ "Daysofweek Wednesday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_WEDNESDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_WEDNESDAY_tfs), ( 0x04 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Third,
+		{ "Third", "atsvc.atsvc_DaysOfMonth.Third", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Third_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Sixteenth,
+		{ "Sixteenth", "atsvc.atsvc_DaysOfMonth.Sixteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Sixteenth_tfs), ( 0x00008000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Eleventh,
+		{ "Eleventh", "atsvc.atsvc_DaysOfMonth.Eleventh", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Eleventh_tfs), ( 0x00000400 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Seventeenth,
+		{ "Seventeenth", "atsvc.atsvc_DaysOfMonth.Seventeenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Seventeenth_tfs), ( 0x00010000 ), NULL, HFILL }},
 	{ &hf_atsvc_atsvc_DaysOfMonth_Ninteenth,
-	  { "Ninteenth", "atsvc.atsvc_DaysOfMonth.Ninteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Ninteenth_tfs), ( 0x00040000 ), NULL, HFILL }},
+		{ "Ninteenth", "atsvc.atsvc_DaysOfMonth.Ninteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Ninteenth_tfs), ( 0x00040000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyfirst,
+		{ "Twentyfirst", "atsvc.atsvc_DaysOfMonth.Twentyfirst", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyfirst_tfs), ( 0x00100000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Fourteenth,
+		{ "Fourteenth", "atsvc.atsvc_DaysOfMonth.Fourteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Fourteenth_tfs), ( 0x00002000 ), NULL, HFILL }},
+	{ &hf_atsvc_status,
+		{ "NT Error", "atsvc.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_JobEnum_resume_handle,
+		{ "Resume Handle", "atsvc.atsvc_JobEnum.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twelfth,
+		{ "Twelfth", "atsvc.atsvc_DaysOfMonth.Twelfth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twelfth_tfs), ( 0x00000800 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Sixth,
+		{ "Sixth", "atsvc.atsvc_DaysOfMonth.Sixth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Sixth_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_JobDel_max_job_id,
+		{ "Max Job Id", "atsvc.atsvc_JobDel.max_job_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_atsvc_atsvc_DaysOfMonth_Thirtieth,
-	  { "Thirtieth", "atsvc.atsvc_DaysOfMonth.Thirtieth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Thirtieth_tfs), ( 0x20000000 ), NULL, HFILL }},
+		{ "Thirtieth", "atsvc.atsvc_DaysOfMonth.Thirtieth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Thirtieth_tfs), ( 0x20000000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_Flags_JOB_EXEC_ERROR,
+		{ "Job Exec Error", "atsvc.atsvc_Flags.JOB_EXEC_ERROR", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_EXEC_ERROR_tfs), ( 0x02 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twentysixth,
+		{ "Twentysixth", "atsvc.atsvc_DaysOfMonth.Twentysixth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentysixth_tfs), ( 0x02000000 ), NULL, HFILL }},
 	{ &hf_atsvc_atsvc_DaysOfMonth_Ninth,
-	  { "Ninth", "atsvc.atsvc_DaysOfMonth.Ninth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Ninth_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_enum_ctr_entries_read,
-	  { "Entries Read", "atsvc.atsvc_enum_ctr.entries_read", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Eleventh,
-	  { "Eleventh", "atsvc.atsvc_DaysOfMonth.Eleventh", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Eleventh_tfs), ( 0x00000400 ), NULL, HFILL }},
-	{ &hf_atsvc_job_info,
-	  { "JobInfo", "atcvs.job_info", FT_NONE, BASE_NONE, NULL, 0, "JobInfo structure", HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Sixth,
-	  { "Sixth", "atsvc.atsvc_DaysOfMonth.Sixth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Sixth_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Fifth,
-	  { "Fifth", "atsvc.atsvc_DaysOfMonth.Fifth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Fifth_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twentysecond,
-	  { "Twentysecond", "atsvc.atsvc_DaysOfMonth.Twentysecond", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentysecond_tfs), ( 0x00200000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twentythird,
-	  { "Twentythird", "atsvc.atsvc_DaysOfMonth.Twentythird", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentythird_tfs), ( 0x00400000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobEnum_ctr,
-	  { "Ctr", "atsvc.atsvc_JobEnum.ctr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_MONDAY,
-	  { "Daysofweek Monday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_MONDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_MONDAY_tfs), ( 0x01 ), NULL, HFILL }},
+		{ "Ninth", "atsvc.atsvc_DaysOfMonth.Ninth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Ninth_tfs), ( 0x00000100 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_Flags_JOB_RUN_PERIODICALLY,
+		{ "Job Run Periodically", "atsvc.atsvc_Flags.JOB_RUN_PERIODICALLY", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_RUN_PERIODICALLY_tfs), ( 0x01 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_SUNDAY,
+		{ "Daysofweek Sunday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_SUNDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_SUNDAY_tfs), ( 0x40 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_Flags_JOB_NONINTERACTIVE,
+		{ "Job Noninteractive", "atsvc.atsvc_Flags.JOB_NONINTERACTIVE", FT_BOOLEAN, 8, TFS(&atsvc_Flags_JOB_NONINTERACTIVE_tfs), ( 0x10 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_enum_ctr_first_entry,
+		{ "First Entry", "atsvc.atsvc_enum_ctr.first_entry", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_THURSDAY,
+		{ "Daysofweek Thursday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_THURSDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_THURSDAY_tfs), ( 0x08 ), NULL, HFILL }},
 	{ &hf_atsvc_atsvc_JobInfo_days_of_week,
-	  { "Days Of Week", "atsvc.atsvc_JobInfo.days_of_week", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobEnumInfo_days_of_week,
-	  { "Days Of Week", "atsvc.atsvc_JobEnumInfo.days_of_week", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyfifth,
-	  { "Twentyfifth", "atsvc.atsvc_DaysOfMonth.Twentyfifth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyfifth_tfs), ( 0x01000000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Fifteenth,
-	  { "Fifteenth", "atsvc.atsvc_DaysOfMonth.Fifteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Fifteenth_tfs), ( 0x00004000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Third,
-	  { "Third", "atsvc.atsvc_DaysOfMonth.Third", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Third_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_atsvc_servername,
-	  { "Server", "atsvc.server", FT_STRING, BASE_NONE, NULL, 0, "Name of the server", HFILL }},
-	{ &hf_atsvc_status,
-	  { "NT Error", "atsvc.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Eighteenth,
-	  { "Eighteenth", "atsvc.atsvc_DaysOfMonth.Eighteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Eighteenth_tfs), ( 0x00020000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Fourteenth,
-	  { "Fourteenth", "atsvc.atsvc_DaysOfMonth.Fourteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Fourteenth_tfs), ( 0x00002000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_SATURDAY,
-	  { "Daysofweek Saturday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_SATURDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_SATURDAY_tfs), ( 0x20 ), NULL, HFILL }},
+		{ "Days Of Week", "atsvc.atsvc_JobInfo.days_of_week", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_atsvc_job_id,
-	  { "Job Id", "atsvc.job_id", FT_UINT32, BASE_DEC, NULL, 0, "Identifier of the scheduled job", HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Tenth,
-	  { "Tenth", "atsvc.atsvc_DaysOfMonth.Tenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Tenth_tfs), ( 0x00000200 ), NULL, HFILL }},
+		{ "Job Id", "atsvc.job_id", FT_UINT32, BASE_DEC, NULL, 0, "Identifier of the scheduled job", HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyth,
+		{ "Twentyth", "atsvc.atsvc_DaysOfMonth.Twentyth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyth_tfs), ( 0x00080000 ), NULL, HFILL }},
 	{ &hf_atsvc_atsvc_JobEnum_preferred_max_len,
-	  { "Preferred Max Len", "atsvc.atsvc_JobEnum.preferred_max_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyfirst,
-	  { "Twentyfirst", "atsvc.atsvc_DaysOfMonth.Twentyfirst", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyfirst_tfs), ( 0x00100000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twelfth,
-	  { "Twelfth", "atsvc.atsvc_DaysOfMonth.Twelfth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twelfth_tfs), ( 0x00000800 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobInfo_command,
-	  { "Command", "atsvc.atsvc_JobInfo.command", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Seventh,
-	  { "Seventh", "atsvc.atsvc_DaysOfMonth.Seventh", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Seventh_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobDel_min_job_id,
-	  { "Min Job Id", "atsvc.atsvc_JobDel.min_job_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobEnum_resume_handle,
-	  { "Resume Handle", "atsvc.atsvc_JobEnum.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Preferred Max Len", "atsvc.atsvc_JobEnum.preferred_max_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_atsvc_atsvc_DaysOfMonth_Eight,
-	  { "Eight", "atsvc.atsvc_DaysOfMonth.Eight", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Eight_tfs), ( 0x00000080 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_THURSDAY,
-	  { "Daysofweek Thursday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_THURSDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_THURSDAY_tfs), ( 0x08 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Second,
-	  { "Second", "atsvc.atsvc_DaysOfMonth.Second", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Second_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Twentyth,
-	  { "Twentyth", "atsvc.atsvc_DaysOfMonth.Twentyth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentyth_tfs), ( 0x00080000 ), NULL, HFILL }},
-	{ &hf_atsvc_atsvc_JobEnumInfo_command,
-	  { "Command", "atsvc.atsvc_JobEnumInfo.command", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_atsvc_atsvc_DaysOfMonth_Seventeenth,
-	  { "Seventeenth", "atsvc.atsvc_DaysOfMonth.Seventeenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Seventeenth_tfs), ( 0x00010000 ), NULL, HFILL }},
+		{ "Eight", "atsvc.atsvc_DaysOfMonth.Eight", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Eight_tfs), ( 0x00000080 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Thitteenth,
+		{ "Thitteenth", "atsvc.atsvc_DaysOfMonth.Thitteenth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Thitteenth_tfs), ( 0x00001000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Twentysecond,
+		{ "Twentysecond", "atsvc.atsvc_DaysOfMonth.Twentysecond", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Twentysecond_tfs), ( 0x00200000 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfWeek_DAYSOFWEEK_SATURDAY,
+		{ "Daysofweek Saturday", "atsvc.atsvc_DaysOfWeek.DAYSOFWEEK_SATURDAY", FT_BOOLEAN, 8, TFS(&atsvc_DaysOfWeek_DAYSOFWEEK_SATURDAY_tfs), ( 0x20 ), NULL, HFILL }},
+	{ &hf_atsvc_atsvc_DaysOfMonth_Fourth,
+		{ "Fourth", "atsvc.atsvc_DaysOfMonth.Fourth", FT_BOOLEAN, 32, TFS(&atsvc_DaysOfMonth_Fourth_tfs), ( 0x00000008 ), NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-butc.c b/epan/dissectors/packet-dcerpc-butc.c
index 1a56d3b160..c4ed43d08e 100644
--- a/epan/dissectors/packet-dcerpc-butc.c
+++ b/epan/dissectors/packet-dcerpc-butc.c
@@ -1480,8 +1480,7 @@ butc_dissect_union_tc_statusInfoSwitch(tvbuff_t *tvb, int offset, packet_info *p
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "tc_statusInfoSwitch");
- 	   tree=proto_item_add_subtree(item, ett_butc_tc_statusInfoSwitch);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_butc_tc_statusInfoSwitch, &item, "tc_statusInfoSwitch");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
diff --git a/epan/dissectors/packet-dcerpc-dfs.c b/epan/dissectors/packet-dcerpc-dfs.c
index 5519d2b24f..d3120b6595 100644
--- a/epan/dissectors/packet-dcerpc-dfs.c
+++ b/epan/dissectors/packet-dcerpc-dfs.c
@@ -64,175 +64,175 @@ static gint ett_netdfs_dfs_UnknownStruct = -1;
 
 
 /* Header field declarations */
-static gint hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_ONLINE = -1;
-static gint hf_netdfs_dfs_EnumEx_bufsize = -1;
-static gint hf_netdfs_dfs_Enum_level = -1;
-static gint hf_netdfs_dfs_EnumEx_info = -1;
-static gint hf_netdfs_dfs_Info3_num_stores = -1;
-static gint hf_netdfs_dfs_RemoveFtRoot_dns_servername = -1;
-static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_SITE_COSTING = -1;
-static gint hf_netdfs_dfs_Info300_flavor = -1;
+static gint hf_netdfs_dfs_Info3_path = -1;
+static gint hf_netdfs_dfs_SetInfo_info = -1;
 static gint hf_netdfs_dfs_RemoveFtRoot_rootshare = -1;
-static gint hf_netdfs_dfs_GetInfo_info = -1;
-static gint hf_netdfs_dfs_Info6_num_stores = -1;
-static gint hf_netdfs_dfs_Info3_state = -1;
-static gint hf_netdfs_dfs_AddFtRoot_unknown2 = -1;
-static gint hf_netdfs_dfs_Info_info0 = -1;
-static gint hf_netdfs_dfs_Remove_sharename = -1;
-static gint hf_netdfs_dfs_EnumInfo_info1 = -1;
-static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_STANDALONE = -1;
+static gint hf_netdfs_dfs_AddFtRoot_flags = -1;
+static gint hf_netdfs_dfs_EnumEx_total = -1;
+static gint hf_netdfs_dfs_Info105_state = -1;
+static gint hf_netdfs_dfs_Info5_state = -1;
+static gint hf_netdfs_dfs_Info4_comment = -1;
+static gint hf_netdfs_dfs_RemoveStdRoot_servername = -1;
+static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_OK = -1;
+static gint hf_netdfs_dfs_EnumArray3_s = -1;
 static gint hf_netdfs_dfs_Remove_servername = -1;
-static gint hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_OFFLINE = -1;
-static gint hf_netdfs_dfs_Info3_path = -1;
+static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_OFFLINE = -1;
+static gint hf_netdfs_dfs_FlushFtTable_rootshare = -1;
+static gint hf_netdfs_dfs_Info2_num_stores = -1;
+static gint hf_netdfs_dfs_AddFtRoot_dfs_config_dn = -1;
+static gint hf_netdfs_dfs_EnumInfo_info200 = -1;
+static gint hf_netdfs_dfs_Info4_path = -1;
+static gint hf_netdfs_dfs_Info_info4 = -1;
+static gint hf_netdfs_dfs_EnumEx_dfs_name = -1;
+static gint hf_netdfs_dfs_Info2_path = -1;
 static gint hf_netdfs_dfs_StorageInfo_share = -1;
-static gint hf_netdfs_dfs_EnumStruct_e = -1;
-static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_INCONSISTENT = -1;
-static gint hf_netdfs_dfs_Info104_priority = -1;
+static gint hf_netdfs_dfs_Info_info6 = -1;
+static gint hf_netdfs_dfs_Info2_state = -1;
+static gint hf_netdfs_dfs_EnumArray200_s = -1;
+static gint hf_netdfs_dfs_EnumInfo_info300 = -1;
+static gint hf_netdfs_dfs_Info105_comment = -1;
+static gint hf_netdfs_dfs_AddFtRoot_unknown2 = -1;
+static gint hf_netdfs_dfs_AddFtRoot_dns_servername = -1;
+static gint hf_netdfs_dfs_Add_server = -1;
+static gint hf_netdfs_dfs_Info_info1 = -1;
+static gint hf_netdfs_dfs_Info6_entry_path = -1;
+static gint hf_netdfs_dfs_Remove_sharename = -1;
+static gint hf_netdfs_dfs_Add_path = -1;
 static gint hf_netdfs_dfs_Info100_comment = -1;
-static gint hf_netdfs_dfs_Info_info104 = -1;
-static gint hf_netdfs_dfs_Info4_comment = -1;
-static gint hf_netdfs_dfs_EnumArray3_s = -1;
+static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_INCONSISTENT = -1;
 static gint hf_netdfs_dfs_Info105_property_flag_mask = -1;
-static gint hf_netdfs_dfs_Info7_generation_guid = -1;
-static gint hf_netdfs_dfs_EnumArray300_s = -1;
-static gint hf_netdfs_dfs_Info106_priority = -1;
-static gint hf_netdfs_dfs_EnumInfo_info3 = -1;
-static gint hf_netdfs_dfs_Add_share = -1;
-static gint hf_netdfs_dfs_EnumArray2_count = -1;
-static gint hf_netdfs_dfs_ManagerInitialize_flags = -1;
-static gint hf_netdfs_dfs_AddStdRootForced_rootshare = -1;
-static gint hf_netdfs_dfs_SetInfo_level = -1;
+static gint hf_netdfs_dfs_AddStdRootForced_store = -1;
+static gint hf_netdfs_dfs_Info106_state = -1;
 static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_AD_BLOB = -1;
-static gint hf_netdfs_dfs_AddStdRootForced_servername = -1;
-static gint hf_netdfs_dfs_Info5_timeout = -1;
-static gint hf_netdfs_dfs_Info5_pktsize = -1;
-static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_ROOT_SCALABILITY = -1;
-static gint hf_netdfs_dfs_SetInfo_dfs_entry_path = -1;
-static gint hf_netdfs_dfs_RemoveFtRoot_flags = -1;
-static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_ONLINE = -1;
-static gint hf_netdfs_dfs_EnumInfo_info2 = -1;
-static gint hf_netdfs_dfs_EnumArray4_count = -1;
-static gint hf_netdfs_dfs_Info_info5 = -1;
-static gint hf_netdfs_dfs_Info_info101 = -1;
-static gint hf_netdfs_dfs_Info6_pktsize = -1;
-static gint hf_netdfs_dfs_EnumArray3_count = -1;
-static gint hf_netdfs_dfs_Target_Priority_target_priority_class = -1;
-static gint hf_netdfs_dfs_Add_server = -1;
-static gint hf_netdfs_dfs_AddFtRoot_servername = -1;
-static gint hf_netdfs_dfs_Info_info3 = -1;
-static gint hf_netdfs_dfs_SetInfo_sharename = -1;
-static gint hf_netdfs_werror = -1;
-static gint hf_netdfs_opnum = -1;
+static gint hf_netdfs_dfs_AddFtRoot_comment = -1;
+static gint hf_netdfs_dfs_SetInfo_servername = -1;
 static gint hf_netdfs_dfs_ManagerInitialize_servername = -1;
+static gint hf_netdfs_dfs_AddStdRoot_flags = -1;
+static gint hf_netdfs_dfs_GetInfo_servername = -1;
+static gint hf_netdfs_dfs_Info300_dom_root = -1;
+static gint hf_netdfs_dfs_Info106_priority = -1;
+static gint hf_netdfs_dfs_Info_info103 = -1;
+static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_SITE_COSTING = -1;
+static gint hf_netdfs_dfs_Target_Priority_target_priority_class = -1;
 static gint hf_netdfs_dfs_Info3_comment = -1;
-static gint hf_netdfs_dfs_SetInfo_servername = -1;
-static gint hf_netdfs_dfs_Info6_entry_path = -1;
-static gint hf_netdfs_dfs_EnumInfo_info4 = -1;
-static gint hf_netdfs_dfs_AddStdRoot_comment = -1;
+static gint hf_netdfs_dfs_Add_comment = -1;
+static gint hf_netdfs_dfs_EnumInfo_info2 = -1;
 static gint hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_ACTIVE = -1;
-static gint hf_netdfs_dfs_AddFtRoot_dfsname = -1;
-static gint hf_netdfs_dfs_RemoveStdRoot_servername = -1;
-static gint hf_netdfs_dfs_Info_info102 = -1;
-static gint hf_netdfs_dfs_Info2_state = -1;
-static gint hf_netdfs_dfs_Info_info103 = -1;
 static gint hf_netdfs_dfs_RemoveStdRoot_flags = -1;
-static gint hf_netdfs_dfs_RemoveFtRoot_dfsname = -1;
-static gint hf_netdfs_dfs_Info5_flags = -1;
-static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_OFFLINE = -1;
-static gint hf_netdfs_dfs_Info4_state = -1;
-static gint hf_netdfs_dfs_EnumInfo_info200 = -1;
-static gint hf_netdfs_dfs_Info6_stores = -1;
-static gint hf_netdfs_dfs_Enum_total = -1;
+static gint hf_netdfs_dfs_EnumArray2_s = -1;
+static gint hf_netdfs_dfs_Info1_path = -1;
+static gint hf_netdfs_dfs_EnumInfo_info4 = -1;
 static gint hf_netdfs_dfs_AddStdRoot_servername = -1;
-static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_OK = -1;
-static gint hf_netdfs_dfs_Info300_dom_root = -1;
-static gint hf_netdfs_dfs_AddStdRootForced_store = -1;
-static gint hf_netdfs_dfs_AddFtRoot_dfs_config_dn = -1;
-static gint hf_netdfs_dfs_Remove_dfs_entry_path = -1;
-static gint hf_netdfs_dfs_UnknownStruct_unknown2 = -1;
-static gint hf_netdfs_dfs_EnumEx_total = -1;
-static gint hf_netdfs_dfs_FlushFtTable_servername = -1;
-static gint hf_netdfs_dfs_FlushFtTable_rootshare = -1;
-static gint hf_netdfs_dfs_GetInfo_sharename = -1;
-static gint hf_netdfs_dfs_Info106_state = -1;
-static gint hf_netdfs_dfs_Info5_state = -1;
-static gint hf_netdfs_dfs_EnumArray1_s = -1;
-static gint hf_netdfs_dfs_Add_flags = -1;
-static gint hf_netdfs_dfs_Info_info2 = -1;
-static gint hf_netdfs_dfs_AddFtRoot_unknown1 = -1;
-static gint hf_netdfs_dfs_Info102_timeout = -1;
+static gint hf_netdfs_dfs_Info3_state = -1;
+static gint hf_netdfs_dfs_Info5_flags = -1;
+static gint hf_netdfs_dfs_Info5_num_stores = -1;
 static gint hf_netdfs_dfs_EnumArray300_count = -1;
-static gint hf_netdfs_dfs_EnumArray200_s = -1;
-static gint hf_netdfs_dfs_GetInfo_level = -1;
-static gint hf_netdfs_dfs_StorageInfo_state = -1;
-static gint hf_netdfs_dfs_RemoveFtRoot_unknown = -1;
-static gint hf_netdfs_dfs_EnumArray2_s = -1;
-static gint hf_netdfs_dfs_Info4_num_stores = -1;
-static gint hf_netdfs_dfs_AddStdRoot_flags = -1;
-static gint hf_netdfs_dfs_RemoveStdRoot_rootshare = -1;
-static gint hf_netdfs_dfs_Info6_guid = -1;
-static gint hf_netdfs_dfs_Add_comment = -1;
-static gint hf_netdfs_dfs_EnumStruct_level = -1;
-static gint hf_netdfs_dfs_Info103_flags = -1;
-static gint hf_netdfs_dfs_Info200_dom_root = -1;
-static gint hf_netdfs_dfs_Info_info105 = -1;
-static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_TARGET_FAILBACK = -1;
-static gint hf_netdfs_dfs_AddStdRoot_rootshare = -1;
-static gint hf_netdfs_dfs_Target_Priority_target_priority_rank = -1;
-static gint hf_netdfs_dfs_Info6_timeout = -1;
-static gint hf_netdfs_dfs_Info105_state = -1;
 static gint hf_netdfs_dfs_Info4_timeout = -1;
-static gint hf_netdfs_dfs_AddFtRoot_comment = -1;
 static gint hf_netdfs_dfs_Info4_stores = -1;
-static gint hf_netdfs_dfs_SetInfo_info = -1;
-static gint hf_netdfs_dfs_Enum_info = -1;
-static gint hf_netdfs_dfs_Info_info100 = -1;
-static gint hf_netdfs_dfs_Info3_stores = -1;
-static gint hf_netdfs_dfs_Info5_path = -1;
-static gint hf_netdfs_dfs_AddFtRoot_rootshare = -1;
-static gint hf_netdfs_dfs_EnumEx_dfs_name = -1;
-static gint hf_netdfs_dfs_Info_info6 = -1;
+static gint hf_netdfs_dfs_Info5_pktsize = -1;
+static gint hf_netdfs_dfs_Info102_timeout = -1;
+static gint hf_netdfs_dfs_Info6_comment = -1;
+static gint hf_netdfs_dfs_Info_info5 = -1;
+static gint hf_netdfs_dfs_EnumArray4_count = -1;
+static gint hf_netdfs_dfs_Info300_flavor = -1;
+static gint hf_netdfs_dfs_GetManagerVersion_version = -1;
+static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_INSITE_REFERRALS = -1;
+static gint hf_netdfs_dfs_Info_info3 = -1;
+static gint hf_netdfs_dfs_GetInfo_sharename = -1;
 static gint hf_netdfs_dfs_Info5_guid = -1;
-static gint hf_netdfs_dfs_GetInfo_dfs_entry_path = -1;
-static gint hf_netdfs_dfs_EnumArray1_count = -1;
-static gint hf_netdfs_dfs_Info6_flags = -1;
-static gint hf_netdfs_dfs_AddStdRootForced_comment = -1;
+static gint hf_netdfs_dfs_SetInfo_dfs_entry_path = -1;
+static gint hf_netdfs_dfs_Info7_generation_guid = -1;
+static gint hf_netdfs_dfs_EnumArray300_s = -1;
+static gint hf_netdfs_dfs_Info4_num_stores = -1;
+static gint hf_netdfs_dfs_GetInfo_level = -1;
 static gint hf_netdfs_dfs_Info105_timeout = -1;
-static gint hf_netdfs_dfs_Info_info4 = -1;
+static gint hf_netdfs_opnum = -1;
+static gint hf_netdfs_dfs_Enum_level = -1;
+static gint hf_netdfs_dfs_EnumStruct_level = -1;
 static gint hf_netdfs_dfs_EnumArray200_count = -1;
-static gint hf_netdfs_dfs_GetManagerVersion_version = -1;
+static gint hf_netdfs_dfs_Info3_num_stores = -1;
 static gint hf_netdfs_dfs_Info105_property_flags = -1;
-static gint hf_netdfs_dfs_Info2_num_stores = -1;
-static gint hf_netdfs_dfs_Info1_path = -1;
-static gint hf_netdfs_dfs_Info105_comment = -1;
-static gint hf_netdfs_dfs_Info4_guid = -1;
-static gint hf_netdfs_dfs_Add_path = -1;
-static gint hf_netdfs_dfs_EnumArray4_s = -1;
-static gint hf_netdfs_dfs_Info101_state = -1;
-static gint hf_netdfs_dfs_Enum_bufsize = -1;
+static gint hf_netdfs_dfs_UnknownStruct_unknown2 = -1;
+static gint hf_netdfs_dfs_Info5_comment = -1;
+static gint hf_netdfs_dfs_Info200_dom_root = -1;
+static gint hf_netdfs_dfs_RemoveFtRoot_servername = -1;
+static gint hf_netdfs_dfs_RemoveFtRoot_dns_servername = -1;
+static gint hf_netdfs_dfs_Enum_total = -1;
+static gint hf_netdfs_dfs_Info_info102 = -1;
 static gint hf_netdfs_dfs_StorageInfo_server = -1;
+static gint hf_netdfs_dfs_Info6_pktsize = -1;
 static gint hf_netdfs_dfs_Info_info106 = -1;
-static gint hf_netdfs_dfs_Info2_path = -1;
-static gint hf_netdfs_dfs_Info5_num_stores = -1;
-static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_INSITE_REFERRALS = -1;
+static gint hf_netdfs_dfs_Info_info105 = -1;
+static gint hf_netdfs_dfs_AddFtRoot_rootshare = -1;
+static gint hf_netdfs_dfs_FlushFtTable_servername = -1;
+static gint hf_netdfs_dfs_EnumArray1_count = -1;
+static gint hf_netdfs_dfs_Info2_comment = -1;
+static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_STANDALONE = -1;
+static gint hf_netdfs_dfs_EnumArray1_s = -1;
+static gint hf_netdfs_dfs_AddStdRoot_rootshare = -1;
+static gint hf_netdfs_dfs_Info3_stores = -1;
+static gint hf_netdfs_dfs_Info6_timeout = -1;
+static gint hf_netdfs_dfs_Info_info100 = -1;
+static gint hf_netdfs_dfs_AddStdRootForced_rootshare = -1;
+static gint hf_netdfs_dfs_Info_info0 = -1;
+static gint hf_netdfs_dfs_Info103_flags = -1;
+static gint hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_OFFLINE = -1;
+static gint hf_netdfs_dfs_AddFtRoot_dfsname = -1;
+static gint hf_netdfs_dfs_Info104_priority = -1;
+static gint hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_ONLINE = -1;
+static gint hf_netdfs_dfs_EnumInfo_info3 = -1;
+static gint hf_netdfs_dfs_RemoveFtRoot_dfsname = -1;
+static gint hf_netdfs_dfs_AddStdRoot_comment = -1;
+static gint hf_netdfs_dfs_Add_flags = -1;
+static gint hf_netdfs_dfs_Info_info104 = -1;
+static gint hf_netdfs_dfs_AddStdRootForced_servername = -1;
+static gint hf_netdfs_dfs_RemoveFtRoot_flags = -1;
+static gint hf_netdfs_dfs_Info_info2 = -1;
+static gint hf_netdfs_dfs_RemoveStdRoot_rootshare = -1;
+static gint hf_netdfs_dfs_Enum_bufsize = -1;
+static gint hf_netdfs_dfs_Info6_state = -1;
+static gint hf_netdfs_dfs_GetInfo_dfs_entry_path = -1;
+static gint hf_netdfs_dfs_Info5_timeout = -1;
+static gint hf_netdfs_dfs_ManagerInitialize_flags = -1;
 static gint hf_netdfs_dfs_StorageInfo2_target_priority = -1;
-static gint hf_netdfs_dfs_Target_Priority_reserved = -1;
+static gint hf_netdfs_dfs_StorageInfo2_info = -1;
+static gint hf_netdfs_dfs_SetInfo_sharename = -1;
+static gint hf_netdfs_dfs_Info6_guid = -1;
+static gint hf_netdfs_dfs_Info_info101 = -1;
+static gint hf_netdfs_dfs_EnumStruct_e = -1;
+static gint hf_netdfs_dfs_Target_Priority_target_priority_rank = -1;
+static gint hf_netdfs_dfs_EnumEx_bufsize = -1;
+static gint hf_netdfs_dfs_Add_share = -1;
+static gint hf_netdfs_dfs_EnumArray3_count = -1;
+static gint hf_netdfs_dfs_Remove_dfs_entry_path = -1;
+static gint hf_netdfs_dfs_Info6_num_stores = -1;
+static gint hf_netdfs_dfs_RemoveFtRoot_unknown = -1;
+static gint hf_netdfs_dfs_AddFtRoot_servername = -1;
+static gint hf_netdfs_dfs_EnumEx_info = -1;
 static gint hf_netdfs_dfs_EnumEx_level = -1;
-static gint hf_netdfs_dfs_Info5_comment = -1;
-static gint hf_netdfs_dfs_Info4_path = -1;
-static gint hf_netdfs_dfs_Info_info1 = -1;
-static gint hf_netdfs_dfs_Info6_state = -1;
-static gint hf_netdfs_dfs_Info6_comment = -1;
-static gint hf_netdfs_dfs_AddFtRoot_flags = -1;
-static gint hf_netdfs_dfs_Info2_comment = -1;
-static gint hf_netdfs_dfs_Info_info7 = -1;
-static gint hf_netdfs_dfs_GetInfo_servername = -1;
-static gint hf_netdfs_dfs_RemoveFtRoot_servername = -1;
+static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_ROOT_SCALABILITY = -1;
+static gint hf_netdfs_dfs_EnumArray4_s = -1;
 static gint hf_netdfs_dfs_UnknownStruct_unknown1 = -1;
-static gint hf_netdfs_dfs_EnumInfo_info300 = -1;
-static gint hf_netdfs_dfs_AddFtRoot_dns_servername = -1;
-static gint hf_netdfs_dfs_StorageInfo2_info = -1;
+static gint hf_netdfs_werror = -1;
+static gint hf_netdfs_dfs_SetInfo_level = -1;
+static gint hf_netdfs_dfs_EnumInfo_info1 = -1;
+static gint hf_netdfs_dfs_Info_info7 = -1;
+static gint hf_netdfs_dfs_StorageInfo_state = -1;
+static gint hf_netdfs_dfs_Info5_path = -1;
+static gint hf_netdfs_dfs_Info6_flags = -1;
+static gint hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_ONLINE = -1;
+static gint hf_netdfs_dfs_Target_Priority_reserved = -1;
+static gint hf_netdfs_dfs_Info4_guid = -1;
+static gint hf_netdfs_dfs_EnumArray2_count = -1;
+static gint hf_netdfs_dfs_GetInfo_info = -1;
+static gint hf_netdfs_dfs_Info101_state = -1;
+static gint hf_netdfs_dfs_Info6_stores = -1;
 static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_CLUSTER_ENABLED = -1;
+static gint hf_netdfs_dfs_AddFtRoot_unknown1 = -1;
+static gint hf_netdfs_dfs_AddStdRootForced_comment = -1;
+static gint hf_netdfs_dfs_Info4_state = -1;
+static gint hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_TARGET_FAILBACK = -1;
+static gint hf_netdfs_dfs_Enum_info = -1;
 
 static gint proto_dcerpc_netdfs = -1;
 /* Version information */
@@ -742,7 +742,7 @@ netdfs_dissect_bitmap_dfs_VolumeState(tvbuff_t *tvb _U_, int offset _U_, packet_
 
 /* IDL: struct { */
 /* IDL: 	[charset(UTF16)] [unique(1)] uint16 *path; */
-/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *comment; */
+/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *comment; */
 /* IDL: 	dfs_VolumeState state; */
 /* IDL: 	uint32 num_stores; */
 /* IDL: } */
@@ -897,7 +897,7 @@ netdfs_dissect_bitmap_dfs_StorageState(tvbuff_t *tvb _U_, int offset _U_, packet
 
 /* IDL: struct { */
 /* IDL: 	dfs_StorageState state; */
-/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *server; */
+/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *server; */
 /* IDL: 	[charset(UTF16)] [unique(1)] uint16 *share; */
 /* IDL: } */
 
@@ -982,7 +982,7 @@ netdfs_dissect_struct_dfs_StorageInfo(tvbuff_t *tvb _U_, int offset _U_, packet_
 
 
 /* IDL: struct { */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *path; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *path; */
 /* IDL: 	[charset(UTF16)] [unique(1)] uint16 *comment; */
 /* IDL: 	dfs_VolumeState state; */
 /* IDL: 	uint32 num_stores; */
@@ -1106,7 +1106,7 @@ netdfs_dissect_struct_dfs_Info3(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 
 
 /* IDL: struct { */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *path; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *path; */
 /* IDL: 	[charset(UTF16)] [unique(1)] uint16 *comment; */
 /* IDL: 	dfs_VolumeState state; */
 /* IDL: 	uint32 timeout; */
@@ -1328,8 +1328,8 @@ netdfs_dissect_bitmap_dfs_PropertyFlags(tvbuff_t *tvb _U_, int offset _U_, packe
 
 
 /* IDL: struct { */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *path; */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *comment; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *path; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *comment; */
 /* IDL: 	dfs_VolumeState state; */
 /* IDL: 	uint32 timeout; */
 /* IDL: 	GUID guid; */
@@ -1611,14 +1611,14 @@ netdfs_dissect_struct_dfs_StorageInfo2(tvbuff_t *tvb _U_, int offset _U_, packet
 
 /* IDL: struct { */
 /* IDL: 	[unique(1)] [charset(UTF16)] uint16 *entry_path; */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *comment; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *comment; */
 /* IDL: 	dfs_VolumeState state; */
 /* IDL: 	uint32 timeout; */
 /* IDL: 	GUID guid; */
 /* IDL: 	dfs_PropertyFlags flags; */
 /* IDL: 	uint32 pktsize; */
 /* IDL: 	uint16 num_stores; */
-/* IDL: 	[unique(1)] [size_is(num_stores)] dfs_StorageInfo2 *stores; */
+/* IDL: 	[size_is(num_stores)] [unique(1)] dfs_StorageInfo2 *stores; */
 /* IDL: } */
 
 static int
@@ -1820,7 +1820,7 @@ netdfs_dissect_struct_dfs_Info7(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 
 
 /* IDL: struct { */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *comment; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *comment; */
 /* IDL: } */
 
 static int
@@ -2265,7 +2265,7 @@ netdfs_dissect_enum_dfs_VolumeFlavor(tvbuff_t *tvb _U_, int offset _U_, packet_i
 
 /* IDL: struct { */
 /* IDL: 	dfs_VolumeFlavor flavor; */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *dom_root; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *dom_root; */
 /* IDL: } */
 
 static int
@@ -2328,20 +2328,20 @@ netdfs_dissect_struct_dfs_Info300(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 
 /* IDL: union { */
-/* IDL: [case(0)] [unique(1)] [case(0)] dfs_Info0 *info0; */
-/* IDL: [case(1)] [unique(1)] [case(1)] dfs_Info1 *info1; */
-/* IDL: [case(2)] [case(2)] [unique(1)] dfs_Info2 *info2; */
-/* IDL: [case(3)] [unique(1)] [case(3)] dfs_Info3 *info3; */
+/* IDL: [case(0)] [case(0)] [unique(1)] dfs_Info0 *info0; */
+/* IDL: [case(1)] [case(1)] [unique(1)] dfs_Info1 *info1; */
+/* IDL: [case(2)] [unique(1)] [case(2)] dfs_Info2 *info2; */
+/* IDL: [case(3)] [case(3)] [unique(1)] dfs_Info3 *info3; */
 /* IDL: [case(4)] [unique(1)] [case(4)] dfs_Info4 *info4; */
 /* IDL: [case(5)] [unique(1)] [case(5)] dfs_Info5 *info5; */
 /* IDL: [case(6)] [case(6)] [unique(1)] dfs_Info6 *info6; */
-/* IDL: [case(7)] [case(7)] [unique(1)] dfs_Info7 *info7; */
-/* IDL: [case(100)] [case(100)] [unique(1)] dfs_Info100 *info100; */
-/* IDL: [case(101)] [case(101)] [unique(1)] dfs_Info101 *info101; */
+/* IDL: [case(7)] [unique(1)] [case(7)] dfs_Info7 *info7; */
+/* IDL: [case(100)] [unique(1)] [case(100)] dfs_Info100 *info100; */
+/* IDL: [case(101)] [unique(1)] [case(101)] dfs_Info101 *info101; */
 /* IDL: [case(102)] [unique(1)] [case(102)] dfs_Info102 *info102; */
 /* IDL: [case(103)] [unique(1)] [case(103)] dfs_Info103 *info103; */
-/* IDL: [case(104)] [unique(1)] [case(104)] dfs_Info104 *info104; */
-/* IDL: [case(105)] [case(105)] [unique(1)] dfs_Info105 *info105; */
+/* IDL: [case(104)] [case(104)] [unique(1)] dfs_Info104 *info104; */
+/* IDL: [case(105)] [unique(1)] [case(105)] dfs_Info105 *info105; */
 /* IDL: [case(106)] [case(106)] [unique(1)] dfs_Info106 *info106; */
 /* IDL: } */
 
@@ -2595,8 +2595,7 @@ netdfs_dissect_dfs_Info(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "dfs_Info");
-		tree = proto_item_add_subtree(item, ett_netdfs_dfs_Info);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_netdfs_dfs_Info, &item, "dfs_Info");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -2671,7 +2670,7 @@ netdfs_dissect_dfs_Info(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[size_is(count)] [unique(1)] dfs_Info1 *s; */
+/* IDL: 	[unique(1)] [size_is(count)] dfs_Info1 *s; */
 /* IDL: } */
 
 static int
@@ -2740,7 +2739,7 @@ netdfs_dissect_struct_dfs_EnumArray1(tvbuff_t *tvb _U_, int offset _U_, packet_i
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[size_is(count)] [unique(1)] dfs_Info2 *s; */
+/* IDL: 	[unique(1)] [size_is(count)] dfs_Info2 *s; */
 /* IDL: } */
 
 static int
@@ -2878,7 +2877,7 @@ netdfs_dissect_struct_dfs_EnumArray3(tvbuff_t *tvb _U_, int offset _U_, packet_i
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[size_is(count)] [unique(1)] dfs_Info4 *s; */
+/* IDL: 	[unique(1)] [size_is(count)] dfs_Info4 *s; */
 /* IDL: } */
 
 static int
@@ -2947,7 +2946,7 @@ netdfs_dissect_struct_dfs_EnumArray4(tvbuff_t *tvb _U_, int offset _U_, packet_i
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[unique(1)] [size_is(count)] dfs_Info200 *s; */
+/* IDL: 	[size_is(count)] [unique(1)] dfs_Info200 *s; */
 /* IDL: } */
 
 static int
@@ -3084,9 +3083,9 @@ netdfs_dissect_struct_dfs_EnumArray300(tvbuff_t *tvb _U_, int offset _U_, packet
 
 
 /* IDL: union { */
-/* IDL: [case(1)] [case(1)] [unique(1)] dfs_EnumArray1 *info1; */
+/* IDL: [case(1)] [unique(1)] [case(1)] dfs_EnumArray1 *info1; */
 /* IDL: [case(2)] [unique(1)] [case(2)] dfs_EnumArray2 *info2; */
-/* IDL: [case(3)] [case(3)] [unique(1)] dfs_EnumArray3 *info3; */
+/* IDL: [case(3)] [unique(1)] [case(3)] dfs_EnumArray3 *info3; */
 /* IDL: [case(4)] [case(4)] [unique(1)] dfs_EnumArray4 *info4; */
 /* IDL: [case(200)] [unique(1)] [case(200)] dfs_EnumArray200 *info200; */
 /* IDL: [case(300)] [unique(1)] [case(300)] dfs_EnumArray300 *info300; */
@@ -3198,8 +3197,7 @@ netdfs_dissect_dfs_EnumInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "dfs_EnumInfo");
-		tree = proto_item_add_subtree(item, ett_netdfs_dfs_EnumInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_netdfs_dfs_EnumInfo, &item, "dfs_EnumInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -3370,7 +3368,7 @@ netdfs_dissect_element_dfs_GetManagerVersion_version_(tvbuff_t *tvb _U_, int off
 }
 
 /* IDL: void dfs_GetManagerVersion( */
-/* IDL: [ref] [out] dfs_ManagerVersion *version */
+/* IDL: [out] [ref] dfs_ManagerVersion *version */
 /* IDL: ); */
 
 static int
@@ -3475,10 +3473,10 @@ netdfs_dissect_element_dfs_Add_flags(tvbuff_t *tvb _U_, int offset _U_, packet_i
 }
 
 /* IDL: WERROR dfs_Add( */
-/* IDL: [charset(UTF16)] [ref] [in] uint16 *path, */
-/* IDL: [ref] [in] [charset(UTF16)] uint16 *server, */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *share, */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *comment, */
+/* IDL: [in] [ref] [charset(UTF16)] uint16 *path, */
+/* IDL: [in] [ref] [charset(UTF16)] uint16 *server, */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *share, */
+/* IDL: [charset(UTF16)] [unique(1)] [in] uint16 *comment, */
 /* IDL: [in] uint32 flags */
 /* IDL: ); */
 
@@ -3571,9 +3569,9 @@ netdfs_dissect_element_dfs_Remove_sharename_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: WERROR dfs_Remove( */
-/* IDL: [ref] [in] [charset(UTF16)] uint16 *dfs_entry_path, */
-/* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *servername, */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *sharename */
+/* IDL: [in] [charset(UTF16)] [ref] uint16 *dfs_entry_path, */
+/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *servername, */
+/* IDL: [charset(UTF16)] [unique(1)] [in] uint16 *sharename */
 /* IDL: ); */
 
 static int
@@ -3677,11 +3675,11 @@ netdfs_dissect_element_dfs_SetInfo_info_(tvbuff_t *tvb _U_, int offset _U_, pack
 }
 
 /* IDL: WERROR dfs_SetInfo( */
-/* IDL: [charset(UTF16)] [in] uint16 dfs_entry_path[*], */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *servername, */
-/* IDL: [charset(UTF16)] [unique(1)] [in] uint16 *sharename, */
+/* IDL: [in] [charset(UTF16)] uint16 dfs_entry_path[*], */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *servername, */
+/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *sharename, */
 /* IDL: [in] uint32 level, */
-/* IDL: [in] [ref] [switch_is(level)] dfs_Info *info */
+/* IDL: [switch_is(level)] [ref] [in] dfs_Info *info */
 /* IDL: ); */
 
 static int
@@ -3789,9 +3787,9 @@ netdfs_dissect_element_dfs_GetInfo_info_(tvbuff_t *tvb _U_, int offset _U_, pack
 }
 
 /* IDL: WERROR dfs_GetInfo( */
-/* IDL: [in] [charset(UTF16)] uint16 dfs_entry_path[*], */
-/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *servername, */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *sharename, */
+/* IDL: [charset(UTF16)] [in] uint16 dfs_entry_path[*], */
+/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *servername, */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *sharename, */
 /* IDL: [in] uint32 level, */
 /* IDL: [out] [switch_is(level)] [ref] dfs_Info *info */
 /* IDL: ); */
@@ -3879,8 +3877,8 @@ netdfs_dissect_element_dfs_Enum_total_(tvbuff_t *tvb _U_, int offset _U_, packet
 /* IDL: WERROR dfs_Enum( */
 /* IDL: [in] uint32 level, */
 /* IDL: [in] uint32 bufsize, */
-/* IDL: [in] [unique(1)] [out] dfs_EnumStruct *info, */
-/* IDL: [out] [in] [unique(1)] uint32 *total */
+/* IDL: [in] [out] [unique(1)] dfs_EnumStruct *info, */
+/* IDL: [out] [unique(1)] [in] uint32 *total */
 /* IDL: ); */
 
 static int
@@ -4125,15 +4123,15 @@ netdfs_dissect_element_dfs_AddFtRoot_unknown2__(tvbuff_t *tvb _U_, int offset _U
 }
 
 /* IDL: WERROR dfs_AddFtRoot( */
-/* IDL: [charset(UTF16)] [in] uint16 servername[*], */
+/* IDL: [in] [charset(UTF16)] uint16 servername[*], */
 /* IDL: [in] [charset(UTF16)] uint16 dns_servername[*], */
-/* IDL: [in] [charset(UTF16)] uint16 dfsname[*], */
-/* IDL: [in] [charset(UTF16)] uint16 rootshare[*], */
+/* IDL: [charset(UTF16)] [in] uint16 dfsname[*], */
+/* IDL: [charset(UTF16)] [in] uint16 rootshare[*], */
 /* IDL: [charset(UTF16)] [in] uint16 comment[*], */
-/* IDL: [charset(UTF16)] [in] uint16 dfs_config_dn[*], */
+/* IDL: [in] [charset(UTF16)] uint16 dfs_config_dn[*], */
 /* IDL: [in] uint8 unknown1, */
 /* IDL: [in] uint32 flags, */
-/* IDL: [out] [in] [unique(1)] dfs_UnknownStruct **unknown2 */
+/* IDL: [in] [out] [unique(1)] dfs_UnknownStruct **unknown2 */
 /* IDL: ); */
 
 static int
@@ -4256,11 +4254,11 @@ netdfs_dissect_element_dfs_RemoveFtRoot_unknown__(tvbuff_t *tvb _U_, int offset
 
 /* IDL: WERROR dfs_RemoveFtRoot( */
 /* IDL: [charset(UTF16)] [in] uint16 servername[*], */
-/* IDL: [charset(UTF16)] [in] uint16 dns_servername[*], */
+/* IDL: [in] [charset(UTF16)] uint16 dns_servername[*], */
 /* IDL: [charset(UTF16)] [in] uint16 dfsname[*], */
 /* IDL: [charset(UTF16)] [in] uint16 rootshare[*], */
 /* IDL: [in] uint32 flags, */
-/* IDL: [out] [in] [unique(1)] dfs_UnknownStruct **unknown */
+/* IDL: [out] [unique(1)] [in] dfs_UnknownStruct **unknown */
 /* IDL: ); */
 
 static int
@@ -4343,7 +4341,7 @@ netdfs_dissect_element_dfs_AddStdRoot_flags(tvbuff_t *tvb _U_, int offset _U_, p
 /* IDL: WERROR dfs_AddStdRoot( */
 /* IDL: [in] [charset(UTF16)] uint16 servername[*], */
 /* IDL: [charset(UTF16)] [in] uint16 rootshare[*], */
-/* IDL: [in] [charset(UTF16)] uint16 comment[*], */
+/* IDL: [charset(UTF16)] [in] uint16 comment[*], */
 /* IDL: [in] uint32 flags */
 /* IDL: ); */
 
@@ -4408,7 +4406,7 @@ netdfs_dissect_element_dfs_RemoveStdRoot_flags(tvbuff_t *tvb _U_, int offset _U_
 
 /* IDL: WERROR dfs_RemoveStdRoot( */
 /* IDL: [in] [charset(UTF16)] uint16 servername[*], */
-/* IDL: [charset(UTF16)] [in] uint16 rootshare[*], */
+/* IDL: [in] [charset(UTF16)] uint16 rootshare[*], */
 /* IDL: [in] uint32 flags */
 /* IDL: ); */
 
@@ -4467,7 +4465,7 @@ netdfs_dissect_element_dfs_ManagerInitialize_flags(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: WERROR dfs_ManagerInitialize( */
-/* IDL: [charset(UTF16)] [in] [ref] uint16 *servername, */
+/* IDL: [in] [charset(UTF16)] [ref] uint16 *servername, */
 /* IDL: [in] uint32 flags */
 /* IDL: ); */
 
@@ -4543,8 +4541,8 @@ netdfs_dissect_element_dfs_AddStdRootForced_store(tvbuff_t *tvb _U_, int offset
 /* IDL: WERROR dfs_AddStdRootForced( */
 /* IDL: [in] [charset(UTF16)] uint16 servername[*], */
 /* IDL: [in] [charset(UTF16)] uint16 rootshare[*], */
-/* IDL: [charset(UTF16)] [in] uint16 comment[*], */
-/* IDL: [charset(UTF16)] [in] uint16 store[*] */
+/* IDL: [in] [charset(UTF16)] uint16 comment[*], */
+/* IDL: [in] [charset(UTF16)] uint16 store[*] */
 /* IDL: ); */
 
 static int
@@ -4788,7 +4786,7 @@ netdfs_dissect_element_dfs_EnumEx_total_(tvbuff_t *tvb _U_, int offset _U_, pack
 }
 
 /* IDL: WERROR dfs_EnumEx( */
-/* IDL: [in] [charset(UTF16)] uint16 dfs_name[*], */
+/* IDL: [charset(UTF16)] [in] uint16 dfs_name[*], */
 /* IDL: [in] uint32 level, */
 /* IDL: [in] uint32 bufsize, */
 /* IDL: [in] [unique(1)] [out] dfs_EnumStruct *info, */
@@ -4911,344 +4909,344 @@ static dcerpc_sub_dissector netdfs_dissectors[] = {
 void proto_register_dcerpc_netdfs(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_ONLINE,
-	  { "Dfs Storage State Online", "netdfs.dfs_StorageState.DFS_STORAGE_STATE_ONLINE", FT_BOOLEAN, 32, TFS(&dfs_StorageState_DFS_STORAGE_STATE_ONLINE_tfs), ( 2 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumEx_bufsize,
-	  { "Bufsize", "netdfs.dfs_EnumEx.bufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Enum_level,
-	  { "Level", "netdfs.dfs_Enum.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumEx_info,
-	  { "Info", "netdfs.dfs_EnumEx.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info3_num_stores,
-	  { "Num Stores", "netdfs.dfs_Info3.num_stores", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_RemoveFtRoot_dns_servername,
-	  { "Dns Servername", "netdfs.dfs_RemoveFtRoot.dns_servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_SITE_COSTING,
-	  { "Dfs Property Flag Site Costing", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_SITE_COSTING", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_SITE_COSTING_tfs), ( 0x04 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info300_flavor,
-	  { "Flavor", "netdfs.dfs_Info300.flavor", FT_UINT1632, BASE_DEC, VALS(netdfs_dfs_VolumeFlavor_vals), 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info3_path,
+		{ "Path", "netdfs.dfs_Info3.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_SetInfo_info,
+		{ "Info", "netdfs.dfs_SetInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_RemoveFtRoot_rootshare,
-	  { "Rootshare", "netdfs.dfs_RemoveFtRoot.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_GetInfo_info,
-	  { "Info", "netdfs.dfs_GetInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_num_stores,
-	  { "Num Stores", "netdfs.dfs_Info6.num_stores", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info3_state,
-	  { "State", "netdfs.dfs_Info3.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_unknown2,
-	  { "Unknown2", "netdfs.dfs_AddFtRoot.unknown2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info0,
-	  { "Info0", "netdfs.dfs_Info.info0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Remove_sharename,
-	  { "Sharename", "netdfs.dfs_Remove.sharename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumInfo_info1,
-	  { "Info1", "netdfs.dfs_EnumInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_STANDALONE,
-	  { "Dfs Volume State Standalone", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_STANDALONE", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_STANDALONE_tfs), ( DFS_VOLUME_FLAVOR_STANDALONE ), NULL, HFILL }},
+		{ "Rootshare", "netdfs.dfs_RemoveFtRoot.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_flags,
+		{ "Flags", "netdfs.dfs_AddFtRoot.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumEx_total,
+		{ "Total", "netdfs.dfs_EnumEx.total", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info105_state,
+		{ "State", "netdfs.dfs_Info105.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info5_state,
+		{ "State", "netdfs.dfs_Info5.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info4_comment,
+		{ "Comment", "netdfs.dfs_Info4.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_RemoveStdRoot_servername,
+		{ "Servername", "netdfs.dfs_RemoveStdRoot.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_OK,
+		{ "Dfs Volume State Ok", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_OK", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_OK_tfs), ( 0x1 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray3_s,
+		{ "S", "netdfs.dfs_EnumArray3.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Remove_servername,
-	  { "Servername", "netdfs.dfs_Remove.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_OFFLINE,
-	  { "Dfs Storage State Offline", "netdfs.dfs_StorageState.DFS_STORAGE_STATE_OFFLINE", FT_BOOLEAN, 32, TFS(&dfs_StorageState_DFS_STORAGE_STATE_OFFLINE_tfs), ( 1 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info3_path,
-	  { "Path", "netdfs.dfs_Info3.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Servername", "netdfs.dfs_Remove.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_OFFLINE,
+		{ "Dfs Volume State Offline", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_OFFLINE", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_OFFLINE_tfs), ( 0x4 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_FlushFtTable_rootshare,
+		{ "Rootshare", "netdfs.dfs_FlushFtTable.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info2_num_stores,
+		{ "Num Stores", "netdfs.dfs_Info2.num_stores", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_dfs_config_dn,
+		{ "Dfs Config Dn", "netdfs.dfs_AddFtRoot.dfs_config_dn", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumInfo_info200,
+		{ "Info200", "netdfs.dfs_EnumInfo.info200", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info4_path,
+		{ "Path", "netdfs.dfs_Info4.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info4,
+		{ "Info4", "netdfs.dfs_Info.info4", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumEx_dfs_name,
+		{ "Dfs Name", "netdfs.dfs_EnumEx.dfs_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info2_path,
+		{ "Path", "netdfs.dfs_Info2.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_StorageInfo_share,
-	  { "Share", "netdfs.dfs_StorageInfo.share", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumStruct_e,
-	  { "E", "netdfs.dfs_EnumStruct.e", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_INCONSISTENT,
-	  { "Dfs Volume State Inconsistent", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_INCONSISTENT", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_INCONSISTENT_tfs), ( 0x2 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info104_priority,
-	  { "Priority", "netdfs.dfs_Info104.priority", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Share", "netdfs.dfs_StorageInfo.share", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info6,
+		{ "Info6", "netdfs.dfs_Info.info6", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info2_state,
+		{ "State", "netdfs.dfs_Info2.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray200_s,
+		{ "S", "netdfs.dfs_EnumArray200.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumInfo_info300,
+		{ "Info300", "netdfs.dfs_EnumInfo.info300", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info105_comment,
+		{ "Comment", "netdfs.dfs_Info105.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_unknown2,
+		{ "Unknown2", "netdfs.dfs_AddFtRoot.unknown2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_dns_servername,
+		{ "Dns Servername", "netdfs.dfs_AddFtRoot.dns_servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Add_server,
+		{ "Server", "netdfs.dfs_Add.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info1,
+		{ "Info1", "netdfs.dfs_Info.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_entry_path,
+		{ "Entry Path", "netdfs.dfs_Info6.entry_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Remove_sharename,
+		{ "Sharename", "netdfs.dfs_Remove.sharename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Add_path,
+		{ "Path", "netdfs.dfs_Add.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info100_comment,
-	  { "Comment", "netdfs.dfs_Info100.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info104,
-	  { "Info104", "netdfs.dfs_Info.info104", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info4_comment,
-	  { "Comment", "netdfs.dfs_Info4.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray3_s,
-	  { "S", "netdfs.dfs_EnumArray3.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Comment", "netdfs.dfs_Info100.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_INCONSISTENT,
+		{ "Dfs Volume State Inconsistent", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_INCONSISTENT", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_INCONSISTENT_tfs), ( 0x2 ), NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info105_property_flag_mask,
-	  { "Property Flag Mask", "netdfs.dfs_Info105.property_flag_mask", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info7_generation_guid,
-	  { "Generation Guid", "netdfs.dfs_Info7.generation_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray300_s,
-	  { "S", "netdfs.dfs_EnumArray300.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info106_priority,
-	  { "Priority", "netdfs.dfs_Info106.priority", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumInfo_info3,
-	  { "Info3", "netdfs.dfs_EnumInfo.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Add_share,
-	  { "Share", "netdfs.dfs_Add.share", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray2_count,
-	  { "Count", "netdfs.dfs_EnumArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_ManagerInitialize_flags,
-	  { "Flags", "netdfs.dfs_ManagerInitialize.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddStdRootForced_rootshare,
-	  { "Rootshare", "netdfs.dfs_AddStdRootForced.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_SetInfo_level,
-	  { "Level", "netdfs.dfs_SetInfo.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Property Flag Mask", "netdfs.dfs_Info105.property_flag_mask", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddStdRootForced_store,
+		{ "Store", "netdfs.dfs_AddStdRootForced.store", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info106_state,
+		{ "State", "netdfs.dfs_Info106.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_AD_BLOB,
-	  { "Dfs Volume State Ad Blob", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_AD_BLOB", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_AD_BLOB_tfs), ( DFS_VOLUME_FLAVOR_AD_BLOB ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddStdRootForced_servername,
-	  { "Servername", "netdfs.dfs_AddStdRootForced.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info5_timeout,
-	  { "Timeout", "netdfs.dfs_Info5.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info5_pktsize,
-	  { "Pktsize", "netdfs.dfs_Info5.pktsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_ROOT_SCALABILITY,
-	  { "Dfs Property Flag Root Scalability", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_ROOT_SCALABILITY", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_ROOT_SCALABILITY_tfs), ( 0x02 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_SetInfo_dfs_entry_path,
-	  { "Dfs Entry Path", "netdfs.dfs_SetInfo.dfs_entry_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_RemoveFtRoot_flags,
-	  { "Flags", "netdfs.dfs_RemoveFtRoot.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_ONLINE,
-	  { "Dfs Volume State Online", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_ONLINE", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_ONLINE_tfs), ( 0x8 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumInfo_info2,
-	  { "Info2", "netdfs.dfs_EnumInfo.info2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray4_count,
-	  { "Count", "netdfs.dfs_EnumArray4.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info5,
-	  { "Info5", "netdfs.dfs_Info.info5", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info101,
-	  { "Info101", "netdfs.dfs_Info.info101", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_pktsize,
-	  { "Pktsize", "netdfs.dfs_Info6.pktsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray3_count,
-	  { "Count", "netdfs.dfs_EnumArray3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Target_Priority_target_priority_class,
-	  { "Target Priority Class", "netdfs.dfs_Target_Priority.target_priority_class", FT_UINT32, BASE_DEC, VALS(netdfs_dfs_Target_PriorityClass_vals), 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Add_server,
-	  { "Server", "netdfs.dfs_Add.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_servername,
-	  { "Servername", "netdfs.dfs_AddFtRoot.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info3,
-	  { "Info3", "netdfs.dfs_Info.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_SetInfo_sharename,
-	  { "Sharename", "netdfs.dfs_SetInfo.sharename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_werror,
-	  { "Windows Error", "netdfs.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
-	{ &hf_netdfs_opnum,
-	  { "Operation", "netdfs.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Dfs Volume State Ad Blob", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_AD_BLOB", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_AD_BLOB_tfs), ( DFS_VOLUME_FLAVOR_AD_BLOB ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_comment,
+		{ "Comment", "netdfs.dfs_AddFtRoot.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_SetInfo_servername,
+		{ "Servername", "netdfs.dfs_SetInfo.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_ManagerInitialize_servername,
-	  { "Servername", "netdfs.dfs_ManagerInitialize.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Servername", "netdfs.dfs_ManagerInitialize.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddStdRoot_flags,
+		{ "Flags", "netdfs.dfs_AddStdRoot.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_GetInfo_servername,
+		{ "Servername", "netdfs.dfs_GetInfo.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info300_dom_root,
+		{ "Dom Root", "netdfs.dfs_Info300.dom_root", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info106_priority,
+		{ "Priority", "netdfs.dfs_Info106.priority", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info103,
+		{ "Info103", "netdfs.dfs_Info.info103", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_SITE_COSTING,
+		{ "Dfs Property Flag Site Costing", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_SITE_COSTING", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_SITE_COSTING_tfs), ( 0x04 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_Target_Priority_target_priority_class,
+		{ "Target Priority Class", "netdfs.dfs_Target_Priority.target_priority_class", FT_UINT32, BASE_DEC, VALS(netdfs_dfs_Target_PriorityClass_vals), 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info3_comment,
-	  { "Comment", "netdfs.dfs_Info3.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_SetInfo_servername,
-	  { "Servername", "netdfs.dfs_SetInfo.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_entry_path,
-	  { "Entry Path", "netdfs.dfs_Info6.entry_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumInfo_info4,
-	  { "Info4", "netdfs.dfs_EnumInfo.info4", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddStdRoot_comment,
-	  { "Comment", "netdfs.dfs_AddStdRoot.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Comment", "netdfs.dfs_Info3.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Add_comment,
+		{ "Comment", "netdfs.dfs_Add.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumInfo_info2,
+		{ "Info2", "netdfs.dfs_EnumInfo.info2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_ACTIVE,
-	  { "Dfs Storage State Active", "netdfs.dfs_StorageState.DFS_STORAGE_STATE_ACTIVE", FT_BOOLEAN, 32, TFS(&dfs_StorageState_DFS_STORAGE_STATE_ACTIVE_tfs), ( 4 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_dfsname,
-	  { "Dfsname", "netdfs.dfs_AddFtRoot.dfsname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_RemoveStdRoot_servername,
-	  { "Servername", "netdfs.dfs_RemoveStdRoot.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info102,
-	  { "Info102", "netdfs.dfs_Info.info102", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info2_state,
-	  { "State", "netdfs.dfs_Info2.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info103,
-	  { "Info103", "netdfs.dfs_Info.info103", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Dfs Storage State Active", "netdfs.dfs_StorageState.DFS_STORAGE_STATE_ACTIVE", FT_BOOLEAN, 32, TFS(&dfs_StorageState_DFS_STORAGE_STATE_ACTIVE_tfs), ( 4 ), NULL, HFILL }},
 	{ &hf_netdfs_dfs_RemoveStdRoot_flags,
-	  { "Flags", "netdfs.dfs_RemoveStdRoot.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_RemoveFtRoot_dfsname,
-	  { "Dfsname", "netdfs.dfs_RemoveFtRoot.dfsname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info5_flags,
-	  { "Flags", "netdfs.dfs_Info5.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_OFFLINE,
-	  { "Dfs Volume State Offline", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_OFFLINE", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_OFFLINE_tfs), ( 0x4 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info4_state,
-	  { "State", "netdfs.dfs_Info4.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumInfo_info200,
-	  { "Info200", "netdfs.dfs_EnumInfo.info200", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_stores,
-	  { "Stores", "netdfs.dfs_Info6.stores", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Enum_total,
-	  { "Total", "netdfs.dfs_Enum.total", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Flags", "netdfs.dfs_RemoveStdRoot.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray2_s,
+		{ "S", "netdfs.dfs_EnumArray2.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info1_path,
+		{ "Path", "netdfs.dfs_Info1.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumInfo_info4,
+		{ "Info4", "netdfs.dfs_EnumInfo.info4", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_AddStdRoot_servername,
-	  { "Servername", "netdfs.dfs_AddStdRoot.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_OK,
-	  { "Dfs Volume State Ok", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_OK", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_OK_tfs), ( 0x1 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info300_dom_root,
-	  { "Dom Root", "netdfs.dfs_Info300.dom_root", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddStdRootForced_store,
-	  { "Store", "netdfs.dfs_AddStdRootForced.store", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_dfs_config_dn,
-	  { "Dfs Config Dn", "netdfs.dfs_AddFtRoot.dfs_config_dn", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Remove_dfs_entry_path,
-	  { "Dfs Entry Path", "netdfs.dfs_Remove.dfs_entry_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_UnknownStruct_unknown2,
-	  { "Unknown2", "netdfs.dfs_UnknownStruct.unknown2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumEx_total,
-	  { "Total", "netdfs.dfs_EnumEx.total", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_FlushFtTable_servername,
-	  { "Servername", "netdfs.dfs_FlushFtTable.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_FlushFtTable_rootshare,
-	  { "Rootshare", "netdfs.dfs_FlushFtTable.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_GetInfo_sharename,
-	  { "Sharename", "netdfs.dfs_GetInfo.sharename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info106_state,
-	  { "State", "netdfs.dfs_Info106.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info5_state,
-	  { "State", "netdfs.dfs_Info5.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray1_s,
-	  { "S", "netdfs.dfs_EnumArray1.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Add_flags,
-	  { "Flags", "netdfs.dfs_Add.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info2,
-	  { "Info2", "netdfs.dfs_Info.info2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_unknown1,
-	  { "Unknown1", "netdfs.dfs_AddFtRoot.unknown1", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info102_timeout,
-	  { "Timeout", "netdfs.dfs_Info102.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Servername", "netdfs.dfs_AddStdRoot.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info3_state,
+		{ "State", "netdfs.dfs_Info3.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info5_flags,
+		{ "Flags", "netdfs.dfs_Info5.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info5_num_stores,
+		{ "Num Stores", "netdfs.dfs_Info5.num_stores", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_EnumArray300_count,
-	  { "Count", "netdfs.dfs_EnumArray300.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray200_s,
-	  { "S", "netdfs.dfs_EnumArray200.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_GetInfo_level,
-	  { "Level", "netdfs.dfs_GetInfo.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_StorageInfo_state,
-	  { "State", "netdfs.dfs_StorageInfo.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_RemoveFtRoot_unknown,
-	  { "Unknown", "netdfs.dfs_RemoveFtRoot.unknown", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray2_s,
-	  { "S", "netdfs.dfs_EnumArray2.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info4_num_stores,
-	  { "Num Stores", "netdfs.dfs_Info4.num_stores", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddStdRoot_flags,
-	  { "Flags", "netdfs.dfs_AddStdRoot.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_RemoveStdRoot_rootshare,
-	  { "Rootshare", "netdfs.dfs_RemoveStdRoot.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_guid,
-	  { "Guid", "netdfs.dfs_Info6.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Add_comment,
-	  { "Comment", "netdfs.dfs_Add.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumStruct_level,
-	  { "Level", "netdfs.dfs_EnumStruct.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info103_flags,
-	  { "Flags", "netdfs.dfs_Info103.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info200_dom_root,
-	  { "Dom Root", "netdfs.dfs_Info200.dom_root", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info105,
-	  { "Info105", "netdfs.dfs_Info.info105", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_TARGET_FAILBACK,
-	  { "Dfs Property Flag Target Failback", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_TARGET_FAILBACK", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_TARGET_FAILBACK_tfs), ( 0x08 ), NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddStdRoot_rootshare,
-	  { "Rootshare", "netdfs.dfs_AddStdRoot.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Target_Priority_target_priority_rank,
-	  { "Target Priority Rank", "netdfs.dfs_Target_Priority.target_priority_rank", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_timeout,
-	  { "Timeout", "netdfs.dfs_Info6.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info105_state,
-	  { "State", "netdfs.dfs_Info105.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Count", "netdfs.dfs_EnumArray300.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info4_timeout,
-	  { "Timeout", "netdfs.dfs_Info4.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_comment,
-	  { "Comment", "netdfs.dfs_AddFtRoot.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Timeout", "netdfs.dfs_Info4.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info4_stores,
-	  { "Stores", "netdfs.dfs_Info4.stores", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_SetInfo_info,
-	  { "Info", "netdfs.dfs_SetInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Enum_info,
-	  { "Info", "netdfs.dfs_Enum.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info100,
-	  { "Info100", "netdfs.dfs_Info.info100", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info3_stores,
-	  { "Stores", "netdfs.dfs_Info3.stores", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info5_path,
-	  { "Path", "netdfs.dfs_Info5.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_rootshare,
-	  { "Rootshare", "netdfs.dfs_AddFtRoot.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumEx_dfs_name,
-	  { "Dfs Name", "netdfs.dfs_EnumEx.dfs_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info6,
-	  { "Info6", "netdfs.dfs_Info.info6", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Stores", "netdfs.dfs_Info4.stores", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info5_pktsize,
+		{ "Pktsize", "netdfs.dfs_Info5.pktsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info102_timeout,
+		{ "Timeout", "netdfs.dfs_Info102.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_comment,
+		{ "Comment", "netdfs.dfs_Info6.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info5,
+		{ "Info5", "netdfs.dfs_Info.info5", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray4_count,
+		{ "Count", "netdfs.dfs_EnumArray4.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info300_flavor,
+		{ "Flavor", "netdfs.dfs_Info300.flavor", FT_UINT1632, BASE_DEC, VALS(netdfs_dfs_VolumeFlavor_vals), 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_GetManagerVersion_version,
+		{ "Version", "netdfs.dfs_GetManagerVersion.version", FT_UINT32, BASE_DEC, VALS(netdfs_dfs_ManagerVersion_vals), 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_INSITE_REFERRALS,
+		{ "Dfs Property Flag Insite Referrals", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_INSITE_REFERRALS", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_INSITE_REFERRALS_tfs), ( 0x01 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info3,
+		{ "Info3", "netdfs.dfs_Info.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_GetInfo_sharename,
+		{ "Sharename", "netdfs.dfs_GetInfo.sharename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info5_guid,
-	  { "Guid", "netdfs.dfs_Info5.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_GetInfo_dfs_entry_path,
-	  { "Dfs Entry Path", "netdfs.dfs_GetInfo.dfs_entry_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray1_count,
-	  { "Count", "netdfs.dfs_EnumArray1.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_flags,
-	  { "Flags", "netdfs.dfs_Info6.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddStdRootForced_comment,
-	  { "Comment", "netdfs.dfs_AddStdRootForced.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Guid", "netdfs.dfs_Info5.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_SetInfo_dfs_entry_path,
+		{ "Dfs Entry Path", "netdfs.dfs_SetInfo.dfs_entry_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info7_generation_guid,
+		{ "Generation Guid", "netdfs.dfs_Info7.generation_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray300_s,
+		{ "S", "netdfs.dfs_EnumArray300.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info4_num_stores,
+		{ "Num Stores", "netdfs.dfs_Info4.num_stores", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_GetInfo_level,
+		{ "Level", "netdfs.dfs_GetInfo.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info105_timeout,
-	  { "Timeout", "netdfs.dfs_Info105.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info4,
-	  { "Info4", "netdfs.dfs_Info.info4", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Timeout", "netdfs.dfs_Info105.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_opnum,
+		{ "Operation", "netdfs.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Enum_level,
+		{ "Level", "netdfs.dfs_Enum.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumStruct_level,
+		{ "Level", "netdfs.dfs_EnumStruct.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_EnumArray200_count,
-	  { "Count", "netdfs.dfs_EnumArray200.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_GetManagerVersion_version,
-	  { "Version", "netdfs.dfs_GetManagerVersion.version", FT_UINT32, BASE_DEC, VALS(netdfs_dfs_ManagerVersion_vals), 0, NULL, HFILL }},
+		{ "Count", "netdfs.dfs_EnumArray200.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info3_num_stores,
+		{ "Num Stores", "netdfs.dfs_Info3.num_stores", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info105_property_flags,
-	  { "Property Flags", "netdfs.dfs_Info105.property_flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info2_num_stores,
-	  { "Num Stores", "netdfs.dfs_Info2.num_stores", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info1_path,
-	  { "Path", "netdfs.dfs_Info1.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info105_comment,
-	  { "Comment", "netdfs.dfs_Info105.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info4_guid,
-	  { "Guid", "netdfs.dfs_Info4.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Add_path,
-	  { "Path", "netdfs.dfs_Add.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumArray4_s,
-	  { "S", "netdfs.dfs_EnumArray4.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info101_state,
-	  { "State", "netdfs.dfs_Info101.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Enum_bufsize,
-	  { "Bufsize", "netdfs.dfs_Enum.bufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Property Flags", "netdfs.dfs_Info105.property_flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_UnknownStruct_unknown2,
+		{ "Unknown2", "netdfs.dfs_UnknownStruct.unknown2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info5_comment,
+		{ "Comment", "netdfs.dfs_Info5.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info200_dom_root,
+		{ "Dom Root", "netdfs.dfs_Info200.dom_root", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_RemoveFtRoot_servername,
+		{ "Servername", "netdfs.dfs_RemoveFtRoot.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_RemoveFtRoot_dns_servername,
+		{ "Dns Servername", "netdfs.dfs_RemoveFtRoot.dns_servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Enum_total,
+		{ "Total", "netdfs.dfs_Enum.total", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info102,
+		{ "Info102", "netdfs.dfs_Info.info102", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_StorageInfo_server,
-	  { "Server", "netdfs.dfs_StorageInfo.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Server", "netdfs.dfs_StorageInfo.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_pktsize,
+		{ "Pktsize", "netdfs.dfs_Info6.pktsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_Info_info106,
-	  { "Info106", "netdfs.dfs_Info.info106", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info2_path,
-	  { "Path", "netdfs.dfs_Info2.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info5_num_stores,
-	  { "Num Stores", "netdfs.dfs_Info5.num_stores", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_INSITE_REFERRALS,
-	  { "Dfs Property Flag Insite Referrals", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_INSITE_REFERRALS", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_INSITE_REFERRALS_tfs), ( 0x01 ), NULL, HFILL }},
+		{ "Info106", "netdfs.dfs_Info.info106", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info105,
+		{ "Info105", "netdfs.dfs_Info.info105", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_rootshare,
+		{ "Rootshare", "netdfs.dfs_AddFtRoot.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_FlushFtTable_servername,
+		{ "Servername", "netdfs.dfs_FlushFtTable.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray1_count,
+		{ "Count", "netdfs.dfs_EnumArray1.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info2_comment,
+		{ "Comment", "netdfs.dfs_Info2.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_STANDALONE,
+		{ "Dfs Volume State Standalone", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_STANDALONE", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_STANDALONE_tfs), ( DFS_VOLUME_FLAVOR_STANDALONE ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray1_s,
+		{ "S", "netdfs.dfs_EnumArray1.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddStdRoot_rootshare,
+		{ "Rootshare", "netdfs.dfs_AddStdRoot.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info3_stores,
+		{ "Stores", "netdfs.dfs_Info3.stores", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_timeout,
+		{ "Timeout", "netdfs.dfs_Info6.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info100,
+		{ "Info100", "netdfs.dfs_Info.info100", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddStdRootForced_rootshare,
+		{ "Rootshare", "netdfs.dfs_AddStdRootForced.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info0,
+		{ "Info0", "netdfs.dfs_Info.info0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info103_flags,
+		{ "Flags", "netdfs.dfs_Info103.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_OFFLINE,
+		{ "Dfs Storage State Offline", "netdfs.dfs_StorageState.DFS_STORAGE_STATE_OFFLINE", FT_BOOLEAN, 32, TFS(&dfs_StorageState_DFS_STORAGE_STATE_OFFLINE_tfs), ( 1 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_dfsname,
+		{ "Dfsname", "netdfs.dfs_AddFtRoot.dfsname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info104_priority,
+		{ "Priority", "netdfs.dfs_Info104.priority", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_StorageState_DFS_STORAGE_STATE_ONLINE,
+		{ "Dfs Storage State Online", "netdfs.dfs_StorageState.DFS_STORAGE_STATE_ONLINE", FT_BOOLEAN, 32, TFS(&dfs_StorageState_DFS_STORAGE_STATE_ONLINE_tfs), ( 2 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumInfo_info3,
+		{ "Info3", "netdfs.dfs_EnumInfo.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_RemoveFtRoot_dfsname,
+		{ "Dfsname", "netdfs.dfs_RemoveFtRoot.dfsname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddStdRoot_comment,
+		{ "Comment", "netdfs.dfs_AddStdRoot.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Add_flags,
+		{ "Flags", "netdfs.dfs_Add.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info104,
+		{ "Info104", "netdfs.dfs_Info.info104", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddStdRootForced_servername,
+		{ "Servername", "netdfs.dfs_AddStdRootForced.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_RemoveFtRoot_flags,
+		{ "Flags", "netdfs.dfs_RemoveFtRoot.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info2,
+		{ "Info2", "netdfs.dfs_Info.info2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_RemoveStdRoot_rootshare,
+		{ "Rootshare", "netdfs.dfs_RemoveStdRoot.rootshare", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Enum_bufsize,
+		{ "Bufsize", "netdfs.dfs_Enum.bufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_state,
+		{ "State", "netdfs.dfs_Info6.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_GetInfo_dfs_entry_path,
+		{ "Dfs Entry Path", "netdfs.dfs_GetInfo.dfs_entry_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info5_timeout,
+		{ "Timeout", "netdfs.dfs_Info5.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_ManagerInitialize_flags,
+		{ "Flags", "netdfs.dfs_ManagerInitialize.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_StorageInfo2_target_priority,
-	  { "Target Priority", "netdfs.dfs_StorageInfo2.target_priority", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Target_Priority_reserved,
-	  { "Reserved", "netdfs.dfs_Target_Priority.reserved", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Target Priority", "netdfs.dfs_StorageInfo2.target_priority", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_StorageInfo2_info,
+		{ "Info", "netdfs.dfs_StorageInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_SetInfo_sharename,
+		{ "Sharename", "netdfs.dfs_SetInfo.sharename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_guid,
+		{ "Guid", "netdfs.dfs_Info6.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info101,
+		{ "Info101", "netdfs.dfs_Info.info101", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumStruct_e,
+		{ "E", "netdfs.dfs_EnumStruct.e", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Target_Priority_target_priority_rank,
+		{ "Target Priority Rank", "netdfs.dfs_Target_Priority.target_priority_rank", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumEx_bufsize,
+		{ "Bufsize", "netdfs.dfs_EnumEx.bufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Add_share,
+		{ "Share", "netdfs.dfs_Add.share", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray3_count,
+		{ "Count", "netdfs.dfs_EnumArray3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Remove_dfs_entry_path,
+		{ "Dfs Entry Path", "netdfs.dfs_Remove.dfs_entry_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_num_stores,
+		{ "Num Stores", "netdfs.dfs_Info6.num_stores", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_RemoveFtRoot_unknown,
+		{ "Unknown", "netdfs.dfs_RemoveFtRoot.unknown", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_servername,
+		{ "Servername", "netdfs.dfs_AddFtRoot.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumEx_info,
+		{ "Info", "netdfs.dfs_EnumEx.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_EnumEx_level,
-	  { "Level", "netdfs.dfs_EnumEx.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info5_comment,
-	  { "Comment", "netdfs.dfs_Info5.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info4_path,
-	  { "Path", "netdfs.dfs_Info4.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info1,
-	  { "Info1", "netdfs.dfs_Info.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_state,
-	  { "State", "netdfs.dfs_Info6.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info6_comment,
-	  { "Comment", "netdfs.dfs_Info6.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_flags,
-	  { "Flags", "netdfs.dfs_AddFtRoot.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info2_comment,
-	  { "Comment", "netdfs.dfs_Info2.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_Info_info7,
-	  { "Info7", "netdfs.dfs_Info.info7", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_GetInfo_servername,
-	  { "Servername", "netdfs.dfs_GetInfo.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_RemoveFtRoot_servername,
-	  { "Servername", "netdfs.dfs_RemoveFtRoot.servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Level", "netdfs.dfs_EnumEx.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_ROOT_SCALABILITY,
+		{ "Dfs Property Flag Root Scalability", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_ROOT_SCALABILITY", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_ROOT_SCALABILITY_tfs), ( 0x02 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray4_s,
+		{ "S", "netdfs.dfs_EnumArray4.s", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_UnknownStruct_unknown1,
-	  { "Unknown1", "netdfs.dfs_UnknownStruct.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_EnumInfo_info300,
-	  { "Info300", "netdfs.dfs_EnumInfo.info300", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_AddFtRoot_dns_servername,
-	  { "Dns Servername", "netdfs.dfs_AddFtRoot.dns_servername", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_netdfs_dfs_StorageInfo2_info,
-	  { "Info", "netdfs.dfs_StorageInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Unknown1", "netdfs.dfs_UnknownStruct.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_werror,
+		{ "Windows Error", "netdfs.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_SetInfo_level,
+		{ "Level", "netdfs.dfs_SetInfo.level", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumInfo_info1,
+		{ "Info1", "netdfs.dfs_EnumInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info_info7,
+		{ "Info7", "netdfs.dfs_Info.info7", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_StorageInfo_state,
+		{ "State", "netdfs.dfs_StorageInfo.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info5_path,
+		{ "Path", "netdfs.dfs_Info5.path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_flags,
+		{ "Flags", "netdfs.dfs_Info6.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_VolumeState_DFS_VOLUME_STATE_ONLINE,
+		{ "Dfs Volume State Online", "netdfs.dfs_VolumeState.DFS_VOLUME_STATE_ONLINE", FT_BOOLEAN, 32, TFS(&dfs_VolumeState_DFS_VOLUME_STATE_ONLINE_tfs), ( 0x8 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_Target_Priority_reserved,
+		{ "Reserved", "netdfs.dfs_Target_Priority.reserved", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info4_guid,
+		{ "Guid", "netdfs.dfs_Info4.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_EnumArray2_count,
+		{ "Count", "netdfs.dfs_EnumArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_GetInfo_info,
+		{ "Info", "netdfs.dfs_GetInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info101_state,
+		{ "State", "netdfs.dfs_Info101.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info6_stores,
+		{ "Stores", "netdfs.dfs_Info6.stores", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_CLUSTER_ENABLED,
-	  { "Dfs Property Flag Cluster Enabled", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_CLUSTER_ENABLED", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_CLUSTER_ENABLED_tfs), ( 0x10 ), NULL, HFILL }},
+		{ "Dfs Property Flag Cluster Enabled", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_CLUSTER_ENABLED", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_CLUSTER_ENABLED_tfs), ( 0x10 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddFtRoot_unknown1,
+		{ "Unknown1", "netdfs.dfs_AddFtRoot.unknown1", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_AddStdRootForced_comment,
+		{ "Comment", "netdfs.dfs_AddStdRootForced.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_Info4_state,
+		{ "State", "netdfs.dfs_Info4.state", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_netdfs_dfs_PropertyFlags_DFS_PROPERTY_FLAG_TARGET_FAILBACK,
+		{ "Dfs Property Flag Target Failback", "netdfs.dfs_PropertyFlags.DFS_PROPERTY_FLAG_TARGET_FAILBACK", FT_BOOLEAN, 32, TFS(&dfs_PropertyFlags_DFS_PROPERTY_FLAG_TARGET_FAILBACK_tfs), ( 0x08 ), NULL, HFILL }},
+	{ &hf_netdfs_dfs_Enum_info,
+		{ "Info", "netdfs.dfs_Enum.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-dnsserver.c b/epan/dissectors/packet-dcerpc-dnsserver.c
index 99bda550a4..89e72a76af 100644
--- a/epan/dissectors/packet-dcerpc-dnsserver.c
+++ b/epan/dissectors/packet-dcerpc-dnsserver.c
@@ -45,148 +45,148 @@ static gint ett_dnsserver_DNS_RECORD_BUFFER = -1;
 
 
 /* Header field declarations */
-static gint hf_dnsserver_DNS_RPC_NAME_NameLength = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_Childcount = -1;
-static gint hf_dnsserver_DNS_RPC_VERSION_OSMajorVersion = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUESTIONS = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_NoRecursion = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_MaxCacheTtl = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension5 = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUERY = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_TCP = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_filter_stop = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_buffer_length = -1;
-static gint hf_dnsserver_DNSSRV_RPC_UNION_ServerInfoDotnet = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_DataLength = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_BootMethod = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_setting_flags = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_records = -1;
-static gint hf_dnsserver_DNSSRV_RPC_UNION_null = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecurseAfterForwarding = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension0 = -1;
-static gint hf_dnsserver_DnssrvQuery2_setting_flags = -1;
-static gint hf_dnsserver_DnssrvQuery2_server_name = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_CACHE_DATA = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_TtlSeconds = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecursionTimeout = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_UNION_NodeName = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_Flags = -1;
+static gint hf_dnsserver_DNSSRV_RPC_UNION_dword = -1;
+static gint hf_dnsserver_DNS_RPC_PROTOCOLS_DNS_RPC_USE_TCPIP = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserve_array = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AutoCacheUpdate = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ScavengingInterval = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForestDirectoryPartition = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DomainDirectoryPartition = -1;
+static gint hf_dnsserver_DNSSRV_RPC_UNION_ServerInfoDotnet = -1;
+static gint hf_dnsserver_DNS_RPC_VERSION_ServicePackVersion = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AUTH_ZONE_ROOT = -1;
 static gint hf_dnsserver_status = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension1 = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultRefreshInterval = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_UDP = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_NODE_NAME_Name = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_Serial = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFileMaxSize = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_UNION_NodeName = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_SEND = -1;
-static gint hf_dnsserver_DNS_RPC_NAME_name = -1;
-static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_AUTHORITY_DATA = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_ANSWERS = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_UPDATE = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_RecordCount = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LocalNetPriorityNetmask = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_node_name = -1;
-static gint hf_dnsserver_DnssrvQuery2_client_version = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_Forwarders = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_BindSecondaries = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_start_child = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension3 = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_record_buffer = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_NodeName = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ListenAddrs = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserve_array2 = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_FULL_PACKETS = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_filter_start = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsAvailable = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_TCP = -1;
+static gint hf_dnsserver_DnssrvQuery2_type_id = -1;
 static gint hf_dnsserver_DnssrvEnumRecords2_client_version = -1;
-static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_CACHE_DATA = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_MaxCacheTtl = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_Serial = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DebugLevel = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_TimeStamp = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ServerName = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_server_name = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_Flags = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_DataLength = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RpcProtocol = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_RecordCount = -1;
 static gint hf_dnsserver_DNS_RPC_PROTOCOLS_DNS_RPC_USE_LPC = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_Version = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_select_flag = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_STICKY = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_reserved = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFilter = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsDsaVersion = -1;
-static gint hf_dnsserver_DNSSRV_RPC_UNION_dword = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsDomainVersion = -1;
 static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_RECV = -1;
-static gint hf_dnsserver_DNS_RPC_PROTOCOLS_DNS_RPC_USE_TCPIP = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LooseWildcarding = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension5 = -1;
 static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECORD_CREATE_PTR = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_ROOT = -1;
-static gint hf_dnsserver_DNS_RECORD_BUFFER_rpc_node = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultNoRefreshInterval = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_COMPLETE = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsForestVersion = -1;
-static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ADDITIONAL_DATA = -1;
-static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ONLY_CHILDREN = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AdminConfigured = -1;
-static gint hf_dnsserver_DNS_RPC_VERSION_OSMinorVersion = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AllowUpdate = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RoundRobin = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_WRITE_THROUGH = -1;
-static gint hf_dnsserver_DnssrvQuery2_zone = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_Type = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_EventLogLevel = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LocalNetPriority = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsPollingInterval = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECOR_DEFAULT_TTL = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_StrictFileParsing = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_SUPPRESS_NOTIFY = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_WriteAuthorityNs = -1;
-static gint hf_dnsserver_opnum = -1;
 static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECORD_TTL_CHANGE = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AutoReverseZones = -1;
-static gint hf_dnsserver_DnssrvQuery2_type_id = -1;
-static gint hf_dnsserver_DnssrvQuery2_operation = -1;
-static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_NO_CHILDREN = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForwardTimeout = -1;
-static gint hf_dnsserver_DnssrvEnumRecords2_record_buffer_ = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_NameCheckFlag = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RpcProtocol = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DomainName = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsContainer = -1;
-static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_NOTIFY = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForestName = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFilePath = -1;
+static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ROOT_HINT_DATA = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension4 = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_StrictFileParsing = -1;
 static gint hf_dnsserver_DNS_RPC_NODE_Length = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AUTH_ZONE_ROOT = -1;
-static gint hf_dnsserver_DNS_RPC_VERSION_ServicePackVersion = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_FULL_PACKETS = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_ANSWERS = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LooseWildcarding = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_UDP = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUESTIONS = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AddressAnswerLimit = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogLevel = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_DELEGATION = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension4 = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFilePath = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RpcStructureVersion = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserved0 = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_Flags = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LocalNetPriority = -1;
+static gint hf_dnsserver_IP4_ARRAY_AddrArray = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_COMPLETE = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFilter = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_STICKY = -1;
 static gint hf_dnsserver_DnssrvEnumRecords2_zone = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_Flags = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension2 = -1;
 static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AGING_ON = -1;
-static gint hf_dnsserver_IP4_ARRAY_AddrArray = -1;
-static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_OPEN_ACL = -1;
-static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ROOT_HINT_DATA = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_TtlSeconds = -1;
+static gint hf_dnsserver_DNS_RPC_NAME_name = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AllowUpdate = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LocalNetPriorityNetmask = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsForestVersion = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ServerName = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_BindSecondaries = -1;
+static gint hf_dnsserver_DnssrvQuery2_setting_flags = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECOR_DEFAULT_TTL = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_NODE_NAME_Name = -1;
+static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_NO_CHILDREN = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsPollingInterval = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_Childcount = -1;
+static gint hf_dnsserver_DNS_RECORD_BUFFER_rpc_node = -1;
 static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_GLUE_DATA = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ServerAddrs = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_setting_flags = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUERY = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_EventLogLevel = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecursionRetry = -1;
+static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_AUTHORITY_DATA = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_UPDATE = -1;
 static gint hf_dnsserver_IP4_ARRAY_AddrCount = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsDsaVersion = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LastScavengeTime = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_filter_start = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_OPEN_ACL = -1;
+static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_CACHE_DATA = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension0 = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForestName = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_TimeStamp = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ServerAddrs = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_record = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension1 = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_Forwarders = -1;
+static gint hf_dnsserver_DnssrvQuery2_data = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_NameCheckFlag = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForwardTimeout = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_records = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_DELEGATION = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ScavengingInterval = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogLevel = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_ROOT = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_Version = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_SecureResponses = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_buffer_length = -1;
+static gint hf_dnsserver_DnssrvQuery2_operation = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFileMaxSize = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_record_buffer_ = -1;
+static gint hf_dnsserver_DnssrvQuery2_zone = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_select_flag = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_start_child = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_server_name = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_SEND = -1;
+static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ONLY_CHILDREN = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_record_buffer = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RoundRobin = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_NodeName = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DomainDirectoryPartition = -1;
+static gint hf_dnsserver_DNSSRV_RPC_UNION_null = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultNoRefreshInterval = -1;
+static gint hf_dnsserver_DNS_RPC_NAME_NameLength = -1;
+static gint hf_dnsserver_DNS_RPC_VERSION_OSMinorVersion = -1;
+static gint hf_dnsserver_DnssrvQuery2_client_version = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_CACHE_DATA = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecursionTimeout = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForestDirectoryPartition = -1;
 static gint hf_dnsserver_DnssrvEnumRecords2_record_type = -1;
-static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsDomainVersion = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultRefreshInterval = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserve_array2 = -1;
+static gint hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_SUPPRESS_NOTIFY = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension2 = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_NoRecursion = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_BootMethod = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AutoCacheUpdate = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_NOTIFY = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsContainer = -1;
+static gint hf_dnsserver_DNS_RPC_VERSION_OSMajorVersion = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultAgingState = -1;
-static gint hf_dnsserver_DNS_RPC_NAME_Name = -1;
-static gint hf_dnsserver_DnssrvQuery2_data = -1;
-static gint hf_dnsserver_DNS_RPC_RECORD_record = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension3 = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DomainName = -1;
+static gint hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_WRITE_THROUGH = -1;
+static gint hf_dnsserver_opnum = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AutoReverseZones = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_Type = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_WriteAuthorityNs = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RpcStructureVersion = -1;
 static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForwardDelegations = -1;
+static gint hf_dnsserver_DnssrvQuery2_server_name = -1;
+static gint hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ADDITIONAL_DATA = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_node_name = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ListenAddrs = -1;
 static gint hf_dnsserver_DNS_RPC_PROTOCOLS_DNS_RPC_USE_NAMED_PIPE = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecurseAfterForwarding = -1;
+static gint hf_dnsserver_DNS_RPC_NAME_Name = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AdminConfigured = -1;
+static gint hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserved0 = -1;
+static gint hf_dnsserver_DnssrvEnumRecords2_filter_stop = -1;
+static gint hf_dnsserver_DNS_RPC_RECORD_reserved = -1;
 
 static gint proto_dcerpc_dnsserver = -1;
 /* Version information */
@@ -1331,8 +1331,7 @@ dnsserver_dissect_DNS_RPC_RECORD_UNION(tvbuff_t *tvb _U_, int offset _U_, packet
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "DNS_RPC_RECORD_UNION");
-		tree = proto_item_add_subtree(item, ett_dnsserver_DNS_RPC_RECORD_UNION);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_dnsserver_DNS_RPC_RECORD_UNION, &item, "DNS_RPC_RECORD_UNION");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -1626,7 +1625,7 @@ dnsserver_dissect_struct_IP4_ARRAY(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 /* IDL: 	uint8 AllowUpdate; */
 /* IDL: 	uint8 DsAvailable; */
 /* IDL: 	[unique(1)] uint8 *ServerName; */
-/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *DsContainer; */
+/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *DsContainer; */
 /* IDL: 	[unique(1)] IP4_ARRAY *ServerAddrs; */
 /* IDL: 	[unique(1)] IP4_ARRAY *ListenAddrs; */
 /* IDL: 	[unique(1)] IP4_ARRAY *Forwarders; */
@@ -2611,8 +2610,7 @@ dnsserver_dissect_DNSSRV_RPC_UNION(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "DNSSRV_RPC_UNION");
-		tree = proto_item_add_subtree(item, ett_dnsserver_DNSSRV_RPC_UNION);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_dnsserver_DNSSRV_RPC_UNION, &item, "DNSSRV_RPC_UNION");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -2937,10 +2935,10 @@ dnsserver_dissect_element_DnssrvQuery2_data_(tvbuff_t *tvb _U_, int offset _U_,
 /* IDL: [in] DNS_RPC_CLIENT_VERSION client_version, */
 /* IDL: [in] uint32 setting_flags, */
 /* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *server_name, */
-/* IDL: [in] [unique(1)] uint8 *zone, */
-/* IDL: [unique(1)] [in] uint8 *operation, */
+/* IDL: [unique(1)] [in] uint8 *zone, */
+/* IDL: [in] [unique(1)] uint8 *operation, */
 /* IDL: [out] [ref] DnssrvRpcTypeId *type_id, */
-/* IDL: [switch_is(*type_id)] [ref] [out] DNSSRV_RPC_UNION *data */
+/* IDL: [ref] [out] [switch_is(*type_id)] DNSSRV_RPC_UNION *data */
 /* IDL: ); */
 
 static int
@@ -3206,16 +3204,16 @@ dnsserver_dissect_element_DnssrvEnumRecords2_record_buffer__(tvbuff_t *tvb _U_,
 /* IDL: NTSTATUS DnssrvEnumRecords2( */
 /* IDL: [in] DNS_RPC_CLIENT_VERSION client_version, */
 /* IDL: [in] uint32 setting_flags, */
-/* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *server_name, */
-/* IDL: [unique(1)] [in] uint8 *zone, */
-/* IDL: [in] [unique(1)] uint8 *node_name, */
+/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *server_name, */
+/* IDL: [in] [unique(1)] uint8 *zone, */
+/* IDL: [unique(1)] [in] uint8 *node_name, */
 /* IDL: [in] [unique(1)] uint8 *start_child, */
 /* IDL: [in] DNS_RECORD_TYPE record_type, */
 /* IDL: [in] DNS_SELECT_FLAGS select_flag, */
-/* IDL: [unique(1)] [in] uint8 *filter_start, */
+/* IDL: [in] [unique(1)] uint8 *filter_start, */
 /* IDL: [unique(1)] [in] uint8 *filter_stop, */
 /* IDL: [out] [ref] uint32 *buffer_length, */
-/* IDL: [unique(1)] [out] [subcontext(4)] DNS_RPC_NODE *record_buffer */
+/* IDL: [out] [unique(1)] [subcontext(4)] DNS_RPC_NODE *record_buffer */
 /* IDL: ); */
 
 static int
@@ -3318,290 +3316,290 @@ static dcerpc_sub_dissector dnsserver_dissectors[] = {
 void proto_register_dcerpc_dnsserver(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_dnsserver_DNS_RPC_NAME_NameLength,
-	  { "Namelength", "dnsserver.DNS_RPC_NAME.NameLength", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_Childcount,
-	  { "Childcount", "dnsserver.DNS_RPC_NODE.Childcount", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_VERSION_OSMajorVersion,
-	  { "Osmajorversion", "dnsserver.DNS_RPC_VERSION.OSMajorVersion", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUESTIONS,
-	  { "Dns Log Level Questions", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_QUESTIONS", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUESTIONS_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_NoRecursion,
-	  { "Norecursion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.NoRecursion", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_MaxCacheTtl,
-	  { "Maxcachettl", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.MaxCacheTtl", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension5,
-	  { "Extension5", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension5", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUERY,
-	  { "Dns Log Level Query", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_QUERY", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUERY_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_TCP,
-	  { "Dns Log Level Tcp", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_TCP", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_TCP_tfs), ( 0x00008000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_filter_stop,
-	  { "Filter Stop", "dnsserver.DnssrvEnumRecords2.filter_stop", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_buffer_length,
-	  { "Buffer Length", "dnsserver.DnssrvEnumRecords2.buffer_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNSSRV_RPC_UNION_ServerInfoDotnet,
-	  { "Serverinfodotnet", "dnsserver.DNSSRV_RPC_UNION.ServerInfoDotnet", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_DataLength,
-	  { "Datalength", "dnsserver.DNS_RPC_RECORD.DataLength", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_BootMethod,
-	  { "Bootmethod", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.BootMethod", FT_UINT8, BASE_DEC, VALS(dnsserver_DNS_RPC_BOOT_METHOD_vals), 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_setting_flags,
-	  { "Setting Flags", "dnsserver.DnssrvEnumRecords2.setting_flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_records,
-	  { "Records", "dnsserver.DNS_RPC_NODE.records", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNSSRV_RPC_UNION_null,
-	  { "Null", "dnsserver.DNSSRV_RPC_UNION.null", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecurseAfterForwarding,
-	  { "Recurseafterforwarding", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RecurseAfterForwarding", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension0,
-	  { "Extension0", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension0", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvQuery2_setting_flags,
-	  { "Setting Flags", "dnsserver.DnssrvQuery2.setting_flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvQuery2_server_name,
-	  { "Server Name", "dnsserver.DnssrvQuery2.server_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_CACHE_DATA,
-	  { "Dns Rpc Flag Cache Data", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_CACHE_DATA", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_CACHE_DATA_tfs), ( 0x80000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_TtlSeconds,
-	  { "Ttlseconds", "dnsserver.DNS_RPC_RECORD.TtlSeconds", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecursionTimeout,
-	  { "Recursiontimeout", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RecursionTimeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_UNION_NodeName,
+		{ "Nodename", "dnsserver.DNS_RPC_RECORD_UNION.NodeName", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_Flags,
+		{ "Flags", "dnsserver.DNS_RPC_RECORD.Flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNSSRV_RPC_UNION_dword,
+		{ "Dword", "dnsserver.DNSSRV_RPC_UNION.dword", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_PROTOCOLS_DNS_RPC_USE_TCPIP,
+		{ "Dns Rpc Use Tcpip", "dnsserver.DNS_RPC_PROTOCOLS.DNS_RPC_USE_TCPIP", FT_BOOLEAN, 32, TFS(&DNS_RPC_PROTOCOLS_DNS_RPC_USE_TCPIP_tfs), ( 0x00000001 ), NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserve_array,
-	  { "Reserve Array", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.reserve_array", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AutoCacheUpdate,
-	  { "Autocacheupdate", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AutoCacheUpdate", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ScavengingInterval,
-	  { "Scavenginginterval", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ScavengingInterval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForestDirectoryPartition,
-	  { "Forestdirectorypartition", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ForestDirectoryPartition", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DomainDirectoryPartition,
-	  { "Domaindirectorypartition", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DomainDirectoryPartition", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Reserve Array", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.reserve_array", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNSSRV_RPC_UNION_ServerInfoDotnet,
+		{ "Serverinfodotnet", "dnsserver.DNSSRV_RPC_UNION.ServerInfoDotnet", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_VERSION_ServicePackVersion,
+		{ "Servicepackversion", "dnsserver.DNS_RPC_VERSION.ServicePackVersion", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AUTH_ZONE_ROOT,
+		{ "Dns Rpc Flag Auth Zone Root", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_AUTH_ZONE_ROOT", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AUTH_ZONE_ROOT_tfs), ( 0x20000000 ), NULL, HFILL }},
 	{ &hf_dnsserver_status,
-	  { "NT Error", "dnsserver.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension1,
-	  { "Extension1", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension1", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultRefreshInterval,
-	  { "Defaultrefreshinterval", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DefaultRefreshInterval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_UDP,
-	  { "Dns Log Level Udp", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_UDP", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_UDP_tfs), ( 0x00004000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_NODE_NAME_Name,
-	  { "Name", "dnsserver.DNS_RPC_RECORD_NODE_NAME.Name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_Serial,
-	  { "Serial", "dnsserver.DNS_RPC_RECORD.Serial", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFileMaxSize,
-	  { "Logfilemaxsize", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LogFileMaxSize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_UNION_NodeName,
-	  { "Nodename", "dnsserver.DNS_RPC_RECORD_UNION.NodeName", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_SEND,
-	  { "Dns Log Level Send", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_SEND", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_SEND_tfs), ( 0x00001000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NAME_name,
-	  { "Name", "dnsserver.DNS_RPC_NAME.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_AUTHORITY_DATA,
-	  { "Dns Rpc View Authority Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_AUTHORITY_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_AUTHORITY_DATA_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_ANSWERS,
-	  { "Dns Log Level Answers", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_ANSWERS", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_ANSWERS_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_UPDATE,
-	  { "Dns Log Level Update", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_UPDATE", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_UPDATE_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_RecordCount,
-	  { "Recordcount", "dnsserver.DNS_RPC_NODE.RecordCount", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LocalNetPriorityNetmask,
-	  { "Localnetprioritynetmask", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LocalNetPriorityNetmask", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_node_name,
-	  { "Node Name", "dnsserver.DnssrvEnumRecords2.node_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvQuery2_client_version,
-	  { "Client Version", "dnsserver.DnssrvQuery2.client_version", FT_UINT32, BASE_DEC, VALS(dnsserver_DNS_RPC_CLIENT_VERSION_vals), 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_Forwarders,
-	  { "Forwarders", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.Forwarders", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_BindSecondaries,
-	  { "Bindsecondaries", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.BindSecondaries", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_start_child,
-	  { "Start Child", "dnsserver.DnssrvEnumRecords2.start_child", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension3,
-	  { "Extension3", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension3", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_record_buffer,
-	  { "Record Buffer", "dnsserver.DnssrvEnumRecords2.record_buffer", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_NodeName,
-	  { "Nodename", "dnsserver.DNS_RPC_NODE.NodeName", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ListenAddrs,
-	  { "Listenaddrs", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ListenAddrs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserve_array2,
-	  { "Reserve Array2", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.reserve_array2", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_FULL_PACKETS,
-	  { "Dns Log Level Full Packets", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_FULL_PACKETS", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_FULL_PACKETS_tfs), ( 0x01000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_filter_start,
-	  { "Filter Start", "dnsserver.DnssrvEnumRecords2.filter_start", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "NT Error", "dnsserver.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsAvailable,
-	  { "Dsavailable", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsAvailable", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Dsavailable", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsAvailable", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_TCP,
+		{ "Dns Log Level Tcp", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_TCP", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_TCP_tfs), ( 0x00008000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvQuery2_type_id,
+		{ "Type Id", "dnsserver.DnssrvQuery2.type_id", FT_UINT32, BASE_DEC, VALS(dnsserver_DnssrvRpcTypeId_vals), 0, NULL, HFILL }},
 	{ &hf_dnsserver_DnssrvEnumRecords2_client_version,
-	  { "Client Version", "dnsserver.DnssrvEnumRecords2.client_version", FT_UINT32, BASE_DEC, VALS(dnsserver_DNS_RPC_CLIENT_VERSION_vals), 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_CACHE_DATA,
-	  { "Dns Rpc View Cache Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_CACHE_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_CACHE_DATA_tfs), ( 0x00000002 ), NULL, HFILL }},
+		{ "Client Version", "dnsserver.DnssrvEnumRecords2.client_version", FT_UINT32, BASE_DEC, VALS(dnsserver_DNS_RPC_CLIENT_VERSION_vals), 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_MaxCacheTtl,
+		{ "Maxcachettl", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.MaxCacheTtl", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_Serial,
+		{ "Serial", "dnsserver.DNS_RPC_RECORD.Serial", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DebugLevel,
-	  { "Debuglevel", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DebugLevel", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_TimeStamp,
-	  { "Timestamp", "dnsserver.DNS_RPC_RECORD.TimeStamp", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ServerName,
-	  { "Servername", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ServerName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_server_name,
-	  { "Server Name", "dnsserver.DnssrvEnumRecords2.server_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Debuglevel", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DebugLevel", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_Flags,
+		{ "Flags", "dnsserver.DNS_RPC_NODE.Flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_DataLength,
+		{ "Datalength", "dnsserver.DNS_RPC_RECORD.DataLength", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RpcProtocol,
+		{ "Rpcprotocol", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RpcProtocol", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_RecordCount,
+		{ "Recordcount", "dnsserver.DNS_RPC_NODE.RecordCount", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_PROTOCOLS_DNS_RPC_USE_LPC,
-	  { "Dns Rpc Use Lpc", "dnsserver.DNS_RPC_PROTOCOLS.DNS_RPC_USE_LPC", FT_BOOLEAN, 32, TFS(&DNS_RPC_PROTOCOLS_DNS_RPC_USE_LPC_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_Version,
-	  { "Version", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.Version", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_select_flag,
-	  { "Select Flag", "dnsserver.DnssrvEnumRecords2.select_flag", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_STICKY,
-	  { "Dns Rpc Flag Node Sticky", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_NODE_STICKY", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_STICKY_tfs), ( 0x01000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_reserved,
-	  { "Reserved", "dnsserver.DNS_RPC_RECORD.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFilter,
-	  { "Logfilter", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LogFilter", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsDsaVersion,
-	  { "Dsdsaversion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsDsaVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNSSRV_RPC_UNION_dword,
-	  { "Dword", "dnsserver.DNSSRV_RPC_UNION.dword", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Dns Rpc Use Lpc", "dnsserver.DNS_RPC_PROTOCOLS.DNS_RPC_USE_LPC", FT_BOOLEAN, 32, TFS(&DNS_RPC_PROTOCOLS_DNS_RPC_USE_LPC_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsDomainVersion,
+		{ "Dsdomainversion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsDomainVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_RECV,
-	  { "Dns Log Level Recv", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_RECV", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_RECV_tfs), ( 0x00002000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_PROTOCOLS_DNS_RPC_USE_TCPIP,
-	  { "Dns Rpc Use Tcpip", "dnsserver.DNS_RPC_PROTOCOLS.DNS_RPC_USE_TCPIP", FT_BOOLEAN, 32, TFS(&DNS_RPC_PROTOCOLS_DNS_RPC_USE_TCPIP_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LooseWildcarding,
-	  { "Loosewildcarding", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LooseWildcarding", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Dns Log Level Recv", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_RECV", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_RECV_tfs), ( 0x00002000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension5,
+		{ "Extension5", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension5", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECORD_CREATE_PTR,
-	  { "Dns Rpc Flag Record Create Ptr", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_RECORD_CREATE_PTR", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECORD_CREATE_PTR_tfs), ( 0x02000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_ROOT,
-	  { "Dns Rpc Flag Zone Root", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_ZONE_ROOT", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_ROOT_tfs), ( 0x40000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RECORD_BUFFER_rpc_node,
-	  { "Rpc Node", "dnsserver.DNS_RECORD_BUFFER.rpc_node", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultNoRefreshInterval,
-	  { "Defaultnorefreshinterval", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DefaultNoRefreshInterval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_COMPLETE,
-	  { "Dns Rpc Flag Node Complete", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_NODE_COMPLETE", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_COMPLETE_tfs), ( 0x00800000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsForestVersion,
-	  { "Dsforestversion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsForestVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ADDITIONAL_DATA,
-	  { "Dns Rpc View Additional Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_ADDITIONAL_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_ADDITIONAL_DATA_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ONLY_CHILDREN,
-	  { "Dns Rpc View Only Children", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_ONLY_CHILDREN", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_ONLY_CHILDREN_tfs), ( 0x00020000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AdminConfigured,
-	  { "Adminconfigured", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AdminConfigured", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_VERSION_OSMinorVersion,
-	  { "Osminorversion", "dnsserver.DNS_RPC_VERSION.OSMinorVersion", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AllowUpdate,
-	  { "Allowupdate", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AllowUpdate", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RoundRobin,
-	  { "Roundrobin", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RoundRobin", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_WRITE_THROUGH,
-	  { "Dns Log Level Write Through", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_WRITE_THROUGH", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_WRITE_THROUGH_tfs), ( 0x80000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvQuery2_zone,
-	  { "Zone", "dnsserver.DnssrvQuery2.zone", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_Type,
-	  { "Type", "dnsserver.DNS_RPC_RECORD.Type", FT_UINT16, BASE_DEC, VALS(dnsserver_DNS_RECORD_TYPE_vals), 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_EventLogLevel,
-	  { "Eventloglevel", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.EventLogLevel", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LocalNetPriority,
-	  { "Localnetpriority", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LocalNetPriority", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsPollingInterval,
-	  { "Dspollinginterval", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsPollingInterval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECOR_DEFAULT_TTL,
-	  { "Dns Rpc Flag Recor Default Ttl", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_RECOR_DEFAULT_TTL", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECOR_DEFAULT_TTL_tfs), ( 0x08000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_StrictFileParsing,
-	  { "Strictfileparsing", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.StrictFileParsing", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_SUPPRESS_NOTIFY,
-	  { "Dns Rpc Flag Suppress Notify", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_SUPPRESS_NOTIFY", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_SUPPRESS_NOTIFY_tfs), ( 0x00010000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_WriteAuthorityNs,
-	  { "Writeauthorityns", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.WriteAuthorityNs", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_opnum,
-	  { "Operation", "dnsserver.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Dns Rpc Flag Record Create Ptr", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_RECORD_CREATE_PTR", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECORD_CREATE_PTR_tfs), ( 0x02000000 ), NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECORD_TTL_CHANGE,
-	  { "Dns Rpc Flag Record Ttl Change", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_RECORD_TTL_CHANGE", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECORD_TTL_CHANGE_tfs), ( 0x04000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AutoReverseZones,
-	  { "Autoreversezones", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AutoReverseZones", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvQuery2_type_id,
-	  { "Type Id", "dnsserver.DnssrvQuery2.type_id", FT_UINT32, BASE_DEC, VALS(dnsserver_DnssrvRpcTypeId_vals), 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvQuery2_operation,
-	  { "Operation", "dnsserver.DnssrvQuery2.operation", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_NO_CHILDREN,
-	  { "Dns Rpc View No Children", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_NO_CHILDREN", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_NO_CHILDREN_tfs), ( 0x00010000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForwardTimeout,
-	  { "Forwardtimeout", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ForwardTimeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvEnumRecords2_record_buffer_,
-	  { "Subcontext length", "dnsserver.DnssrvEnumRecords2.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_NameCheckFlag,
-	  { "Namecheckflag", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.NameCheckFlag", FT_UINT32, BASE_DEC, VALS(dnsserver_DNS_NAME_CHECK_FLAGS_vals), 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RpcProtocol,
-	  { "Rpcprotocol", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RpcProtocol", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DomainName,
-	  { "Domainname", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DomainName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsContainer,
-	  { "Dscontainer", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsContainer", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_NOTIFY,
-	  { "Dns Log Level Notify", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_NOTIFY", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_NOTIFY_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForestName,
-	  { "Forestname", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ForestName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Dns Rpc Flag Record Ttl Change", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_RECORD_TTL_CHANGE", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECORD_TTL_CHANGE_tfs), ( 0x04000000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFilePath,
+		{ "Logfilepath", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LogFilePath", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ROOT_HINT_DATA,
+		{ "Dns Rpc View Root Hint Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_ROOT_HINT_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_ROOT_HINT_DATA_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension4,
+		{ "Extension4", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension4", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_StrictFileParsing,
+		{ "Strictfileparsing", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.StrictFileParsing", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_NODE_Length,
-	  { "Length", "dnsserver.DNS_RPC_NODE.Length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AUTH_ZONE_ROOT,
-	  { "Dns Rpc Flag Auth Zone Root", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_AUTH_ZONE_ROOT", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AUTH_ZONE_ROOT_tfs), ( 0x20000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_VERSION_ServicePackVersion,
-	  { "Servicepackversion", "dnsserver.DNS_RPC_VERSION.ServicePackVersion", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Length", "dnsserver.DNS_RPC_NODE.Length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_FULL_PACKETS,
+		{ "Dns Log Level Full Packets", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_FULL_PACKETS", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_FULL_PACKETS_tfs), ( 0x01000000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_ANSWERS,
+		{ "Dns Log Level Answers", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_ANSWERS", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_ANSWERS_tfs), ( 0x00000200 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LooseWildcarding,
+		{ "Loosewildcarding", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LooseWildcarding", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_UDP,
+		{ "Dns Log Level Udp", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_UDP", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_UDP_tfs), ( 0x00004000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUESTIONS,
+		{ "Dns Log Level Questions", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_QUESTIONS", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUESTIONS_tfs), ( 0x00000100 ), NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AddressAnswerLimit,
-	  { "Addressanswerlimit", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AddressAnswerLimit", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogLevel,
-	  { "Loglevel", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LogLevel", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_DELEGATION,
-	  { "Dns Rpc Flag Zone Delegation", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_ZONE_DELEGATION", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_DELEGATION_tfs), ( 0x10000000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension4,
-	  { "Extension4", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension4", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFilePath,
-	  { "Logfilepath", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LogFilePath", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RpcStructureVersion,
-	  { "Rpcstructureversion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RpcStructureVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserved0,
-	  { "Reserved0", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.reserved0", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_Flags,
-	  { "Flags", "dnsserver.DNS_RPC_NODE.Flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Addressanswerlimit", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AddressAnswerLimit", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LocalNetPriority,
+		{ "Localnetpriority", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LocalNetPriority", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_IP4_ARRAY_AddrArray,
+		{ "Addrarray", "dnsserver.IP4_ARRAY.AddrArray", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_COMPLETE,
+		{ "Dns Rpc Flag Node Complete", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_NODE_COMPLETE", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_COMPLETE_tfs), ( 0x00800000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFilter,
+		{ "Logfilter", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LogFilter", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_STICKY,
+		{ "Dns Rpc Flag Node Sticky", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_NODE_STICKY", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_NODE_STICKY_tfs), ( 0x01000000 ), NULL, HFILL }},
 	{ &hf_dnsserver_DnssrvEnumRecords2_zone,
-	  { "Zone", "dnsserver.DnssrvEnumRecords2.zone", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_Flags,
-	  { "Flags", "dnsserver.DNS_RPC_RECORD.Flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension2,
-	  { "Extension2", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Zone", "dnsserver.DnssrvEnumRecords2.zone", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AGING_ON,
-	  { "Dns Rpc Flag Aging On", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_AGING_ON", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AGING_ON_tfs), ( 0x00020000 ), NULL, HFILL }},
-	{ &hf_dnsserver_IP4_ARRAY_AddrArray,
-	  { "Addrarray", "dnsserver.IP4_ARRAY.AddrArray", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_OPEN_ACL,
-	  { "Dns Rpc Flag Open Acl", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_OPEN_ACL", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_OPEN_ACL_tfs), ( 0x00040000 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ROOT_HINT_DATA,
-	  { "Dns Rpc View Root Hint Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_ROOT_HINT_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_ROOT_HINT_DATA_tfs), ( 0x00000008 ), NULL, HFILL }},
+		{ "Dns Rpc Flag Aging On", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_AGING_ON", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_AGING_ON_tfs), ( 0x00020000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_TtlSeconds,
+		{ "Ttlseconds", "dnsserver.DNS_RPC_RECORD.TtlSeconds", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NAME_name,
+		{ "Name", "dnsserver.DNS_RPC_NAME.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AllowUpdate,
+		{ "Allowupdate", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AllowUpdate", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LocalNetPriorityNetmask,
+		{ "Localnetprioritynetmask", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LocalNetPriorityNetmask", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsForestVersion,
+		{ "Dsforestversion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsForestVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ServerName,
+		{ "Servername", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ServerName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_BindSecondaries,
+		{ "Bindsecondaries", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.BindSecondaries", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvQuery2_setting_flags,
+		{ "Setting Flags", "dnsserver.DnssrvQuery2.setting_flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECOR_DEFAULT_TTL,
+		{ "Dns Rpc Flag Recor Default Ttl", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_RECOR_DEFAULT_TTL", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_RECOR_DEFAULT_TTL_tfs), ( 0x08000000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_NODE_NAME_Name,
+		{ "Name", "dnsserver.DNS_RPC_RECORD_NODE_NAME.Name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_NO_CHILDREN,
+		{ "Dns Rpc View No Children", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_NO_CHILDREN", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_NO_CHILDREN_tfs), ( 0x00010000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsPollingInterval,
+		{ "Dspollinginterval", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsPollingInterval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_Childcount,
+		{ "Childcount", "dnsserver.DNS_RPC_NODE.Childcount", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RECORD_BUFFER_rpc_node,
+		{ "Rpc Node", "dnsserver.DNS_RECORD_BUFFER.rpc_node", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_GLUE_DATA,
-	  { "Dns Rpc View Glue Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_GLUE_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_GLUE_DATA_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ServerAddrs,
-	  { "Serveraddrs", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ServerAddrs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Dns Rpc View Glue Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_GLUE_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_GLUE_DATA_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_setting_flags,
+		{ "Setting Flags", "dnsserver.DnssrvEnumRecords2.setting_flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUERY,
+		{ "Dns Log Level Query", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_QUERY", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_QUERY_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_EventLogLevel,
+		{ "Eventloglevel", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.EventLogLevel", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecursionRetry,
-	  { "Recursionretry", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RecursionRetry", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Recursionretry", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RecursionRetry", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_AUTHORITY_DATA,
+		{ "Dns Rpc View Authority Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_AUTHORITY_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_AUTHORITY_DATA_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_UPDATE,
+		{ "Dns Log Level Update", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_UPDATE", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_UPDATE_tfs), ( 0x00000020 ), NULL, HFILL }},
 	{ &hf_dnsserver_IP4_ARRAY_AddrCount,
-	  { "Addrcount", "dnsserver.IP4_ARRAY.AddrCount", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Addrcount", "dnsserver.IP4_ARRAY.AddrCount", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsDsaVersion,
+		{ "Dsdsaversion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsDsaVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LastScavengeTime,
-	  { "Lastscavengetime", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LastScavengeTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Lastscavengetime", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LastScavengeTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_filter_start,
+		{ "Filter Start", "dnsserver.DnssrvEnumRecords2.filter_start", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_OPEN_ACL,
+		{ "Dns Rpc Flag Open Acl", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_OPEN_ACL", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_OPEN_ACL_tfs), ( 0x00040000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_CACHE_DATA,
+		{ "Dns Rpc View Cache Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_CACHE_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_CACHE_DATA_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension0,
+		{ "Extension0", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension0", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForestName,
+		{ "Forestname", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ForestName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_TimeStamp,
+		{ "Timestamp", "dnsserver.DNS_RPC_RECORD.TimeStamp", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ServerAddrs,
+		{ "Serveraddrs", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ServerAddrs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_record,
+		{ "Record", "dnsserver.DNS_RPC_RECORD.record", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension1,
+		{ "Extension1", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension1", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_Forwarders,
+		{ "Forwarders", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.Forwarders", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvQuery2_data,
+		{ "Data", "dnsserver.DnssrvQuery2.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_NameCheckFlag,
+		{ "Namecheckflag", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.NameCheckFlag", FT_UINT32, BASE_DEC, VALS(dnsserver_DNS_NAME_CHECK_FLAGS_vals), 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForwardTimeout,
+		{ "Forwardtimeout", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ForwardTimeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_records,
+		{ "Records", "dnsserver.DNS_RPC_NODE.records", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_DELEGATION,
+		{ "Dns Rpc Flag Zone Delegation", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_ZONE_DELEGATION", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_DELEGATION_tfs), ( 0x10000000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ScavengingInterval,
+		{ "Scavenginginterval", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ScavengingInterval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogLevel,
+		{ "Loglevel", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LogLevel", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_ROOT,
+		{ "Dns Rpc Flag Zone Root", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_ZONE_ROOT", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_ZONE_ROOT_tfs), ( 0x40000000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_Version,
+		{ "Version", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.Version", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_SecureResponses,
-	  { "Secureresponses", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.SecureResponses", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Secureresponses", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.SecureResponses", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_buffer_length,
+		{ "Buffer Length", "dnsserver.DnssrvEnumRecords2.buffer_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvQuery2_operation,
+		{ "Operation", "dnsserver.DnssrvQuery2.operation", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_LogFileMaxSize,
+		{ "Logfilemaxsize", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.LogFileMaxSize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_record_buffer_,
+		{ "Subcontext length", "dnsserver.DnssrvEnumRecords2.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvQuery2_zone,
+		{ "Zone", "dnsserver.DnssrvQuery2.zone", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_select_flag,
+		{ "Select Flag", "dnsserver.DnssrvEnumRecords2.select_flag", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_start_child,
+		{ "Start Child", "dnsserver.DnssrvEnumRecords2.start_child", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_server_name,
+		{ "Server Name", "dnsserver.DnssrvEnumRecords2.server_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_SEND,
+		{ "Dns Log Level Send", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_SEND", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_SEND_tfs), ( 0x00001000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ONLY_CHILDREN,
+		{ "Dns Rpc View Only Children", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_ONLY_CHILDREN", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_ONLY_CHILDREN_tfs), ( 0x00020000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_record_buffer,
+		{ "Record Buffer", "dnsserver.DnssrvEnumRecords2.record_buffer", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RoundRobin,
+		{ "Roundrobin", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RoundRobin", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_NodeName,
+		{ "Nodename", "dnsserver.DNS_RPC_NODE.NodeName", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DomainDirectoryPartition,
+		{ "Domaindirectorypartition", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DomainDirectoryPartition", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNSSRV_RPC_UNION_null,
+		{ "Null", "dnsserver.DNSSRV_RPC_UNION.null", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultNoRefreshInterval,
+		{ "Defaultnorefreshinterval", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DefaultNoRefreshInterval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NAME_NameLength,
+		{ "Namelength", "dnsserver.DNS_RPC_NAME.NameLength", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_VERSION_OSMinorVersion,
+		{ "Osminorversion", "dnsserver.DNS_RPC_VERSION.OSMinorVersion", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvQuery2_client_version,
+		{ "Client Version", "dnsserver.DnssrvQuery2.client_version", FT_UINT32, BASE_DEC, VALS(dnsserver_DNS_RPC_CLIENT_VERSION_vals), 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_CACHE_DATA,
+		{ "Dns Rpc Flag Cache Data", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_CACHE_DATA", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_CACHE_DATA_tfs), ( 0x80000000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecursionTimeout,
+		{ "Recursiontimeout", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RecursionTimeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForestDirectoryPartition,
+		{ "Forestdirectorypartition", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ForestDirectoryPartition", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DnssrvEnumRecords2_record_type,
-	  { "Record Type", "dnsserver.DnssrvEnumRecords2.record_type", FT_UINT16, BASE_DEC, VALS(dnsserver_DNS_RECORD_TYPE_vals), 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsDomainVersion,
-	  { "Dsdomainversion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsDomainVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Record Type", "dnsserver.DnssrvEnumRecords2.record_type", FT_UINT16, BASE_DEC, VALS(dnsserver_DNS_RECORD_TYPE_vals), 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultRefreshInterval,
+		{ "Defaultrefreshinterval", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DefaultRefreshInterval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserve_array2,
+		{ "Reserve Array2", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.reserve_array2", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_SUPPRESS_NOTIFY,
+		{ "Dns Rpc Flag Suppress Notify", "dnsserver.DNS_RPC_NODE_FLAGS.DNS_RPC_FLAG_SUPPRESS_NOTIFY", FT_BOOLEAN, 32, TFS(&DNS_RPC_NODE_FLAGS_DNS_RPC_FLAG_SUPPRESS_NOTIFY_tfs), ( 0x00010000 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension2,
+		{ "Extension2", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_NoRecursion,
+		{ "Norecursion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.NoRecursion", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_BootMethod,
+		{ "Bootmethod", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.BootMethod", FT_UINT8, BASE_DEC, VALS(dnsserver_DNS_RPC_BOOT_METHOD_vals), 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AutoCacheUpdate,
+		{ "Autocacheupdate", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AutoCacheUpdate", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_NOTIFY,
+		{ "Dns Log Level Notify", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_NOTIFY", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_NOTIFY_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DsContainer,
+		{ "Dscontainer", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DsContainer", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_VERSION_OSMajorVersion,
+		{ "Osmajorversion", "dnsserver.DNS_RPC_VERSION.OSMajorVersion", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DefaultAgingState,
-	  { "Defaultagingstate", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DefaultAgingState", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_NAME_Name,
-	  { "Name", "dnsserver.DNS_RPC_NAME.Name", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DnssrvQuery2_data,
-	  { "Data", "dnsserver.DnssrvQuery2.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dnsserver_DNS_RPC_RECORD_record,
-	  { "Record", "dnsserver.DNS_RPC_RECORD.record", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Defaultagingstate", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DefaultAgingState", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_extension3,
+		{ "Extension3", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.extension3", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_DomainName,
+		{ "Domainname", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.DomainName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_LOG_LEVELS_DNS_LOG_LEVEL_WRITE_THROUGH,
+		{ "Dns Log Level Write Through", "dnsserver.DNS_LOG_LEVELS.DNS_LOG_LEVEL_WRITE_THROUGH", FT_BOOLEAN, 32, TFS(&DNS_LOG_LEVELS_DNS_LOG_LEVEL_WRITE_THROUGH_tfs), ( 0x80000000 ), NULL, HFILL }},
+	{ &hf_dnsserver_opnum,
+		{ "Operation", "dnsserver.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AutoReverseZones,
+		{ "Autoreversezones", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AutoReverseZones", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_Type,
+		{ "Type", "dnsserver.DNS_RPC_RECORD.Type", FT_UINT16, BASE_DEC, VALS(dnsserver_DNS_RECORD_TYPE_vals), 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_WriteAuthorityNs,
+		{ "Writeauthorityns", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.WriteAuthorityNs", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RpcStructureVersion,
+		{ "Rpcstructureversion", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RpcStructureVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ForwardDelegations,
-	  { "Forwarddelegations", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ForwardDelegations", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Forwarddelegations", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ForwardDelegations", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvQuery2_server_name,
+		{ "Server Name", "dnsserver.DnssrvQuery2.server_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_SELECT_FLAGS_DNS_RPC_VIEW_ADDITIONAL_DATA,
+		{ "Dns Rpc View Additional Data", "dnsserver.DNS_SELECT_FLAGS.DNS_RPC_VIEW_ADDITIONAL_DATA", FT_BOOLEAN, 32, TFS(&DNS_SELECT_FLAGS_DNS_RPC_VIEW_ADDITIONAL_DATA_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_node_name,
+		{ "Node Name", "dnsserver.DnssrvEnumRecords2.node_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_ListenAddrs,
+		{ "Listenaddrs", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.ListenAddrs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_dnsserver_DNS_RPC_PROTOCOLS_DNS_RPC_USE_NAMED_PIPE,
-	  { "Dns Rpc Use Named Pipe", "dnsserver.DNS_RPC_PROTOCOLS.DNS_RPC_USE_NAMED_PIPE", FT_BOOLEAN, 32, TFS(&DNS_RPC_PROTOCOLS_DNS_RPC_USE_NAMED_PIPE_tfs), ( 0x00000002 ), NULL, HFILL }},
+		{ "Dns Rpc Use Named Pipe", "dnsserver.DNS_RPC_PROTOCOLS.DNS_RPC_USE_NAMED_PIPE", FT_BOOLEAN, 32, TFS(&DNS_RPC_PROTOCOLS_DNS_RPC_USE_NAMED_PIPE_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_RecurseAfterForwarding,
+		{ "Recurseafterforwarding", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.RecurseAfterForwarding", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_NAME_Name,
+		{ "Name", "dnsserver.DNS_RPC_NAME.Name", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_AdminConfigured,
+		{ "Adminconfigured", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.AdminConfigured", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_SERVER_INFO_DOTNET_reserved0,
+		{ "Reserved0", "dnsserver.DNS_RPC_SERVER_INFO_DOTNET.reserved0", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DnssrvEnumRecords2_filter_stop,
+		{ "Filter Stop", "dnsserver.DnssrvEnumRecords2.filter_stop", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dnsserver_DNS_RPC_RECORD_reserved,
+		{ "Reserved", "dnsserver.DNS_RPC_RECORD.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-drsuapi.c b/epan/dissectors/packet-dcerpc-drsuapi.c
index db7f4e857a..88a3c9142f 100644
--- a/epan/dissectors/packet-dcerpc-drsuapi.c
+++ b/epan/dissectors/packet-dcerpc-drsuapi.c
@@ -1144,8 +1144,7 @@ drsuapi_dissect_union_DsBindInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsBindInfo");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsBindInfo);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsBindInfo, &item, "DsBindInfo");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -1821,8 +1820,7 @@ drsuapi_dissect_union_DsReplicaSyncRequest(tvbuff_t *tvb, int offset, packet_inf
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsReplicaSyncRequest");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsReplicaSyncRequest);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsReplicaSyncRequest, &item, "DsReplicaSyncRequest");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -2556,8 +2554,7 @@ drsuapi_dissect_union_DsGetNCChangesRequest(tvbuff_t *tvb, int offset, packet_in
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsGetNCChangesRequest");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsGetNCChangesRequest);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsGetNCChangesRequest, &item, "DsGetNCChangesRequest");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -2940,8 +2937,7 @@ drsuapi_dissect_union_DsGetNCChangesCtr(tvbuff_t *tvb, int offset, packet_info *
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsGetNCChangesCtr");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsGetNCChangesCtr);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsGetNCChangesCtr, &item, "DsGetNCChangesCtr");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -3221,8 +3217,7 @@ drsuapi_dissect_union_DsReplicaUpdateRefsRequest(tvbuff_t *tvb, int offset, pack
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsReplicaUpdateRefsRequest");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsReplicaUpdateRefsRequest);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsReplicaUpdateRefsRequest, &item, "DsReplicaUpdateRefsRequest");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -3776,8 +3771,7 @@ drsuapi_dissect_union_DsNameRequest(tvbuff_t *tvb, int offset, packet_info *pinf
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsNameRequest");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsNameRequest);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsNameRequest, &item, "DsNameRequest");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -3941,8 +3935,7 @@ drsuapi_dissect_union_DsNameCtr(tvbuff_t *tvb, int offset, packet_info *pinfo, p
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsNameCtr");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsNameCtr);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsNameCtr, &item, "DsNameCtr");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -4157,8 +4150,7 @@ drsuapi_dissect_union_DsWriteAccountSpnRequest(tvbuff_t *tvb, int offset, packet
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsWriteAccountSpnRequest");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsWriteAccountSpnRequest);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsWriteAccountSpnRequest, &item, "DsWriteAccountSpnRequest");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -4237,8 +4229,7 @@ drsuapi_dissect_union_DsWriteAccountSpnResult(tvbuff_t *tvb, int offset, packet_
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsWriteAccountSpnResult");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsWriteAccountSpnResult);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsWriteAccountSpnResult, &item, "DsWriteAccountSpnResult");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -4426,8 +4417,7 @@ drsuapi_dissect_union_DsGetDCInfoRequest(tvbuff_t *tvb, int offset, packet_info
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsGetDCInfoRequest");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsGetDCInfoRequest);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsGetDCInfoRequest, &item, "DsGetDCInfoRequest");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -5090,8 +5080,7 @@ drsuapi_dissect_union_DsGetDCInfoCtr(tvbuff_t *tvb, int offset, packet_info *pin
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsGetDCInfoCtr");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsGetDCInfoCtr);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsGetDCInfoCtr, &item, "DsGetDCInfoCtr");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -5459,8 +5448,7 @@ drsuapi_dissect_union_DsReplicaGetInfoRequest(tvbuff_t *tvb, int offset, packet_
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsReplicaGetInfoRequest");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsReplicaGetInfoRequest);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsReplicaGetInfoRequest, &item, "DsReplicaGetInfoRequest");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
@@ -6170,8 +6158,7 @@ drsuapi_dissect_union_DsRplicaOpOptions(tvbuff_t *tvb, int offset, packet_info *
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsRplicaOpOptions");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsRplicaOpOptions);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsRplicaOpOptions, &item, "DsRplicaOpOptions");
     }
 
     offset=dissect_ndr_uint16(tvb, offset, pinfo, tree,
@@ -7800,8 +7787,7 @@ drsuapi_dissect_union_DsReplicaInfo(tvbuff_t *tvb, int offset, packet_info *pinf
 
     old_offset=offset;
     if(parent_tree){
- 	   item=proto_tree_add_text(parent_tree, tvb, offset, -1, "DsReplicaInfo");
- 	   tree=proto_item_add_subtree(item, ett_drsuapi_DsReplicaInfo);
+ 	   tree=proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_drsuapi_DsReplicaInfo, &item, "DsReplicaInfo");
     }
 
     offset=dissect_ndr_uint32(tvb, offset, pinfo, tree,
diff --git a/epan/dissectors/packet-dcerpc-dssetup.c b/epan/dissectors/packet-dcerpc-dssetup.c
index a0e6bf5309..2f7fa5e192 100644
--- a/epan/dissectors/packet-dcerpc-dssetup.c
+++ b/epan/dissectors/packet-dcerpc-dssetup.c
@@ -36,26 +36,26 @@ static gint ett_dssetup_dssetup_DsRoleInfo = -1;
 
 
 /* Header field declarations */
-static gint hf_dssetup_werror = -1;
-static gint hf_dssetup_dssetup_DsRoleGetPrimaryDomainInformation_info = -1;
-static gint hf_dssetup_dssetup_DsRoleUpgradeStatus_previous_role = -1;
-static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_role = -1;
-static gint hf_dssetup_dssetup_DsRoleInfo_upgrade = -1;
-static gint hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_UPGRADE_IN_PROGRESS = -1;
-static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_domain = -1;
-static gint hf_dssetup_dssetup_DsRoleInfo_opstatus = -1;
-static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_flags = -1;
 static gint hf_dssetup_dssetup_DsRoleUpgradeStatus_upgrading = -1;
-static gint hf_dssetup_dssetup_DsRoleGetPrimaryDomainInformation_level = -1;
-static gint hf_dssetup_dssetup_DsRoleInfo_basic = -1;
-static gint hf_dssetup_opnum = -1;
-static gint hf_dssetup_dssetup_DsRoleOpStatus_status = -1;
-static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_forest = -1;
 static gint hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT = -1;
-static gint hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_MIXED_MODE = -1;
 static gint hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_RUNNING = -1;
 static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_domain_guid = -1;
+static gint hf_dssetup_dssetup_DsRoleGetPrimaryDomainInformation_level = -1;
+static gint hf_dssetup_dssetup_DsRoleInfo_opstatus = -1;
+static gint hf_dssetup_dssetup_DsRoleOpStatus_status = -1;
+static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_role = -1;
+static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_domain = -1;
+static gint hf_dssetup_opnum = -1;
+static gint hf_dssetup_dssetup_DsRoleInfo_basic = -1;
+static gint hf_dssetup_werror = -1;
+static gint hf_dssetup_dssetup_DsRoleInfo_upgrade = -1;
+static gint hf_dssetup_dssetup_DsRoleUpgradeStatus_previous_role = -1;
+static gint hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_MIXED_MODE = -1;
+static gint hf_dssetup_dssetup_DsRoleGetPrimaryDomainInformation_info = -1;
+static gint hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_UPGRADE_IN_PROGRESS = -1;
+static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_flags = -1;
 static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_dns_domain = -1;
+static gint hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_forest = -1;
 
 static gint proto_dcerpc_dssetup = -1;
 /* Version information */
@@ -229,7 +229,7 @@ dssetup_dissect_bitmap_DsRoleFlags(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 /* IDL: struct { */
 /* IDL: 	dssetup_DsRole role; */
 /* IDL: 	dssetup_DsRoleFlags flags; */
-/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *domain; */
+/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *domain; */
 /* IDL: 	[charset(UTF16)] [unique(1)] uint16 *dns_domain; */
 /* IDL: 	[charset(UTF16)] [unique(1)] uint16 *forest; */
 /* IDL: 	GUID domain_guid; */
@@ -574,8 +574,7 @@ dssetup_dissect_DsRoleInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "dssetup_DsRoleInfo");
-		tree = proto_item_add_subtree(item, ett_dssetup_dssetup_DsRoleInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_dssetup_dssetup_DsRoleInfo, &item, "dssetup_DsRoleInfo");
 	}
 
 	offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -625,7 +624,7 @@ dssetup_dissect_element_DsRoleGetPrimaryDomainInformation_info_(tvbuff_t *tvb _U
 
 /* IDL: WERROR dssetup_DsRoleGetPrimaryDomainInformation( */
 /* IDL: [in] dssetup_DsRoleInfoLevel level, */
-/* IDL: [out] [unique(1)] [switch_is(level)] dssetup_DsRoleInfo *info */
+/* IDL: [switch_is(level)] [unique(1)] [out] dssetup_DsRoleInfo *info */
 /* IDL: ); */
 
 static int
@@ -934,46 +933,46 @@ static dcerpc_sub_dissector dssetup_dissectors[] = {
 void proto_register_dcerpc_dssetup(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_dssetup_werror,
-	  { "Windows Error", "dssetup.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleGetPrimaryDomainInformation_info,
-	  { "Info", "dssetup.dssetup_DsRoleGetPrimaryDomainInformation.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleUpgradeStatus_previous_role,
-	  { "Previous Role", "dssetup.dssetup_DsRoleUpgradeStatus.previous_role", FT_UINT1632, BASE_DEC, VALS(dssetup_dssetup_DsPrevious_vals), 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_role,
-	  { "Role", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.role", FT_UINT1632, BASE_DEC, VALS(dssetup_dssetup_DsRole_vals), 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleInfo_upgrade,
-	  { "Upgrade", "dssetup.dssetup_DsRoleInfo.upgrade", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_UPGRADE_IN_PROGRESS,
-	  { "Ds Role Upgrade In Progress", "dssetup.dssetup_DsRoleFlags.DS_ROLE_UPGRADE_IN_PROGRESS", FT_BOOLEAN, 32, TFS(&dssetup_DsRoleFlags_DS_ROLE_UPGRADE_IN_PROGRESS_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_domain,
-	  { "Domain", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.domain", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleInfo_opstatus,
-	  { "Opstatus", "dssetup.dssetup_DsRoleInfo.opstatus", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_flags,
-	  { "Flags", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_dssetup_dssetup_DsRoleUpgradeStatus_upgrading,
-	  { "Upgrading", "dssetup.dssetup_DsRoleUpgradeStatus.upgrading", FT_UINT32, BASE_DEC, VALS(dssetup_dssetup_DsUpgrade_vals), 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleGetPrimaryDomainInformation_level,
-	  { "Level", "dssetup.dssetup_DsRoleGetPrimaryDomainInformation.level", FT_UINT1632, BASE_DEC, VALS(dssetup_dssetup_DsRoleInfoLevel_vals), 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleInfo_basic,
-	  { "Basic", "dssetup.dssetup_DsRoleInfo.basic", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_dssetup_opnum,
-	  { "Operation", "dssetup.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleOpStatus_status,
-	  { "Status", "dssetup.dssetup_DsRoleOpStatus.status", FT_UINT1632, BASE_DEC, VALS(dssetup_dssetup_DsRoleOp_vals), 0, NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_forest,
-	  { "Forest", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.forest", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Upgrading", "dssetup.dssetup_DsRoleUpgradeStatus.upgrading", FT_UINT32, BASE_DEC, VALS(dssetup_dssetup_DsUpgrade_vals), 0, NULL, HFILL }},
 	{ &hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT,
-	  { "Ds Role Primary Domain Guid Present", "dssetup.dssetup_DsRoleFlags.DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT", FT_BOOLEAN, 32, TFS(&dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT_tfs), ( 0x01000000 ), NULL, HFILL }},
-	{ &hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_MIXED_MODE,
-	  { "Ds Role Primary Ds Mixed Mode", "dssetup.dssetup_DsRoleFlags.DS_ROLE_PRIMARY_DS_MIXED_MODE", FT_BOOLEAN, 32, TFS(&dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_MIXED_MODE_tfs), ( 0x00000002 ), NULL, HFILL }},
+		{ "Ds Role Primary Domain Guid Present", "dssetup.dssetup_DsRoleFlags.DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT", FT_BOOLEAN, 32, TFS(&dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT_tfs), ( 0x01000000 ), NULL, HFILL }},
 	{ &hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_RUNNING,
-	  { "Ds Role Primary Ds Running", "dssetup.dssetup_DsRoleFlags.DS_ROLE_PRIMARY_DS_RUNNING", FT_BOOLEAN, 32, TFS(&dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_RUNNING_tfs), ( 0x00000001 ), NULL, HFILL }},
+		{ "Ds Role Primary Ds Running", "dssetup.dssetup_DsRoleFlags.DS_ROLE_PRIMARY_DS_RUNNING", FT_BOOLEAN, 32, TFS(&dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_RUNNING_tfs), ( 0x00000001 ), NULL, HFILL }},
 	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_domain_guid,
-	  { "Domain Guid", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.domain_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Domain Guid", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.domain_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleGetPrimaryDomainInformation_level,
+		{ "Level", "dssetup.dssetup_DsRoleGetPrimaryDomainInformation.level", FT_UINT1632, BASE_DEC, VALS(dssetup_dssetup_DsRoleInfoLevel_vals), 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleInfo_opstatus,
+		{ "Opstatus", "dssetup.dssetup_DsRoleInfo.opstatus", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleOpStatus_status,
+		{ "Status", "dssetup.dssetup_DsRoleOpStatus.status", FT_UINT1632, BASE_DEC, VALS(dssetup_dssetup_DsRoleOp_vals), 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_role,
+		{ "Role", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.role", FT_UINT1632, BASE_DEC, VALS(dssetup_dssetup_DsRole_vals), 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_domain,
+		{ "Domain", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.domain", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dssetup_opnum,
+		{ "Operation", "dssetup.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleInfo_basic,
+		{ "Basic", "dssetup.dssetup_DsRoleInfo.basic", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dssetup_werror,
+		{ "Windows Error", "dssetup.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleInfo_upgrade,
+		{ "Upgrade", "dssetup.dssetup_DsRoleInfo.upgrade", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleUpgradeStatus_previous_role,
+		{ "Previous Role", "dssetup.dssetup_DsRoleUpgradeStatus.previous_role", FT_UINT1632, BASE_DEC, VALS(dssetup_dssetup_DsPrevious_vals), 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_MIXED_MODE,
+		{ "Ds Role Primary Ds Mixed Mode", "dssetup.dssetup_DsRoleFlags.DS_ROLE_PRIMARY_DS_MIXED_MODE", FT_BOOLEAN, 32, TFS(&dssetup_DsRoleFlags_DS_ROLE_PRIMARY_DS_MIXED_MODE_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleGetPrimaryDomainInformation_info,
+		{ "Info", "dssetup.dssetup_DsRoleGetPrimaryDomainInformation.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRoleFlags_DS_ROLE_UPGRADE_IN_PROGRESS,
+		{ "Ds Role Upgrade In Progress", "dssetup.dssetup_DsRoleFlags.DS_ROLE_UPGRADE_IN_PROGRESS", FT_BOOLEAN, 32, TFS(&dssetup_DsRoleFlags_DS_ROLE_UPGRADE_IN_PROGRESS_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_flags,
+		{ "Flags", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_dns_domain,
-	  { "Dns Domain", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.dns_domain", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Dns Domain", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.dns_domain", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_dssetup_dssetup_DsRolePrimaryDomInfoBasic_forest,
+		{ "Forest", "dssetup.dssetup_DsRolePrimaryDomInfoBasic.forest", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-efs.c b/epan/dissectors/packet-dcerpc-efs.c
index d0a1c52c1d..6a0369be9f 100644
--- a/epan/dissectors/packet-dcerpc-efs.c
+++ b/epan/dissectors/packet-dcerpc-efs.c
@@ -36,38 +36,38 @@ static gint ett_efs_ENCRYPTION_CERTIFICATE = -1;
 
 
 /* Header field declarations */
-static gint hf_efs_EFS_CERTIFICATE_BLOB_cbData = -1;
-static gint hf_efs_ENCRYPTION_CERTIFICATE_TotalLength = -1;
-static gint hf_efs_EfsRpcSetFileEncryptionKey_pEncryptionCertificate = -1;
-static gint hf_efs_EfsRpcDecryptFileSrv_Reserved = -1;
-static gint hf_efs_EfsRpcOpenFileRaw_FileName = -1;
-static gint hf_efs_EfsRpcQueryRecoveryAgents_FileName = -1;
-static gint hf_efs_werror = -1;
-static gint hf_efs_EfsRpcAddUsersToFile_FileName = -1;
-static gint hf_efs_EfsRpcOpenFileRaw_pvContext = -1;
+static gint hf_efs_EfsRpcReadFileRaw_pvContext = -1;
 static gint hf_efs_EfsRpcEncryptFileSrv_Filename = -1;
-static gint hf_efs_opnum = -1;
-static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_pHash = -1;
-static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_pUserSid = -1;
-static gint hf_efs_EfsRpcCloseRaw_pvContext = -1;
 static gint hf_efs_EFS_CERTIFICATE_BLOB_dwCertEncodingType = -1;
+static gint hf_efs_EfsRpcAddUsersToFile_FileName = -1;
+static gint hf_efs_EFS_HASH_BLOB_cbData = -1;
+static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_pHash = -1;
+static gint hf_efs_ENCRYPTION_CERTIFICATE_pUserSid = -1;
 static gint hf_efs_ENCRYPTION_CERTIFICATE_pCertBlob = -1;
-static gint hf_efs_EfsRpcWriteFileRaw_pvContext = -1;
-static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash = -1;
-static gint hf_efs_EFS_CERTIFICATE_BLOB_pbData = -1;
-static gint hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents = -1;
 static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation = -1;
-static gint hf_efs_EfsRpcReadFileRaw_pvContext = -1;
+static gint hf_efs_EfsRpcQueryRecoveryAgents_FileName = -1;
+static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_pUserSid = -1;
+static gint hf_efs_werror = -1;
+static gint hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents = -1;
+static gint hf_efs_EfsRpcOpenFileRaw_pvContext = -1;
 static gint hf_efs_EfsRpcQueryUsersOnFile_FileName = -1;
+static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength = -1;
+static gint hf_efs_ENCRYPTION_CERTIFICATE_TotalLength = -1;
 static gint hf_efs_EfsRpcDecryptFileSrv_FileName = -1;
-static gint hf_efs_EfsRpcOpenFileRaw_Flags = -1;
-static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers = -1;
+static gint hf_efs_EFS_CERTIFICATE_BLOB_cbData = -1;
+static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash = -1;
+static gint hf_efs_EFS_CERTIFICATE_BLOB_pbData = -1;
+static gint hf_efs_EfsRpcRemoveUsersFromFile_FileName = -1;
+static gint hf_efs_EfsRpcOpenFileRaw_FileName = -1;
 static gint hf_efs_EFS_HASH_BLOB_pbData = -1;
-static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength = -1;
+static gint hf_efs_EfsRpcCloseRaw_pvContext = -1;
+static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers = -1;
+static gint hf_efs_EfsRpcWriteFileRaw_pvContext = -1;
+static gint hf_efs_EfsRpcSetFileEncryptionKey_pEncryptionCertificate = -1;
+static gint hf_efs_EfsRpcOpenFileRaw_Flags = -1;
 static gint hf_efs_EfsRpcQueryUsersOnFile_pUsers = -1;
-static gint hf_efs_ENCRYPTION_CERTIFICATE_pUserSid = -1;
-static gint hf_efs_EFS_HASH_BLOB_cbData = -1;
-static gint hf_efs_EfsRpcRemoveUsersFromFile_FileName = -1;
+static gint hf_efs_opnum = -1;
+static gint hf_efs_EfsRpcDecryptFileSrv_Reserved = -1;
 
 static gint proto_dcerpc_efs = -1;
 /* Version information */
@@ -143,7 +143,7 @@ efs_dissect_struct_dom_sid(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, pr
 
 /* IDL: struct { */
 /* IDL: 	uint32 cbData; */
-/* IDL: 	[size_is(cbData)] [unique(1)] uint8 *pbData; */
+/* IDL: 	[unique(1)] [size_is(cbData)] uint8 *pbData; */
 /* IDL: } */
 
 static int
@@ -712,7 +712,7 @@ efs_dissect_element_EfsRpcCloseRaw_pvContext_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: void EfsRpcCloseRaw( */
-/* IDL: [out] [ref] [in] policy_handle *pvContext */
+/* IDL: [ref] [in] [out] policy_handle *pvContext */
 /* IDL: ); */
 
 static int
@@ -746,7 +746,7 @@ efs_dissect_element_EfsRpcEncryptFileSrv_Filename(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: WERROR EfsRpcEncryptFileSrv( */
-/* IDL: [in] [charset(UTF16)] uint16 Filename[*] */
+/* IDL: [charset(UTF16)] [in] uint16 Filename[*] */
 /* IDL: ); */
 
 static int
@@ -792,7 +792,7 @@ efs_dissect_element_EfsRpcDecryptFileSrv_Reserved(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: WERROR EfsRpcDecryptFileSrv( */
-/* IDL: [in] [charset(UTF16)] uint16 FileName[*], */
+/* IDL: [charset(UTF16)] [in] uint16 FileName[*], */
 /* IDL: [in] uint32 Reserved */
 /* IDL: ); */
 
@@ -858,7 +858,7 @@ efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers__(tvbuff_t *tvb _U_, int offse
 
 /* IDL: WERROR EfsRpcQueryUsersOnFile( */
 /* IDL: [in] [charset(UTF16)] uint16 FileName[*], */
-/* IDL: [unique(1)] [ref] [out] ENCRYPTION_CERTIFICATE_HASH_LIST **pUsers */
+/* IDL: [out] [ref] [unique(1)] ENCRYPTION_CERTIFICATE_HASH_LIST **pUsers */
 /* IDL: ); */
 
 static int
@@ -924,7 +924,7 @@ efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents__(tvbuff_t *tvb _U
 
 /* IDL: WERROR EfsRpcQueryRecoveryAgents( */
 /* IDL: [charset(UTF16)] [in] uint16 FileName[*], */
-/* IDL: [out] [ref] [unique(1)] ENCRYPTION_CERTIFICATE_HASH_LIST **pRecoveryAgents */
+/* IDL: [ref] [unique(1)] [out] ENCRYPTION_CERTIFICATE_HASH_LIST **pRecoveryAgents */
 /* IDL: ); */
 
 static int
@@ -1003,7 +1003,7 @@ efs_dissect_element_EfsRpcAddUsersToFile_FileName(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: WERROR EfsRpcAddUsersToFile( */
-/* IDL: [charset(UTF16)] [in] uint16 FileName[*] */
+/* IDL: [in] [charset(UTF16)] uint16 FileName[*] */
 /* IDL: ); */
 
 static int
@@ -1046,7 +1046,7 @@ efs_dissect_element_EfsRpcSetFileEncryptionKey_pEncryptionCertificate_(tvbuff_t
 }
 
 /* IDL: WERROR EfsRpcSetFileEncryptionKey( */
-/* IDL: [unique(1)] [in] ENCRYPTION_CERTIFICATE *pEncryptionCertificate */
+/* IDL: [in] [unique(1)] ENCRYPTION_CERTIFICATE *pEncryptionCertificate */
 /* IDL: ); */
 
 static int
@@ -1183,70 +1183,70 @@ static dcerpc_sub_dissector efs_dissectors[] = {
 void proto_register_dcerpc_efs(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_efs_EFS_CERTIFICATE_BLOB_cbData,
-	  { "Cbdata", "efs.EFS_CERTIFICATE_BLOB.cbData", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_ENCRYPTION_CERTIFICATE_TotalLength,
-	  { "Totallength", "efs.ENCRYPTION_CERTIFICATE.TotalLength", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcSetFileEncryptionKey_pEncryptionCertificate,
-	  { "Pencryptioncertificate", "efs.EfsRpcSetFileEncryptionKey.pEncryptionCertificate", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcDecryptFileSrv_Reserved,
-	  { "Reserved", "efs.EfsRpcDecryptFileSrv.Reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcOpenFileRaw_FileName,
-	  { "Filename", "efs.EfsRpcOpenFileRaw.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcQueryRecoveryAgents_FileName,
-	  { "Filename", "efs.EfsRpcQueryRecoveryAgents.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_werror,
-	  { "Windows Error", "efs.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcAddUsersToFile_FileName,
-	  { "Filename", "efs.EfsRpcAddUsersToFile.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcOpenFileRaw_pvContext,
-	  { "Pvcontext", "efs.EfsRpcOpenFileRaw.pvContext", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcReadFileRaw_pvContext,
+		{ "Pvcontext", "efs.EfsRpcReadFileRaw.pvContext", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_efs_EfsRpcEncryptFileSrv_Filename,
-	  { "Filename", "efs.EfsRpcEncryptFileSrv.Filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_opnum,
-	  { "Operation", "efs.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_pHash,
-	  { "Phash", "efs.ENCRYPTION_CERTIFICATE_HASH.pHash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_pUserSid,
-	  { "Pusersid", "efs.ENCRYPTION_CERTIFICATE_HASH.pUserSid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcCloseRaw_pvContext,
-	  { "Pvcontext", "efs.EfsRpcCloseRaw.pvContext", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Filename", "efs.EfsRpcEncryptFileSrv.Filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_efs_EFS_CERTIFICATE_BLOB_dwCertEncodingType,
-	  { "Dwcertencodingtype", "efs.EFS_CERTIFICATE_BLOB.dwCertEncodingType", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Dwcertencodingtype", "efs.EFS_CERTIFICATE_BLOB.dwCertEncodingType", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcAddUsersToFile_FileName,
+		{ "Filename", "efs.EfsRpcAddUsersToFile.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EFS_HASH_BLOB_cbData,
+		{ "Cbdata", "efs.EFS_HASH_BLOB.cbData", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_pHash,
+		{ "Phash", "efs.ENCRYPTION_CERTIFICATE_HASH.pHash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_ENCRYPTION_CERTIFICATE_pUserSid,
+		{ "Pusersid", "efs.ENCRYPTION_CERTIFICATE.pUserSid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_efs_ENCRYPTION_CERTIFICATE_pCertBlob,
-	  { "Pcertblob", "efs.ENCRYPTION_CERTIFICATE.pCertBlob", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcWriteFileRaw_pvContext,
-	  { "Pvcontext", "efs.EfsRpcWriteFileRaw.pvContext", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash,
-	  { "Ncert Hash", "efs.ENCRYPTION_CERTIFICATE_HASH_LIST.nCert_Hash", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EFS_CERTIFICATE_BLOB_pbData,
-	  { "Pbdata", "efs.EFS_CERTIFICATE_BLOB.pbData", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents,
-	  { "Precoveryagents", "efs.EfsRpcQueryRecoveryAgents.pRecoveryAgents", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Pcertblob", "efs.ENCRYPTION_CERTIFICATE.pCertBlob", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation,
-	  { "Lpdisplayinformation", "efs.ENCRYPTION_CERTIFICATE_HASH.lpDisplayInformation", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcReadFileRaw_pvContext,
-	  { "Pvcontext", "efs.EfsRpcReadFileRaw.pvContext", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Lpdisplayinformation", "efs.ENCRYPTION_CERTIFICATE_HASH.lpDisplayInformation", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcQueryRecoveryAgents_FileName,
+		{ "Filename", "efs.EfsRpcQueryRecoveryAgents.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_pUserSid,
+		{ "Pusersid", "efs.ENCRYPTION_CERTIFICATE_HASH.pUserSid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_werror,
+		{ "Windows Error", "efs.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents,
+		{ "Precoveryagents", "efs.EfsRpcQueryRecoveryAgents.pRecoveryAgents", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcOpenFileRaw_pvContext,
+		{ "Pvcontext", "efs.EfsRpcOpenFileRaw.pvContext", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_efs_EfsRpcQueryUsersOnFile_FileName,
-	  { "Filename", "efs.EfsRpcQueryUsersOnFile.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Filename", "efs.EfsRpcQueryUsersOnFile.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength,
+		{ "Cbtotallength", "efs.ENCRYPTION_CERTIFICATE_HASH.cbTotalLength", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_ENCRYPTION_CERTIFICATE_TotalLength,
+		{ "Totallength", "efs.ENCRYPTION_CERTIFICATE.TotalLength", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_efs_EfsRpcDecryptFileSrv_FileName,
-	  { "Filename", "efs.EfsRpcDecryptFileSrv.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcOpenFileRaw_Flags,
-	  { "Flags", "efs.EfsRpcOpenFileRaw.Flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers,
-	  { "Pusers", "efs.ENCRYPTION_CERTIFICATE_HASH_LIST.pUsers", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Filename", "efs.EfsRpcDecryptFileSrv.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EFS_CERTIFICATE_BLOB_cbData,
+		{ "Cbdata", "efs.EFS_CERTIFICATE_BLOB.cbData", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash,
+		{ "Ncert Hash", "efs.ENCRYPTION_CERTIFICATE_HASH_LIST.nCert_Hash", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EFS_CERTIFICATE_BLOB_pbData,
+		{ "Pbdata", "efs.EFS_CERTIFICATE_BLOB.pbData", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcRemoveUsersFromFile_FileName,
+		{ "Filename", "efs.EfsRpcRemoveUsersFromFile.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcOpenFileRaw_FileName,
+		{ "Filename", "efs.EfsRpcOpenFileRaw.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_efs_EFS_HASH_BLOB_pbData,
-	  { "Pbdata", "efs.EFS_HASH_BLOB.pbData", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength,
-	  { "Cbtotallength", "efs.ENCRYPTION_CERTIFICATE_HASH.cbTotalLength", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Pbdata", "efs.EFS_HASH_BLOB.pbData", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcCloseRaw_pvContext,
+		{ "Pvcontext", "efs.EfsRpcCloseRaw.pvContext", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers,
+		{ "Pusers", "efs.ENCRYPTION_CERTIFICATE_HASH_LIST.pUsers", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcWriteFileRaw_pvContext,
+		{ "Pvcontext", "efs.EfsRpcWriteFileRaw.pvContext", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcSetFileEncryptionKey_pEncryptionCertificate,
+		{ "Pencryptioncertificate", "efs.EfsRpcSetFileEncryptionKey.pEncryptionCertificate", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcOpenFileRaw_Flags,
+		{ "Flags", "efs.EfsRpcOpenFileRaw.Flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_efs_EfsRpcQueryUsersOnFile_pUsers,
-	  { "Pusers", "efs.EfsRpcQueryUsersOnFile.pUsers", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_ENCRYPTION_CERTIFICATE_pUserSid,
-	  { "Pusersid", "efs.ENCRYPTION_CERTIFICATE.pUserSid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EFS_HASH_BLOB_cbData,
-	  { "Cbdata", "efs.EFS_HASH_BLOB.cbData", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_efs_EfsRpcRemoveUsersFromFile_FileName,
-	  { "Filename", "efs.EfsRpcRemoveUsersFromFile.FileName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Pusers", "efs.EfsRpcQueryUsersOnFile.pUsers", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_opnum,
+		{ "Operation", "efs.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_efs_EfsRpcDecryptFileSrv_Reserved,
+		{ "Reserved", "efs.EfsRpcDecryptFileSrv.Reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-epm.c b/epan/dissectors/packet-dcerpc-epm.c
index b2b6a58e6a..eafed8d94d 100644
--- a/epan/dissectors/packet-dcerpc-epm.c
+++ b/epan/dissectors/packet-dcerpc-epm.c
@@ -165,8 +165,7 @@ epm_dissect_ept_entry_t(tvbuff_t *tvb, int offset,
     }
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Entry:");
-        tree = proto_item_add_subtree(item, ett_epm_entry);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_epm_entry, &item, "Entry:");
     }
 
     offset = dissect_ndr_uuid_t (tvb, offset, pinfo, tree, di, drep,
@@ -335,8 +334,7 @@ epm_dissect_tower_data (tvbuff_t *tvb, int offset,
         e_uuid_t uuid;
         proto_item *pi;
 
-        it = proto_tree_add_text(tree, tvb, offset, 0, "Floor %d ", ii+1);
-        tr = proto_item_add_subtree(it, ett_epm_tower_floor);
+        tr = proto_tree_add_subtree_format(tree, tvb, offset, 0, ett_epm_tower_floor, &it, "Floor %d ", ii+1);
 
         len = tvb_get_letohs(tvb, offset);
         proto_tree_add_uint(tr, hf_epm_tower_lhs_len, tvb, offset, 2, len);
diff --git a/epan/dissectors/packet-dcerpc-eventlog.c b/epan/dissectors/packet-dcerpc-eventlog.c
index 0f6377ba28..3b87970e29 100644
--- a/epan/dissectors/packet-dcerpc-eventlog.c
+++ b/epan/dissectors/packet-dcerpc-eventlog.c
@@ -36,98 +36,98 @@ static gint ett_eventlog_eventlog_ChangeUnknown0 = -1;
 
 
 /* Header field declarations */
-static gint hf_eventlog_eventlog_Record_sid_offset = -1;
-static gint hf_eventlog_eventlog_GetLogIntormation_handle = -1;
-static gint hf_eventlog_opnum = -1;
-static gint hf_eventlog_eventlog_ReportEventW_Type = -1;
-static gint hf_eventlog_eventlog_Record_event_category = -1;
-static gint hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE = -1;
-static gint hf_eventlog_eventlog_ChangeUnknown0_unknown0 = -1;
-static gint hf_eventlog_eventlog_GetLogIntormation_cbBytesNeeded = -1;
-static gint hf_eventlog_eventlog_ReadEventLogW_sent_size = -1;
-static gint hf_eventlog_eventlog_ReadEventLogW_real_size = -1;
-static gint hf_eventlog_eventlog_Record_raw_data = -1;
-static gint hf_eventlog_eventlog_Record_time_written = -1;
-static gint hf_eventlog_eventlog_OpenUnknown0_unknown1 = -1;
-static gint hf_eventlog_eventlog_GetNumRecords_number = -1;
-static gint hf_eventlog_Record_source_name = -1;
-static gint hf_eventlog_eventlog_Record_source_name = -1;
-static gint hf_eventlog_eventlog_Record_size = -1;
+static gint hf_eventlog_Record_string = -1;
+static gint hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ = -1;
+static gint hf_eventlog_eventlog_ReadEventLogW_data = -1;
+static gint hf_eventlog_eventlog_Record_computer_name = -1;
 static gint hf_eventlog_eventlog_Record_closing_record_number = -1;
-static gint hf_eventlog_eventlog_ReadEventLogW_number_of_bytes = -1;
+static gint hf_eventlog_eventlog_OpenBackupEventLogW_logname = -1;
+static gint hf_eventlog_eventlog_Record_data_offset = -1;
+static gint hf_eventlog_eventlog_BackupEventLogW_handle = -1;
+static gint hf_eventlog_eventlog_ReportEventW_handle = -1;
+static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown0 = -1;
+static gint hf_eventlog_eventlog_Record_num_of_strings = -1;
+static gint hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE = -1;
+static gint hf_eventlog_eventlog_OpenEventLogW_MinorVersion = -1;
+static gint hf_eventlog_eventlog_GetLogIntormation_lpBuffer = -1;
+static gint hf_eventlog_eventlog_Record_time_written = -1;
 static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown3 = -1;
 static gint hf_eventlog_eventlog_OpenUnknown0_unknown0 = -1;
+static gint hf_eventlog_eventlog_GetLogIntormation_cbBytesNeeded = -1;
+static gint hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS = -1;
+static gint hf_eventlog_eventlog_ChangeUnknown0_unknown1 = -1;
+static gint hf_eventlog_eventlog_RegisterEventSourceW_logname = -1;
 static gint hf_eventlog_eventlog_Record_strings = -1;
-static gint hf_eventlog_Record_length = -1;
-static gint hf_eventlog_eventlog_ReadEventLogW_offset = -1;
-static gint hf_eventlog_eventlog_GetNumRecords_handle = -1;
-static gint hf_eventlog_eventlog_Record_event_type = -1;
-static gint hf_eventlog_eventlog_Record_data_offset = -1;
-static gint hf_eventlog_eventlog_Record_num_of_strings = -1;
-static gint hf_eventlog_eventlog_FlushEventLog_handle = -1;
-static gint hf_eventlog_eventlog_Record_record_number = -1;
-static gint hf_eventlog_eventlog_ReportEventW_data_length = -1;
-static gint hf_eventlog_eventlog_ChangeNotify_handle = -1;
-static gint hf_eventlog_eventlog_CloseEventLog_handle = -1;
+static gint hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE = -1;
+static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown0 = -1;
+static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown2 = -1;
+static gint hf_eventlog_eventlog_Record_raw_data = -1;
+static gint hf_eventlog_eventlog_Record_size = -1;
 static gint hf_eventlog_eventlog_OpenEventLogW_unknown0 = -1;
+static gint hf_eventlog_eventlog_CloseEventLog_handle = -1;
+static gint hf_eventlog_eventlog_Record_data_length = -1;
+static gint hf_eventlog_eventlog_GetNumRecords_number = -1;
+static gint hf_eventlog_eventlog_Record_sid_length = -1;
+static gint hf_eventlog_eventlog_Record_event_id = -1;
+static gint hf_eventlog_eventlog_ChangeNotify_unknown3 = -1;
+static gint hf_eventlog_eventlog_ReadEventLogW_handle = -1;
+static gint hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ = -1;
+static gint hf_eventlog_Record_length = -1;
 static gint hf_eventlog_eventlog_OpenEventLogW_RegModuleName = -1;
+static gint hf_eventlog_eventlog_ReadEventLogW_sent_size = -1;
+static gint hf_eventlog_eventlog_ClearEventLogW_handle = -1;
+static gint hf_eventlog_eventlog_OpenEventLogW_handle = -1;
+static gint hf_eventlog_eventlog_ChangeNotify_unknown2 = -1;
+static gint hf_eventlog_eventlog_Record_source_name = -1;
+static gint hf_eventlog_eventlog_ChangeUnknown0_unknown0 = -1;
+static gint hf_eventlog_eventlog_Record_event_category = -1;
+static gint hf_eventlog_Record_computer_name = -1;
+static gint hf_eventlog_eventlog_ReportEventW_num_of_strings = -1;
+static gint hf_eventlog_Record = -1;
+static gint hf_eventlog_eventlog_Record_sid_offset = -1;
+static gint hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE = -1;
+static gint hf_eventlog_eventlog_GetLogIntormation_dwInfoLevel = -1;
+static gint hf_eventlog_eventlog_GetNumRecords_handle = -1;
 static gint hf_eventlog_eventlog_BackupEventLogW_backupfilename = -1;
-static gint hf_eventlog_eventlog_OpenEventLogW_Module = -1;
-static gint hf_eventlog_eventlog_ChangeUnknown0_unknown1 = -1;
+static gint hf_eventlog_eventlog_RegisterEventSourceW_handle = -1;
 static gint hf_eventlog_eventlogEventTypes_EVENTLOG_SUCCESS = -1;
-static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown0 = -1;
+static gint hf_eventlog_eventlog_ClearEventLogW_backupfilename = -1;
 static gint hf_eventlog_eventlogReadFlags_EVENTLOG_BACKWARDS_READ = -1;
-static gint hf_eventlog_eventlog_Record_data_length = -1;
 static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown3 = -1;
-static gint hf_eventlog_eventlog_ClearEventLogW_backupfilename = -1;
-static gint hf_eventlog_eventlog_DeregisterEventSource_handle = -1;
-static gint hf_eventlog_eventlog_GetLogIntormation_lpBuffer = -1;
+static gint hf_eventlog_eventlog_OpenEventLogW_MajorVersion = -1;
+static gint hf_eventlog_eventlog_ReportEventW_event_category = -1;
+static gint hf_eventlog_eventlog_GetOldestRecord_oldest = -1;
+static gint hf_eventlog_eventlog_ReportEventW_data_length = -1;
 static gint hf_eventlog_eventlog_ReportEventW_computer_name = -1;
-static gint hf_eventlog_eventlog_BackupEventLogW_handle = -1;
-static gint hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE = -1;
-static gint hf_eventlog_Record = -1;
-static gint hf_eventlog_Record_string = -1;
-static gint hf_eventlog_eventlog_OpenEventLogW_handle = -1;
-static gint hf_eventlog_eventlog_Record_stringoffset = -1;
-static gint hf_eventlog_eventlog_ReadEventLogW_flags = -1;
-static gint hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS = -1;
-static gint hf_eventlog_eventlog_RegisterEventSourceW_logname = -1;
-static gint hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ = -1;
-static gint hf_eventlog_eventlog_GetLogIntormation_dwInfoLevel = -1;
-static gint hf_eventlog_eventlog_ReportEventW_num_of_strings = -1;
-static gint hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE = -1;
+static gint hf_eventlog_eventlog_ReadEventLogW_offset = -1;
+static gint hf_eventlog_eventlog_FlushEventLog_handle = -1;
+static gint hf_eventlog_opnum = -1;
+static gint hf_eventlog_eventlog_ReadEventLogW_number_of_bytes = -1;
 static gint hf_eventlog_eventlog_RegisterEventSourceW_servername = -1;
+static gint hf_eventlog_eventlog_ReportEventW_time = -1;
+static gint hf_eventlog_eventlog_Record_event_type = -1;
+static gint hf_eventlog_eventlog_ReadEventLogW_real_size = -1;
+static gint hf_eventlog_eventlog_Record_stringoffset = -1;
+static gint hf_eventlog_eventlog_ReportEventW_event_id = -1;
+static gint hf_eventlog_eventlog_DeregisterEventSource_handle = -1;
+static gint hf_eventlog_eventlog_ReportEventW_Type = -1;
+static gint hf_eventlog_eventlog_GetLogIntormation_cbBufSize = -1;
+static gint hf_eventlog_eventlog_OpenEventLogW_Module = -1;
+static gint hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ = -1;
 static gint hf_eventlog_eventlog_GetOldestRecord_handle = -1;
+static gint hf_eventlog_eventlog_GetLogIntormation_handle = -1;
 static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown2 = -1;
-static gint hf_eventlog_eventlog_ReadEventLogW_data = -1;
-static gint hf_eventlog_eventlog_Record_computer_name = -1;
-static gint hf_eventlog_eventlog_Record_sid_length = -1;
-static gint hf_eventlog_eventlog_ChangeNotify_unknown3 = -1;
-static gint hf_eventlog_status = -1;
-static gint hf_eventlog_eventlog_ReportEventW_time = -1;
-static gint hf_eventlog_eventlog_OpenBackupEventLogW_logname = -1;
-static gint hf_eventlog_eventlog_RegisterEventSourceW_handle = -1;
-static gint hf_eventlog_eventlog_ClearEventLogW_handle = -1;
-static gint hf_eventlog_eventlog_OpenEventLogW_MajorVersion = -1;
 static gint hf_eventlog_eventlog_OpenBackupEventLogW_handle = -1;
-static gint hf_eventlog_Record_computer_name = -1;
-static gint hf_eventlog_eventlog_ReportEventW_handle = -1;
-static gint hf_eventlog_eventlog_OpenEventLogW_MinorVersion = -1;
-static gint hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ = -1;
 static gint hf_eventlog_eventlog_Record_time_generated = -1;
-static gint hf_eventlog_eventlog_GetLogIntormation_cbBufSize = -1;
-static gint hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ = -1;
-static gint hf_eventlog_eventlog_GetOldestRecord_oldest = -1;
-static gint hf_eventlog_eventlog_Record_reserved = -1;
-static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown2 = -1;
-static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown0 = -1;
-static gint hf_eventlog_eventlog_ReportEventW_event_id = -1;
-static gint hf_eventlog_eventlog_Record_event_id = -1;
-static gint hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE = -1;
+static gint hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE = -1;
 static gint hf_eventlog_eventlog_Record_reserved_flags = -1;
-static gint hf_eventlog_eventlog_ReportEventW_event_category = -1;
-static gint hf_eventlog_eventlog_ReadEventLogW_handle = -1;
-static gint hf_eventlog_eventlog_ChangeNotify_unknown2 = -1;
+static gint hf_eventlog_status = -1;
+static gint hf_eventlog_Record_source_name = -1;
+static gint hf_eventlog_eventlog_Record_record_number = -1;
+static gint hf_eventlog_eventlog_ReadEventLogW_flags = -1;
+static gint hf_eventlog_eventlog_Record_reserved = -1;
+static gint hf_eventlog_eventlog_OpenUnknown0_unknown1 = -1;
+static gint hf_eventlog_eventlog_ChangeNotify_handle = -1;
 
 static gint proto_dcerpc_eventlog = -1;
 /* Version information */
@@ -883,7 +883,7 @@ eventlog_dissect_element_ClearEventLogW_backupfilename_(tvbuff_t *tvb _U_, int o
 
 /* IDL: NTSTATUS eventlog_ClearEventLogW( */
 /* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [unique(1)] [in] lsa_String *backupfilename */
+/* IDL: [in] [unique(1)] lsa_String *backupfilename */
 /* IDL: ); */
 
 static int
@@ -990,7 +990,7 @@ eventlog_dissect_element_CloseEventLog_handle_(tvbuff_t *tvb _U_, int offset _U_
 }
 
 /* IDL: NTSTATUS eventlog_CloseEventLog( */
-/* IDL: [out] [ref] [in] policy_handle *handle */
+/* IDL: [ref] [out] [in] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1036,7 +1036,7 @@ eventlog_dissect_element_DeregisterEventSource_handle_(tvbuff_t *tvb _U_, int of
 }
 
 /* IDL: NTSTATUS eventlog_DeregisterEventSource( */
-/* IDL: [in] [ref] [out] policy_handle *handle */
+/* IDL: [ref] [out] [in] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1099,7 +1099,7 @@ eventlog_dissect_element_GetNumRecords_number_(tvbuff_t *tvb _U_, int offset _U_
 
 /* IDL: NTSTATUS eventlog_GetNumRecords( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [out] [ref] uint32 *number */
+/* IDL: [ref] [out] uint32 *number */
 /* IDL: ); */
 
 static int
@@ -1162,7 +1162,7 @@ eventlog_dissect_element_GetOldestRecord_oldest_(tvbuff_t *tvb _U_, int offset _
 
 /* IDL: NTSTATUS eventlog_GetOldestRecord( */
 /* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [ref] [out] uint32 *oldest */
+/* IDL: [out] [ref] uint32 *oldest */
 /* IDL: ); */
 
 static int
@@ -1233,7 +1233,7 @@ eventlog_dissect_element_ChangeNotify_unknown3(tvbuff_t *tvb _U_, int offset _U_
 
 /* IDL: NTSTATUS eventlog_ChangeNotify( */
 /* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [in] [ref] eventlog_ChangeUnknown0 *unknown2, */
+/* IDL: [ref] [in] eventlog_ChangeUnknown0 *unknown2, */
 /* IDL: [in] uint32 unknown3 */
 /* IDL: ); */
 
@@ -1329,12 +1329,12 @@ eventlog_dissect_element_OpenEventLogW_handle_(tvbuff_t *tvb _U_, int offset _U_
 }
 
 /* IDL: NTSTATUS eventlog_OpenEventLogW( */
-/* IDL: [in] [unique(1)] eventlog_OpenUnknown0 *unknown0, */
+/* IDL: [unique(1)] [in] eventlog_OpenUnknown0 *unknown0, */
 /* IDL: [in] lsa_String Module, */
 /* IDL: [in] lsa_String RegModuleName, */
 /* IDL: [in] uint32 MajorVersion, */
 /* IDL: [in] uint32 MinorVersion, */
-/* IDL: [out] [ref] policy_handle *handle */
+/* IDL: [ref] [out] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1436,12 +1436,12 @@ eventlog_dissect_element_RegisterEventSourceW_handle_(tvbuff_t *tvb _U_, int off
 }
 
 /* IDL: NTSTATUS eventlog_RegisterEventSourceW( */
-/* IDL: [in] [unique(1)] eventlog_OpenUnknown0 *unknown0, */
+/* IDL: [unique(1)] [in] eventlog_OpenUnknown0 *unknown0, */
 /* IDL: [in] lsa_String logname, */
 /* IDL: [in] lsa_String servername, */
 /* IDL: [in] uint32 unknown2, */
 /* IDL: [in] uint32 unknown3, */
-/* IDL: [out] [ref] policy_handle *handle */
+/* IDL: [ref] [out] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1535,11 +1535,11 @@ eventlog_dissect_element_OpenBackupEventLogW_handle_(tvbuff_t *tvb _U_, int offs
 }
 
 /* IDL: NTSTATUS eventlog_OpenBackupEventLogW( */
-/* IDL: [in] [unique(1)] eventlog_OpenUnknown0 *unknown0, */
+/* IDL: [unique(1)] [in] eventlog_OpenUnknown0 *unknown0, */
 /* IDL: [in] lsa_String logname, */
 /* IDL: [in] uint32 unknown2, */
 /* IDL: [in] uint32 unknown3, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1668,7 +1668,7 @@ eventlog_dissect_element_ReadEventLogW_real_size_(tvbuff_t *tvb _U_, int offset
 /* IDL: [in] uint32 offset, */
 /* IDL: [in] uint32 number_of_bytes, */
 /* IDL: [ref] [out] [size_is(number_of_bytes)] uint8 *data, */
-/* IDL: [out] [ref] uint32 *sent_size, */
+/* IDL: [ref] [out] uint32 *sent_size, */
 /* IDL: [out] [ref] uint32 *real_size */
 /* IDL: ); */
 
@@ -2145,9 +2145,9 @@ eventlog_dissect_element_GetLogIntormation_cbBytesNeeded_(tvbuff_t *tvb _U_, int
 }
 
 /* IDL: NTSTATUS eventlog_GetLogIntormation( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] uint32 dwInfoLevel, */
-/* IDL: [size_is(cbBufSize)] [out] uint8 lpBuffer[*], */
+/* IDL: [out] [size_is(cbBufSize)] uint8 lpBuffer[*], */
 /* IDL: [in] uint32 cbBufSize, */
 /* IDL: [out] [ref] int32 *cbBytesNeeded */
 /* IDL: ); */
@@ -2284,190 +2284,190 @@ static dcerpc_sub_dissector eventlog_dissectors[] = {
 void proto_register_dcerpc_eventlog(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_eventlog_eventlog_Record_sid_offset,
-	  { "Sid Offset", "eventlog.eventlog_Record.sid_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_GetLogIntormation_handle,
-	  { "Handle", "eventlog.eventlog_GetLogIntormation.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_opnum,
-	  { "Operation", "eventlog.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReportEventW_Type,
-	  { "Type", "eventlog.eventlog_ReportEventW.Type", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_event_category,
-	  { "Event Category", "eventlog.eventlog_Record.event_category", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE,
-	  { "Eventlog Audit Failure", "eventlog.eventlogEventTypes.EVENTLOG_AUDIT_FAILURE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_AUDIT_FAILURE_tfs), ( 0x0010 ), NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ChangeUnknown0_unknown0,
-	  { "Unknown0", "eventlog.eventlog_ChangeUnknown0.unknown0", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_GetLogIntormation_cbBytesNeeded,
-	  { "Cbbytesneeded", "eventlog.eventlog_GetLogIntormation.cbBytesNeeded", FT_INT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReadEventLogW_sent_size,
-	  { "Sent Size", "eventlog.eventlog_ReadEventLogW.sent_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReadEventLogW_real_size,
-	  { "Real Size", "eventlog.eventlog_ReadEventLogW.real_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_raw_data,
-	  { "Raw Data", "eventlog.eventlog_Record.raw_data", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_time_written,
-	  { "Time Written", "eventlog.eventlog_Record.time_written", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_OpenUnknown0_unknown1,
-	  { "Unknown1", "eventlog.eventlog_OpenUnknown0.unknown1", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_GetNumRecords_number,
-	  { "Number", "eventlog.eventlog_GetNumRecords.number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_Record_source_name,
-	  { "Source Name", "eventlog.Record.source_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_source_name,
-	  { "Source Name", "eventlog.eventlog_Record.source_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_size,
-	  { "Size", "eventlog.eventlog_Record.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_Record_string,
+		{ "string", "eventlog.Record.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ,
+		{ "Eventlog Forwards Read", "eventlog.eventlogReadFlags.EVENTLOG_FORWARDS_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_FORWARDS_READ_tfs), ( 0x0004 ), NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReadEventLogW_data,
+		{ "Data", "eventlog.eventlog_ReadEventLogW.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_computer_name,
+		{ "Computer Name", "eventlog.eventlog_Record.computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_Record_closing_record_number,
-	  { "Closing Record Number", "eventlog.eventlog_Record.closing_record_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReadEventLogW_number_of_bytes,
-	  { "Number Of Bytes", "eventlog.eventlog_ReadEventLogW.number_of_bytes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Closing Record Number", "eventlog.eventlog_Record.closing_record_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_OpenBackupEventLogW_logname,
+		{ "Logname", "eventlog.eventlog_OpenBackupEventLogW.logname", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_data_offset,
+		{ "Data Offset", "eventlog.eventlog_Record.data_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_BackupEventLogW_handle,
+		{ "Handle", "eventlog.eventlog_BackupEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReportEventW_handle,
+		{ "Handle", "eventlog.eventlog_ReportEventW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_OpenBackupEventLogW_unknown0,
+		{ "Unknown0", "eventlog.eventlog_OpenBackupEventLogW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_num_of_strings,
+		{ "Num Of Strings", "eventlog.eventlog_Record.num_of_strings", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE,
+		{ "Eventlog Information Type", "eventlog.eventlogEventTypes.EVENTLOG_INFORMATION_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_INFORMATION_TYPE_tfs), ( 0x0004 ), NULL, HFILL }},
+	{ &hf_eventlog_eventlog_OpenEventLogW_MinorVersion,
+		{ "Minorversion", "eventlog.eventlog_OpenEventLogW.MinorVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_GetLogIntormation_lpBuffer,
+		{ "Lpbuffer", "eventlog.eventlog_GetLogIntormation.lpBuffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_time_written,
+		{ "Time Written", "eventlog.eventlog_Record.time_written", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_OpenBackupEventLogW_unknown3,
-	  { "Unknown3", "eventlog.eventlog_OpenBackupEventLogW.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown3", "eventlog.eventlog_OpenBackupEventLogW.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_OpenUnknown0_unknown0,
-	  { "Unknown0", "eventlog.eventlog_OpenUnknown0.unknown0", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown0", "eventlog.eventlog_OpenUnknown0.unknown0", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_GetLogIntormation_cbBytesNeeded,
+		{ "Cbbytesneeded", "eventlog.eventlog_GetLogIntormation.cbBytesNeeded", FT_INT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS,
+		{ "Eventlog Audit Success", "eventlog.eventlogEventTypes.EVENTLOG_AUDIT_SUCCESS", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS_tfs), ( 0x0008 ), NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ChangeUnknown0_unknown1,
+		{ "Unknown1", "eventlog.eventlog_ChangeUnknown0.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_RegisterEventSourceW_logname,
+		{ "Logname", "eventlog.eventlog_RegisterEventSourceW.logname", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_Record_strings,
-	  { "Strings", "eventlog.eventlog_Record.strings", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_Record_length,
-	  { "Record Length", "eventlog.Record.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReadEventLogW_offset,
-	  { "Offset", "eventlog.eventlog_ReadEventLogW.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_GetNumRecords_handle,
-	  { "Handle", "eventlog.eventlog_GetNumRecords.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_event_type,
-	  { "Event Type", "eventlog.eventlog_Record.event_type", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_data_offset,
-	  { "Data Offset", "eventlog.eventlog_Record.data_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_num_of_strings,
-	  { "Num Of Strings", "eventlog.eventlog_Record.num_of_strings", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_FlushEventLog_handle,
-	  { "Handle", "eventlog.eventlog_FlushEventLog.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_record_number,
-	  { "Record Number", "eventlog.eventlog_Record.record_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReportEventW_data_length,
-	  { "Data Length", "eventlog.eventlog_ReportEventW.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ChangeNotify_handle,
-	  { "Handle", "eventlog.eventlog_ChangeNotify.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_CloseEventLog_handle,
-	  { "Handle", "eventlog.eventlog_CloseEventLog.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Strings", "eventlog.eventlog_Record.strings", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE,
+		{ "Eventlog Audit Failure", "eventlog.eventlogEventTypes.EVENTLOG_AUDIT_FAILURE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_AUDIT_FAILURE_tfs), ( 0x0010 ), NULL, HFILL }},
+	{ &hf_eventlog_eventlog_RegisterEventSourceW_unknown0,
+		{ "Unknown0", "eventlog.eventlog_RegisterEventSourceW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_OpenBackupEventLogW_unknown2,
+		{ "Unknown2", "eventlog.eventlog_OpenBackupEventLogW.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_raw_data,
+		{ "Raw Data", "eventlog.eventlog_Record.raw_data", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_size,
+		{ "Size", "eventlog.eventlog_Record.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_OpenEventLogW_unknown0,
-	  { "Unknown0", "eventlog.eventlog_OpenEventLogW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Unknown0", "eventlog.eventlog_OpenEventLogW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_CloseEventLog_handle,
+		{ "Handle", "eventlog.eventlog_CloseEventLog.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_data_length,
+		{ "Data Length", "eventlog.eventlog_Record.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_GetNumRecords_number,
+		{ "Number", "eventlog.eventlog_GetNumRecords.number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_sid_length,
+		{ "Sid Length", "eventlog.eventlog_Record.sid_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_event_id,
+		{ "Event Id", "eventlog.eventlog_Record.event_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ChangeNotify_unknown3,
+		{ "Unknown3", "eventlog.eventlog_ChangeNotify.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReadEventLogW_handle,
+		{ "Handle", "eventlog.eventlog_ReadEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ,
+		{ "Eventlog Seek Read", "eventlog.eventlogReadFlags.EVENTLOG_SEEK_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_SEEK_READ_tfs), ( 0x0002 ), NULL, HFILL }},
+	{ &hf_eventlog_Record_length,
+		{ "Record Length", "eventlog.Record.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_OpenEventLogW_RegModuleName,
-	  { "Regmodulename", "eventlog.eventlog_OpenEventLogW.RegModuleName", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Regmodulename", "eventlog.eventlog_OpenEventLogW.RegModuleName", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReadEventLogW_sent_size,
+		{ "Sent Size", "eventlog.eventlog_ReadEventLogW.sent_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ClearEventLogW_handle,
+		{ "Handle", "eventlog.eventlog_ClearEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_OpenEventLogW_handle,
+		{ "Handle", "eventlog.eventlog_OpenEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ChangeNotify_unknown2,
+		{ "Unknown2", "eventlog.eventlog_ChangeNotify.unknown2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_source_name,
+		{ "Source Name", "eventlog.eventlog_Record.source_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ChangeUnknown0_unknown0,
+		{ "Unknown0", "eventlog.eventlog_ChangeUnknown0.unknown0", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_event_category,
+		{ "Event Category", "eventlog.eventlog_Record.event_category", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_Record_computer_name,
+		{ "Computer Name", "eventlog.Record.computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReportEventW_num_of_strings,
+		{ "Num Of Strings", "eventlog.eventlog_ReportEventW.num_of_strings", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_Record,
+		{ "Record", "eventlog.Record", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_sid_offset,
+		{ "Sid Offset", "eventlog.eventlog_Record.sid_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE,
+		{ "Eventlog Warning Type", "eventlog.eventlogEventTypes.EVENTLOG_WARNING_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_WARNING_TYPE_tfs), ( 0x0002 ), NULL, HFILL }},
+	{ &hf_eventlog_eventlog_GetLogIntormation_dwInfoLevel,
+		{ "Dwinfolevel", "eventlog.eventlog_GetLogIntormation.dwInfoLevel", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_GetNumRecords_handle,
+		{ "Handle", "eventlog.eventlog_GetNumRecords.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_BackupEventLogW_backupfilename,
-	  { "Backupfilename", "eventlog.eventlog_BackupEventLogW.backupfilename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_OpenEventLogW_Module,
-	  { "Module", "eventlog.eventlog_OpenEventLogW.Module", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ChangeUnknown0_unknown1,
-	  { "Unknown1", "eventlog.eventlog_ChangeUnknown0.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Backupfilename", "eventlog.eventlog_BackupEventLogW.backupfilename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_RegisterEventSourceW_handle,
+		{ "Handle", "eventlog.eventlog_RegisterEventSourceW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_SUCCESS,
-	  { "Eventlog Success", "eventlog.eventlogEventTypes.EVENTLOG_SUCCESS", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_SUCCESS_tfs), ( 0x0000 ), NULL, HFILL }},
-	{ &hf_eventlog_eventlog_OpenBackupEventLogW_unknown0,
-	  { "Unknown0", "eventlog.eventlog_OpenBackupEventLogW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Eventlog Success", "eventlog.eventlogEventTypes.EVENTLOG_SUCCESS", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_SUCCESS_tfs), ( 0x0000 ), NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ClearEventLogW_backupfilename,
+		{ "Backupfilename", "eventlog.eventlog_ClearEventLogW.backupfilename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlogReadFlags_EVENTLOG_BACKWARDS_READ,
-	  { "Eventlog Backwards Read", "eventlog.eventlogReadFlags.EVENTLOG_BACKWARDS_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_BACKWARDS_READ_tfs), ( 0x0008 ), NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_data_length,
-	  { "Data Length", "eventlog.eventlog_Record.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Eventlog Backwards Read", "eventlog.eventlogReadFlags.EVENTLOG_BACKWARDS_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_BACKWARDS_READ_tfs), ( 0x0008 ), NULL, HFILL }},
 	{ &hf_eventlog_eventlog_RegisterEventSourceW_unknown3,
-	  { "Unknown3", "eventlog.eventlog_RegisterEventSourceW.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ClearEventLogW_backupfilename,
-	  { "Backupfilename", "eventlog.eventlog_ClearEventLogW.backupfilename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_DeregisterEventSource_handle,
-	  { "Handle", "eventlog.eventlog_DeregisterEventSource.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_GetLogIntormation_lpBuffer,
-	  { "Lpbuffer", "eventlog.eventlog_GetLogIntormation.lpBuffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown3", "eventlog.eventlog_RegisterEventSourceW.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_OpenEventLogW_MajorVersion,
+		{ "Majorversion", "eventlog.eventlog_OpenEventLogW.MajorVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReportEventW_event_category,
+		{ "Event Category", "eventlog.eventlog_ReportEventW.event_category", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_GetOldestRecord_oldest,
+		{ "Oldest", "eventlog.eventlog_GetOldestRecord.oldest", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReportEventW_data_length,
+		{ "Data Length", "eventlog.eventlog_ReportEventW.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_ReportEventW_computer_name,
-	  { "Computer Name", "eventlog.eventlog_ReportEventW.computer_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_BackupEventLogW_handle,
-	  { "Handle", "eventlog.eventlog_BackupEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE,
-	  { "Eventlog Information Type", "eventlog.eventlogEventTypes.EVENTLOG_INFORMATION_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_INFORMATION_TYPE_tfs), ( 0x0004 ), NULL, HFILL }},
-	{ &hf_eventlog_Record,
-	  { "Record", "eventlog.Record", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_Record_string,
-	  { "string", "eventlog.Record.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_OpenEventLogW_handle,
-	  { "Handle", "eventlog.eventlog_OpenEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_stringoffset,
-	  { "Stringoffset", "eventlog.eventlog_Record.stringoffset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReadEventLogW_flags,
-	  { "Flags", "eventlog.eventlog_ReadEventLogW.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS,
-	  { "Eventlog Audit Success", "eventlog.eventlogEventTypes.EVENTLOG_AUDIT_SUCCESS", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS_tfs), ( 0x0008 ), NULL, HFILL }},
-	{ &hf_eventlog_eventlog_RegisterEventSourceW_logname,
-	  { "Logname", "eventlog.eventlog_RegisterEventSourceW.logname", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ,
-	  { "Eventlog Seek Read", "eventlog.eventlogReadFlags.EVENTLOG_SEEK_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_SEEK_READ_tfs), ( 0x0002 ), NULL, HFILL }},
-	{ &hf_eventlog_eventlog_GetLogIntormation_dwInfoLevel,
-	  { "Dwinfolevel", "eventlog.eventlog_GetLogIntormation.dwInfoLevel", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReportEventW_num_of_strings,
-	  { "Num Of Strings", "eventlog.eventlog_ReportEventW.num_of_strings", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE,
-	  { "Eventlog Error Type", "eventlog.eventlogEventTypes.EVENTLOG_ERROR_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_ERROR_TYPE_tfs), ( 0x0001 ), NULL, HFILL }},
+		{ "Computer Name", "eventlog.eventlog_ReportEventW.computer_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReadEventLogW_offset,
+		{ "Offset", "eventlog.eventlog_ReadEventLogW.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_FlushEventLog_handle,
+		{ "Handle", "eventlog.eventlog_FlushEventLog.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_opnum,
+		{ "Operation", "eventlog.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReadEventLogW_number_of_bytes,
+		{ "Number Of Bytes", "eventlog.eventlog_ReadEventLogW.number_of_bytes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_RegisterEventSourceW_servername,
-	  { "Servername", "eventlog.eventlog_RegisterEventSourceW.servername", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Servername", "eventlog.eventlog_RegisterEventSourceW.servername", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReportEventW_time,
+		{ "Time", "eventlog.eventlog_ReportEventW.time", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_event_type,
+		{ "Event Type", "eventlog.eventlog_Record.event_type", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReadEventLogW_real_size,
+		{ "Real Size", "eventlog.eventlog_ReadEventLogW.real_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_stringoffset,
+		{ "Stringoffset", "eventlog.eventlog_Record.stringoffset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReportEventW_event_id,
+		{ "Event Id", "eventlog.eventlog_ReportEventW.event_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_DeregisterEventSource_handle,
+		{ "Handle", "eventlog.eventlog_DeregisterEventSource.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReportEventW_Type,
+		{ "Type", "eventlog.eventlog_ReportEventW.Type", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_GetLogIntormation_cbBufSize,
+		{ "Cbbufsize", "eventlog.eventlog_GetLogIntormation.cbBufSize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_OpenEventLogW_Module,
+		{ "Module", "eventlog.eventlog_OpenEventLogW.Module", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ,
+		{ "Eventlog Sequential Read", "eventlog.eventlogReadFlags.EVENTLOG_SEQUENTIAL_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ_tfs), ( 0x0001 ), NULL, HFILL }},
 	{ &hf_eventlog_eventlog_GetOldestRecord_handle,
-	  { "Handle", "eventlog.eventlog_GetOldestRecord.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Handle", "eventlog.eventlog_GetOldestRecord.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_GetLogIntormation_handle,
+		{ "Handle", "eventlog.eventlog_GetLogIntormation.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_RegisterEventSourceW_unknown2,
-	  { "Unknown2", "eventlog.eventlog_RegisterEventSourceW.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReadEventLogW_data,
-	  { "Data", "eventlog.eventlog_ReadEventLogW.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_computer_name,
-	  { "Computer Name", "eventlog.eventlog_Record.computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_sid_length,
-	  { "Sid Length", "eventlog.eventlog_Record.sid_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ChangeNotify_unknown3,
-	  { "Unknown3", "eventlog.eventlog_ChangeNotify.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_status,
-	  { "NT Error", "eventlog.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReportEventW_time,
-	  { "Time", "eventlog.eventlog_ReportEventW.time", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_OpenBackupEventLogW_logname,
-	  { "Logname", "eventlog.eventlog_OpenBackupEventLogW.logname", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_RegisterEventSourceW_handle,
-	  { "Handle", "eventlog.eventlog_RegisterEventSourceW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ClearEventLogW_handle,
-	  { "Handle", "eventlog.eventlog_ClearEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_OpenEventLogW_MajorVersion,
-	  { "Majorversion", "eventlog.eventlog_OpenEventLogW.MajorVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown2", "eventlog.eventlog_RegisterEventSourceW.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_OpenBackupEventLogW_handle,
-	  { "Handle", "eventlog.eventlog_OpenBackupEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_Record_computer_name,
-	  { "Computer Name", "eventlog.Record.computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReportEventW_handle,
-	  { "Handle", "eventlog.eventlog_ReportEventW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_OpenEventLogW_MinorVersion,
-	  { "Minorversion", "eventlog.eventlog_OpenEventLogW.MinorVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ,
-	  { "Eventlog Sequential Read", "eventlog.eventlogReadFlags.EVENTLOG_SEQUENTIAL_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ_tfs), ( 0x0001 ), NULL, HFILL }},
+		{ "Handle", "eventlog.eventlog_OpenBackupEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_eventlog_eventlog_Record_time_generated,
-	  { "Time Generated", "eventlog.eventlog_Record.time_generated", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_GetLogIntormation_cbBufSize,
-	  { "Cbbufsize", "eventlog.eventlog_GetLogIntormation.cbBufSize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ,
-	  { "Eventlog Forwards Read", "eventlog.eventlogReadFlags.EVENTLOG_FORWARDS_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_FORWARDS_READ_tfs), ( 0x0004 ), NULL, HFILL }},
-	{ &hf_eventlog_eventlog_GetOldestRecord_oldest,
-	  { "Oldest", "eventlog.eventlog_GetOldestRecord.oldest", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_reserved,
-	  { "Reserved", "eventlog.eventlog_Record.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_OpenBackupEventLogW_unknown2,
-	  { "Unknown2", "eventlog.eventlog_OpenBackupEventLogW.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_RegisterEventSourceW_unknown0,
-	  { "Unknown0", "eventlog.eventlog_RegisterEventSourceW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReportEventW_event_id,
-	  { "Event Id", "eventlog.eventlog_ReportEventW.event_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_Record_event_id,
-	  { "Event Id", "eventlog.eventlog_Record.event_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE,
-	  { "Eventlog Warning Type", "eventlog.eventlogEventTypes.EVENTLOG_WARNING_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_WARNING_TYPE_tfs), ( 0x0002 ), NULL, HFILL }},
+		{ "Time Generated", "eventlog.eventlog_Record.time_generated", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE,
+		{ "Eventlog Error Type", "eventlog.eventlogEventTypes.EVENTLOG_ERROR_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_ERROR_TYPE_tfs), ( 0x0001 ), NULL, HFILL }},
 	{ &hf_eventlog_eventlog_Record_reserved_flags,
-	  { "Reserved Flags", "eventlog.eventlog_Record.reserved_flags", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReportEventW_event_category,
-	  { "Event Category", "eventlog.eventlog_ReportEventW.event_category", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ReadEventLogW_handle,
-	  { "Handle", "eventlog.eventlog_ReadEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_eventlog_eventlog_ChangeNotify_unknown2,
-	  { "Unknown2", "eventlog.eventlog_ChangeNotify.unknown2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Reserved Flags", "eventlog.eventlog_Record.reserved_flags", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_status,
+		{ "NT Error", "eventlog.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
+	{ &hf_eventlog_Record_source_name,
+		{ "Source Name", "eventlog.Record.source_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_record_number,
+		{ "Record Number", "eventlog.eventlog_Record.record_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ReadEventLogW_flags,
+		{ "Flags", "eventlog.eventlog_ReadEventLogW.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_Record_reserved,
+		{ "Reserved", "eventlog.eventlog_Record.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_OpenUnknown0_unknown1,
+		{ "Unknown1", "eventlog.eventlog_OpenUnknown0.unknown1", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_eventlog_eventlog_ChangeNotify_handle,
+		{ "Handle", "eventlog.eventlog_ChangeNotify.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-fileexp.c b/epan/dissectors/packet-dcerpc-fileexp.c
index 5f0494c537..9e6551554c 100644
--- a/epan/dissectors/packet-dcerpc-fileexp.c
+++ b/epan/dissectors/packet-dcerpc-fileexp.c
@@ -347,8 +347,7 @@ dissect_afsFid (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "afsFid:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsFid);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_afsFid, &item, "afsFid:");
     }
 
 
@@ -410,10 +409,9 @@ dissect_afsConnParams (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-	proto_tree_add_text (parent_tree, tvb, offset, -1,
-			     "afsConnParams_t:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsConnParams);
+      tree =
+	proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+			     ett_fileexp_afsConnParams, &item, "afsConnParams_t:");
     }
   offset =
     dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -566,10 +564,9 @@ typedef [string] byte   NameString_t[AFS_NAMEMAX];
 
   if (parent_tree)
     {
-      item =
-	proto_tree_add_text (parent_tree, tvb, offset, -1,
-			     "afsNameString_t:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsNameString_t);
+      tree =
+	proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+			     ett_fileexp_afsNameString_t, &item, "afsNameString_t:");
     }
 
  offset =
@@ -619,9 +616,8 @@ dissect_afsNetAddr (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "afsNetAddr:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsNetAddr);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_afsNetAddr, &item, "afsNetAddr:");
     }
 
 
@@ -699,9 +695,8 @@ dissect_afsNetData (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-	proto_tree_add_text (parent_tree, tvb, offset, -1, "afsNetData:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsNetData);
+      tree =
+	proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_fileexp_afsNetData, &item, "afsNetData:");
     }
 
 
@@ -741,9 +736,8 @@ dissect_afsTaggedPath (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-	proto_tree_add_text (parent_tree, tvb, offset, -1, "afsTaggedPath");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsTaggedPath);
+      tree =
+	proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_fileexp_afsTaggedPath, &item, "afsTaggedPath");
     }
 
 
@@ -790,8 +784,7 @@ dissect_afsAcl (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "afsAcl");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsAcl);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_afsAcl, &item, "afsAcl");
     }
 
 
@@ -848,9 +841,8 @@ dissect_afsErrorStatus (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "afsErrorStatus");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsErrorStatus);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_afsErrorStatus, &item, "afsErrorStatus");
     }
 
   offset =
@@ -895,9 +887,8 @@ dissect_afsRecordLock (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "afsRecordLock:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsRecordLock);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_afsRecordLock, &item, "afsRecordLock:");
     }
 
   offset =
@@ -980,9 +971,8 @@ dissect_afsstorestatus (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "afsStoreStatus:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsstorestatus);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_afsstorestatus, &item, "afsStoreStatus:");
     }
 
   offset =
@@ -1154,8 +1144,7 @@ dissect_afstoken (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "afsToken:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afstoken);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_afstoken, &item, "afsToken:");
     }
 
   offset =
@@ -1297,9 +1286,8 @@ dissect_afstaggedname (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "afsTaggedName:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afstaggedname);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_afstaggedname, &item, "afsTaggedName:");
     }
 
   offset =
@@ -1348,9 +1336,8 @@ dissect_afsfidtaggedname (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "FidTaggedName:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsfidtaggedname);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_afsfidtaggedname, &item, "FidTaggedName:");
     }
   offset = dissect_afsFid (tvb, offset, pinfo, tree, di, drep);
   offset = dissect_afstaggedname (tvb, offset, pinfo, tree, di, drep);
@@ -1382,8 +1369,7 @@ dissect_minvvp (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "minVVp:");
-      tree = proto_item_add_subtree (item, ett_fileexp_minvvp);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_minvvp,  &item, "minVVp:");
     }
   offset =
     dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -1424,8 +1410,7 @@ dissect_afsuuid (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "afsUUID:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsuuid);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_afsuuid, &item, "afsUUID:");
     }
 
   offset = dissect_ndr_uuid_t (tvb, offset, pinfo, tree, di, drep, hf_fileexp_afsuuid_uuid, &uuid1);
@@ -1459,8 +1444,7 @@ dissect_offsetp (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "minVVp:");
-      tree = proto_item_add_subtree (item, ett_fileexp_offsetp);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_offsetp, &item, "minVVp:");
     }
   offset =
     dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -1500,8 +1484,7 @@ dissect_returntokenidp (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "returnTokenIDp:");
-      tree = proto_item_add_subtree (item, ett_fileexp_returntokenidp);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_returntokenidp, &item, "returnTokenIDp:");
     }
   offset =
     dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -1548,9 +1531,8 @@ dissect_volsync (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "AfsVolSync:");
-      tree = proto_item_add_subtree (item, ett_fileexp_volsync);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_volsync, &item, "AfsVolSync:");
     }
 
   offset =
@@ -1612,8 +1594,7 @@ dissect_afsFlags (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "AfsFlags:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsflags);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_afsflags, &item, "AfsFlags:");
     }
 
   offset =
@@ -1769,9 +1750,8 @@ dissect_fetchstatus (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "FetchStatus:");
-      tree = proto_item_add_subtree (item, ett_fileexp_fetchstatus);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_fetchstatus, &item, "FetchStatus:");
     }
 
   offset =
@@ -1928,9 +1908,8 @@ dissect_afsReturnDesc (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "afsReturnDesc:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsReturnDesc);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fileexp_afsReturnDesc, &item, "afsReturnDesc:");
     }
 
 
@@ -2003,8 +1982,7 @@ dissect_afsbundled_stat (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "afsbundled_stat:");
-      tree = proto_item_add_subtree (item, ett_fileexp_afsbundled_stat);
+      tree = proto_tree_add_subtree (parent_tree, tvb, offset, -1, ett_fileexp_afsbundled_stat, &item, "afsbundled_stat:");
     }
 
 /*  bundled_stat
diff --git a/epan/dissectors/packet-dcerpc-fldb.c b/epan/dissectors/packet-dcerpc-fldb.c
index 5b4fce15d4..ae40cfd103 100644
--- a/epan/dissectors/packet-dcerpc-fldb.c
+++ b/epan/dissectors/packet-dcerpc-fldb.c
@@ -250,9 +250,8 @@ dissect_afsnetaddr (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "afsNetAddr:");
-      tree = proto_item_add_subtree (item, ett_fldb_afsnetaddr);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fldb_afsnetaddr, &item, "afsNetAddr:");
     }
 
 /*                 unsigned16 type;
@@ -334,9 +333,8 @@ dissect_vlconf_cell (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "vlconf_cell:");
-      tree = proto_item_add_subtree (item, ett_fldb_vlconf_cell);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fldb_vlconf_cell, &item, "vlconf_cell:");
     }
 
   /* byte name[MAXVLCELLCHARS];          Cell name */
@@ -445,10 +443,8 @@ typedef [string] byte   NameString_t[AFS_NAMEMAX];
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-				  "afsNameString_t:");
-      tree = proto_item_add_subtree (item, ett_fldb_afsNameString_t);
-    }
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+				  ett_fldb_afsNameString_t, &item, "afsNameString_t:");    }
 
   offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
 			       hf_fldb_afsNameString_t_principalName_size,
@@ -488,8 +484,7 @@ dissect_afsflags (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "afsFlags:");
-      tree = proto_item_add_subtree (item, ett_fldb_afsflags);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_fldb_afsflags, &item, "afsFlags:");
     }
 
   offset =
@@ -601,8 +596,7 @@ dissect_siteflags (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "SiteFlags:");
-      tree = proto_item_add_subtree (item, ett_fldb_siteflags);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_fldb_siteflags, &item, "SiteFlags:");
     }
 
   offset =
@@ -676,8 +670,7 @@ dissect_vldbentry (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1, "vldbentry:");
-      tree = proto_item_add_subtree (item, ett_fldb_vldbentry);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_fldb_vldbentry, &item, "vldbentry:");
     }
 
 /*    byte            name[114];      Volume name  */
diff --git a/epan/dissectors/packet-dcerpc-frsrpc.c b/epan/dissectors/packet-dcerpc-frsrpc.c
index 5072ae1e52..99d055afe0 100644
--- a/epan/dissectors/packet-dcerpc-frsrpc.c
+++ b/epan/dissectors/packet-dcerpc-frsrpc.c
@@ -45,182 +45,182 @@ static gint ett_frsrpc_frsrpc_FrsSendCommPktReq = -1;
 
 
 /* Header field declarations */
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_data_checksum = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCALCO = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_password = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_co_guid_ = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_CO_ABORT = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_VV_UPDATE = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_RETRY = -1;
+static gint hf_frsrpc_werror = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_ack_version = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_name_length = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_block_size = -1;
+static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_replica_set_name = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare3guid_p2 = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_DIRECTED_CO = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_last_join_time = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MORPH_GEN_HEAD = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_block = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_join_time = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTROL = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding1 = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_COMPRESSED_STAGE = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunk_type = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding3 = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkGuidName_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2guid_p1 = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_OVERWRITE = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_VVRETIRE_EXEC = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_remote_co = -1;
 static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_OLD_NAME = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VV_ACTIVATED = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_co_ext_win2k_ = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_co_guid = -1;
 static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_extension = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_VV_UPDATE = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunk_data = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_offset = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_name = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding2 = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_name = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_attributes = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCALCO = -1;
+static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_data_name = -1;
 static gint hf_frsrpc_CommPktChangeOrderCommand_file_name = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_frs_vsn = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_vvector_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_remote_co = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1guid_p1 = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_new_replica_num = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_replica_set_type = -1;
+static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_prefix_size = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_content_cmd = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_NEW_FILE = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_connection_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_replica_version_guid_ = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_password = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_SECURITY_CHANGE = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NEW_NAME = -1;
 static gint hf_frsrpc_frsrpc_CommPktChunkData_co_extension2 = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_major = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2ul1 = -1;
-static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_not_used = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ONLIST = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_guid = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset_count = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2bin = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding3 = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_DIR_ENUM_PENDING = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_version_number = -1;
 static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_major = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_CO_ABORT = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_data_retry_timeout = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCATION_CMD = -1;
+static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_parent_password = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1guid_p1 = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_join_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_co_guid_ = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_bop = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_field_size = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_EXTEND = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_replica_version_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_event_time = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_join_time_ = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_CREATE = -1;
+static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_pkt_len = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_vvector = -1;
 static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_not_used = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare3guid_p2 = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_change_order_guid = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VVJOIN_TO_ORIG = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_guid_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding1 = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_replica_set_name = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2wcs = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_join_guid_ = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_to = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset_last = -1;
+static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_data_handle = -1;
+static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_upk_len = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_sequence_number = -1;
 static gint hf_frsrpc_frsrpc_CommPktGSVN_vsn = -1;
-static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_first_try_time = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_bopend = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_offset = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset_count = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_co_ext_win2k = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_bop = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_jrnl_usn = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1wcs = -1;
+static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_replica_set_type = -1;
+static gint hf_frsrpc_opnum = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_jrnl_first_usn = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_connection = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTENT_CMD = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_EXTEND = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_princ_name = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_co_sequnence_number = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_new_parent_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset_count = -1;
 static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_partner_auth_level = -1;
+static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_parent_account = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_flags = -1;
+static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_minor = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_ORIG_REC_C = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_vvector_ = -1;
+static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent___ndr_guid_size = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_file_size = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_major = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_gvsn_ = -1;
 static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset = -1;
+static gint hf_frsrpc_frsrpc_CommPktGSVN_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_replica = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding4 = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_guid = -1;
 static gint hf_frsrpc_frsrpc_CommPktChunkGuidName_name = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_guid_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_BASIC_INFO_CHANGE = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_last_join_time = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_bopend = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ONLIST = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_command = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkGuidName_name_ = -1;
+static gint hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_prefix_type = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_jrnl_usn = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_not_used = -1;
 static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_field_size = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_remote_co_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_flags = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_new_replica_num = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_block_size = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_OVERWRITE = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_data_retry_timeout = -1;
-static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_parent_account = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_iflags = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_CREATE = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_name = -1;
 static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_ctr = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1guid_p2 = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_EA_CHANGE = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_replica_version_guid_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_field_size = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_change_order_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_OVERWRITE = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_co_ext_win2k = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MOVEIN_GEN = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_blob = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2bin = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_old_parent_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_COMPRESSION_CHANGE = -1;
 static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ABORT_CO = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_content_cmd = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_major = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_gvsn = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding4 = -1;
+static gint hf_frsrpc_frsrpc_FrsSendCommPkt_req = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent___ndr_guid_size = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1guid_p2 = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_BASIC_INFO_CHANGE = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_frs_vsn = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_guid_ = -1;
 static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_data_checksum = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_file_offset = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_VVRETIRE_EXEC = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_OVERWRITE = -1;
 static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_memory_len = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding2 = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_princ_name = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_location_cmd = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_compression_guid = -1;
-static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_data_handle = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_gvsn_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_ack_version = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_co_sequnence_number = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_account = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MORPH_GEN_HEAD = -1;
-static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_cs_id = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset0 = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_originator_guid = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_DIRECTED_CO = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_COMPRESSED_STAGE = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTENT_CMD = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset_last = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_status = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_gvsn = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_TRUNCATION = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_guid_ = -1;
 static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_auth_level = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_join_time = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent___ndr_guid_size = -1;
-static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_parent_password = -1;
-static gint hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_prefix_size = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_guid = -1;
-static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_replica_set_type = -1;
-static gint hf_frsrpc_werror = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunk_data_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_COMPRESSION_CHANGE = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_attributes = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_not_used = -1;
-static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_count = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_EXTEND = -1;
-static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_pkt_len = -1;
-static gint hf_frsrpc_opnum = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_RETRY = -1;
-static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_prefix_size = -1;
-static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_prefix_type = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_guid = -1;
 static gint hf_CommPktChunk = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTROL = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_name = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_replica_set_type = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_SECURITY_CHANGE = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset_last = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_compression_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset_count = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VV_ACTIVATED = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_DELETE = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_file_offset = -1;
 static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_TRUNCATION = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_guid = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_vvector = -1;
-static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_minor = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2guid_p1 = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_account = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_location_cmd = -1;
 static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_partern_ack_sequence_number = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_replica_set_name = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_join_guid = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_replica_version_guid = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_JUST_OID_RESET = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunk_type = -1;
-static gint hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_prefix_type = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_guid = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_from = -1;
-static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent_replica_set_name = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_OUT_OF_ORDER = -1;
-static gint hf_frsrpc_frsrpc_FrsSendCommPkt_req = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_connection_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_guid = -1;
+static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_cs_id = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset1 = -1;
 static gint hf_frsrpc_frsrpc_CommPktChunkGuidName_guid_ = -1;
-static gint hf_frsrpc_frsrpc_FrsVerifyPromotionParent___ndr_guid_size = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MOVEIN_GEN = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_replica = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkGuidName_name_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_ORIG_REC_C = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCATION_CMD = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_command = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_new_parent_guid = -1;
 static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_ctr_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_jrnl_first_usn = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_file_size = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2wcs = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_EXTEND = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_to = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_connection = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_version_number = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_JUST_OID_RESET = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_usn = -1;
 static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_size = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_name_length = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_TRUNCATION = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NEW_NAME = -1;
-static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_data_name = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_sequence_number = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunk_data = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_event_time = -1;
-static gint hf_frsrpc_frsrpc_CommPktGSVN_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_originator_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_remote_co_ = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunk_data_ = -1;
 static gint hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_data = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_DELETE = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset1 = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_NEW_FILE = -1;
-static gint hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset_last = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_co_guid = -1;
-static gint hf_frsrpc_frsrpc_FrsSendCommPktReq_upk_len = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_co_ext_win2k_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_name = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_join_time_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_join_guid_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_old_parent_guid = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_block = -1;
-static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_guid_ = -1;
-static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_usn = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkData_blob = -1;
+static gint hf_frsrpc_frsrpc_CommPktChunkData_from = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_DIR_ENUM_PENDING = -1;
+static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_first_try_time = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset0 = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_OUT_OF_ORDER = -1;
+static gint hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_prefix_size = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_EA_CHANGE = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_status = -1;
+static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_count = -1;
+static gint hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VVJOIN_TO_ORIG = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2ul1 = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1wcs = -1;
 static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_original_replica_num = -1;
-static gint hf_frsrpc_frsrpc_CommPktChunkGuidName_guid = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_iflags = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_data_checksum = -1;
+static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_prefix_type = -1;
+static gint hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_not_used = -1;
+static gint hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_guid_ = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_name = -1;
+static gint hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_major = -1;
 
 static gint proto_dcerpc_frsrpc = -1;
 /* Version information */
@@ -2320,19 +2320,19 @@ frsrpc_dissect_enum_CommPktChunkType(tvbuff_t *tvb _U_, int offset _U_, packet_i
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_CONNECTION)] [case(FRSRPC_COMM_PKT_CHUNK_CONNECTION)] frsrpc_CommPktChunkGuidName connection; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_JOIN_GUID)] [subcontext(4)] [case(FRSRPC_COMM_PKT_CHUNK_JOIN_GUID)] GUID join_guid; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_LAST_JOIN_TIME)] [case(FRSRPC_COMM_PKT_CHUNK_LAST_JOIN_TIME)] NTTIME last_join_time; */
-/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_VVECTOR)] [subcontext(4)] [case(FRSRPC_COMM_PKT_CHUNK_VVECTOR)] frsrpc_CommPktGSVN vvector; */
-/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_JOIN_TIME)] [subcontext(4)] [case(FRSRPC_COMM_PKT_CHUNK_JOIN_TIME)] NTTIME join_time; */
+/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_VVECTOR)] [case(FRSRPC_COMM_PKT_CHUNK_VVECTOR)] [subcontext(4)] frsrpc_CommPktGSVN vvector; */
+/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_JOIN_TIME)] [case(FRSRPC_COMM_PKT_CHUNK_JOIN_TIME)] [subcontext(4)] NTTIME join_time; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_REPLICA_VERSION_GUID)] [subcontext(4)] [case(FRSRPC_COMM_PKT_CHUNK_REPLICA_VERSION_GUID)] GUID replica_version_guid; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_COMPRESSION_GUID)] [case(FRSRPC_COMM_PKT_CHUNK_COMPRESSION_GUID)] GUID compression_guid; */
-/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_BLOCK)] [case(FRSRPC_COMM_PKT_CHUNK_BLOCK)] [flag(LIBNDR_FLAG_REMAINING)] DATA_BLOB block; */
+/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_BLOCK)] [flag(LIBNDR_FLAG_REMAINING)] [case(FRSRPC_COMM_PKT_CHUNK_BLOCK)] DATA_BLOB block; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_BLOCK_SIZE)] [case(FRSRPC_COMM_PKT_CHUNK_BLOCK_SIZE)] hyper block_size; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_FILE_SIZE)] [case(FRSRPC_COMM_PKT_CHUNK_FILE_SIZE)] hyper file_size; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_FILE_OFFSET)] [case(FRSRPC_COMM_PKT_CHUNK_FILE_OFFSET)] hyper file_offset; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_GVSN)] [subcontext(4)] [case(FRSRPC_COMM_PKT_CHUNK_GVSN)] frsrpc_CommPktGSVN gvsn; */
-/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_CO_GUID)] [subcontext(4)] [case(FRSRPC_COMM_PKT_CHUNK_CO_GUID)] GUID co_guid; */
+/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_CO_GUID)] [case(FRSRPC_COMM_PKT_CHUNK_CO_GUID)] [subcontext(4)] GUID co_guid; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_CO_SEQUENCE_NUMBER)] [case(FRSRPC_COMM_PKT_CHUNK_CO_SEQUENCE_NUMBER)] uint32 co_sequnence_number; */
-/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_REMOTE_CO)] [case(FRSRPC_COMM_PKT_CHUNK_REMOTE_CO)] [subcontext(4)] frsrpc_CommPktChangeOrderCommand remote_co; */
-/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_CO_EXT_WIN2K)] [subcontext(4)] [case(FRSRPC_COMM_PKT_CHUNK_CO_EXT_WIN2K)] frsrpc_CommPktCoRecordExtensionWin2k co_ext_win2k; */
+/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_REMOTE_CO)] [subcontext(4)] [case(FRSRPC_COMM_PKT_CHUNK_REMOTE_CO)] frsrpc_CommPktChangeOrderCommand remote_co; */
+/* IDL: [case(FRSRPC_COMM_PKT_CHUNK_CO_EXT_WIN2K)] [case(FRSRPC_COMM_PKT_CHUNK_CO_EXT_WIN2K)] [subcontext(4)] frsrpc_CommPktCoRecordExtensionWin2k co_ext_win2k; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_CO_EXTENTION_2)] [case(FRSRPC_COMM_PKT_CHUNK_CO_EXTENTION_2)] frsrpc_CommPktChangeOrderRecordExtension co_extension2; */
 /* IDL: [case(FRSRPC_COMM_PKT_CHUNK_EOP)] [value(0xFFFFFFFF)] [case(FRSRPC_COMM_PKT_CHUNK_EOP)] uint32 bopend; */
 /* IDL: } */
@@ -2699,8 +2699,7 @@ frsrpc_dissect_CommPktChunkData(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "frsrpc_CommPktChunkData");
-		tree = proto_item_add_subtree(item, ett_frsrpc_frsrpc_CommPktChunkData);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_frsrpc_frsrpc_CommPktChunkData, &item, "frsrpc_CommPktChunkData");
 	}
 
 	switch(level) {
@@ -2808,7 +2807,7 @@ frsrpc_dissect_CommPktChunkData(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 
 /* IDL: struct { */
 /* IDL: 	frsrpc_CommPktChunkType type; */
-/* IDL: 	[switch_is(type)] [subcontext(4)] frsrpc_CommPktChunkData data; */
+/* IDL: 	[subcontext(4)] [switch_is(type)] frsrpc_CommPktChunkData data; */
 /* IDL: } */
 
 static int
@@ -2908,7 +2907,7 @@ frsrpc_dissect_enum_CommPktMinor(tvbuff_t *tvb _U_, int offset _U_, packet_info
 /* IDL: 	[value(pkt_len+12)] uint32 memory_len; */
 /* IDL: 	[value(ndr_size_frsrpc_CommPktChunkCtr(r->ctr,ndr->flags))] [range(0,262144)] uint32 pkt_len; */
 /* IDL: 	[value(0)] uint32 upk_len; */
-/* IDL: 	[unique(1)] [subcontext(4)] [subcontext_size(pkt_len)] frsrpc_CommPktChunkCtr *ctr; */
+/* IDL: 	[unique(1)] [subcontext_size(pkt_len)] [subcontext(4)] frsrpc_CommPktChunkCtr *ctr; */
 /* IDL: 	[value(0)] uint3264 data_name; */
 /* IDL: 	[value(0)] uint3264 data_handle; */
 /* IDL: } */
@@ -3206,10 +3205,10 @@ frsrpc_dissect_element_FrsVerifyPromotionParent___ndr_guid_size(tvbuff_t *tvb _U
 }
 
 /* IDL: WERROR frsrpc_FrsVerifyPromotionParent( */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *parent_account, */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *parent_password, */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *replica_set_name, */
-/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *replica_set_type, */
+/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *parent_account, */
+/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *parent_password, */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *replica_set_name, */
+/* IDL: [charset(UTF16)] [unique(1)] [in] uint16 *replica_set_type, */
 /* IDL: [in] frsrpc_PartnerAuthLevel partner_auth_level, */
 /* IDL: [in] uint32 __ndr_guid_size */
 /* IDL: ); */
@@ -3505,18 +3504,18 @@ frsrpc_dissect_element_FrsStartPromotionParent_parent_guid__(tvbuff_t *tvb _U_,
 }
 
 /* IDL: WERROR frsrpc_FrsStartPromotionParent( */
-/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *parent_account, */
-/* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *parent_password, */
-/* IDL: [charset(UTF16)] [unique(1)] [in] uint16 *replica_set_name, */
+/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *parent_account, */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *parent_password, */
+/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *replica_set_name, */
 /* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *replica_set_type, */
-/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *connection_name, */
-/* IDL: [charset(UTF16)] [unique(1)] [in] uint16 *partner_name, */
-/* IDL: [charset(UTF16)] [unique(1)] [in] uint16 *partner_princ_name, */
+/* IDL: [charset(UTF16)] [unique(1)] [in] uint16 *connection_name, */
+/* IDL: [unique(1)] [charset(UTF16)] [in] uint16 *partner_name, */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *partner_princ_name, */
 /* IDL: [in] frsrpc_PartnerAuthLevel partner_auth_level, */
-/* IDL: [range(16,16)] [in] [value(16)] uint32 __ndr_guid_size, */
-/* IDL: [subcontext_size(16)] [subcontext(4)] [in] [unique(1)] GUID *connection_guid, */
-/* IDL: [subcontext_size(16)] [subcontext(4)] [in] [unique(1)] GUID *partner_guid, */
-/* IDL: [subcontext_size(16)] [subcontext(4)] [in] [out] [unique(1)] GUID *parent_guid */
+/* IDL: [in] [range(16,16)] [value(16)] uint32 __ndr_guid_size, */
+/* IDL: [subcontext(4)] [in] [subcontext_size(16)] [unique(1)] GUID *connection_guid, */
+/* IDL: [in] [subcontext(4)] [unique(1)] [subcontext_size(16)] GUID *partner_guid, */
+/* IDL: [subcontext(4)] [in] [subcontext_size(16)] [unique(1)] [out] GUID *parent_guid */
 /* IDL: ); */
 
 static int
@@ -3748,358 +3747,358 @@ static dcerpc_sub_dissector frsrpc_dissectors[] = {
 void proto_register_dcerpc_frsrpc(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_data_checksum,
-	  { "Data Checksum", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.data_checksum", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCALCO,
-	  { "Frsrpc Co Flag Localco", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_LOCALCO", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCALCO_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_password,
-	  { "Parent Password", "frsrpc.frsrpc_FrsStartPromotionParent.parent_password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_guid_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_CO_ABORT,
+		{ "Frsrpc Co Iflag Co Abort", "frsrpc.frsrpc_CommPktCoCmdIFlags.FRSRPC_CO_IFLAG_CO_ABORT", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_CO_ABORT_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_VV_UPDATE,
+		{ "Frsrpc Co Flag Skip Vv Update", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_SKIP_VV_UPDATE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_VV_UPDATE_tfs), ( 0x02000000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_RETRY,
+		{ "Frsrpc Co Flag Retry", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_RETRY", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_RETRY_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_frsrpc_werror,
+		{ "Windows Error", "frsrpc.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_ack_version,
+		{ "Ack Version", "frsrpc.frsrpc_CommPktChangeOrderCommand.ack_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_name_length,
+		{ "File Name Length", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_name_length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_block_size,
+		{ "Block Size", "frsrpc.frsrpc_CommPktChunkData.block_size", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_replica_set_name,
+		{ "Replica Set Name", "frsrpc.frsrpc_FrsVerifyPromotionParent.replica_set_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare3guid_p2,
+		{ "Spare3guid P2", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare3guid_p2", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_DIRECTED_CO,
+		{ "Frsrpc Co Flag Directed Co", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_DIRECTED_CO", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_DIRECTED_CO_tfs), ( 0x00002000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_last_join_time,
+		{ "Last Join Time", "frsrpc.frsrpc_CommPktChunkData.last_join_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MORPH_GEN_HEAD,
+		{ "Frsrpc Co Flag Morph Gen Head", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_MORPH_GEN_HEAD", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MORPH_GEN_HEAD_tfs), ( 0x00400000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_block,
+		{ "Block", "frsrpc.frsrpc_CommPktChunkData.block", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_guid,
+		{ "Partner Guid", "frsrpc.frsrpc_FrsStartPromotionParent.partner_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_join_time,
+		{ "Join Time", "frsrpc.frsrpc_CommPktChunkData.join_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTROL,
+		{ "Frsrpc Co Flag Control", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_CONTROL", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTROL_tfs), ( 0x00001000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding1,
+		{ "Padding1", "frsrpc.frsrpc_CommPktChangeOrderCommand.padding1", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_COMPRESSED_STAGE,
+		{ "Frsrpc Co Flag Compressed Stage", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_COMPRESSED_STAGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_COMPRESSED_STAGE_tfs), ( 0x01000000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunk_type,
+		{ "Type", "frsrpc.frsrpc_CommPktChunk.type", FT_UINT1632, BASE_DEC, VALS(frsrpc_frsrpc_CommPktChunkType_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding3,
+		{ "Padding3", "frsrpc.frsrpc_CommPktChangeOrderCommand.padding3", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkGuidName_guid,
+		{ "Guid", "frsrpc.frsrpc_CommPktChunkGuidName.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2guid_p1,
+		{ "Spare2guid P1", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare2guid_p1", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_OVERWRITE,
+		{ "Frsrpc Content Reason Named Data Overwrite", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_NAMED_DATA_OVERWRITE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_OVERWRITE_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_VVRETIRE_EXEC,
+		{ "Frsrpc Co Iflag Vvretire Exec", "frsrpc.frsrpc_CommPktCoCmdIFlags.FRSRPC_CO_IFLAG_VVRETIRE_EXEC", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_VVRETIRE_EXEC_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_remote_co,
+		{ "Remote Co", "frsrpc.frsrpc_CommPktChunkData.remote_co", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_OLD_NAME,
-	  { "Frsrpc Content Reason Old Name", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_OLD_NAME", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_OLD_NAME_tfs), ( 0x00001000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VV_ACTIVATED,
-	  { "Frsrpc Co Flag Vv Activated", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_VV_ACTIVATED", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VV_ACTIVATED_tfs), ( 0x00000002 ), NULL, HFILL }},
+		{ "Frsrpc Content Reason Old Name", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_OLD_NAME", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_OLD_NAME_tfs), ( 0x00001000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_ext_win2k_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_guid,
+		{ "Co Guid", "frsrpc.frsrpc_CommPktChunkData.co_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_extension,
-	  { "Extension", "frsrpc.frsrpc_CommPktChangeOrderCommand.extension", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_VV_UPDATE,
-	  { "Frsrpc Co Flag Skip Vv Update", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_SKIP_VV_UPDATE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_VV_UPDATE_tfs), ( 0x02000000 ), NULL, HFILL }},
+		{ "Extension", "frsrpc.frsrpc_CommPktChangeOrderCommand.extension", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunk_data,
+		{ "Data", "frsrpc.frsrpc_CommPktChunk.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_offset,
+		{ "File Offset", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_offset", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_name,
+		{ "Partner Name", "frsrpc.frsrpc_FrsStartPromotionParent.partner_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding2,
+		{ "Padding2", "frsrpc.frsrpc_CommPktChangeOrderCommand.padding2", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_name,
+		{ "Connection Name", "frsrpc.frsrpc_FrsStartPromotionParent.connection_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_attributes,
+		{ "File Attributes", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCALCO,
+		{ "Frsrpc Co Flag Localco", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_LOCALCO", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCALCO_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_data_name,
+		{ "Data Name", "frsrpc.frsrpc_FrsSendCommPktReq.data_name", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_CommPktChangeOrderCommand_file_name,
-	  { "File Name", "frsrpc.CommPktChangeOrderCommand.file_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_frs_vsn,
-	  { "Frs Vsn", "frsrpc.frsrpc_CommPktChangeOrderCommand.frs_vsn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_vvector_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_remote_co,
-	  { "Remote Co", "frsrpc.frsrpc_CommPktChunkData.remote_co", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1guid_p1,
-	  { "Spare1guid P1", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare1guid_p1", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "File Name", "frsrpc.CommPktChangeOrderCommand.file_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_new_replica_num,
+		{ "New Replica Num", "frsrpc.frsrpc_CommPktChangeOrderCommand.new_replica_num", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_replica_set_type,
+		{ "Replica Set Type", "frsrpc.frsrpc_FrsStartPromotionParent.replica_set_type", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_prefix_size,
+		{ "Prefix Size", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.prefix_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_content_cmd,
+		{ "Content Cmd", "frsrpc.frsrpc_CommPktChangeOrderCommand.content_cmd", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_NEW_FILE,
+		{ "Frsrpc Co Flag New File", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_NEW_FILE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_NEW_FILE_tfs), ( 0x00000400 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_connection_guid,
+		{ "Connection Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_replica_version_guid_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_password,
+		{ "Parent Password", "frsrpc.frsrpc_FrsStartPromotionParent.parent_password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_SECURITY_CHANGE,
+		{ "Frsrpc Content Reason Security Change", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_SECURITY_CHANGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_SECURITY_CHANGE_tfs), ( 0x00000800 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NEW_NAME,
+		{ "Frsrpc Content Reason New Name", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_NEW_NAME", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NEW_NAME_tfs), ( 0x00002000 ), NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_extension2,
-	  { "Co Extension2", "frsrpc.frsrpc_CommPktChunkData.co_extension2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_major,
-	  { "Major", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.major", FT_UINT1632, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCoRecordExtensionMajor_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2ul1,
-	  { "Spare2ul1", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare2ul1", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_not_used,
-	  { "Not Used", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.not_used", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ONLIST,
-	  { "Frsrpc Co Flag Onlist", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_ONLIST", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ONLIST_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_guid,
-	  { "Partner Guid", "frsrpc.frsrpc_FrsStartPromotionParent.partner_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset_count,
-	  { "Offset Count", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.offset_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2bin,
-	  { "Spare2bin", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare2bin", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding3,
-	  { "Padding3", "frsrpc.frsrpc_CommPktChangeOrderCommand.padding3", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_DIR_ENUM_PENDING,
-	  { "Frsrpc Co Iflag Dir Enum Pending", "frsrpc.frsrpc_CommPktCoCmdIFlags.FRSRPC_CO_IFLAG_DIR_ENUM_PENDING", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_DIR_ENUM_PENDING_tfs), ( 0x00000004 ), NULL, HFILL }},
+		{ "Co Extension2", "frsrpc.frsrpc_CommPktChunkData.co_extension2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_version_number,
+		{ "File Version Number", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_version_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_major,
-	  { "Major", "frsrpc.frsrpc_FrsSendCommPktReq.major", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktMajor_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_CO_ABORT,
-	  { "Frsrpc Co Iflag Co Abort", "frsrpc.frsrpc_CommPktCoCmdIFlags.FRSRPC_CO_IFLAG_CO_ABORT", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_CO_ABORT_tfs), ( 0x00000002 ), NULL, HFILL }},
+		{ "Major", "frsrpc.frsrpc_FrsSendCommPktReq.major", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktMajor_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_data_retry_timeout,
+		{ "Data Retry Timeout", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.data_retry_timeout", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCATION_CMD,
+		{ "Frsrpc Co Flag Location Cmd", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_LOCATION_CMD", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCATION_CMD_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_parent_password,
+		{ "Parent Password", "frsrpc.frsrpc_FrsVerifyPromotionParent.parent_password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1guid_p1,
+		{ "Spare1guid P1", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare1guid_p1", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_join_guid,
+		{ "Join Guid", "frsrpc.frsrpc_CommPktChunkData.join_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_guid_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_bop,
+		{ "Bop", "frsrpc.frsrpc_CommPktChunkData.bop", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_field_size,
+		{ "Field Size", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.field_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_EXTEND,
+		{ "Frsrpc Content Reason Named Data Extend", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_NAMED_DATA_EXTEND", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_EXTEND_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_replica_version_guid,
+		{ "Replica Version Guid", "frsrpc.frsrpc_CommPktChunkData.replica_version_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_event_time,
+		{ "Event Time", "frsrpc.frsrpc_CommPktChangeOrderCommand.event_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_join_time_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_CREATE,
+		{ "Frsrpc Content Reason File Create", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_FILE_CREATE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_CREATE_tfs), ( 0x00000100 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_pkt_len,
+		{ "Pkt Len", "frsrpc.frsrpc_FrsSendCommPktReq.pkt_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_vvector,
+		{ "Vvector", "frsrpc.frsrpc_CommPktChunkData.vvector", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_not_used,
-	  { "Not Used", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.not_used", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare3guid_p2,
-	  { "Spare3guid P2", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare3guid_p2", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_change_order_guid,
-	  { "Change Order Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.change_order_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VVJOIN_TO_ORIG,
-	  { "Frsrpc Co Flag Vvjoin To Orig", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_VVJOIN_TO_ORIG", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VVJOIN_TO_ORIG_tfs), ( 0x00040000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_guid_,
-	  { "Subcontext length", "frsrpc.frsrpc_FrsStartPromotionParent.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding1,
-	  { "Padding1", "frsrpc.frsrpc_CommPktChangeOrderCommand.padding1", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Not Used", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.not_used", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_replica_set_name,
+		{ "Replica Set Name", "frsrpc.frsrpc_FrsStartPromotionParent.replica_set_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2wcs,
+		{ "Spare2wcs", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare2wcs", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_join_guid_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_to,
+		{ "To", "frsrpc.frsrpc_CommPktChunkData.to", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset_last,
+		{ "Offset Last", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.offset_last", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_data_handle,
+		{ "Data Handle", "frsrpc.frsrpc_FrsSendCommPktReq.data_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_upk_len,
+		{ "Upk Len", "frsrpc.frsrpc_FrsSendCommPktReq.upk_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_sequence_number,
+		{ "Sequence Number", "frsrpc.frsrpc_CommPktChangeOrderCommand.sequence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktGSVN_vsn,
-	  { "Vsn", "frsrpc.frsrpc_CommPktGSVN.vsn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_first_try_time,
-	  { "First Try Time", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.first_try_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_bopend,
-	  { "Bopend", "frsrpc.frsrpc_CommPktChunkData.bopend", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_offset,
-	  { "File Offset", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_offset", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset_count,
-	  { "Offset Count", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.offset_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_ext_win2k,
-	  { "Co Ext Win2k", "frsrpc.frsrpc_CommPktChunkData.co_ext_win2k", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_bop,
-	  { "Bop", "frsrpc.frsrpc_CommPktChunkData.bop", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_jrnl_usn,
-	  { "Jrnl Usn", "frsrpc.frsrpc_CommPktChangeOrderCommand.jrnl_usn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1wcs,
-	  { "Spare1wcs", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare1wcs", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Vsn", "frsrpc.frsrpc_CommPktGSVN.vsn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_replica_set_type,
+		{ "Replica Set Type", "frsrpc.frsrpc_FrsVerifyPromotionParent.replica_set_type", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_opnum,
+		{ "Operation", "frsrpc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_jrnl_first_usn,
+		{ "Jrnl First Usn", "frsrpc.frsrpc_CommPktChangeOrderCommand.jrnl_first_usn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_connection,
+		{ "Connection", "frsrpc.frsrpc_CommPktChunkData.connection", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTENT_CMD,
+		{ "Frsrpc Co Flag Content Cmd", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_CONTENT_CMD", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTENT_CMD_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_EXTEND,
+		{ "Frsrpc Content Reason Data Extend", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_DATA_EXTEND", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_EXTEND_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_princ_name,
+		{ "Partner Princ Name", "frsrpc.frsrpc_FrsStartPromotionParent.partner_princ_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_sequnence_number,
+		{ "Co Sequnence Number", "frsrpc.frsrpc_CommPktChunkData.co_sequnence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_new_parent_guid,
+		{ "New Parent Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.new_parent_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset_count,
+		{ "Offset Count", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.offset_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_partner_auth_level,
-	  { "Partner Auth Level", "frsrpc.frsrpc_FrsVerifyPromotionParent.partner_auth_level", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_PartnerAuthLevel_vals), 0, NULL, HFILL }},
+		{ "Partner Auth Level", "frsrpc.frsrpc_FrsVerifyPromotionParent.partner_auth_level", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_PartnerAuthLevel_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_parent_account,
+		{ "Parent Account", "frsrpc.frsrpc_FrsVerifyPromotionParent.parent_account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_flags,
+		{ "Flags", "frsrpc.frsrpc_CommPktChangeOrderCommand.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_minor,
+		{ "Minor", "frsrpc.frsrpc_FrsSendCommPktReq.minor", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktMinor_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_ORIG_REC_C,
+		{ "Frsrpc Co Flag Skip Orig Rec C", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_SKIP_ORIG_REC_C", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_ORIG_REC_C_tfs), ( 0x00100000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_vvector_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent___ndr_guid_size,
+		{ "Ndr Guid Size", "frsrpc.frsrpc_FrsVerifyPromotionParent.__ndr_guid_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_file_size,
+		{ "File Size", "frsrpc.frsrpc_CommPktChunkData.file_size", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_major,
+		{ "Major", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.major", FT_UINT1632, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCoRecordExtensionMajor_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_gvsn_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset,
-	  { "Offset", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Offset", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktGSVN_guid,
+		{ "Guid", "frsrpc.frsrpc_CommPktGSVN.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_replica,
+		{ "Replica", "frsrpc.frsrpc_CommPktChunkData.replica", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding4,
+		{ "Padding4", "frsrpc.frsrpc_CommPktChangeOrderCommand.padding4", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_guid,
+		{ "Connection Guid", "frsrpc.frsrpc_FrsStartPromotionParent.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktChunkGuidName_name,
-	  { "Name", "frsrpc.frsrpc_CommPktChunkGuidName.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_guid_,
-	  { "Subcontext length", "frsrpc.frsrpc_FrsStartPromotionParent.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_BASIC_INFO_CHANGE,
-	  { "Frsrpc Content Reason Basic Info Change", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_BASIC_INFO_CHANGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_BASIC_INFO_CHANGE_tfs), ( 0x00004000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_last_join_time,
-	  { "Last Join Time", "frsrpc.frsrpc_CommPktChunkData.last_join_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+		{ "Name", "frsrpc.frsrpc_CommPktChunkGuidName.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_bopend,
+		{ "Bopend", "frsrpc.frsrpc_CommPktChunkData.bopend", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ONLIST,
+		{ "Frsrpc Co Flag Onlist", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_ONLIST", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ONLIST_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_command,
+		{ "Command", "frsrpc.frsrpc_CommPktChunkData.command", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCommand_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkGuidName_name_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkGuidName.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_prefix_type,
+		{ "Prefix Type", "frsrpc.frsrpc_CommPktDataExtensionChecksum.prefix_type", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktDataExtensionType_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_jrnl_usn,
+		{ "Jrnl Usn", "frsrpc.frsrpc_CommPktChangeOrderCommand.jrnl_usn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_not_used,
+		{ "Not Used", "frsrpc.frsrpc_CommPktChangeOrderCommand.not_used", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_field_size,
-	  { "Field Size", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.field_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_remote_co_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_flags,
-	  { "Flags", "frsrpc.frsrpc_CommPktChangeOrderCommand.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_new_replica_num,
-	  { "New Replica Num", "frsrpc.frsrpc_CommPktChangeOrderCommand.new_replica_num", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_block_size,
-	  { "Block Size", "frsrpc.frsrpc_CommPktChunkData.block_size", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_OVERWRITE,
-	  { "Frsrpc Content Reason Named Data Overwrite", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_NAMED_DATA_OVERWRITE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_OVERWRITE_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_data_retry_timeout,
-	  { "Data Retry Timeout", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.data_retry_timeout", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_parent_account,
-	  { "Parent Account", "frsrpc.frsrpc_FrsVerifyPromotionParent.parent_account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_iflags,
-	  { "Iflags", "frsrpc.frsrpc_CommPktChangeOrderCommand.iflags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_CREATE,
-	  { "Frsrpc Content Reason File Create", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_FILE_CREATE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_CREATE_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_name,
-	  { "Connection Name", "frsrpc.frsrpc_FrsStartPromotionParent.connection_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Field Size", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.field_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_ctr,
-	  { "Ctr", "frsrpc.frsrpc_FrsSendCommPktReq.ctr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1guid_p2,
-	  { "Spare1guid P2", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare1guid_p2", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_EA_CHANGE,
-	  { "Frsrpc Content Reason Ea Change", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_EA_CHANGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_EA_CHANGE_tfs), ( 0x00000400 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_replica_version_guid_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_field_size,
-	  { "Field Size", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.field_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Ctr", "frsrpc.frsrpc_FrsSendCommPktReq.ctr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_change_order_guid,
+		{ "Change Order Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.change_order_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_OVERWRITE,
+		{ "Frsrpc Content Reason Data Overwrite", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_DATA_OVERWRITE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_OVERWRITE_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_ext_win2k,
+		{ "Co Ext Win2k", "frsrpc.frsrpc_CommPktChunkData.co_ext_win2k", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MOVEIN_GEN,
+		{ "Frsrpc Co Flag Movein Gen", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_MOVEIN_GEN", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MOVEIN_GEN_tfs), ( 0x00200000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_blob,
+		{ "Blob", "frsrpc.frsrpc_CommPktChunkData.blob", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2bin,
+		{ "Spare2bin", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare2bin", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_old_parent_guid,
+		{ "Old Parent Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.old_parent_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_COMPRESSION_CHANGE,
+		{ "Frsrpc Content Reason Compression Change", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_COMPRESSION_CHANGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_COMPRESSION_CHANGE_tfs), ( 0x00020000 ), NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ABORT_CO,
-	  { "Frsrpc Co Flag Abort Co", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_ABORT_CO", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ABORT_CO_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_content_cmd,
-	  { "Content Cmd", "frsrpc.frsrpc_CommPktChangeOrderCommand.content_cmd", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_major,
-	  { "Major", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.major", FT_UINT1632, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCoRecordExtensionMajor_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_gvsn,
-	  { "Gvsn", "frsrpc.frsrpc_CommPktChunkData.gvsn", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding4,
-	  { "Padding4", "frsrpc.frsrpc_CommPktChangeOrderCommand.padding4", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Frsrpc Co Flag Abort Co", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_ABORT_CO", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_ABORT_CO_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsSendCommPkt_req,
+		{ "Req", "frsrpc.frsrpc_FrsSendCommPkt.req", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent___ndr_guid_size,
+		{ "Ndr Guid Size", "frsrpc.frsrpc_FrsStartPromotionParent.__ndr_guid_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1guid_p2,
+		{ "Spare1guid P2", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare1guid_p2", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_BASIC_INFO_CHANGE,
+		{ "Frsrpc Content Reason Basic Info Change", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_BASIC_INFO_CHANGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_BASIC_INFO_CHANGE_tfs), ( 0x00004000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_frs_vsn,
+		{ "Frs Vsn", "frsrpc.frsrpc_CommPktChangeOrderCommand.frs_vsn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_guid_,
+		{ "Subcontext length", "frsrpc.frsrpc_FrsStartPromotionParent.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_data_checksum,
-	  { "Data Checksum", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.data_checksum", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_file_offset,
-	  { "File Offset", "frsrpc.frsrpc_CommPktChunkData.file_offset", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_VVRETIRE_EXEC,
-	  { "Frsrpc Co Iflag Vvretire Exec", "frsrpc.frsrpc_CommPktCoCmdIFlags.FRSRPC_CO_IFLAG_VVRETIRE_EXEC", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_VVRETIRE_EXEC_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_OVERWRITE,
-	  { "Frsrpc Content Reason Data Overwrite", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_DATA_OVERWRITE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_OVERWRITE_tfs), ( 0x00000001 ), NULL, HFILL }},
+		{ "Data Checksum", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.data_checksum", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_memory_len,
-	  { "Memory Len", "frsrpc.frsrpc_FrsSendCommPktReq.memory_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_padding2,
-	  { "Padding2", "frsrpc.frsrpc_CommPktChangeOrderCommand.padding2", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_princ_name,
-	  { "Partner Princ Name", "frsrpc.frsrpc_FrsStartPromotionParent.partner_princ_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_location_cmd,
-	  { "Location Cmd", "frsrpc.frsrpc_CommPktChangeOrderCommand.location_cmd", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCoCmdLocationCmd_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_compression_guid,
-	  { "Compression Guid", "frsrpc.frsrpc_CommPktChunkData.compression_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_data_handle,
-	  { "Data Handle", "frsrpc.frsrpc_FrsSendCommPktReq.data_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_gvsn_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_ack_version,
-	  { "Ack Version", "frsrpc.frsrpc_CommPktChangeOrderCommand.ack_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_sequnence_number,
-	  { "Co Sequnence Number", "frsrpc.frsrpc_CommPktChunkData.co_sequnence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_account,
-	  { "Parent Account", "frsrpc.frsrpc_FrsStartPromotionParent.parent_account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MORPH_GEN_HEAD,
-	  { "Frsrpc Co Flag Morph Gen Head", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_MORPH_GEN_HEAD", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MORPH_GEN_HEAD_tfs), ( 0x00400000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_cs_id,
-	  { "Cs Id", "frsrpc.frsrpc_FrsSendCommPktReq.cs_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset0,
-	  { "Offset0", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.offset0", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_originator_guid,
-	  { "Originator Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.originator_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_DIRECTED_CO,
-	  { "Frsrpc Co Flag Directed Co", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_DIRECTED_CO", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_DIRECTED_CO_tfs), ( 0x00002000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_COMPRESSED_STAGE,
-	  { "Frsrpc Co Flag Compressed Stage", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_COMPRESSED_STAGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_COMPRESSED_STAGE_tfs), ( 0x01000000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTENT_CMD,
-	  { "Frsrpc Co Flag Content Cmd", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_CONTENT_CMD", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTENT_CMD_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset_last,
-	  { "Offset Last", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.offset_last", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_status,
-	  { "Status", "frsrpc.frsrpc_CommPktChangeOrderCommand.status", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCoCmdStatus_vals), 0, NULL, HFILL }},
+		{ "Memory Len", "frsrpc.frsrpc_FrsSendCommPktReq.memory_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_gvsn,
+		{ "Gvsn", "frsrpc.frsrpc_CommPktChunkData.gvsn", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_TRUNCATION,
+		{ "Frsrpc Content Reason Data Truncation", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_DATA_TRUNCATION", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_TRUNCATION_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_guid_,
+		{ "Subcontext length", "frsrpc.frsrpc_FrsStartPromotionParent.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_auth_level,
-	  { "Partner Auth Level", "frsrpc.frsrpc_FrsStartPromotionParent.partner_auth_level", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_PartnerAuthLevel_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_join_time,
-	  { "Join Time", "frsrpc.frsrpc_CommPktChunkData.join_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent___ndr_guid_size,
-	  { "Ndr Guid Size", "frsrpc.frsrpc_FrsStartPromotionParent.__ndr_guid_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_parent_password,
-	  { "Parent Password", "frsrpc.frsrpc_FrsVerifyPromotionParent.parent_password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_prefix_size,
-	  { "Prefix Size", "frsrpc.frsrpc_CommPktDataExtensionChecksum.prefix_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_guid,
-	  { "Connection Guid", "frsrpc.frsrpc_FrsStartPromotionParent.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_replica_set_type,
-	  { "Replica Set Type", "frsrpc.frsrpc_FrsVerifyPromotionParent.replica_set_type", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_werror,
-	  { "Windows Error", "frsrpc.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunk_data_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunk.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_COMPRESSION_CHANGE,
-	  { "Frsrpc Content Reason Compression Change", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_COMPRESSION_CHANGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_COMPRESSION_CHANGE_tfs), ( 0x00020000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_attributes,
-	  { "File Attributes", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_not_used,
-	  { "Not Used", "frsrpc.frsrpc_CommPktChangeOrderCommand.not_used", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_count,
-	  { "Count", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_EXTEND,
-	  { "Frsrpc Content Reason Named Data Extend", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_NAMED_DATA_EXTEND", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_EXTEND_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_pkt_len,
-	  { "Pkt Len", "frsrpc.frsrpc_FrsSendCommPktReq.pkt_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_opnum,
-	  { "Operation", "frsrpc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_RETRY,
-	  { "Frsrpc Co Flag Retry", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_RETRY", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_RETRY_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_prefix_size,
-	  { "Prefix Size", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.prefix_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_prefix_type,
-	  { "Prefix Type", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.prefix_type", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktDataExtensionType_vals), 0, NULL, HFILL }},
+		{ "Partner Auth Level", "frsrpc.frsrpc_FrsStartPromotionParent.partner_auth_level", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_PartnerAuthLevel_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_guid,
+		{ "Parent Guid", "frsrpc.frsrpc_FrsStartPromotionParent.parent_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_CommPktChunk,
-	  { "Chunk", "frsrpc.chunk.ctr.chunk", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTROL,
-	  { "Frsrpc Co Flag Control", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_CONTROL", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_CONTROL_tfs), ( 0x00001000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_name,
-	  { "Partner Name", "frsrpc.frsrpc_FrsStartPromotionParent.partner_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_replica_set_type,
-	  { "Replica Set Type", "frsrpc.frsrpc_FrsStartPromotionParent.replica_set_type", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_SECURITY_CHANGE,
-	  { "Frsrpc Content Reason Security Change", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_SECURITY_CHANGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_SECURITY_CHANGE_tfs), ( 0x00000800 ), NULL, HFILL }},
+		{ "Chunk", "frsrpc.chunk.ctr.chunk", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset_last,
+		{ "Offset Last", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.offset_last", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_compression_guid,
+		{ "Compression Guid", "frsrpc.frsrpc_CommPktChunkData.compression_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset_count,
+		{ "Offset Count", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.offset_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VV_ACTIVATED,
+		{ "Frsrpc Co Flag Vv Activated", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_VV_ACTIVATED", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VV_ACTIVATED_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_DELETE,
+		{ "Frsrpc Content Reason File Delete", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_FILE_DELETE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_DELETE_tfs), ( 0x00000200 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_file_offset,
+		{ "File Offset", "frsrpc.frsrpc_CommPktChunkData.file_offset", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_TRUNCATION,
-	  { "Frsrpc Content Reason Named Data Truncation", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_NAMED_DATA_TRUNCATION", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_TRUNCATION_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_guid,
-	  { "File Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_vvector,
-	  { "Vvector", "frsrpc.frsrpc_CommPktChunkData.vvector", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_minor,
-	  { "Minor", "frsrpc.frsrpc_FrsSendCommPktReq.minor", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktMinor_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2guid_p1,
-	  { "Spare2guid P1", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare2guid_p1", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Frsrpc Content Reason Named Data Truncation", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_NAMED_DATA_TRUNCATION", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NAMED_DATA_TRUNCATION_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_account,
+		{ "Parent Account", "frsrpc.frsrpc_FrsStartPromotionParent.parent_account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_location_cmd,
+		{ "Location Cmd", "frsrpc.frsrpc_CommPktChangeOrderCommand.location_cmd", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCoCmdLocationCmd_vals), 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_partern_ack_sequence_number,
-	  { "Partern Ack Sequence Number", "frsrpc.frsrpc_CommPktChangeOrderCommand.partern_ack_sequence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_replica_set_name,
-	  { "Replica Set Name", "frsrpc.frsrpc_FrsStartPromotionParent.replica_set_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_join_guid,
-	  { "Join Guid", "frsrpc.frsrpc_CommPktChunkData.join_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_replica_version_guid,
-	  { "Replica Version Guid", "frsrpc.frsrpc_CommPktChunkData.replica_version_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_JUST_OID_RESET,
-	  { "Frsrpc Co Flag Just Oid Reset", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_JUST_OID_RESET", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_JUST_OID_RESET_tfs), ( 0x00800000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunk_type,
-	  { "Type", "frsrpc.frsrpc_CommPktChunk.type", FT_UINT1632, BASE_DEC, VALS(frsrpc_frsrpc_CommPktChunkType_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_prefix_type,
-	  { "Prefix Type", "frsrpc.frsrpc_CommPktDataExtensionChecksum.prefix_type", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktDataExtensionType_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_parent_guid,
-	  { "Parent Guid", "frsrpc.frsrpc_FrsStartPromotionParent.parent_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_from,
-	  { "From", "frsrpc.frsrpc_CommPktChunkData.from", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent_replica_set_name,
-	  { "Replica Set Name", "frsrpc.frsrpc_FrsVerifyPromotionParent.replica_set_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_OUT_OF_ORDER,
-	  { "Frsrpc Co Flag Out Of Order", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_OUT_OF_ORDER", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_OUT_OF_ORDER_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsSendCommPkt_req,
-	  { "Req", "frsrpc.frsrpc_FrsSendCommPkt.req", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_connection_guid,
-	  { "Connection Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Partern Ack Sequence Number", "frsrpc.frsrpc_CommPktChangeOrderCommand.partern_ack_sequence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_guid,
+		{ "File Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_cs_id,
+		{ "Cs Id", "frsrpc.frsrpc_FrsSendCommPktReq.cs_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset1,
+		{ "Offset1", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.offset1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktChunkGuidName_guid_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkGuidName.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsVerifyPromotionParent___ndr_guid_size,
-	  { "Ndr Guid Size", "frsrpc.frsrpc_FrsVerifyPromotionParent.__ndr_guid_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MOVEIN_GEN,
-	  { "Frsrpc Co Flag Movein Gen", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_MOVEIN_GEN", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_MOVEIN_GEN_tfs), ( 0x00200000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_replica,
-	  { "Replica", "frsrpc.frsrpc_CommPktChunkData.replica", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkGuidName_name_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkGuidName.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_ORIG_REC_C,
-	  { "Frsrpc Co Flag Skip Orig Rec C", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_SKIP_ORIG_REC_C", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_SKIP_ORIG_REC_C_tfs), ( 0x00100000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCATION_CMD,
-	  { "Frsrpc Co Flag Location Cmd", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_LOCATION_CMD", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_LOCATION_CMD_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_command,
-	  { "Command", "frsrpc.frsrpc_CommPktChunkData.command", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCommand_vals), 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_new_parent_guid,
-	  { "New Parent Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.new_parent_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkGuidName.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_ctr_,
-	  { "Subcontext length", "frsrpc.frsrpc_FrsSendCommPktReq.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_jrnl_first_usn,
-	  { "Jrnl First Usn", "frsrpc.frsrpc_CommPktChangeOrderCommand.jrnl_first_usn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_file_size,
-	  { "File Size", "frsrpc.frsrpc_CommPktChunkData.file_size", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2wcs,
-	  { "Spare2wcs", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare2wcs", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_EXTEND,
-	  { "Frsrpc Content Reason Data Extend", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_DATA_EXTEND", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_EXTEND_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_to,
-	  { "To", "frsrpc.frsrpc_CommPktChunkData.to", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_connection,
-	  { "Connection", "frsrpc.frsrpc_CommPktChunkData.connection", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_version_number,
-	  { "File Version Number", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_version_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Subcontext length", "frsrpc.frsrpc_FrsSendCommPktReq.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_JUST_OID_RESET,
+		{ "Frsrpc Co Flag Just Oid Reset", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_JUST_OID_RESET", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_JUST_OID_RESET_tfs), ( 0x00800000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_usn,
+		{ "File Usn", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_usn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_size,
-	  { "File Size", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_size", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_name_length,
-	  { "File Name Length", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_name_length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_TRUNCATION,
-	  { "Frsrpc Content Reason Data Truncation", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_DATA_TRUNCATION", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_DATA_TRUNCATION_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NEW_NAME,
-	  { "Frsrpc Content Reason New Name", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_NEW_NAME", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_NEW_NAME_tfs), ( 0x00002000 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_data_name,
-	  { "Data Name", "frsrpc.frsrpc_FrsSendCommPktReq.data_name", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_sequence_number,
-	  { "Sequence Number", "frsrpc.frsrpc_CommPktChangeOrderCommand.sequence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunk_data,
-	  { "Data", "frsrpc.frsrpc_CommPktChunk.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_event_time,
-	  { "Event Time", "frsrpc.frsrpc_CommPktChangeOrderCommand.event_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktGSVN_guid,
-	  { "Guid", "frsrpc.frsrpc_CommPktGSVN.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "File Size", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_size", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_originator_guid,
+		{ "Originator Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.originator_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_remote_co_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunk_data_,
+		{ "Subcontext length", "frsrpc.frsrpc_CommPktChunk.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_data,
-	  { "Data", "frsrpc.frsrpc_CommPktDataExtensionChecksum.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_DELETE,
-	  { "Frsrpc Content Reason File Delete", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_FILE_DELETE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_FILE_DELETE_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset1,
-	  { "Offset1", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.offset1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_NEW_FILE,
-	  { "Frsrpc Co Flag New File", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_NEW_FILE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_NEW_FILE_tfs), ( 0x00000400 ), NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktCoRecordExtensionWin2k_offset_last,
-	  { "Offset Last", "frsrpc.frsrpc_CommPktCoRecordExtensionWin2k.offset_last", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_guid,
-	  { "Co Guid", "frsrpc.frsrpc_CommPktChunkData.co_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsSendCommPktReq_upk_len,
-	  { "Upk Len", "frsrpc.frsrpc_FrsSendCommPktReq.upk_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_co_ext_win2k_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_name,
-	  { "File Name", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_join_time_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_join_guid_,
-	  { "Subcontext length", "frsrpc.frsrpc_CommPktChunkData.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_old_parent_guid,
-	  { "Old Parent Guid", "frsrpc.frsrpc_CommPktChangeOrderCommand.old_parent_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_block,
-	  { "Block", "frsrpc.frsrpc_CommPktChunkData.block", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_connection_guid_,
-	  { "Subcontext length", "frsrpc.frsrpc_FrsStartPromotionParent.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_usn,
-	  { "File Usn", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_usn", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkData_blob,
-	  { "Blob", "frsrpc.frsrpc_CommPktChunkData.blob", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Data", "frsrpc.frsrpc_CommPktDataExtensionChecksum.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChunkData_from,
+		{ "From", "frsrpc.frsrpc_CommPktChunkData.from", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_DIR_ENUM_PENDING,
+		{ "Frsrpc Co Iflag Dir Enum Pending", "frsrpc.frsrpc_CommPktCoCmdIFlags.FRSRPC_CO_IFLAG_DIR_ENUM_PENDING", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdIFlags_FRSRPC_CO_IFLAG_DIR_ENUM_PENDING_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_first_try_time,
+		{ "First Try Time", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.first_try_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_offset0,
+		{ "Offset0", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.offset0", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_OUT_OF_ORDER,
+		{ "Frsrpc Co Flag Out Of Order", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_OUT_OF_ORDER", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_OUT_OF_ORDER_tfs), ( 0x00000200 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktDataExtensionChecksum_prefix_size,
+		{ "Prefix Size", "frsrpc.frsrpc_CommPktDataExtensionChecksum.prefix_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_EA_CHANGE,
+		{ "Frsrpc Content Reason Ea Change", "frsrpc.frsrpc_CommPktCoCmdContentCmd.FRSRPC_CONTENT_REASON_EA_CHANGE", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdContentCmd_FRSRPC_CONTENT_REASON_EA_CHANGE_tfs), ( 0x00000400 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_status,
+		{ "Status", "frsrpc.frsrpc_CommPktChangeOrderCommand.status", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCoCmdStatus_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_count,
+		{ "Count", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VVJOIN_TO_ORIG,
+		{ "Frsrpc Co Flag Vvjoin To Orig", "frsrpc.frsrpc_CommPktCoCmdFlags.FRSRPC_CO_FLAG_VVJOIN_TO_ORIG", FT_BOOLEAN, 32, TFS(&frsrpc_CommPktCoCmdFlags_FRSRPC_CO_FLAG_VVJOIN_TO_ORIG_tfs), ( 0x00040000 ), NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare2ul1,
+		{ "Spare2ul1", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare2ul1", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_spare1wcs,
+		{ "Spare1wcs", "frsrpc.frsrpc_CommPktChangeOrderCommand.spare1wcs", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_original_replica_num,
-	  { "Original Replica Num", "frsrpc.frsrpc_CommPktChangeOrderCommand.original_replica_num", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frsrpc_frsrpc_CommPktChunkGuidName_guid,
-	  { "Guid", "frsrpc.frsrpc_CommPktChunkGuidName.guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Original Replica Num", "frsrpc.frsrpc_CommPktChangeOrderCommand.original_replica_num", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_iflags,
+		{ "Iflags", "frsrpc.frsrpc_CommPktChangeOrderCommand.iflags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_data_checksum,
+		{ "Data Checksum", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.data_checksum", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_prefix_type,
+		{ "Prefix Type", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.prefix_type", FT_UINT32, BASE_DEC, VALS(frsrpc_frsrpc_CommPktDataExtensionType_vals), 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktDataExtensionRetryTimeout_not_used,
+		{ "Not Used", "frsrpc.frsrpc_CommPktDataExtensionRetryTimeout.not_used", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_FrsStartPromotionParent_partner_guid_,
+		{ "Subcontext length", "frsrpc.frsrpc_FrsStartPromotionParent.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderCommand_file_name,
+		{ "File Name", "frsrpc.frsrpc_CommPktChangeOrderCommand.file_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frsrpc_frsrpc_CommPktChangeOrderRecordExtension_major,
+		{ "Major", "frsrpc.frsrpc_CommPktChangeOrderRecordExtension.major", FT_UINT1632, BASE_DEC, VALS(frsrpc_frsrpc_CommPktCoRecordExtensionMajor_vals), 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-frstrans.c b/epan/dissectors/packet-dcerpc-frstrans.c
index b0f9fd9dfd..d587e3633b 100644
--- a/epan/dissectors/packet-dcerpc-frstrans.c
+++ b/epan/dissectors/packet-dcerpc-frstrans.c
@@ -43,104 +43,104 @@ static gint ett_frstrans_frstrans_RdcFileInfo = -1;
 
 
 /* Header field declarations */
-static gint hf_frstrans_frstrans_RdcFileInfo_on_disk_file_size = -1;
-static gint hf_frstrans_frstrans_Update_fence = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_second = -1;
-static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_epoque_vector = -1;
-static gint hf_frstrans_frstrans_CheckConnectivity_connection_guid = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_frs_update = -1;
-static gint hf_frstrans_frstrans_EstablishConnection_downstream_flags = -1;
-static gint hf_frstrans_frstrans_AsyncPoll_response = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_version_vector_diff_count = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_size_read = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_rdc_file_info = -1;
+static gint hf_frstrans_frstrans_RequestVersionVector_content_set_guid = -1;
+static gint hf_frstrans_frstrans_VersionVector_low = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_hour = -1;
+static gint hf_frstrans_frstrans_Update_clock = -1;
+static gint hf_frstrans_frstrans_RdcParameterFilterPoint_max_chunk_size = -1;
+static gint hf_frstrans_frstrans_Update_uid_version = -1;
+static gint hf_frstrans_frstrans_Update_sha1_hash = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_day_of_week = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_credits_available = -1;
 static gint hf_frstrans_frstrans_RdcParameterUnion_filter_point = -1;
-static gint hf_frstrans_frstrans_CheckConnectivity_replica_set_guid = -1;
-static gint hf_frstrans_frstrans_VersionVector_high = -1;
-static gint hf_frstrans_frstrans_Update_create_time = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_update_request_type = -1;
-static gint hf_frstrans_frstrans_RdcParameterFilterPoint_min_chunk_size = -1;
-static gint hf_frstrans_frstrans_RdcParameterUnion_filter_generic = -1;
-static gint hf_frstrans_frstrans_RequestVersionVector_vv_generation = -1;
-static gint hf_frstrans_frstrans_Update_gsvn_version = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_update_count = -1;
 static gint hf_frstrans_opnum = -1;
-static gint hf_frstrans_frstrans_RdcFileInfo_rdc_minimum_compatible_version = -1;
-static gint hf_frstrans_frstrans_EstablishConnection_downstream_protocol_version = -1;
-static gint hf_frstrans_frstrans_Update_name = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_day = -1;
-static gint hf_frstrans_frstrans_RdcFileInfo_rdc_filter_parameters = -1;
-static gint hf_frstrans_frstrans_Update_parent_version = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_rdc_desired = -1;
-static gint hf_frstrans_frstrans_Update_parent_db_guid = -1;
-static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_epoque_vector_count = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_frs_update = -1;
+static gint hf_frstrans_frstrans_Update_content_set_guid = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_milli_seconds = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_server_context = -1;
+static gint hf_frstrans_frstrans_RdcFileInfo_rdc_version = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_content_set_guid = -1;
 static gint hf_frstrans_frstrans_RdcParameterGeneric_chunker_parameters = -1;
-static gint hf_frstrans_frstrans_RequestVersionVector_change_type = -1;
-static gint hf_frstrans_frstrans_RequestVersionVector_connection_guid = -1;
-static gint hf_frstrans_frstrans_Update_gsvn_db_guid = -1;
-static gint hf_frstrans_frstrans_Update_sha1_hash = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_month = -1;
-static gint hf_frstrans_frstrans_RdcParameterFilterPoint_max_chunk_size = -1;
-static gint hf_frstrans_frstrans_VersionVector_low = -1;
-static gint hf_frstrans_frstrans_RequestVersionVector_content_set_guid = -1;
-static gint hf_frstrans_frstrans_RdcFileInfo_file_size_estimate = -1;
-static gint hf_frstrans_frstrans_AsyncResponseContext_response = -1;
-static gint hf_frstrans_frstrans_AsyncResponseContext_status = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_hash_requested = -1;
+static gint hf_frstrans_frstrans_Update_fence = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_frs_update = -1;
 static gint hf_frstrans_frstrans_RequestUpdates_connection_guid = -1;
-static gint hf_frstrans_frstrans_Update_present = -1;
-static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_version_vector = -1;
-static gint hf_frstrans_frstrans_AsyncPoll_connection_guid = -1;
+static gint hf_frstrans_frstrans_Update_gsvn_version = -1;
+static gint hf_frstrans_frstrans_EstablishConnection_upstream_protocol_version = -1;
+static gint hf_frstrans_frstrans_RdcFileInfo_on_disk_file_size = -1;
+static gint hf_frstrans_frstrans_RdcFileInfo_rdc_signature_levels = -1;
+static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_version_vector_count = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_gvsn_version = -1;
+static gint hf_frstrans_frstrans_VersionVector_high = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_minute = -1;
+static gint hf_frstrans_frstrans_CheckConnectivity_replica_set_guid = -1;
 static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_vv_generation = -1;
 static gint hf_frstrans_frstrans_EstablishConnection_replica_set_guid = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_gvsn_version = -1;
-static gint hf_frstrans_frstrans_EstablishSession_connection_guid = -1;
-static gint hf_frstrans_frstrans_RdcFileInfo_rdc_signature_levels = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_year = -1;
-static gint hf_frstrans_frstrans_RdcParameters_u = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_machine_guid = -1;
-static gint hf_frstrans_frstrans_RequestVersionVector_sequence_number = -1;
-static gint hf_frstrans_frstrans_EstablishConnection_upstream_protocol_version = -1;
-static gint hf_frstrans_frstrans_RdcFileInfo_compression_algorithm = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_update_status = -1;
-static gint hf_frstrans_frstrans_RdcParameterFilterMax_max_window_size = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_data_buffer = -1;
-static gint hf_frstrans_frstrans_Update_rdc_similarity = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_staging_policy = -1;
-static gint hf_frstrans_frstrans_Update_attributes = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_update_count = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_is_end_of_file = -1;
 static gint hf_frstrans_frstrans_RdcParameters_rdc_chunker_algorithm = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_milli_seconds = -1;
-static gint hf_frstrans_frstrans_RdcFileInfo_rdc_version = -1;
-static gint hf_frstrans_frstrans_VersionVector_db_guid = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_day_of_week = -1;
-static gint hf_frstrans_frstrans_Update_clock = -1;
-static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_version_vector_count = -1;
+static gint hf_frstrans_frstrans_AsyncPoll_connection_guid = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_frs_update = -1;
 static gint hf_frstrans_frstrans_Update_uid_db_guid = -1;
+static gint hf_frstrans_frstrans_Update_gsvn_db_guid = -1;
+static gint hf_frstrans_frstrans_RdcParameterFilterPoint_min_chunk_size = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_update_status = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_rdc_desired = -1;
+static gint hf_frstrans_frstrans_Update_parent_version = -1;
+static gint hf_frstrans_frstrans_EstablishConnection_downstream_protocol_version = -1;
 static gint hf_frstrans_frstrans_EstablishSession_content_set_guid = -1;
+static gint hf_frstrans_frstrans_RdcParameters_u = -1;
+static gint hf_frstrans_frstrans_Update_present = -1;
+static gint hf_frstrans_frstrans_Update_parent_db_guid = -1;
 static gint hf_frstrans_frstrans_RequestUpdates_gvsn_db_guid = -1;
-static gint hf_frstrans_frstrans_EstablishConnection_connection_guid = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_buffer_size = -1;
-static gint hf_frstrans_frstrans_AsyncResponseContext_sequence_number = -1;
-static gint hf_frstrans_frstrans_Update_name_conflict = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_content_set_guid = -1;
-static gint hf_frstrans_frstrans_RdcParameterUnion_filter_max = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_data_buffer = -1;
+static gint hf_frstrans_frstrans_RdcFileInfo_compression_algorithm = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_year = -1;
+static gint hf_frstrans_frstrans_VersionVector_db_guid = -1;
+static gint hf_frstrans_frstrans_RequestVersionVector_sequence_number = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_machine_guid = -1;
+static gint hf_frstrans_frstrans_RdcFileInfo_rdc_minimum_compatible_version = -1;
+static gint hf_frstrans_frstrans_RequestVersionVector_connection_guid = -1;
+static gint hf_frstrans_frstrans_AsyncPoll_response = -1;
+static gint hf_frstrans_frstrans_RequestVersionVector_change_type = -1;
 static gint hf_frstrans_frstrans_EstablishConnection_upstream_flags = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_minute = -1;
-static gint hf_frstrans_frstrans_Update_flags = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_rdc_file_info = -1;
 static gint hf_frstrans_frstrans_RequestUpdates_version_vector_diff = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_is_end_of_file = -1;
+static gint hf_frstrans_frstrans_EstablishSession_connection_guid = -1;
+static gint hf_frstrans_frstrans_RdcFileInfo_rdc_filter_parameters = -1;
+static gint hf_frstrans_frstrans_TransportFlags_FRSTRANS_TRANSPORT_SUPPORTS_RDC_SIMILARITY = -1;
+static gint hf_frstrans_frstrans_RequestVersionVector_vv_generation = -1;
+static gint hf_frstrans_frstrans_CheckConnectivity_connection_guid = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_day = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_version_vector_diff_count = -1;
 static gint hf_frstrans_frstrans_RdcParameterGeneric_chunker_type = -1;
-static gint hf_frstrans_frstrans_InitializeFileTransferAsync_server_context = -1;
-static gint hf_frstrans_frstrans_Update_content_set_guid = -1;
 static gint hf_frstrans_frstrans_RdcParameterFilterMax_min_horizon_size = -1;
-static gint hf_frstrans_frstrans_EpoqueVector_hour = -1;
-static gint hf_frstrans_werror = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_staging_policy = -1;
+static gint hf_frstrans_frstrans_Update_create_time = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_buffer_size = -1;
+static gint hf_frstrans_frstrans_Update_name_conflict = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_month = -1;
+static gint hf_frstrans_frstrans_RdcParameterFilterMax_max_window_size = -1;
+static gint hf_frstrans_frstrans_AsyncResponseContext_response = -1;
+static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_version_vector = -1;
+static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_epoque_vector_count = -1;
+static gint hf_frstrans_frstrans_RdcFileInfo_file_size_estimate = -1;
+static gint hf_frstrans_frstrans_AsyncResponseContext_status = -1;
+static gint hf_frstrans_frstrans_RdcParameterUnion_filter_generic = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_update_request_type = -1;
 static gint hf_frstrans_frstrans_InitializeFileTransferAsync_connection_guid = -1;
-static gint hf_frstrans_frstrans_RequestUpdates_credits_available = -1;
-static gint hf_frstrans_frstrans_TransportFlags_FRSTRANS_TRANSPORT_SUPPORTS_RDC_SIMILARITY = -1;
-static gint hf_frstrans_frstrans_Update_uid_version = -1;
+static gint hf_frstrans_frstrans_EpoqueVector_second = -1;
+static gint hf_frstrans_frstrans_Update_rdc_similarity = -1;
+static gint hf_frstrans_frstrans_EstablishConnection_downstream_flags = -1;
+static gint hf_frstrans_frstrans_RequestUpdates_hash_requested = -1;
+static gint hf_frstrans_frstrans_Update_attributes = -1;
 static gint hf_frstrans_frstrans_RequestVersionVector_request_type = -1;
+static gint hf_frstrans_werror = -1;
+static gint hf_frstrans_frstrans_InitializeFileTransferAsync_size_read = -1;
+static gint hf_frstrans_frstrans_AsyncVersionVectorResponse_epoque_vector = -1;
+static gint hf_frstrans_frstrans_Update_flags = -1;
+static gint hf_frstrans_frstrans_EstablishConnection_connection_guid = -1;
+static gint hf_frstrans_frstrans_AsyncResponseContext_sequence_number = -1;
+static gint hf_frstrans_frstrans_Update_name = -1;
+static gint hf_frstrans_frstrans_RdcParameterUnion_filter_max = -1;
 
 static gint proto_dcerpc_frstrans = -1;
 /* Version information */
@@ -920,7 +920,7 @@ frstrans_dissect_struct_EpoqueVector(tvbuff_t *tvb _U_, int offset _U_, packet_i
 /* IDL: struct { */
 /* IDL: 	hyper vv_generation; */
 /* IDL: 	uint32 version_vector_count; */
-/* IDL: 	[unique(1)] [size_is(version_vector_count)] frstrans_VersionVector *version_vector; */
+/* IDL: 	[size_is(version_vector_count)] [unique(1)] frstrans_VersionVector *version_vector; */
 /* IDL: 	uint32 epoque_vector_count; */
 /* IDL: 	[size_is(epoque_vector_count)] [unique(1)] frstrans_EpoqueVector *epoque_vector; */
 /* IDL: } */
@@ -1351,8 +1351,7 @@ frstrans_dissect_RdcParameterUnion(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "frstrans_RdcParameterUnion");
-		tree = proto_item_add_subtree(item, ett_frstrans_frstrans_RdcParameterUnion);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_frstrans_frstrans_RdcParameterUnion, &item, "frstrans_RdcParameterUnion");
 	}
 
 	offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -1968,15 +1967,15 @@ frstrans_dissect_element_RequestUpdates_gvsn_version_(tvbuff_t *tvb _U_, int off
 /* IDL: [in] GUID connection_guid, */
 /* IDL: [in] GUID content_set_guid, */
 /* IDL: [range(0,256)] [in] uint32 credits_available, */
-/* IDL: [in] [range(0,1)] uint32 hash_requested, */
-/* IDL: [in] [range(0,2)] frstrans_UpdateRequestType update_request_type, */
+/* IDL: [range(0,1)] [in] uint32 hash_requested, */
+/* IDL: [range(0,2)] [in] frstrans_UpdateRequestType update_request_type, */
 /* IDL: [in] uint32 version_vector_diff_count, */
-/* IDL: [size_is(version_vector_diff_count)] [in] [ref] frstrans_VersionVector *version_vector_diff, */
-/* IDL: [out] [size_is(credits_available)] [length_is(*update_count)] [ref] frstrans_Update *frs_update, */
+/* IDL: [in] [size_is(version_vector_diff_count)] [ref] frstrans_VersionVector *version_vector_diff, */
+/* IDL: [length_is(*update_count)] [size_is(credits_available)] [ref] [out] frstrans_Update *frs_update, */
 /* IDL: [out] [ref] uint32 *update_count, */
 /* IDL: [ref] [out] frstrans_UpdateStatus *update_status, */
 /* IDL: [ref] [out] GUID *gvsn_db_guid, */
-/* IDL: [out] [ref] hyper *gvsn_version */
+/* IDL: [ref] [out] hyper *gvsn_version */
 /* IDL: ); */
 
 static int
@@ -2454,14 +2453,14 @@ frstrans_dissect_element_InitializeFileTransferAsync_is_end_of_file_(tvbuff_t *t
 
 /* IDL: WERROR frstrans_InitializeFileTransferAsync( */
 /* IDL: [in] GUID connection_guid, */
-/* IDL: [out] [in] [ref] frstrans_Update *frs_update, */
+/* IDL: [out] [ref] [in] frstrans_Update *frs_update, */
 /* IDL: [range(0,1)] [in] uint32 rdc_desired, */
 /* IDL: [in] [ref] [out] frstrans_RequestedStagingPolicy *staging_policy, */
 /* IDL: [out] [ref] policy_handle *server_context, */
 /* IDL: [ref] [out] frstrans_RdcFileInfo **rdc_file_info, */
-/* IDL: [length_is(*size_read)] [ref] [out] [size_is(buffer_size)] uint8 *data_buffer, */
+/* IDL: [out] [length_is(*size_read)] [size_is(buffer_size)] [ref] uint8 *data_buffer, */
 /* IDL: [range(0,262144)] [in] uint32 buffer_size, */
-/* IDL: [out] [ref] uint32 *size_read, */
+/* IDL: [ref] [out] uint32 *size_read, */
 /* IDL: [out] [ref] uint32 *is_end_of_file */
 /* IDL: ); */
 
@@ -2613,202 +2612,202 @@ static dcerpc_sub_dissector frstrans_dissectors[] = {
 void proto_register_dcerpc_frstrans(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_frstrans_frstrans_RdcFileInfo_on_disk_file_size,
-	  { "On Disk File Size", "frstrans.frstrans_RdcFileInfo.on_disk_file_size", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_fence,
-	  { "Fence", "frstrans.frstrans_Update.fence", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_second,
-	  { "Second", "frstrans.frstrans_EpoqueVector.second", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_epoque_vector,
-	  { "Epoque Vector", "frstrans.frstrans_AsyncVersionVectorResponse.epoque_vector", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_CheckConnectivity_connection_guid,
-	  { "Connection Guid", "frstrans.frstrans_CheckConnectivity.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_frs_update,
-	  { "Frs Update", "frstrans.frstrans_InitializeFileTransferAsync.frs_update", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EstablishConnection_downstream_flags,
-	  { "Downstream Flags", "frstrans.frstrans_EstablishConnection.downstream_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncPoll_response,
-	  { "Response", "frstrans.frstrans_AsyncPoll.response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_version_vector_diff_count,
-	  { "Version Vector Diff Count", "frstrans.frstrans_RequestUpdates.version_vector_diff_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_size_read,
-	  { "Size Read", "frstrans.frstrans_InitializeFileTransferAsync.size_read", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_rdc_file_info,
+		{ "Rdc File Info", "frstrans.frstrans_InitializeFileTransferAsync.rdc_file_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestVersionVector_content_set_guid,
+		{ "Content Set Guid", "frstrans.frstrans_RequestVersionVector.content_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_VersionVector_low,
+		{ "Low", "frstrans.frstrans_VersionVector.low", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_hour,
+		{ "Hour", "frstrans.frstrans_EpoqueVector.hour", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_clock,
+		{ "Clock", "frstrans.frstrans_Update.clock", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcParameterFilterPoint_max_chunk_size,
+		{ "Max Chunk Size", "frstrans.frstrans_RdcParameterFilterPoint.max_chunk_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_uid_version,
+		{ "Uid Version", "frstrans.frstrans_Update.uid_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_sha1_hash,
+		{ "Sha1 Hash", "frstrans.frstrans_Update.sha1_hash", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_day_of_week,
+		{ "Day Of Week", "frstrans.frstrans_EpoqueVector.day_of_week", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_credits_available,
+		{ "Credits Available", "frstrans.frstrans_RequestUpdates.credits_available", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RdcParameterUnion_filter_point,
-	  { "Filter Point", "frstrans.frstrans_RdcParameterUnion.filter_point", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_CheckConnectivity_replica_set_guid,
-	  { "Replica Set Guid", "frstrans.frstrans_CheckConnectivity.replica_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_VersionVector_high,
-	  { "High", "frstrans.frstrans_VersionVector.high", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_create_time,
-	  { "Create Time", "frstrans.frstrans_Update.create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_update_request_type,
-	  { "Update Request Type", "frstrans.frstrans_RequestUpdates.update_request_type", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_UpdateRequestType_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcParameterFilterPoint_min_chunk_size,
-	  { "Min Chunk Size", "frstrans.frstrans_RdcParameterFilterPoint.min_chunk_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcParameterUnion_filter_generic,
-	  { "Filter Generic", "frstrans.frstrans_RdcParameterUnion.filter_generic", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestVersionVector_vv_generation,
-	  { "Vv Generation", "frstrans.frstrans_RequestVersionVector.vv_generation", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_gsvn_version,
-	  { "Gsvn Version", "frstrans.frstrans_Update.gsvn_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_update_count,
-	  { "Update Count", "frstrans.frstrans_RequestUpdates.update_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Filter Point", "frstrans.frstrans_RdcParameterUnion.filter_point", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_opnum,
-	  { "Operation", "frstrans.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcFileInfo_rdc_minimum_compatible_version,
-	  { "Rdc Minimum Compatible Version", "frstrans.frstrans_RdcFileInfo.rdc_minimum_compatible_version", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcVersionCompatible_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EstablishConnection_downstream_protocol_version,
-	  { "Downstream Protocol Version", "frstrans.frstrans_EstablishConnection.downstream_protocol_version", FT_UINT32, BASE_DEC, VALS(frstrans_frstrans_ProtocolVersion_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_name,
-	  { "Name", "frstrans.frstrans_Update.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_day,
-	  { "Day", "frstrans.frstrans_EpoqueVector.day", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcFileInfo_rdc_filter_parameters,
-	  { "Rdc Filter Parameters", "frstrans.frstrans_RdcFileInfo.rdc_filter_parameters", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_parent_version,
-	  { "Parent Version", "frstrans.frstrans_Update.parent_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_rdc_desired,
-	  { "Rdc Desired", "frstrans.frstrans_InitializeFileTransferAsync.rdc_desired", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_parent_db_guid,
-	  { "Parent Db Guid", "frstrans.frstrans_Update.parent_db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_epoque_vector_count,
-	  { "Epoque Vector Count", "frstrans.frstrans_AsyncVersionVectorResponse.epoque_vector_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_frs_update,
-	  { "Frs Update", "frstrans.frstrans_RequestUpdates.frs_update", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Operation", "frstrans.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_content_set_guid,
+		{ "Content Set Guid", "frstrans.frstrans_Update.content_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_milli_seconds,
+		{ "Milli Seconds", "frstrans.frstrans_EpoqueVector.milli_seconds", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_server_context,
+		{ "Server Context", "frstrans.frstrans_InitializeFileTransferAsync.server_context", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcFileInfo_rdc_version,
+		{ "Rdc Version", "frstrans.frstrans_RdcFileInfo.rdc_version", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcVersion_vals), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_content_set_guid,
+		{ "Content Set Guid", "frstrans.frstrans_RequestUpdates.content_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RdcParameterGeneric_chunker_parameters,
-	  { "Chunker Parameters", "frstrans.frstrans_RdcParameterGeneric.chunker_parameters", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestVersionVector_change_type,
-	  { "Change Type", "frstrans.frstrans_RequestVersionVector.change_type", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_VersionChangeType_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestVersionVector_connection_guid,
-	  { "Connection Guid", "frstrans.frstrans_RequestVersionVector.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_gsvn_db_guid,
-	  { "Gsvn Db Guid", "frstrans.frstrans_Update.gsvn_db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_sha1_hash,
-	  { "Sha1 Hash", "frstrans.frstrans_Update.sha1_hash", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_month,
-	  { "Month", "frstrans.frstrans_EpoqueVector.month", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcParameterFilterPoint_max_chunk_size,
-	  { "Max Chunk Size", "frstrans.frstrans_RdcParameterFilterPoint.max_chunk_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_VersionVector_low,
-	  { "Low", "frstrans.frstrans_VersionVector.low", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestVersionVector_content_set_guid,
-	  { "Content Set Guid", "frstrans.frstrans_RequestVersionVector.content_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcFileInfo_file_size_estimate,
-	  { "File Size Estimate", "frstrans.frstrans_RdcFileInfo.file_size_estimate", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncResponseContext_response,
-	  { "Response", "frstrans.frstrans_AsyncResponseContext.response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncResponseContext_status,
-	  { "Status", "frstrans.frstrans_AsyncResponseContext.status", FT_UINT32, BASE_DEC, VALS(WERR_errors), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_hash_requested,
-	  { "Hash Requested", "frstrans.frstrans_RequestUpdates.hash_requested", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Chunker Parameters", "frstrans.frstrans_RdcParameterGeneric.chunker_parameters", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_fence,
+		{ "Fence", "frstrans.frstrans_Update.fence", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_frs_update,
+		{ "Frs Update", "frstrans.frstrans_RequestUpdates.frs_update", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RequestUpdates_connection_guid,
-	  { "Connection Guid", "frstrans.frstrans_RequestUpdates.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_present,
-	  { "Present", "frstrans.frstrans_Update.present", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_version_vector,
-	  { "Version Vector", "frstrans.frstrans_AsyncVersionVectorResponse.version_vector", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncPoll_connection_guid,
-	  { "Connection Guid", "frstrans.frstrans_AsyncPoll.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Connection Guid", "frstrans.frstrans_RequestUpdates.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_gsvn_version,
+		{ "Gsvn Version", "frstrans.frstrans_Update.gsvn_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EstablishConnection_upstream_protocol_version,
+		{ "Upstream Protocol Version", "frstrans.frstrans_EstablishConnection.upstream_protocol_version", FT_UINT32, BASE_DEC, VALS(frstrans_frstrans_ProtocolVersion_vals), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcFileInfo_on_disk_file_size,
+		{ "On Disk File Size", "frstrans.frstrans_RdcFileInfo.on_disk_file_size", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcFileInfo_rdc_signature_levels,
+		{ "Rdc Signature Levels", "frstrans.frstrans_RdcFileInfo.rdc_signature_levels", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_version_vector_count,
+		{ "Version Vector Count", "frstrans.frstrans_AsyncVersionVectorResponse.version_vector_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_gvsn_version,
+		{ "Gvsn Version", "frstrans.frstrans_RequestUpdates.gvsn_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_VersionVector_high,
+		{ "High", "frstrans.frstrans_VersionVector.high", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_minute,
+		{ "Minute", "frstrans.frstrans_EpoqueVector.minute", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_CheckConnectivity_replica_set_guid,
+		{ "Replica Set Guid", "frstrans.frstrans_CheckConnectivity.replica_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_vv_generation,
-	  { "Vv Generation", "frstrans.frstrans_AsyncVersionVectorResponse.vv_generation", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Vv Generation", "frstrans.frstrans_AsyncVersionVectorResponse.vv_generation", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_EstablishConnection_replica_set_guid,
-	  { "Replica Set Guid", "frstrans.frstrans_EstablishConnection.replica_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_gvsn_version,
-	  { "Gvsn Version", "frstrans.frstrans_RequestUpdates.gvsn_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EstablishSession_connection_guid,
-	  { "Connection Guid", "frstrans.frstrans_EstablishSession.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcFileInfo_rdc_signature_levels,
-	  { "Rdc Signature Levels", "frstrans.frstrans_RdcFileInfo.rdc_signature_levels", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_year,
-	  { "Year", "frstrans.frstrans_EpoqueVector.year", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcParameters_u,
-	  { "U", "frstrans.frstrans_RdcParameters.u", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_machine_guid,
-	  { "Machine Guid", "frstrans.frstrans_EpoqueVector.machine_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestVersionVector_sequence_number,
-	  { "Sequence Number", "frstrans.frstrans_RequestVersionVector.sequence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EstablishConnection_upstream_protocol_version,
-	  { "Upstream Protocol Version", "frstrans.frstrans_EstablishConnection.upstream_protocol_version", FT_UINT32, BASE_DEC, VALS(frstrans_frstrans_ProtocolVersion_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcFileInfo_compression_algorithm,
-	  { "Compression Algorithm", "frstrans.frstrans_RdcFileInfo.compression_algorithm", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcCompressionAlgorithm_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_update_status,
-	  { "Update Status", "frstrans.frstrans_RequestUpdates.update_status", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_UpdateStatus_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcParameterFilterMax_max_window_size,
-	  { "Max Window Size", "frstrans.frstrans_RdcParameterFilterMax.max_window_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_data_buffer,
-	  { "Data Buffer", "frstrans.frstrans_InitializeFileTransferAsync.data_buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_rdc_similarity,
-	  { "Rdc Similarity", "frstrans.frstrans_Update.rdc_similarity", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_staging_policy,
-	  { "Staging Policy", "frstrans.frstrans_InitializeFileTransferAsync.staging_policy", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RequestedStagingPolicy_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_attributes,
-	  { "Attributes", "frstrans.frstrans_Update.attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Replica Set Guid", "frstrans.frstrans_EstablishConnection.replica_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_update_count,
+		{ "Update Count", "frstrans.frstrans_RequestUpdates.update_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_is_end_of_file,
+		{ "Is End Of File", "frstrans.frstrans_InitializeFileTransferAsync.is_end_of_file", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RdcParameters_rdc_chunker_algorithm,
-	  { "Rdc Chunker Algorithm", "frstrans.frstrans_RdcParameters.rdc_chunker_algorithm", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcChunckerAlgorithm_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_milli_seconds,
-	  { "Milli Seconds", "frstrans.frstrans_EpoqueVector.milli_seconds", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcFileInfo_rdc_version,
-	  { "Rdc Version", "frstrans.frstrans_RdcFileInfo.rdc_version", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcVersion_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_VersionVector_db_guid,
-	  { "Db Guid", "frstrans.frstrans_VersionVector.db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_day_of_week,
-	  { "Day Of Week", "frstrans.frstrans_EpoqueVector.day_of_week", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_clock,
-	  { "Clock", "frstrans.frstrans_Update.clock", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_version_vector_count,
-	  { "Version Vector Count", "frstrans.frstrans_AsyncVersionVectorResponse.version_vector_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Rdc Chunker Algorithm", "frstrans.frstrans_RdcParameters.rdc_chunker_algorithm", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcChunckerAlgorithm_vals), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncPoll_connection_guid,
+		{ "Connection Guid", "frstrans.frstrans_AsyncPoll.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_frs_update,
+		{ "Frs Update", "frstrans.frstrans_InitializeFileTransferAsync.frs_update", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_Update_uid_db_guid,
-	  { "Uid Db Guid", "frstrans.frstrans_Update.uid_db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Uid Db Guid", "frstrans.frstrans_Update.uid_db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_gsvn_db_guid,
+		{ "Gsvn Db Guid", "frstrans.frstrans_Update.gsvn_db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcParameterFilterPoint_min_chunk_size,
+		{ "Min Chunk Size", "frstrans.frstrans_RdcParameterFilterPoint.min_chunk_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_update_status,
+		{ "Update Status", "frstrans.frstrans_RequestUpdates.update_status", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_UpdateStatus_vals), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_rdc_desired,
+		{ "Rdc Desired", "frstrans.frstrans_InitializeFileTransferAsync.rdc_desired", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_parent_version,
+		{ "Parent Version", "frstrans.frstrans_Update.parent_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EstablishConnection_downstream_protocol_version,
+		{ "Downstream Protocol Version", "frstrans.frstrans_EstablishConnection.downstream_protocol_version", FT_UINT32, BASE_DEC, VALS(frstrans_frstrans_ProtocolVersion_vals), 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_EstablishSession_content_set_guid,
-	  { "Content Set Guid", "frstrans.frstrans_EstablishSession.content_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Content Set Guid", "frstrans.frstrans_EstablishSession.content_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcParameters_u,
+		{ "U", "frstrans.frstrans_RdcParameters.u", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_present,
+		{ "Present", "frstrans.frstrans_Update.present", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_parent_db_guid,
+		{ "Parent Db Guid", "frstrans.frstrans_Update.parent_db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RequestUpdates_gvsn_db_guid,
-	  { "Gvsn Db Guid", "frstrans.frstrans_RequestUpdates.gvsn_db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EstablishConnection_connection_guid,
-	  { "Connection Guid", "frstrans.frstrans_EstablishConnection.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_buffer_size,
-	  { "Buffer Size", "frstrans.frstrans_InitializeFileTransferAsync.buffer_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_AsyncResponseContext_sequence_number,
-	  { "Sequence Number", "frstrans.frstrans_AsyncResponseContext.sequence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_name_conflict,
-	  { "Name Conflict", "frstrans.frstrans_Update.name_conflict", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_content_set_guid,
-	  { "Content Set Guid", "frstrans.frstrans_RequestUpdates.content_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RdcParameterUnion_filter_max,
-	  { "Filter Max", "frstrans.frstrans_RdcParameterUnion.filter_max", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Gvsn Db Guid", "frstrans.frstrans_RequestUpdates.gvsn_db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_data_buffer,
+		{ "Data Buffer", "frstrans.frstrans_InitializeFileTransferAsync.data_buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcFileInfo_compression_algorithm,
+		{ "Compression Algorithm", "frstrans.frstrans_RdcFileInfo.compression_algorithm", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcCompressionAlgorithm_vals), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_year,
+		{ "Year", "frstrans.frstrans_EpoqueVector.year", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_VersionVector_db_guid,
+		{ "Db Guid", "frstrans.frstrans_VersionVector.db_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestVersionVector_sequence_number,
+		{ "Sequence Number", "frstrans.frstrans_RequestVersionVector.sequence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_machine_guid,
+		{ "Machine Guid", "frstrans.frstrans_EpoqueVector.machine_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcFileInfo_rdc_minimum_compatible_version,
+		{ "Rdc Minimum Compatible Version", "frstrans.frstrans_RdcFileInfo.rdc_minimum_compatible_version", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcVersionCompatible_vals), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestVersionVector_connection_guid,
+		{ "Connection Guid", "frstrans.frstrans_RequestVersionVector.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncPoll_response,
+		{ "Response", "frstrans.frstrans_AsyncPoll.response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestVersionVector_change_type,
+		{ "Change Type", "frstrans.frstrans_RequestVersionVector.change_type", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_VersionChangeType_vals), 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_EstablishConnection_upstream_flags,
-	  { "Upstream Flags", "frstrans.frstrans_EstablishConnection.upstream_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_minute,
-	  { "Minute", "frstrans.frstrans_EpoqueVector.minute", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_flags,
-	  { "Flags", "frstrans.frstrans_Update.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_rdc_file_info,
-	  { "Rdc File Info", "frstrans.frstrans_InitializeFileTransferAsync.rdc_file_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Upstream Flags", "frstrans.frstrans_EstablishConnection.upstream_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RequestUpdates_version_vector_diff,
-	  { "Version Vector Diff", "frstrans.frstrans_RequestUpdates.version_vector_diff", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_is_end_of_file,
-	  { "Is End Of File", "frstrans.frstrans_InitializeFileTransferAsync.is_end_of_file", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Version Vector Diff", "frstrans.frstrans_RequestUpdates.version_vector_diff", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EstablishSession_connection_guid,
+		{ "Connection Guid", "frstrans.frstrans_EstablishSession.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcFileInfo_rdc_filter_parameters,
+		{ "Rdc Filter Parameters", "frstrans.frstrans_RdcFileInfo.rdc_filter_parameters", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_TransportFlags_FRSTRANS_TRANSPORT_SUPPORTS_RDC_SIMILARITY,
+		{ "Frstrans Transport Supports Rdc Similarity", "frstrans.frstrans_TransportFlags.FRSTRANS_TRANSPORT_SUPPORTS_RDC_SIMILARITY", FT_BOOLEAN, 32, TFS(&frstrans_TransportFlags_FRSTRANS_TRANSPORT_SUPPORTS_RDC_SIMILARITY_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestVersionVector_vv_generation,
+		{ "Vv Generation", "frstrans.frstrans_RequestVersionVector.vv_generation", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_CheckConnectivity_connection_guid,
+		{ "Connection Guid", "frstrans.frstrans_CheckConnectivity.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_day,
+		{ "Day", "frstrans.frstrans_EpoqueVector.day", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_version_vector_diff_count,
+		{ "Version Vector Diff Count", "frstrans.frstrans_RequestUpdates.version_vector_diff_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RdcParameterGeneric_chunker_type,
-	  { "Chunker Type", "frstrans.frstrans_RdcParameterGeneric.chunker_type", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcChunckerAlgorithm_vals), 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_server_context,
-	  { "Server Context", "frstrans.frstrans_InitializeFileTransferAsync.server_context", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_content_set_guid,
-	  { "Content Set Guid", "frstrans.frstrans_Update.content_set_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Chunker Type", "frstrans.frstrans_RdcParameterGeneric.chunker_type", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RdcChunckerAlgorithm_vals), 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RdcParameterFilterMax_min_horizon_size,
-	  { "Min Horizon Size", "frstrans.frstrans_RdcParameterFilterMax.min_horizon_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_EpoqueVector_hour,
-	  { "Hour", "frstrans.frstrans_EpoqueVector.hour", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_werror,
-	  { "Windows Error", "frstrans.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+		{ "Min Horizon Size", "frstrans.frstrans_RdcParameterFilterMax.min_horizon_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_staging_policy,
+		{ "Staging Policy", "frstrans.frstrans_InitializeFileTransferAsync.staging_policy", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_RequestedStagingPolicy_vals), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_create_time,
+		{ "Create Time", "frstrans.frstrans_Update.create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_buffer_size,
+		{ "Buffer Size", "frstrans.frstrans_InitializeFileTransferAsync.buffer_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_name_conflict,
+		{ "Name Conflict", "frstrans.frstrans_Update.name_conflict", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_month,
+		{ "Month", "frstrans.frstrans_EpoqueVector.month", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcParameterFilterMax_max_window_size,
+		{ "Max Window Size", "frstrans.frstrans_RdcParameterFilterMax.max_window_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncResponseContext_response,
+		{ "Response", "frstrans.frstrans_AsyncResponseContext.response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_version_vector,
+		{ "Version Vector", "frstrans.frstrans_AsyncVersionVectorResponse.version_vector", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_epoque_vector_count,
+		{ "Epoque Vector Count", "frstrans.frstrans_AsyncVersionVectorResponse.epoque_vector_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcFileInfo_file_size_estimate,
+		{ "File Size Estimate", "frstrans.frstrans_RdcFileInfo.file_size_estimate", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncResponseContext_status,
+		{ "Status", "frstrans.frstrans_AsyncResponseContext.status", FT_UINT32, BASE_DEC, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcParameterUnion_filter_generic,
+		{ "Filter Generic", "frstrans.frstrans_RdcParameterUnion.filter_generic", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_update_request_type,
+		{ "Update Request Type", "frstrans.frstrans_RequestUpdates.update_request_type", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_UpdateRequestType_vals), 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_connection_guid,
-	  { "Connection Guid", "frstrans.frstrans_InitializeFileTransferAsync.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_RequestUpdates_credits_available,
-	  { "Credits Available", "frstrans.frstrans_RequestUpdates.credits_available", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_frstrans_frstrans_TransportFlags_FRSTRANS_TRANSPORT_SUPPORTS_RDC_SIMILARITY,
-	  { "Frstrans Transport Supports Rdc Similarity", "frstrans.frstrans_TransportFlags.FRSTRANS_TRANSPORT_SUPPORTS_RDC_SIMILARITY", FT_BOOLEAN, 32, TFS(&frstrans_TransportFlags_FRSTRANS_TRANSPORT_SUPPORTS_RDC_SIMILARITY_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_frstrans_frstrans_Update_uid_version,
-	  { "Uid Version", "frstrans.frstrans_Update.uid_version", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Connection Guid", "frstrans.frstrans_InitializeFileTransferAsync.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EpoqueVector_second,
+		{ "Second", "frstrans.frstrans_EpoqueVector.second", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_rdc_similarity,
+		{ "Rdc Similarity", "frstrans.frstrans_Update.rdc_similarity", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EstablishConnection_downstream_flags,
+		{ "Downstream Flags", "frstrans.frstrans_EstablishConnection.downstream_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RequestUpdates_hash_requested,
+		{ "Hash Requested", "frstrans.frstrans_RequestUpdates.hash_requested", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_attributes,
+		{ "Attributes", "frstrans.frstrans_Update.attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_frstrans_frstrans_RequestVersionVector_request_type,
-	  { "Request Type", "frstrans.frstrans_RequestVersionVector.request_type", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_VersionRequestType_vals), 0, NULL, HFILL }},
+		{ "Request Type", "frstrans.frstrans_RequestVersionVector.request_type", FT_UINT1632, BASE_DEC, VALS(frstrans_frstrans_VersionRequestType_vals), 0, NULL, HFILL }},
+	{ &hf_frstrans_werror,
+		{ "Windows Error", "frstrans.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_InitializeFileTransferAsync_size_read,
+		{ "Size Read", "frstrans.frstrans_InitializeFileTransferAsync.size_read", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncVersionVectorResponse_epoque_vector,
+		{ "Epoque Vector", "frstrans.frstrans_AsyncVersionVectorResponse.epoque_vector", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_flags,
+		{ "Flags", "frstrans.frstrans_Update.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_EstablishConnection_connection_guid,
+		{ "Connection Guid", "frstrans.frstrans_EstablishConnection.connection_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_AsyncResponseContext_sequence_number,
+		{ "Sequence Number", "frstrans.frstrans_AsyncResponseContext.sequence_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_Update_name,
+		{ "Name", "frstrans.frstrans_Update.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_frstrans_frstrans_RdcParameterUnion_filter_max,
+		{ "Filter Max", "frstrans.frstrans_RdcParameterUnion.filter_max", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-initshutdown.c b/epan/dissectors/packet-dcerpc-initshutdown.c
index fb85540cd7..9b5fade07d 100644
--- a/epan/dissectors/packet-dcerpc-initshutdown.c
+++ b/epan/dissectors/packet-dcerpc-initshutdown.c
@@ -32,22 +32,22 @@ static gint ett_initshutdown_initshutdown_ReasonFlags = -1;
 
 
 /* Header field declarations */
-static gint hf_initshutdown_opnum = -1;
-static gint hf_initshutdown_initshutdown_ReasonFlags_SHTDN_REASON_FLAG_PLANNED = -1;
-static gint hf_initshutdown_initshutdown_Init_message = -1;
+static gint hf_initshutdown_initshutdown_Abort_server = -1;
+static gint hf_initshutdown_initshutdown_InitEx_force_apps = -1;
+static gint hf_initshutdown_initshutdown_Init_do_reboot = -1;
 static gint hf_initshutdown_initshutdown_InitEx_timeout = -1;
-static gint hf_initshutdown_initshutdown_InitEx_message = -1;
-static gint hf_initshutdown_initshutdown_ReasonFlags_SHTDN_REASON_FLAG_USER_DEFINED = -1;
-static gint hf_initshutdown_initshutdown_Init_timeout = -1;
 static gint hf_initshutdown_werror = -1;
-static gint hf_initshutdown_initshutdown_InitEx_force_apps = -1;
+static gint hf_initshutdown_initshutdown_InitEx_message = -1;
 static gint hf_initshutdown_initshutdown_InitEx_do_reboot = -1;
-static gint hf_initshutdown_initshutdown_InitEx_reason = -1;
-static gint hf_initshutdown_initshutdown_Init_do_reboot = -1;
-static gint hf_initshutdown_initshutdown_Abort_server = -1;
-static gint hf_initshutdown_initshutdown_Init_hostname = -1;
+static gint hf_initshutdown_opnum = -1;
+static gint hf_initshutdown_initshutdown_Init_timeout = -1;
 static gint hf_initshutdown_initshutdown_InitEx_hostname = -1;
 static gint hf_initshutdown_initshutdown_Init_force_apps = -1;
+static gint hf_initshutdown_initshutdown_ReasonFlags_SHTDN_REASON_FLAG_PLANNED = -1;
+static gint hf_initshutdown_initshutdown_Init_hostname = -1;
+static gint hf_initshutdown_initshutdown_Init_message = -1;
+static gint hf_initshutdown_initshutdown_ReasonFlags_SHTDN_REASON_FLAG_USER_DEFINED = -1;
+static gint hf_initshutdown_initshutdown_InitEx_reason = -1;
 
 static gint proto_dcerpc_initshutdown = -1;
 /* Version information */
@@ -303,7 +303,7 @@ initshutdown_dissect_element_Init_do_reboot(tvbuff_t *tvb _U_, int offset _U_, p
 }
 
 /* IDL: WERROR initshutdown_Init( */
-/* IDL: [unique(1)] [in] uint16 *hostname, */
+/* IDL: [in] [unique(1)] uint16 *hostname, */
 /* IDL: [in] [unique(1)] lsa_StringLarge *message, */
 /* IDL: [in] uint32 timeout, */
 /* IDL: [in] uint8 force_apps, */
@@ -504,38 +504,38 @@ static dcerpc_sub_dissector initshutdown_dissectors[] = {
 void proto_register_dcerpc_initshutdown(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_initshutdown_opnum,
-	  { "Operation", "initshutdown.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_ReasonFlags_SHTDN_REASON_FLAG_PLANNED,
-	  { "Shtdn Reason Flag Planned", "initshutdown.initshutdown_ReasonFlags.SHTDN_REASON_FLAG_PLANNED", FT_BOOLEAN, 32, TFS(&initshutdown_ReasonFlags_SHTDN_REASON_FLAG_PLANNED_tfs), ( 0x80000000 ), NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_Init_message,
-	  { "Message", "initshutdown.initshutdown_Init.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_Abort_server,
+		{ "Server", "initshutdown.initshutdown_Abort.server", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_InitEx_force_apps,
+		{ "Force Apps", "initshutdown.initshutdown_InitEx.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_Init_do_reboot,
+		{ "Do Reboot", "initshutdown.initshutdown_Init.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_initshutdown_initshutdown_InitEx_timeout,
-	  { "Timeout", "initshutdown.initshutdown_InitEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_InitEx_message,
-	  { "Message", "initshutdown.initshutdown_InitEx.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_ReasonFlags_SHTDN_REASON_FLAG_USER_DEFINED,
-	  { "Shtdn Reason Flag User Defined", "initshutdown.initshutdown_ReasonFlags.SHTDN_REASON_FLAG_USER_DEFINED", FT_BOOLEAN, 32, TFS(&initshutdown_ReasonFlags_SHTDN_REASON_FLAG_USER_DEFINED_tfs), ( 0x40000000 ), NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_Init_timeout,
-	  { "Timeout", "initshutdown.initshutdown_Init.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Timeout", "initshutdown.initshutdown_InitEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_initshutdown_werror,
-	  { "Windows Error", "initshutdown.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_InitEx_force_apps,
-	  { "Force Apps", "initshutdown.initshutdown_InitEx.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Windows Error", "initshutdown.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_InitEx_message,
+		{ "Message", "initshutdown.initshutdown_InitEx.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_initshutdown_initshutdown_InitEx_do_reboot,
-	  { "Do Reboot", "initshutdown.initshutdown_InitEx.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_InitEx_reason,
-	  { "Reason", "initshutdown.initshutdown_InitEx.reason", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_Init_do_reboot,
-	  { "Do Reboot", "initshutdown.initshutdown_Init.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_Abort_server,
-	  { "Server", "initshutdown.initshutdown_Abort.server", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_initshutdown_initshutdown_Init_hostname,
-	  { "Hostname", "initshutdown.initshutdown_Init.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Do Reboot", "initshutdown.initshutdown_InitEx.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_initshutdown_opnum,
+		{ "Operation", "initshutdown.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_Init_timeout,
+		{ "Timeout", "initshutdown.initshutdown_Init.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_initshutdown_initshutdown_InitEx_hostname,
-	  { "Hostname", "initshutdown.initshutdown_InitEx.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Hostname", "initshutdown.initshutdown_InitEx.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_initshutdown_initshutdown_Init_force_apps,
-	  { "Force Apps", "initshutdown.initshutdown_Init.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Force Apps", "initshutdown.initshutdown_Init.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_ReasonFlags_SHTDN_REASON_FLAG_PLANNED,
+		{ "Shtdn Reason Flag Planned", "initshutdown.initshutdown_ReasonFlags.SHTDN_REASON_FLAG_PLANNED", FT_BOOLEAN, 32, TFS(&initshutdown_ReasonFlags_SHTDN_REASON_FLAG_PLANNED_tfs), ( 0x80000000 ), NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_Init_hostname,
+		{ "Hostname", "initshutdown.initshutdown_Init.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_Init_message,
+		{ "Message", "initshutdown.initshutdown_Init.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_ReasonFlags_SHTDN_REASON_FLAG_USER_DEFINED,
+		{ "Shtdn Reason Flag User Defined", "initshutdown.initshutdown_ReasonFlags.SHTDN_REASON_FLAG_USER_DEFINED", FT_BOOLEAN, 32, TFS(&initshutdown_ReasonFlags_SHTDN_REASON_FLAG_USER_DEFINED_tfs), ( 0x40000000 ), NULL, HFILL }},
+	{ &hf_initshutdown_initshutdown_InitEx_reason,
+		{ "Reason", "initshutdown.initshutdown_InitEx.reason", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-lsa.c b/epan/dissectors/packet-dcerpc-lsa.c
index 70ba0de787..002df92142 100644
--- a/epan/dissectors/packet-dcerpc-lsa.c
+++ b/epan/dissectors/packet-dcerpc-lsa.c
@@ -101,427 +101,427 @@ static gint ett_lsarpc_lsa_ForestTrustInformation = -1;
 
 
 /* Header field declarations */
-static gint hf_lsarpc_lsa_LookupPrivValue_luid = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_level = -1;
-static gint hf_lsarpc_lsa_LookupPrivName_handle = -1;
-static gint hf_lsarpc_opnum = -1;
-static gint hf_lsarpc_lsa_ForestTrustInformation_count = -1;
-static gint hf_lsarpc_lsa_OpenTrustedDomainByName_handle = -1;
+static gint hf_lsarpc_lsa_DefaultQuotaInfo_max_wss = -1;
+static gint hf_lsarpc_lsa_LookupSids2_sids = -1;
+static gint hf_lsarpc_lsa_DefaultQuotaInfo_unknown = -1;
+static gint hf_lsarpc_lsa_OpenPolicy_attr = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_direction = -1;
+static gint hf_lsarpc_lsa_String_size = -1;
+static gint hf_lsarpc_lsa_TransNameArray2_count = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_dom_sid = -1;
+static gint hf_lsarpc_efs_blob_len = -1;
+static gint hf_lsarpc_lsa_TrustedDomainInfo_auth_info = -1;
 static gint hf_lsarpc_lsa_SetInfoPolicy2_handle = -1;
-static gint hf_lsarpc_lsa_CreateTrustedDomain_info = -1;
-static gint hf_lsarpc_lsa_DomainListEx_count = -1;
-static gint hf_lsarpc_lsa_AuditFullQueryInfo_shutdown_on_full = -1;
-static gint hf_lsarpc_lsa_LookupSids3_unknown2 = -1;
+static gint hf_lsarpc_lsa_TransNameArray2_names = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_sid = -1;
+static gint hf_lsarpc_lsa_DomainList_count = -1;
+static gint hf_lsarpc_lsa_DeleteTrustedDomain_handle = -1;
+static gint hf_lsarpc_lsa_OpenPolicy2_access_mask = -1;
+static gint hf_lsarpc_lsa_LookupNames4_unknown2 = -1;
 static gint hf_lsarpc_lsa_LookupNames_sids = -1;
-static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES = -1;
-static gint hf_lsarpc_lsa_AsciiStringLarge_length = -1;
-static gint hf_lsarpc_lsa_TranslatedSid3_sid = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_count = -1;
-static gint hf_lsarpc_lsa_OpenPolicy_attr = -1;
-static gint hf_lsarpc_lsa_DATA_BUF_PTR_buf = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_secret_type = -1;
-static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_info = -1;
-static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS = -1;
-static gint hf_lsarpc_lsa_LookupSids2_unknown1 = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_level = -1;
-static gint hf_lsarpc_lsa_DomainInfoEfs_blob_size = -1;
-static gint hf_lsarpc_lsa_AsciiStringLarge_string = -1;
-static gint hf_lsarpc_lsa_DomainList_domains = -1;
-static gint hf_lsarpc_lsa_QuerySecret_new_val = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_posix_offset = -1;
+static gint hf_lsarpc_lsa_Close_handle = -1;
+static gint hf_lsarpc_status = -1;
+static gint hf_lsarpc_lsa_TrustedDomainInfo_info_all = -1;
+static gint hf_lsarpc_lsa_OpenPolicy_system_name = -1;
+static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME = -1;
+static gint hf_lsarpc_lsa_SetInfoPolicy2_info = -1;
+static gint hf_lsarpc_lsa_QuerySecurity_sdbuf = -1;
+static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_trusted_domain = -1;
+static gint hf_lsarpc_lsa_AddPrivilegesToAccount_privs = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_trustdom_handle = -1;
+static gint hf_lsarpc_String_name = -1;
+static gint hf_lsarpc_lsa_LookupPrivDisplayName_disp_name = -1;
+static gint hf_lsarpc_lsa_TranslatedName_name = -1;
+static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_domains = -1;
+static gint hf_lsarpc_lsa_QueryInfoPolicy_handle = -1;
+static gint hf_lsarpc_lsa_LookupSids3_sids = -1;
+static gint hf_lsarpc_lsa_DATA_BUF_size = -1;
+static gint hf_lsarpc_lsa_LookupNames2_count = -1;
+static gint hf_lsarpc_lsa_EnumAccounts_resume_handle = -1;
+static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_level = -1;
+static gint hf_lsarpc_lsa_ForestTrustBinaryData_length = -1;
+static gint hf_lsarpc_lsa_GetUserName_system_name = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoPassword_password = -1;
+static gint hf_lsarpc_lsa_TranslatedName2_unknown = -1;
+static gint hf_lsarpc_lsa_TransNameArray_count = -1;
+static gint hf_lsarpc_lsa_TranslatedSid_rid = -1;
+static gint hf_lsarpc_lsa_SidPtr_sid = -1;
+static gint hf_lsarpc_lsa_RefDomainList_max_size = -1;
+static gint hf_lsarpc_lsa_CreateSecret_access_mask = -1;
 static gint hf_lsarpc_lsa_DATA_BUF2_size = -1;
-static gint hf_lsarpc_lsa_LookupNames_count = -1;
+static gint hf_lsarpc_domain_access_mask = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE = -1;
+static gint hf_lsarpc_lsa_EnumAccounts_handle = -1;
+static gint hf_lsarpc_lsa_OpenPolicy_access_mask = -1;
+static gint hf_lsarpc_lsa_QosInfo_effective_only = -1;
+static gint hf_lsarpc_lsa_DnsDomainInfo_sid = -1;
+static gint hf_lsarpc_lsa_TranslatedSid_sid_index = -1;
+static gint hf_lsarpc_lsa_TranslatedSid3_unknown = -1;
+static gint hf_lsarpc_lsa_ObjectAttribute_attributes = -1;
+static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_handle = -1;
+static gint hf_lsarpc_lsa_DefaultQuotaInfo_pagefile = -1;
+static gint hf_lsarpc_lsa_LookupNames2_sids = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_handle = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_db = -1;
+static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_unknown = -1;
+static gint hf_lsarpc_lsa_AddAccountRights_sid = -1;
+static gint hf_lsarpc_lsa_LookupNames4_unknown1 = -1;
+static gint hf_lsarpc_lsa_LookupNames3_num_names = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_quota = -1;
+static gint hf_lsarpc_lsa_String_length = -1;
 static gint hf_lsarpc_lsa_TrustDomainInfoPassword_old_password = -1;
-static gint hf_lsarpc_lsa_OpenPolicy_system_name = -1;
-static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_sids = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_auth_info = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN = -1;
-static gint hf_lsarpc_lsa_LUIDAttribute_attribute = -1;
-static gint hf_lsarpc_lsa_CreateTrustedDomain_trustdom_handle = -1;
+static gint hf_lsarpc_lsa_LookupNames4_sids = -1;
+static gint hf_lsarpc_lsa_ObjectAttribute_object_name = -1;
 static gint hf_lsarpc_lsa_AuditLogInfo_percent_full = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS = -1;
-static gint hf_lsarpc_lsa_DomainInfoKerberos_unknown6 = -1;
-static gint hf_lsarpc_lsa_AddPrivilegesToAccount_handle = -1;
-static gint hf_lsarpc_lsa_LookupNames_num_names = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_current_auth_info = -1;
-static gint hf_lsarpc_lsa_LookupSids2_count = -1;
+static gint hf_lsarpc_lsa_DomainInformationPolicy_kerberos_info = -1;
+static gint hf_lsarpc_lsa_StringPointer_string = -1;
+static gint hf_lsarpc_lsa_CreateTrustedDomain_info = -1;
+static gint hf_lsarpc_lsa_TranslatedSid2_sid_type = -1;
+static gint hf_lsarpc_lsa_OpenPolicy_handle = -1;
+static gint hf_lsarpc_lsa_SetInfoPolicy_handle = -1;
+static gint hf_lsarpc_lsa_CreateSecret_name = -1;
+static gint hf_lsarpc_lsa_LookupPrivDisplayName_handle = -1;
+static gint hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_lifetime = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN = -1;
+static gint hf_lsarpc_lsa_ForestTrustDomainInfo_dns_domain_name = -1;
+static gint hf_lsarpc_lsa_AuditEventsInfo_count = -1;
+static gint hf_lsarpc_lsa_LookupNames2_names = -1;
+static gint hf_lsarpc_lsa_SidArray_sids = -1;
+static gint hf_lsarpc_lsa_QuerySecret_old_val = -1;
+static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_level = -1;
 static gint hf_lsarpc_lsa_PrivEntry_name = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoBasic_sid = -1;
-static gint hf_lsarpc_lsa_TransNameArray_names = -1;
-static gint hf_lsarpc_lsa_DATA_BUF_size = -1;
-static gint hf_lsarpc_lsa_CreateAccount_acct_handle = -1;
-static gint hf_lsarpc_lsa_EnumTrustDom_handle = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfo11_data1 = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_info = -1;
+static gint hf_lsarpc_lsa_TrustedDomainInfo_name = -1;
+static gint hf_lsarpc_lsa_RemoveAccountRights_sid = -1;
+static gint hf_lsarpc_lsa_LookupPrivValue_luid = -1;
+static gint hf_lsarpc_lsa_LookupSids_names = -1;
 static gint hf_lsarpc_lsa_SetInfoPolicy_level = -1;
-static gint hf_lsarpc_lsa_CreateSecret_sec_handle = -1;
-static gint hf_lsarpc_lsa_LookupPrivValue_name = -1;
-static gint hf_lsarpc_lsa_EnumPrivs_privs = -1;
-static gint hf_lsarpc_lsa_LookupNames2_unknown2 = -1;
-static gint hf_lsarpc_lsa_LookupNames4_unknown1 = -1;
-static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_privs = -1;
-static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX = -1;
-static gint hf_lsarpc_lsa_LookupNames3_count = -1;
-static gint hf_lsarpc_secret_access_mask = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_info_ex = -1;
-static gint hf_lsarpc_lsa_LookupSids3_domains = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION = -1;
-static gint hf_lsarpc_lsa_LookupSids3_level = -1;
-static gint hf_lsarpc_lsa_LookupNames4_unknown2 = -1;
-static gint hf_lsarpc_lsa_AddAccountRights_sid = -1;
-static gint hf_lsarpc_lsa_Strings_names = -1;
-static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_domains = -1;
-static gint hf_lsarpc_lsa_RightSet_count = -1;
-static gint hf_lsarpc_lsa_TranslatedName2_sid_type = -1;
-static gint hf_lsarpc_lsa_EnumPrivsAccount_privs = -1;
-static gint hf_lsarpc_lsa_DATA_BUF_data = -1;
-static gint hf_lsarpc_lsa_CreateAccount_handle = -1;
-static gint hf_lsarpc_lsa_DefaultQuotaInfo_pagefile = -1;
-static gint hf_lsarpc_lsa_PDAccountInfo_name = -1;
-static gint hf_lsarpc_lsa_StringLarge_size = -1;
-static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_max_size = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_data1 = -1;
-static gint hf_lsarpc_lsa_EnumAccounts_handle = -1;
-static gint hf_lsarpc_lsa_LookupNames_level = -1;
-static gint hf_lsarpc_lsa_ForestTrustDomainInfo_dns_domain_name = -1;
 static gint hf_lsarpc_lsa_PrivArray_privs = -1;
-static gint hf_lsarpc_lsa_TranslatedSid_sid_type = -1;
-static gint hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE = -1;
-static gint hf_lsarpc_lsa_TranslatedName_sid_index = -1;
-static gint hf_lsarpc_lsa_OpenTrustedDomain_access_mask = -1;
-static gint hf_lsarpc_lsa_LookupPrivName_luid = -1;
-static gint hf_lsarpc_domain_access_mask = -1;
-static gint hf_lsarpc_lsa_LookupSids_handle = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_role = -1;
-static gint hf_lsarpc_lsa_CreateTrustedDomain_access_mask = -1;
-static gint hf_lsarpc_lsa_TranslatedSid2_sid_index = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_pd = -1;
-static gint hf_lsarpc_lsa_DeleteTrustedDomain_handle = -1;
-static gint hf_lsarpc_lsa_TrustedDomainInfo_info11 = -1;
-static gint hf_lsarpc_lsa_SetDomainInformationPolicy_info = -1;
-static gint hf_lsarpc_lsa_LookupPrivName_name = -1;
 static gint hf_lsarpc_lsa_DomainListEx_domains = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_db = -1;
-static gint hf_lsarpc_lsa_AuditLogInfo_retention_time = -1;
-static gint hf_lsarpc_lsa_QueryInfoPolicy2_info = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_audit_events = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_sid = -1;
-static gint hf_lsarpc_lsa_String_size = -1;
-static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_handle = -1;
+static gint hf_lsarpc_lsa_AddAccountRights_handle = -1;
+static gint hf_lsarpc_lsa_LookupNames2_unknown2 = -1;
+static gint hf_lsarpc_lsa_ForestTrustInformation_entries = -1;
 static gint hf_lsarpc_lsa_AuditEventsInfo_auditing_mode = -1;
+static gint hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE = -1;
+static gint hf_lsarpc_lsa_LookupNames3_unknown1 = -1;
+static gint hf_lsarpc_lsa_LookupSids_count = -1;
+static gint hf_lsarpc_lsa_LookupNames_num_names = -1;
+static gint hf_lsarpc_lsa_AddAccountRights_rights = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION = -1;
+static gint hf_lsarpc_lsa_EnumPrivs_resume_handle = -1;
+static gint hf_lsarpc_lsa_TranslatedName2_name = -1;
+static gint hf_lsarpc_lsa_SetInfoPolicy_info = -1;
+static gint hf_lsarpc_lsa_OpenAccount_access_mask = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_count = -1;
+static gint hf_lsarpc_lsa_TransSidArray2_sids = -1;
+static gint hf_lsarpc_lsa_DATA_BUF_PTR_buf = -1;
 static gint hf_lsarpc_lsa_TrustedDomainInfo_password = -1;
-static gint hf_lsarpc_lsa_AuditLogInfo_shutdown_in_progress = -1;
-static gint hf_lsarpc_lsa_String_string = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_info_ex = -1;
+static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW = -1;
 static gint hf_lsarpc_lsa_CloseTrustedDomainEx_handle = -1;
-static gint hf_lsarpc_lsa_EnumTrustDom_resume_handle = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_handle = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_auditfullset = -1;
-static gint hf_lsarpc_lsa_LookupSids_domains = -1;
-static gint hf_lsarpc_lsa_DefaultQuotaInfo_non_paged_pool = -1;
-static gint hf_lsarpc_lsa_LookupNames4_count = -1;
-static gint hf_lsarpc_names = -1;
-static gint hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_renewaltime = -1;
-static gint hf_lsarpc_lsa_LookupNames3_domains = -1;
-static gint hf_lsarpc_account_access_mask = -1;
-static gint hf_lsarpc_lsa_DomainInformationPolicy_efs_info = -1;
-static gint hf_lsarpc_lsa_CreateSecret_name = -1;
-static gint hf_lsarpc_lsa_ServerRole_role = -1;
-static gint hf_lsarpc_lsa_ForestTrustDomainInfo_netbios_domain_name = -1;
-static gint hf_lsarpc_lsa_TranslatedName2_name = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoPassword_password = -1;
-static gint hf_lsarpc_lsa_PrivilegeSet_count = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_trusted_domain = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfo11_info_ex = -1;
-static gint hf_lsarpc_lsa_DeleteTrustedDomain_dom_sid = -1;
-static gint hf_lsarpc_lsa_ForestTrustData_top_level_name = -1;
-static gint hf_lsarpc_lsa_PrivArray_count = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS = -1;
-static gint hf_lsarpc_lsa_OpenPolicy_handle = -1;
-static gint hf_lsarpc_lsa_SetSecret_sec_handle = -1;
-static gint hf_lsarpc_lsa_ObjectAttribute_root_dir = -1;
-static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_handle = -1;
-static gint hf_lsarpc_lsa_OpenSecret_sec_handle = -1;
-static gint hf_lsarpc_lsa_DnsDomainInfo_sid = -1;
+static gint hf_lsarpc_lsa_DomainInfo_name = -1;
+static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_remove_all = -1;
+static gint hf_lsarpc_lsa_StringLarge_length = -1;
 static gint hf_lsarpc_lsa_EnumAccountRights_sid = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_posix_offset = -1;
-static gint hf_lsarpc_lsa_LookupPrivDisplayName_language_id = -1;
-static gint hf_lsarpc_lsa_LookupNames3_num_names = -1;
-static gint hf_lsarpc_lsa_QuerySecret_sec_handle = -1;
-static gint hf_lsarpc_lsa_OpenTrustedDomainByName_name = -1;
-static gint hf_lsarpc_lsa_DomainInfoKerberos_clock_skew = -1;
-static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_handle = -1;
-static gint hf_lsarpc_lsa_TranslatedSid3_unknown = -1;
-static gint hf_lsarpc_lsa_ObjectAttribute_object_name = -1;
-static gint hf_lsarpc_lsa_SetInfoPolicy2_info = -1;
-static gint hf_lsarpc_lsa_QueryInfoPolicy_level = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_attributes = -1;
-static gint hf_lsarpc_lsa_AsciiStringLarge_size = -1;
-static gint hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_lifetime = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_posix_offset = -1;
-static gint hf_lsarpc_lsa_TrustedDomainInfo_auth_info = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_domain_name = -1;
-static gint hf_lsarpc_lsa_LookupNames4_sids = -1;
-static gint hf_lsarpc_lsa_TranslatedName_sid_type = -1;
-static gint hf_lsarpc_lsa_OpenPolicy2_system_name = -1;
-static gint hf_lsarpc_lsa_LookupSids3_unknown1 = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_replica = -1;
+static gint hf_lsarpc_lsa_LookupSids2_names = -1;
+static gint hf_lsarpc_lsa_LookupPrivName_name = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_info = -1;
+static gint hf_lsarpc_lsa_TranslatedSid3_sid = -1;
+static gint hf_lsarpc_lsa_LookupSids2_unknown1 = -1;
+static gint hf_lsarpc_lsa_StringLarge_size = -1;
+static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS = -1;
+static gint hf_lsarpc_lsa_TranslatedSid2_unknown = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_audit_log = -1;
+static gint hf_lsarpc_lsa_LookupPrivName_luid = -1;
 static gint hf_lsarpc_lsa_ObjectAttribute_sec_desc = -1;
-static gint hf_lsarpc_lsa_DomainInfo_sid = -1;
-static gint hf_lsarpc_lsa_AuditLogInfo_time_to_shutdown = -1;
-static gint hf_lsarpc_lsa_RefDomainList_max_size = -1;
-static gint hf_lsarpc_lsa_RemoveAccountRights_rights = -1;
-static gint hf_lsarpc_lsa_GetUserName_authority_name = -1;
-static gint hf_lsarpc_lsa_TransSidArray2_sids = -1;
-static gint hf_lsarpc_lsa_TranslatedName_name = -1;
-static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_auth_info = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE = -1;
-static gint hf_lsarpc_lsa_EnumPrivs_resume_handle = -1;
-static gint hf_lsarpc_lsa_ForestTrustInformation_entries = -1;
-static gint hf_lsarpc_lsa_SidPtr_sid = -1;
-static gint hf_lsarpc_lsa_LookupNames2_sids = -1;
-static gint hf_lsarpc_lsa_LookupSids3_names = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoPosixOffset_posix_offset = -1;
-static gint hf_lsarpc_lsa_LookupPrivDisplayName_handle = -1;
-static gint hf_lsarpc_lsa_Close_handle = -1;
-static gint hf_lsarpc_lsa_LookupPrivValue_handle = -1;
-static gint hf_lsarpc_lsa_LookupPrivDisplayName_name = -1;
-static gint hf_lsarpc_lsa_RemoveAccountRights_handle = -1;
-static gint hf_lsarpc_lsa_LookupSids3_sids = -1;
-static gint hf_lsarpc_lsa_EnumAccounts_sids = -1;
-static gint hf_lsarpc_lsa_EnumTrustDom_domains = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_account_domain = -1;
+static gint hf_lsarpc_lsa_OpenSecret_access_mask = -1;
+static gint hf_lsarpc_lsa_LUID_high = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_attributes = -1;
+static gint hf_lsarpc_lsa_RefDomainList_count = -1;
+static gint hf_lsarpc_lsa_LookupNames4_level = -1;
+static gint hf_lsarpc_lsa_LookupSids3_unknown2 = -1;
+static gint hf_lsarpc_lsa_CreateTrustedDomain_trustdom_handle = -1;
+static gint hf_lsarpc_lsa_AuditLogInfo_unknown = -1;
+static gint hf_lsarpc_lsa_TrustedDomainInfo_info11 = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_current_auth_info = -1;
+static gint hf_lsarpc_lsa_LookupNames2_level = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT = -1;
+static gint hf_lsarpc_lsa_TranslatedSid2_rid = -1;
+static gint hf_lsarpc_lsa_AsciiString_length = -1;
+static gint hf_lsarpc_lsa_AsciiStringLarge_length = -1;
+static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_level = -1;
+static gint hf_lsarpc_lsa_AsciiString_string = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS = -1;
+static gint hf_lsarpc_lsa_QueryInfoPolicy2_info = -1;
+static gint hf_lsarpc_lsa_OpenTrustedDomainByName_handle = -1;
 static gint hf_lsarpc_lsa_DefaultQuotaInfo_paged_pool = -1;
-static gint hf_lsarpc_lsa_LookupPrivDisplayName_unknown = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_count = -1;
-static gint hf_lsarpc_lsa_DnsDomainInfo_domain_guid = -1;
-static gint hf_lsarpc_lsa_LookupNames3_unknown1 = -1;
+static gint hf_lsarpc_lsa_OpenTrustedDomainByName_trustdom_handle = -1;
+static gint hf_lsarpc_lsa_LUIDAttribute_attribute = -1;
+static gint hf_lsarpc_lsa_RemoveAccountRights_handle = -1;
+static gint hf_lsarpc_lsa_AuditLogInfo_shutdown_in_progress = -1;
+static gint hf_lsarpc_lsa_GetUserName_account_name = -1;
+static gint hf_lsarpc_lsa_QuerySecret_new_val = -1;
+static gint hf_lsarpc_lsa_CreateAccount_access_mask = -1;
+static gint hf_lsarpc_lsa_CreateTrustedDomain_handle = -1;
+static gint hf_lsarpc_lsa_LookupNames2_handle = -1;
 static gint hf_lsarpc_lsa_LookupSids_level = -1;
-static gint hf_lsarpc_lsa_TranslatedSid_sid_index = -1;
+static gint hf_lsarpc_lsa_OpenPolicy2_system_name = -1;
+static gint hf_lsarpc_lsa_LookupNames2_num_names = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_info = -1;
+static gint hf_lsarpc_lsa_DomainListEx_count = -1;
+static gint hf_lsarpc_lsa_Strings_count = -1;
+static gint hf_lsarpc_lsa_RightSet_names = -1;
+static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_max_size = -1;
+static gint hf_lsarpc_lsa_SetDomainInformationPolicy_handle = -1;
+static gint hf_lsarpc_lsa_RightAttribute_name = -1;
+static gint hf_lsarpc_lsa_ForestTrustRecord_flags = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_netbios_name = -1;
 static gint hf_lsarpc_lsa_TrustedDomainInfo_info_ex = -1;
-static gint hf_lsarpc_lsa_EnumAccounts_resume_handle = -1;
-static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_level = -1;
+static gint hf_lsarpc_lsa_AuditLogInfo_retention_time = -1;
+static gint hf_lsarpc_lsa_ForestTrustRecord_unknown = -1;
+static gint hf_lsarpc_lsa_EnumPrivs_handle = -1;
+static gint hf_lsarpc_lsa_TranslatedName2_sid_index = -1;
+static gint hf_lsarpc_lsa_QueryInfoPolicy_info = -1;
 static gint hf_lsarpc_lsa_TrustedDomainInfo_full_info = -1;
+static gint hf_lsarpc_lsa_TranslatedSid3_sid_index = -1;
+static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS = -1;
+static gint hf_lsarpc_lsa_LookupNames3_count = -1;
+static gint hf_lsarpc_lsa_OpenTrustedDomain_trustdom_handle = -1;
+static gint hf_lsarpc_lsa_DomainInfoEfs_efs_blob = -1;
+static gint hf_lsarpc_lsa_OpenAccount_handle = -1;
+static gint hf_lsarpc_lsa_PrivilegeSet_set = -1;
+static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_resume_handle = -1;
+static gint hf_lsarpc_lsa_LookupSids2_handle = -1;
+static gint hf_lsarpc_lsa_QuerySecret_sec_handle = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_auditfullquery = -1;
+static gint hf_lsarpc_lsa_ForestTrustInformation_count = -1;
+static gint hf_lsarpc_lsa_StringLarge_string = -1;
+static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX = -1;
+static gint hf_lsarpc_lsa_TransNameArray_names = -1;
 static gint hf_lsarpc_lsa_DATA_BUF_length = -1;
-static gint hf_lsarpc_lsa_LookupNames4_domains = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_trustdom_handle = -1;
-static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_level = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT = -1;
-static gint hf_lsarpc_lsa_OpenSecret_access_mask = -1;
-static gint hf_lsarpc_lsa_TransSidArray2_count = -1;
-static gint hf_lsarpc_lsa_AsciiString_size = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_quota = -1;
-static gint hf_lsarpc_lsa_AddAccountRights_rights = -1;
-static gint hf_lsarpc_lsa_ForestTrustData_top_level_name_ex = -1;
-static gint hf_lsarpc_lsa_Strings_count = -1;
-static gint hf_lsarpc_lsa_ForestTrustData_data = -1;
+static gint hf_lsarpc_lsa_EnumAccounts_num_entries = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_posix_offset = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_last_update_time = -1;
+static gint hf_lsarpc_lsa_QueryInfoPolicy2_handle = -1;
 static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_type = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_pd = -1;
+static gint hf_lsarpc_lsa_PrivilegeSet_count = -1;
 static gint hf_lsarpc_lsa_DATA_BUF2_data = -1;
-static gint hf_lsarpc_lsa_SetInfoPolicy_info = -1;
-static gint hf_lsarpc_lsa_SetSecret_new_val = -1;
-static gint hf_lsarpc_lsa_TranslatedSid3_sid_index = -1;
-static gint hf_lsarpc_lsa_TransNameArray2_count = -1;
-static gint hf_lsarpc_lsa_Delete_handle = -1;
-static gint hf_lsarpc_lsa_EnumPrivs_max_count = -1;
-static gint hf_lsarpc_lsa_CreateSecret_access_mask = -1;
-static gint hf_lsarpc_status = -1;
-static gint hf_lsarpc_lsa_ForestTrustRecord_forest_trust_data = -1;
-static gint hf_lsarpc_lsa_OpenTrustedDomain_trustdom_handle = -1;
-static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_forest_trust_info = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN = -1;
-static gint hf_lsarpc_lsa_ObjectAttribute_sec_qos = -1;
-static gint hf_lsarpc_lsa_LookupSids2_sids = -1;
-static gint hf_lsarpc_lsa_DnsDomainInfo_dns_domain = -1;
-static gint hf_lsarpc_lsa_SetDomainInformationPolicy_handle = -1;
-static gint hf_lsarpc_lsa_PrivilegeSet_unknown = -1;
-static gint hf_lsarpc_lsa_DomainInfoKerberos_service_tkt_lifetime = -1;
-static gint hf_lsarpc_lsa_StringLarge_length = -1;
-static gint hf_lsarpc_lsa_OpenTrustedDomain_sid = -1;
-static gint hf_lsarpc_lsa_QuerySecurity_sdbuf = -1;
-static gint hf_lsarpc_lsa_OpenTrustedDomainByName_access_mask = -1;
-static gint hf_lsarpc_lsa_DomainInfo_name = -1;
-static gint hf_lsarpc_lsa_ModificationInfo_db_create_time = -1;
-static gint hf_lsarpc_lsa_LookupSids_sids = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_current_auth_info = -1;
-static gint hf_lsarpc_lsa_LookupNames_names = -1;
-static gint hf_lsarpc_lsa_ForestTrustBinaryData_data = -1;
-static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_handle = -1;
-static gint hf_lsarpc_lsa_LookupNames3_sids = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_domain = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_data1 = -1;
 static gint hf_lsarpc_lsa_AuditLogInfo_log_size = -1;
-static gint hf_lsarpc_lsa_OpenTrustedDomainByName_trustdom_handle = -1;
-static gint hf_lsarpc_lsa_DnsDomainInfo_name = -1;
-static gint hf_lsarpc_lsa_ObjectAttribute_len = -1;
-static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_resume_handle = -1;
-static gint hf_lsarpc_sec_desc_buf_len = -1;
-static gint hf_lsarpc_efs_blob_len = -1;
-static gint hf_lsarpc_lsa_DomainInformationPolicy_kerberos_info = -1;
-static gint hf_lsarpc_lsa_CreateAccount_access_mask = -1;
-static gint hf_lsarpc_lsa_StringPointer_string = -1;
-static gint hf_lsarpc_lsa_AuditEventsInfo_count = -1;
-static gint hf_lsarpc_lsa_ObjectAttribute_attributes = -1;
-static gint hf_lsarpc_lsa_PrivEntry_luid = -1;
+static gint hf_lsarpc_lsa_AsciiStringLarge_size = -1;
 static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_info = -1;
-static gint hf_lsarpc_lsa_QosInfo_impersonation_level = -1;
-static gint hf_lsarpc_lsa_CreateTrustedDomain_handle = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_info = -1;
-static gint hf_lsarpc_lsa_AuditEventsInfo_settings = -1;
-static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_last_update_time = -1;
-static gint hf_lsarpc_lsa_LookupNames2_level = -1;
-static gint hf_lsarpc_lsa_QuerySecurity_handle = -1;
-static gint hf_lsarpc_lsa_LUID_low = -1;
+static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_handle = -1;
+static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_sids = -1;
+static gint hf_lsarpc_lsa_LookupSids2_domains = -1;
+static gint hf_lsarpc_lsa_AuditFullSetInfo_shutdown_on_full = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_dns = -1;
+static gint hf_lsarpc_lsa_Delete_handle = -1;
+static gint hf_lsarpc_lsa_CreateAccount_handle = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_current_auth_info = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN = -1;
+static gint hf_lsarpc_lsa_LookupNames_domains = -1;
+static gint hf_lsarpc_names = -1;
 static gint hf_lsarpc_lsa_EnumPrivsAccount_handle = -1;
-static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_remove_all = -1;
-static gint hf_lsarpc_lsa_TranslatedName2_sid_index = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_data = -1;
+static gint hf_lsarpc_lsa_AuditLogInfo_next_audit_record = -1;
+static gint hf_lsarpc_lsa_DomainInfo_sid = -1;
+static gint hf_lsarpc_lsa_LookupSids3_domains = -1;
 static gint hf_lsarpc_lsa_DomainInfoKerberos_enforce_restrictions = -1;
-static gint hf_lsarpc_lsa_QosInfo_context_mode = -1;
-static gint hf_lsarpc_lsa_EnumPrivs_handle = -1;
-static gint hf_lsarpc_lsa_LookupNames3_names = -1;
-static gint hf_lsarpc_lsa_AuditLogInfo_unknown = -1;
-static gint hf_lsarpc_lsa_AddPrivilegesToAccount_privs = -1;
-static gint hf_lsarpc_lsa_ForestTrustRecord_unknown = -1;
-static gint hf_lsarpc_lsa_TranslatedSid_rid = -1;
-static gint hf_lsarpc_lsa_AddAccountRights_handle = -1;
-static gint hf_lsarpc_lsa_TransSidArray_sids = -1;
-static gint hf_lsarpc_lsa_LUID_high = -1;
-static gint hf_lsarpc_lsa_ReplicaSourceInfo_source = -1;
-static gint hf_lsarpc_lsa_LookupNames4_names = -1;
-static gint hf_lsarpc_lsa_LookupSids2_unknown2 = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_dom_sid = -1;
-static gint hf_lsarpc_lsa_LookupNames_domains = -1;
-static gint hf_lsarpc_lsa_DefaultQuotaInfo_min_wss = -1;
-static gint hf_lsarpc_lsa_TransNameArray_count = -1;
-static gint hf_lsarpc_lsa_ForestTrustBinaryData_length = -1;
-static gint hf_lsarpc_lsa_TrustedDomainInfo_info_all = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoName_netbios_name = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_info = -1;
+static gint hf_lsarpc_lsa_TranslatedName2_sid_type = -1;
+static gint hf_lsarpc_lsa_AuditLogInfo_time_to_shutdown = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION = -1;
+static gint hf_lsarpc_lsa_EnumAccountRights_handle = -1;
+static gint hf_lsarpc_lsa_ForestTrustDomainInfo_netbios_domain_name = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_level = -1;
 static gint hf_lsarpc_lsa_CreateSecret_handle = -1;
-static gint hf_lsarpc_lsa_LookupNames2_handle = -1;
-static gint hf_lsarpc_lsa_DomainList_count = -1;
-static gint hf_lsarpc_lsa_TrustedDomainInfo_name = -1;
-static gint hf_lsarpc_lsa_LookupSids2_level = -1;
-static gint hf_lsarpc_lsa_SetDomainInformationPolicy_level = -1;
-static gint hf_lsarpc_lsa_EnumAccounts_num_entries = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_previous_auth_info = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoBasic_netbios_name = -1;
-static gint hf_lsarpc_lsa_LookupNames2_domains = -1;
-static gint hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE = -1;
-static gint hf_lsarpc_lsa_RightAttribute_name = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_replica = -1;
-static gint hf_lsarpc_lsa_AsciiString_length = -1;
-static gint hf_lsarpc_lsa_OpenAccount_handle = -1;
-static gint hf_lsarpc_lsa_CreateAccount_sid = -1;
-static gint hf_lsarpc_lsa_String_length = -1;
-static gint hf_lsarpc_lsa_GetUserName_account_name = -1;
-static gint hf_lsarpc_lsa_QueryInfoPolicy2_level = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_dns = -1;
+static gint hf_lsarpc_lsa_OpenAccount_acct_handle = -1;
+static gint hf_lsarpc_lsa_LookupNames3_domains = -1;
+static gint hf_lsarpc_account_access_mask = -1;
+static gint hf_lsarpc_lsa_LookupNames_level = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_auth_info = -1;
+static gint hf_lsarpc_lsa_OpenAccount_sid = -1;
 static gint hf_lsarpc_lsa_LookupNames3_unknown2 = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_direction = -1;
-static gint hf_lsarpc_lsa_LookupSids3_count = -1;
+static gint hf_lsarpc_lsa_LookupPrivValue_name = -1;
+static gint hf_lsarpc_lsa_String_string = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN = -1;
+static gint hf_lsarpc_lsa_EnumTrustDom_handle = -1;
+static gint hf_lsarpc_lsa_OpenTrustedDomain_access_mask = -1;
+static gint hf_lsarpc_lsa_LookupNames3_handle = -1;
+static gint hf_lsarpc_sec_desc_buf_len = -1;
+static gint hf_lsarpc_lsa_EnumPrivsAccount_privs = -1;
+static gint hf_lsarpc_lsa_TranslatedSid_sid_type = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_domain_name = -1;
+static gint hf_lsarpc_lsa_EnumTrustDom_domains = -1;
+static gint hf_lsarpc_lsa_EnumAccountRights_rights = -1;
+static gint hf_lsarpc_lsa_LookupSids_handle = -1;
+static gint hf_lsarpc_lsa_TranslatedName_sid_index = -1;
+static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX = -1;
+static gint hf_lsarpc_lsa_ObjectAttribute_root_dir = -1;
+static gint hf_lsarpc_lsa_LookupSids3_level = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfo11_info_ex = -1;
+static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_name = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_auditfullset = -1;
 static gint hf_lsarpc_lsa_TransSidArray3_sids = -1;
-static gint hf_lsarpc_lsa_SetSecret_old_val = -1;
-static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_unknown = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_audit_log = -1;
+static gint hf_lsarpc_lsa_LookupPrivName_handle = -1;
+static gint hf_lsarpc_lsa_OpenPolicy2_attr = -1;
 static gint hf_lsarpc_lsa_TransSidArray3_count = -1;
-static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME = -1;
-static gint hf_lsarpc_lsa_GetUserName_system_name = -1;
-static gint hf_lsarpc_lsa_SetInfoPolicy_handle = -1;
-static gint hf_lsarpc_lsa_TrustedDomainInfo_info_basic = -1;
-static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH = -1;
-static gint hf_lsarpc_lsa_SidArray_sids = -1;
-static gint hf_lsarpc_lsa_LookupSids2_names = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_handle = -1;
-static gint hf_lsarpc_lsa_LookupSids2_domains = -1;
-static gint hf_lsarpc_lsa_QueryInfoPolicy_handle = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION = -1;
-static gint hf_lsarpc_lsa_RightSet_names = -1;
-static gint hf_lsarpc_lsa_QuerySecurity_sec_info = -1;
-static gint hf_lsarpc_lsa_DnsDomainInfo_dns_forest = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_level = -1;
+static gint hf_lsarpc_lsa_DomainInfoEfs_blob_size = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_role = -1;
+static gint hf_lsarpc_lsa_LookupSids3_unknown1 = -1;
+static gint hf_lsarpc_lsa_RightSet_count = -1;
+static gint hf_lsarpc_lsa_DomainInfoKerberos_service_tkt_lifetime = -1;
+static gint hf_lsarpc_lsa_LookupPrivDisplayName_name = -1;
+static gint hf_lsarpc_lsa_ForestTrustData_data = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoBasic_netbios_name = -1;
+static gint hf_lsarpc_lsa_DeleteTrustedDomain_dom_sid = -1;
+static gint hf_lsarpc_lsa_SetSecret_old_val = -1;
+static gint hf_lsarpc_lsa_ObjectAttribute_sec_qos = -1;
+static gint hf_lsarpc_lsa_LookupNames_names = -1;
+static gint hf_lsarpc_lsa_LookupNames_count = -1;
+static gint hf_lsarpc_lsa_TranslatedName_sid_type = -1;
 static gint hf_lsarpc_lsa_QuerySecret_new_mtime = -1;
-static gint hf_lsarpc_lsa_TranslatedSid2_sid_type = -1;
-static gint hf_lsarpc_lsa_SidArray_num_sids = -1;
-static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_name = -1;
-static gint hf_lsarpc_lsa_AuditFullQueryInfo_log_is_full = -1;
-static gint hf_lsarpc_lsa_SetInfoPolicy2_level = -1;
-static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_handle = -1;
-static gint hf_lsarpc_lsa_RemoveAccountRights_unknown = -1;
-static gint hf_lsarpc_lsa_TranslatedSid2_unknown = -1;
-static gint hf_lsarpc_lsa_TransSidArray_count = -1;
-static gint hf_lsarpc_lsa_StringLarge_string = -1;
-static gint hf_lsarpc_lsa_OpenAccount_acct_handle = -1;
-static gint hf_lsarpc_lsa_DefaultQuotaInfo_unknown = -1;
-static gint hf_lsarpc_lsa_TransNameArray2_names = -1;
+static gint hf_lsarpc_lsa_TrustedDomainInfo_info_basic = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS = -1;
+static gint hf_lsarpc_lsa_QueryInfoPolicy2_level = -1;
+static gint hf_lsarpc_lsa_ForestTrustData_top_level_name = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoName_netbios_name = -1;
+static gint hf_lsarpc_lsa_QosInfo_impersonation_level = -1;
+static gint hf_lsarpc_lsa_EnumTrustDom_max_size = -1;
+static gint hf_lsarpc_lsa_LookupNames4_count = -1;
+static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_handle = -1;
 static gint hf_lsarpc_lsa_ReplicaSourceInfo_account = -1;
-static gint hf_lsarpc_lsa_LookupSids_names = -1;
-static gint hf_lsarpc_lsa_ForestTrustDomainInfo_domain_sid = -1;
-static gint hf_lsarpc_lsa_EnumAccountRights_rights = -1;
-static gint hf_lsarpc_lsa_TranslatedSid3_sid_type = -1;
-static gint hf_lsarpc_lsa_QuerySecret_old_val = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfo11_data1 = -1;
+static gint hf_lsarpc_lsa_CreateTrustedDomain_access_mask = -1;
+static gint hf_lsarpc_lsa_DATA_BUF_data = -1;
+static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_info = -1;
+static gint hf_lsarpc_lsa_CreateSecret_sec_handle = -1;
+static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_account_domain = -1;
+static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_handle = -1;
 static gint hf_lsarpc_lsa_OpenSecret_handle = -1;
-static gint hf_lsarpc_lsa_AuditFullSetInfo_shutdown_on_full = -1;
+static gint hf_lsarpc_lsa_DefaultQuotaInfo_min_wss = -1;
 static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_handle = -1;
-static gint hf_lsarpc_lsa_QueryInfoPolicy_info = -1;
-static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX = -1;
-static gint hf_lsarpc_lsa_OpenPolicy2_attr = -1;
-static gint hf_lsarpc_lsa_LookupNames2_unknown1 = -1;
-static gint hf_lsarpc_policy_access_mask = -1;
-static gint hf_lsarpc_lsa_EnumAccountRights_handle = -1;
-static gint hf_lsarpc_lsa_LookupNames3_level = -1;
-static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH = -1;
-static gint hf_lsarpc_lsa_RemoveAccountRights_sid = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_auditfullquery = -1;
-static gint hf_lsarpc_lsa_AuditFullQueryInfo_unknown = -1;
-static gint hf_lsarpc_lsa_AsciiString_string = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_data = -1;
-static gint hf_lsarpc_lsa_PrivilegeSet_set = -1;
-static gint hf_lsarpc_lsa_DomainInfoEfs_efs_blob = -1;
-static gint hf_lsarpc_lsa_LUIDAttribute_luid = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION = -1;
-static gint hf_lsarpc_lsa_ForestTrustRecord_flags = -1;
-static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_trusted_domain = -1;
-static gint hf_lsarpc_lsa_LookupSids_count = -1;
-static gint hf_lsarpc_lsa_OpenAccount_access_mask = -1;
+static gint hf_lsarpc_lsa_LookupSids2_count = -1;
+static gint hf_lsarpc_lsa_RemoveAccountRights_unknown = -1;
+static gint hf_lsarpc_lsa_LUID_low = -1;
+static gint hf_lsarpc_lsa_DomainInfoKerberos_unknown6 = -1;
+static gint hf_lsarpc_lsa_LookupSids2_level = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_info_ex = -1;
+static gint hf_lsarpc_lsa_LookupSids_sids = -1;
+static gint hf_lsarpc_lsa_ForestTrustRecord_forest_trust_data = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_trusted_domain = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoPosixOffset_posix_offset = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION = -1;
+static gint hf_lsarpc_lsa_LookupPrivDisplayName_unknown = -1;
+static gint hf_lsarpc_lsa_DefaultQuotaInfo_non_paged_pool = -1;
+static gint hf_lsarpc_lsa_GetUserName_authority_name = -1;
+static gint hf_lsarpc_lsa_EnumTrustDom_resume_handle = -1;
 static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_previous_auth_info = -1;
-static gint hf_lsarpc_lsa_TranslatedSid2_rid = -1;
-static gint hf_lsarpc_lsa_LookupNames4_num_names = -1;
-static gint hf_lsarpc_lsa_LookupNames2_names = -1;
+static gint hf_lsarpc_lsa_EnumPrivs_max_count = -1;
+static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_handle = -1;
+static gint hf_lsarpc_lsa_LookupSids3_count = -1;
+static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION = -1;
+static gint hf_lsarpc_lsa_CreateAccount_sid = -1;
+static gint hf_lsarpc_lsa_EnumPrivs_privs = -1;
+static gint hf_lsarpc_lsa_AuditFullQueryInfo_log_is_full = -1;
+static gint hf_lsarpc_lsa_SidArray_num_sids = -1;
+static gint hf_lsarpc_lsa_PolicyInformation_audit_events = -1;
 static gint hf_lsarpc_lsa_ForestTrustRecord_level = -1;
-static gint hf_lsarpc_lsa_RefDomainList_count = -1;
-static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoBasic_sid = -1;
+static gint hf_lsarpc_lsa_LookupNames4_names = -1;
+static gint hf_lsarpc_lsa_AddPrivilegesToAccount_handle = -1;
+static gint hf_lsarpc_lsa_LookupPrivValue_handle = -1;
 static gint hf_lsarpc_lsa_TrustedDomainInfo_posix_offset = -1;
-static gint hf_lsarpc_lsa_OpenPolicy_access_mask = -1;
-static gint hf_lsarpc_lsa_TranslatedName2_unknown = -1;
-static gint hf_lsarpc_lsa_QosInfo_effective_only = -1;
-static gint hf_lsarpc_lsa_AuditLogInfo_next_audit_record = -1;
+static gint hf_lsarpc_lsa_OpenTrustedDomain_handle = -1;
+static gint hf_lsarpc_lsa_ModificationInfo_modified_id = -1;
+static gint hf_lsarpc_lsa_OpenSecret_sec_handle = -1;
+static gint hf_lsarpc_lsa_ModificationInfo_db_create_time = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_secret_type = -1;
+static gint hf_lsarpc_lsa_LUIDAttribute_luid = -1;
+static gint hf_lsarpc_lsa_PDAccountInfo_name = -1;
+static gint hf_lsarpc_lsa_LookupPrivDisplayName_language_id = -1;
+static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_privs = -1;
+static gint hf_lsarpc_lsa_ForestTrustDomainInfo_domain_sid = -1;
+static gint hf_lsarpc_lsa_TranslatedSid3_sid_type = -1;
+static gint hf_lsarpc_lsa_QuerySecret_old_mtime = -1;
+static gint hf_lsarpc_lsa_LookupSids2_unknown2 = -1;
+static gint hf_lsarpc_lsa_LookupNames3_names = -1;
+static gint hf_lsarpc_lsa_DnsDomainInfo_dns_forest = -1;
+static gint hf_lsarpc_lsa_QuerySecurity_sec_info = -1;
+static gint hf_lsarpc_secret_access_mask = -1;
+static gint hf_lsarpc_lsa_TranslatedSid2_sid_index = -1;
+static gint hf_lsarpc_lsa_LookupNames2_domains = -1;
+static gint hf_lsarpc_lsa_DomainList_domains = -1;
+static gint hf_lsarpc_lsa_AsciiStringLarge_string = -1;
+static gint hf_lsarpc_lsa_AuditFullQueryInfo_unknown = -1;
+static gint hf_lsarpc_lsa_SetSecret_sec_handle = -1;
+static gint hf_lsarpc_lsa_OpenPolicy2_handle = -1;
+static gint hf_lsarpc_lsa_DnsDomainInfo_name = -1;
+static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS = -1;
+static gint hf_lsarpc_lsa_LookupNames3_level = -1;
+static gint hf_lsarpc_lsa_LookupNames4_domains = -1;
+static gint hf_lsarpc_lsa_LookupNames4_num_names = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_auth_info = -1;
+static gint hf_lsarpc_lsa_QuerySecurity_handle = -1;
+static gint hf_lsarpc_lsa_ForestTrustData_top_level_name_ex = -1;
+static gint hf_lsarpc_lsa_ServerRole_role = -1;
+static gint hf_lsarpc_lsa_SetInfoPolicy2_level = -1;
+static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_handle = -1;
+static gint hf_lsarpc_lsa_OpenTrustedDomain_sid = -1;
+static gint hf_lsarpc_lsa_LookupNames_handle = -1;
+static gint hf_lsarpc_lsa_LookupNames2_unknown1 = -1;
+static gint hf_lsarpc_lsa_ReplicaSourceInfo_source = -1;
+static gint hf_lsarpc_lsa_SetSecret_new_val = -1;
 static gint hf_lsarpc_lsa_QosInfo_len = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_info = -1;
+static gint hf_lsarpc_lsa_AuditFullQueryInfo_shutdown_on_full = -1;
+static gint hf_lsarpc_lsa_CreateAccount_acct_handle = -1;
 static gint hf_lsarpc_lsa_ForestTrustData_domain_info = -1;
-static gint hf_lsarpc_lsa_QuerySecret_old_mtime = -1;
-static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_level = -1;
-static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION = -1;
-static gint hf_lsarpc_lsa_QueryInfoPolicy2_handle = -1;
-static gint hf_lsarpc_lsa_LookupNames4_level = -1;
-static gint hf_lsarpc_lsa_LookupSids2_handle = -1;
-static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_netbios_name = -1;
-static gint hf_lsarpc_lsa_OpenAccount_sid = -1;
+static gint hf_lsarpc_lsa_OpenTrustedDomainByName_name = -1;
+static gint hf_lsarpc_lsa_DnsDomainInfo_domain_guid = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_previous_auth_info = -1;
+static gint hf_lsarpc_lsa_ObjectAttribute_len = -1;
+static gint hf_lsarpc_lsa_DomainInfoKerberos_clock_skew = -1;
+static gint hf_lsarpc_opnum = -1;
+static gint hf_lsarpc_lsa_TransSidArray_sids = -1;
+static gint hf_lsarpc_lsa_AsciiString_size = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_count = -1;
+static gint hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_renewaltime = -1;
+static gint hf_lsarpc_lsa_EnumAccounts_sids = -1;
+static gint hf_lsarpc_lsa_DomainInformationPolicy_efs_info = -1;
+static gint hf_lsarpc_lsa_SetDomainInformationPolicy_level = -1;
+static gint hf_lsarpc_lsa_PrivEntry_luid = -1;
 static gint hf_lsarpc_lsa_RefDomainList_domains = -1;
-static gint hf_lsarpc_String_name = -1;
-static gint hf_lsarpc_lsa_LookupNames2_count = -1;
-static gint hf_lsarpc_lsa_PolicyInformation_domain = -1;
-static gint hf_lsarpc_lsa_OpenPolicy2_handle = -1;
+static gint hf_lsarpc_lsa_RemoveAccountRights_rights = -1;
+static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_info_ex = -1;
+static gint hf_lsarpc_lsa_TransSidArray_count = -1;
+static gint hf_lsarpc_lsa_QosInfo_context_mode = -1;
+static gint hf_lsarpc_lsa_LookupSids_domains = -1;
 static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_trusted_domain_name = -1;
-static gint hf_lsarpc_lsa_LookupPrivDisplayName_disp_name = -1;
-static gint hf_lsarpc_lsa_LookupNames3_handle = -1;
-static gint hf_lsarpc_lsa_OpenSecret_name = -1;
-static gint hf_lsarpc_lsa_LookupNames_handle = -1;
-static gint hf_lsarpc_lsa_LookupNames2_num_names = -1;
+static gint hf_lsarpc_lsa_LookupNames3_sids = -1;
+static gint hf_lsarpc_lsa_LookupSids3_names = -1;
+static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_forest_trust_info = -1;
+static gint hf_lsarpc_lsa_SetDomainInformationPolicy_info = -1;
+static gint hf_lsarpc_lsa_PrivArray_count = -1;
+static gint hf_lsarpc_lsa_OpenTrustedDomainByName_access_mask = -1;
+static gint hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE = -1;
+static gint hf_lsarpc_policy_access_mask = -1;
+static gint hf_lsarpc_lsa_AuditEventsInfo_settings = -1;
+static gint hf_lsarpc_lsa_PrivilegeSet_unknown = -1;
 static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS = -1;
-static gint hf_lsarpc_lsa_DefaultQuotaInfo_max_wss = -1;
-static gint hf_lsarpc_lsa_ModificationInfo_modified_id = -1;
-static gint hf_lsarpc_lsa_EnumTrustDom_max_size = -1;
-static gint hf_lsarpc_lsa_OpenTrustedDomain_handle = -1;
-static gint hf_lsarpc_lsa_OpenPolicy2_access_mask = -1;
+static gint hf_lsarpc_lsa_QueryInfoPolicy_level = -1;
+static gint hf_lsarpc_lsa_TransSidArray2_count = -1;
+static gint hf_lsarpc_lsa_DnsDomainInfo_dns_domain = -1;
+static gint hf_lsarpc_lsa_Strings_names = -1;
+static gint hf_lsarpc_lsa_OpenSecret_name = -1;
+static gint hf_lsarpc_lsa_ForestTrustBinaryData_data = -1;
+static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH = -1;
 
 static gint proto_dcerpc_lsarpc = -1;
 /* Version information */
@@ -1663,7 +1663,7 @@ lsarpc_dissect_bitmap_security_secinfo(tvbuff_t *tvb _U_, int offset _U_, packet
 /* IDL: struct { */
 /* IDL: 	[value(2*strlen_m(string))] uint16 length; */
 /* IDL: 	[value(2*strlen_m(string))] uint16 size; */
-/* IDL: 	[size_is(size/2)] [charset(UTF16)] [length_is(length/2)] [unique(1)] uint16 *string; */
+/* IDL: 	[unique(1)] [charset(UTF16)] [size_is(size/2)] [length_is(length/2)] uint16 *string; */
 /* IDL: } */
 
 static int
@@ -1727,7 +1727,7 @@ lsarpc_dissect_struct_lsa_String(tvbuff_t *tvb _U_, int offset _U_, packet_info
 /* IDL: struct { */
 /* IDL: 	[value(2*strlen_m(string))] uint16 length; */
 /* IDL: 	[value(2*strlen_m_term(string))] uint16 size; */
-/* IDL: 	[size_is(size/2)] [charset(UTF16)] [length_is(length/2)] [unique(1)] uint16 *string; */
+/* IDL: 	[unique(1)] [size_is(size/2)] [charset(UTF16)] [length_is(length/2)] uint16 *string; */
 /* IDL: } */
 
 static int
@@ -1860,7 +1860,7 @@ lsarpc_dissect_struct_lsa_Strings(tvbuff_t *tvb _U_, int offset _U_, packet_info
 /* IDL: struct { */
 /* IDL: 	[value(strlen_m(string))] uint16 length; */
 /* IDL: 	[value(strlen_m(string))] uint16 size; */
-/* IDL: 	[unique(1)] [length_is(length)] [charset(DOS)] [size_is(size)] uint8 *string; */
+/* IDL: 	[unique(1)] [size_is(size)] [charset(DOS)] [length_is(length)] uint8 *string; */
 /* IDL: } */
 
 static int
@@ -1940,7 +1940,7 @@ lsarpc_dissect_struct_lsa_AsciiString(tvbuff_t *tvb _U_, int offset _U_, packet_
 /* IDL: struct { */
 /* IDL: 	[value(strlen_m(string))] uint16 length; */
 /* IDL: 	[value(strlen_m_term(string))] uint16 size; */
-/* IDL: 	[length_is(length)] [unique(1)] [size_is(size)] [charset(DOS)] uint8 *string; */
+/* IDL: 	[unique(1)] [charset(DOS)] [size_is(size)] [length_is(length)] uint8 *string; */
 /* IDL: } */
 
 static int
@@ -2581,7 +2581,7 @@ lsarpc_dissect_enum_lsa_PolicyAuditEventType(tvbuff_t *tvb _U_, int offset _U_,
 
 /* IDL: struct { */
 /* IDL: 	uint32 auditing_mode; */
-/* IDL: 	[size_is(count)] [unique(1)] lsa_PolicyAuditPolicy *settings; */
+/* IDL: 	[unique(1)] [size_is(count)] lsa_PolicyAuditPolicy *settings; */
 /* IDL: 	uint32 count; */
 /* IDL: } */
 
@@ -3375,8 +3375,7 @@ lsarpc_dissect_lsa_PolicyInformation(tvbuff_t *tvb _U_, int offset _U_, packet_i
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "lsa_PolicyInformation");
-		tree = proto_item_add_subtree(item, ett_lsarpc_lsa_PolicyInformation);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_lsarpc_lsa_PolicyInformation, &item, "lsa_PolicyInformation");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -3489,7 +3488,7 @@ lsarpc_dissect_struct_lsa_SidPtr(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 /* IDL: struct { */
 /* IDL: 	[range(0,1000)] uint32 num_sids; */
-/* IDL: 	[unique(1)] [size_is(num_sids)] lsa_SidPtr *sids; */
+/* IDL: 	[size_is(num_sids)] [unique(1)] lsa_SidPtr *sids; */
 /* IDL: } */
 
 static int
@@ -3558,7 +3557,7 @@ lsarpc_dissect_struct_lsa_SidArray(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[unique(1)] [size_is(count)] lsa_DomainInfo *domains; */
+/* IDL: 	[size_is(count)] [unique(1)] lsa_DomainInfo *domains; */
 /* IDL: } */
 
 static int
@@ -3788,7 +3787,7 @@ lsarpc_dissect_struct_lsa_TransSidArray(tvbuff_t *tvb _U_, int offset _U_, packe
 
 /* IDL: struct { */
 /* IDL: 	[range(0,1000)] uint32 count; */
-/* IDL: 	[unique(1)] [size_is(count)] lsa_DomainInfo *domains; */
+/* IDL: 	[size_is(count)] [unique(1)] lsa_DomainInfo *domains; */
 /* IDL: 	uint32 max_size; */
 /* IDL: } */
 
@@ -4151,7 +4150,7 @@ lsarpc_dissect_struct_lsa_PrivilegeSet(tvbuff_t *tvb _U_, int offset _U_, packet
 /* IDL: struct { */
 /* IDL: 	uint32 length; */
 /* IDL: 	uint32 size; */
-/* IDL: 	[unique(1)] [length_is(length)] [size_is(size)] uint8 *data; */
+/* IDL: 	[size_is(size)] [length_is(length)] [unique(1)] uint8 *data; */
 /* IDL: } */
 
 static int
@@ -4230,7 +4229,7 @@ lsarpc_dissect_struct_lsa_DATA_BUF(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 
 /* IDL: struct { */
 /* IDL: 	[range(0,65536)] uint32 size; */
-/* IDL: 	[unique(1)] [size_is(size)] uint8 *data; */
+/* IDL: 	[size_is(size)] [unique(1)] uint8 *data; */
 /* IDL: } */
 
 static int
@@ -5123,8 +5122,7 @@ lsarpc_dissect_lsa_TrustedDomainInfo(tvbuff_t *tvb _U_, int offset _U_, packet_i
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "lsa_TrustedDomainInfo");
-		tree = proto_item_add_subtree(item, ett_lsarpc_lsa_TrustedDomainInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_lsarpc_lsa_TrustedDomainInfo, &item, "lsa_TrustedDomainInfo");
 	}
 
 	offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -5224,7 +5222,7 @@ lsarpc_dissect_struct_lsa_DATA_BUF_PTR(tvbuff_t *tvb _U_, int offset _U_, packet
 
 
 /* IDL: struct { */
-/* IDL: 	[unique(1)] [charset(UTF16)] uint16 *name; */
+/* IDL: 	[charset(UTF16)] [unique(1)] uint16 *name; */
 /* IDL: } */
 
 static int
@@ -5278,7 +5276,7 @@ lsarpc_dissect_struct_lsa_RightAttribute(tvbuff_t *tvb _U_, int offset _U_, pack
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[size_is(count)] [unique(1)] lsa_StringLarge *names; */
+/* IDL: 	[unique(1)] [size_is(count)] lsa_StringLarge *names; */
 /* IDL: } */
 
 static int
@@ -5397,7 +5395,7 @@ lsarpc_dissect_struct_lsa_StringPointer(tvbuff_t *tvb _U_, int offset _U_, packe
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[size_is(count)] [unique(1)] lsa_TrustDomainInfoInfoEx *domains; */
+/* IDL: 	[unique(1)] [size_is(count)] lsa_TrustDomainInfoInfoEx *domains; */
 /* IDL: } */
 
 static int
@@ -5674,8 +5672,7 @@ lsarpc_dissect_lsa_DomainInformationPolicy(tvbuff_t *tvb _U_, int offset _U_, pa
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "lsa_DomainInformationPolicy");
-		tree = proto_item_add_subtree(item, ett_lsarpc_lsa_DomainInformationPolicy);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_lsarpc_lsa_DomainInformationPolicy, &item, "lsa_DomainInformationPolicy");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -5917,7 +5914,7 @@ lsarpc_dissect_struct_lsa_TranslatedSid2(tvbuff_t *tvb _U_, int offset _U_, pack
 
 /* IDL: struct { */
 /* IDL: 	[range(0,1000)] uint32 count; */
-/* IDL: 	[size_is(count)] [unique(1)] lsa_TranslatedSid2 *sids; */
+/* IDL: 	[unique(1)] [size_is(count)] lsa_TranslatedSid2 *sids; */
 /* IDL: } */
 
 static int
@@ -6069,7 +6066,7 @@ lsarpc_dissect_struct_lsa_TranslatedSid3(tvbuff_t *tvb _U_, int offset _U_, pack
 
 /* IDL: struct { */
 /* IDL: 	[range(0,1000)] uint32 count; */
-/* IDL: 	[size_is(count)] [unique(1)] lsa_TranslatedSid3 *sids; */
+/* IDL: 	[unique(1)] [size_is(count)] lsa_TranslatedSid3 *sids; */
 /* IDL: } */
 
 static int
@@ -6326,8 +6323,7 @@ lsarpc_dissect_lsa_ForestTrustData(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "lsa_ForestTrustData");
-		tree = proto_item_add_subtree(item, ett_lsarpc_lsa_ForestTrustData);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_lsarpc_lsa_ForestTrustData, &item, "lsa_ForestTrustData");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -6547,7 +6543,7 @@ lsarpc_dissect_element_lsa_Close_handle_(tvbuff_t *tvb _U_, int offset _U_, pack
 }
 
 /* IDL: NTSTATUS lsa_Close( */
-/* IDL: [out] [in] [ref] policy_handle *handle */
+/* IDL: [in] [ref] [out] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -6677,7 +6673,7 @@ lsarpc_dissect_element_lsa_EnumPrivs_privs_(tvbuff_t *tvb _U_, int offset _U_, p
 
 /* IDL: NTSTATUS lsa_EnumPrivs( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [out] [in] [ref] uint32 *resume_handle, */
+/* IDL: [out] [ref] [in] uint32 *resume_handle, */
 /* IDL: [in] uint32 max_count, */
 /* IDL: [ref] [out] lsa_PrivArray *privs */
 /* IDL: ); */
@@ -6758,7 +6754,7 @@ lsarpc_dissect_element_lsa_QuerySecurity_sdbuf_(tvbuff_t *tvb _U_, int offset _U
 /* IDL: NTSTATUS lsa_QuerySecurity( */
 /* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] security_secinfo sec_info, */
-/* IDL: [out] [unique(1)] sec_desc_buf *sdbuf */
+/* IDL: [unique(1)] [out] sec_desc_buf *sdbuf */
 /* IDL: ); */
 
 static int
@@ -6897,7 +6893,7 @@ lsarpc_dissect_element_lsa_OpenPolicy_handle_(tvbuff_t *tvb _U_, int offset _U_,
 
 /* IDL: NTSTATUS lsa_OpenPolicy( */
 /* IDL: [unique(1)] [in] uint16 *system_name, */
-/* IDL: [in] [ref] lsa_ObjectAttribute *attr, */
+/* IDL: [ref] [in] lsa_ObjectAttribute *attr, */
 /* IDL: [in] lsa_PolicyAccessMask access_mask, */
 /* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
@@ -6973,9 +6969,9 @@ lsarpc_dissect_element_lsa_QueryInfoPolicy_info_(tvbuff_t *tvb _U_, int offset _
 }
 
 /* IDL: NTSTATUS lsa_QueryInfoPolicy( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] lsa_PolicyInfo level, */
-/* IDL: [out] [unique(1)] [switch_is(level)] lsa_PolicyInformation *info */
+/* IDL: [unique(1)] [switch_is(level)] [out] lsa_PolicyInformation *info */
 /* IDL: ); */
 
 static int
@@ -7047,9 +7043,9 @@ lsarpc_dissect_element_lsa_SetInfoPolicy_info_(tvbuff_t *tvb _U_, int offset _U_
 }
 
 /* IDL: NTSTATUS lsa_SetInfoPolicy( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] lsa_PolicyInfo level, */
-/* IDL: [switch_is(level)] [ref] [in] lsa_PolicyInformation *info */
+/* IDL: [switch_is(level)] [in] [ref] lsa_PolicyInformation *info */
 /* IDL: ); */
 
 static int
@@ -7161,10 +7157,10 @@ lsarpc_dissect_element_lsa_CreateAccount_acct_handle_(tvbuff_t *tvb _U_, int off
 }
 
 /* IDL: NTSTATUS lsa_CreateAccount( */
-/* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [in] [ref] dom_sid2 *sid, */
+/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] dom_sid2 *sid, */
 /* IDL: [in] lsa_AccountAccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *acct_handle */
+/* IDL: [ref] [out] policy_handle *acct_handle */
 /* IDL: ); */
 
 static int
@@ -7255,9 +7251,9 @@ lsarpc_dissect_element_lsa_EnumAccounts_sids_(tvbuff_t *tvb _U_, int offset _U_,
 
 /* IDL: NTSTATUS lsa_EnumAccounts( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] [out] uint32 *resume_handle, */
-/* IDL: [range(0,8192)] [in] uint32 num_entries, */
-/* IDL: [out] [ref] lsa_SidArray *sids */
+/* IDL: [out] [ref] [in] uint32 *resume_handle, */
+/* IDL: [in] [range(0,8192)] uint32 num_entries, */
+/* IDL: [ref] [out] lsa_SidArray *sids */
 /* IDL: ); */
 
 static int
@@ -7350,10 +7346,10 @@ lsarpc_dissect_element_lsa_CreateTrustedDomain_trustdom_handle_(tvbuff_t *tvb _U
 }
 
 /* IDL: NTSTATUS lsa_CreateTrustedDomain( */
-/* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [in] [ref] lsa_DomainInfo *info, */
+/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] lsa_DomainInfo *info, */
 /* IDL: [in] lsa_DomainAccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *trustdom_handle */
+/* IDL: [ref] [out] policy_handle *trustdom_handle */
 /* IDL: ); */
 
 static int
@@ -7444,7 +7440,7 @@ lsarpc_dissect_element_lsa_EnumTrustDom_domains_(tvbuff_t *tvb _U_, int offset _
 
 /* IDL: NTSTATUS lsa_EnumTrustDom( */
 /* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [ref] [in] [out] uint32 *resume_handle, */
+/* IDL: [out] [ref] [in] uint32 *resume_handle, */
 /* IDL: [in] uint32 max_size, */
 /* IDL: [out] [ref] lsa_DomainList *domains */
 /* IDL: ); */
@@ -7573,11 +7569,11 @@ lsarpc_dissect_element_lsa_LookupNames_count_(tvbuff_t *tvb _U_, int offset _U_,
 /* IDL: NTSTATUS lsa_LookupNames( */
 /* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [range(0,1000)] [in] uint32 num_names, */
-/* IDL: [size_is(num_names)] [in] lsa_String names[*], */
-/* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */
-/* IDL: [out] [in] [ref] lsa_TransSidArray *sids, */
+/* IDL: [in] [size_is(num_names)] lsa_String names[*], */
+/* IDL: [unique(1)] [out] lsa_RefDomainList *domains, */
+/* IDL: [out] [ref] [in] lsa_TransSidArray *sids, */
 /* IDL: [in] lsa_LookupNamesLevel level, */
-/* IDL: [ref] [out] [in] uint32 *count */
+/* IDL: [out] [ref] [in] uint32 *count */
 /* IDL: ); */
 
 static int
@@ -7714,9 +7710,9 @@ lsarpc_dissect_element_lsa_LookupSids_count_(tvbuff_t *tvb _U_, int offset _U_,
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] [ref] lsa_SidArray *sids, */
 /* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */
-/* IDL: [ref] [out] [in] lsa_TransNameArray *names, */
+/* IDL: [in] [ref] [out] lsa_TransNameArray *names, */
 /* IDL: [in] uint16 level, */
-/* IDL: [out] [in] [ref] uint32 *count */
+/* IDL: [in] [ref] [out] uint32 *count */
 /* IDL: ); */
 
 static int
@@ -7811,7 +7807,7 @@ lsarpc_dissect_element_lsa_CreateSecret_sec_handle_(tvbuff_t *tvb _U_, int offse
 /* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] lsa_String name, */
 /* IDL: [in] lsa_SecretAccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *sec_handle */
+/* IDL: [out] [ref] policy_handle *sec_handle */
 /* IDL: ); */
 
 static int
@@ -7901,10 +7897,10 @@ lsarpc_dissect_element_lsa_OpenAccount_acct_handle_(tvbuff_t *tvb _U_, int offse
 }
 
 /* IDL: NTSTATUS lsa_OpenAccount( */
-/* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [in] [ref] dom_sid2 *sid, */
+/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [ref] [in] dom_sid2 *sid, */
 /* IDL: [in] lsa_AccountAccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *acct_handle */
+/* IDL: [ref] [out] policy_handle *acct_handle */
 /* IDL: ); */
 
 static int
@@ -7971,7 +7967,7 @@ lsarpc_dissect_element_lsa_EnumPrivsAccount_privs_(tvbuff_t *tvb _U_, int offset
 
 /* IDL: NTSTATUS lsa_EnumPrivsAccount( */
 /* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [unique(1)] [out] lsa_PrivilegeSet *privs */
+/* IDL: [out] [unique(1)] lsa_PrivilegeSet *privs */
 /* IDL: ); */
 
 static int
@@ -8033,8 +8029,8 @@ lsarpc_dissect_element_lsa_AddPrivilegesToAccount_privs_(tvbuff_t *tvb _U_, int
 }
 
 /* IDL: NTSTATUS lsa_AddPrivilegesToAccount( */
-/* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] lsa_PrivilegeSet *privs */
+/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] lsa_PrivilegeSet *privs */
 /* IDL: ); */
 
 static int
@@ -8105,7 +8101,7 @@ lsarpc_dissect_element_lsa_RemovePrivilegesFromAccount_privs_(tvbuff_t *tvb _U_,
 /* IDL: NTSTATUS lsa_RemovePrivilegesFromAccount( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] uint8 remove_all, */
-/* IDL: [unique(1)] [in] lsa_PrivilegeSet *privs */
+/* IDL: [in] [unique(1)] lsa_PrivilegeSet *privs */
 /* IDL: ); */
 
 static int
@@ -8295,7 +8291,7 @@ lsarpc_dissect_element_lsa_OpenTrustedDomain_trustdom_handle_(tvbuff_t *tvb _U_,
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [ref] [in] dom_sid2 *sid, */
 /* IDL: [in] lsa_DomainAccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *trustdom_handle */
+/* IDL: [ref] [out] policy_handle *trustdom_handle */
 /* IDL: ); */
 
 static int
@@ -8371,7 +8367,7 @@ lsarpc_dissect_element_lsa_QueryTrustedDomainInfo_info_(tvbuff_t *tvb _U_, int o
 /* IDL: NTSTATUS lsa_QueryTrustedDomainInfo( */
 /* IDL: [ref] [in] policy_handle *trustdom_handle, */
 /* IDL: [in] lsa_TrustDomInfoEnum level, */
-/* IDL: [out] [unique(1)] [switch_is(level)] lsa_TrustedDomainInfo *info */
+/* IDL: [unique(1)] [switch_is(level)] [out] lsa_TrustedDomainInfo *info */
 /* IDL: ); */
 
 static int
@@ -8476,7 +8472,7 @@ lsarpc_dissect_element_lsa_OpenSecret_sec_handle_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: NTSTATUS lsa_OpenSecret( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] lsa_String name, */
 /* IDL: [in] lsa_SecretAccessMask access_mask, */
 /* IDL: [out] [ref] policy_handle *sec_handle */
@@ -8562,7 +8558,7 @@ lsarpc_dissect_element_lsa_SetSecret_old_val_(tvbuff_t *tvb _U_, int offset _U_,
 
 /* IDL: NTSTATUS lsa_SetSecret( */
 /* IDL: [in] [ref] policy_handle *sec_handle, */
-/* IDL: [unique(1)] [in] lsa_DATA_BUF *new_val, */
+/* IDL: [in] [unique(1)] lsa_DATA_BUF *new_val, */
 /* IDL: [unique(1)] [in] lsa_DATA_BUF *old_val */
 /* IDL: ); */
 
@@ -8674,10 +8670,10 @@ lsarpc_dissect_element_lsa_QuerySecret_old_mtime_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: NTSTATUS lsa_QuerySecret( */
-/* IDL: [ref] [in] policy_handle *sec_handle, */
-/* IDL: [unique(1)] [out] [in] lsa_DATA_BUF_PTR *new_val, */
-/* IDL: [in] [out] [unique(1)] NTTIME_hyper *new_mtime, */
-/* IDL: [in] [out] [unique(1)] lsa_DATA_BUF_PTR *old_val, */
+/* IDL: [in] [ref] policy_handle *sec_handle, */
+/* IDL: [out] [in] [unique(1)] lsa_DATA_BUF_PTR *new_val, */
+/* IDL: [out] [in] [unique(1)] NTTIME_hyper *new_mtime, */
+/* IDL: [unique(1)] [out] [in] lsa_DATA_BUF_PTR *old_val, */
 /* IDL: [unique(1)] [out] [in] NTTIME_hyper *old_mtime */
 /* IDL: ); */
 
@@ -8773,8 +8769,8 @@ lsarpc_dissect_element_lsa_LookupPrivValue_luid_(tvbuff_t *tvb _U_, int offset _
 }
 
 /* IDL: NTSTATUS lsa_LookupPrivValue( */
-/* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [ref] [in] lsa_String *name, */
+/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [in] [ref] lsa_String *name, */
 /* IDL: [ref] [out] lsa_LUID *luid */
 /* IDL: ); */
 
@@ -8855,8 +8851,8 @@ lsarpc_dissect_element_lsa_LookupPrivName_name_(tvbuff_t *tvb _U_, int offset _U
 }
 
 /* IDL: NTSTATUS lsa_LookupPrivName( */
-/* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [ref] [in] lsa_LUID *luid, */
+/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [in] [ref] lsa_LUID *luid, */
 /* IDL: [unique(1)] [out] lsa_StringLarge *name */
 /* IDL: ); */
 
@@ -8961,10 +8957,10 @@ lsarpc_dissect_element_lsa_LookupPrivDisplayName_unknown(tvbuff_t *tvb _U_, int
 }
 
 /* IDL: NTSTATUS lsa_LookupPrivDisplayName( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] [ref] lsa_String *name, */
 /* IDL: [unique(1)] [out] lsa_StringLarge *disp_name, */
-/* IDL: [ref] [out] [in] uint16 *language_id, */
+/* IDL: [out] [ref] [in] uint16 *language_id, */
 /* IDL: [in] uint16 unknown */
 /* IDL: ); */
 
@@ -9079,7 +9075,7 @@ lsarpc_dissect_element_lsa_EnumAccountsWithUserRight_sids_(tvbuff_t *tvb _U_, in
 /* IDL: NTSTATUS lsa_EnumAccountsWithUserRight( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [unique(1)] [in] lsa_String *name, */
-/* IDL: [out] [ref] lsa_SidArray *sids */
+/* IDL: [ref] [out] lsa_SidArray *sids */
 /* IDL: ); */
 
 static int
@@ -9159,8 +9155,8 @@ lsarpc_dissect_element_lsa_EnumAccountRights_rights_(tvbuff_t *tvb _U_, int offs
 }
 
 /* IDL: NTSTATUS lsa_EnumAccountRights( */
-/* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [in] [ref] dom_sid2 *sid, */
+/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] dom_sid2 *sid, */
 /* IDL: [ref] [out] lsa_RightSet *rights */
 /* IDL: ); */
 
@@ -9242,8 +9238,8 @@ lsarpc_dissect_element_lsa_AddAccountRights_rights_(tvbuff_t *tvb _U_, int offse
 
 /* IDL: NTSTATUS lsa_AddAccountRights( */
 /* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [in] [ref] dom_sid2 *sid, */
-/* IDL: [ref] [in] lsa_RightSet *rights */
+/* IDL: [ref] [in] dom_sid2 *sid, */
+/* IDL: [in] [ref] lsa_RightSet *rights */
 /* IDL: ); */
 
 static int
@@ -9333,7 +9329,7 @@ lsarpc_dissect_element_lsa_RemoveAccountRights_rights_(tvbuff_t *tvb _U_, int of
 /* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [ref] [in] dom_sid2 *sid, */
 /* IDL: [in] uint32 unknown, */
-/* IDL: [ref] [in] lsa_RightSet *rights */
+/* IDL: [in] [ref] lsa_RightSet *rights */
 /* IDL: ); */
 
 static int
@@ -9425,7 +9421,7 @@ lsarpc_dissect_element_lsa_QueryTrustedDomainInfoBySid_info_(tvbuff_t *tvb _U_,
 /* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] [ref] dom_sid2 *dom_sid, */
 /* IDL: [in] lsa_TrustDomInfoEnum level, */
-/* IDL: [unique(1)] [out] [switch_is(level)] lsa_TrustedDomainInfo *info */
+/* IDL: [out] [switch_is(level)] [unique(1)] lsa_TrustedDomainInfo *info */
 /* IDL: ); */
 
 static int
@@ -9516,7 +9512,7 @@ lsarpc_dissect_element_lsa_DeleteTrustedDomain_dom_sid_(tvbuff_t *tvb _U_, int o
 }
 
 /* IDL: NTSTATUS lsa_DeleteTrustedDomain( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [ref] [in] dom_sid2 *dom_sid */
 /* IDL: ); */
 
@@ -9656,9 +9652,9 @@ lsarpc_dissect_element_lsa_OpenPolicy2_handle_(tvbuff_t *tvb _U_, int offset _U_
 
 /* IDL: NTSTATUS lsa_OpenPolicy2( */
 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *system_name, */
-/* IDL: [ref] [in] lsa_ObjectAttribute *attr, */
+/* IDL: [in] [ref] lsa_ObjectAttribute *attr, */
 /* IDL: [in] lsa_PolicyAccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -9743,8 +9739,8 @@ lsarpc_dissect_element_lsa_GetUserName_authority_name_(tvbuff_t *tvb _U_, int of
 }
 
 /* IDL: NTSTATUS lsa_GetUserName( */
-/* IDL: [in] [unique(1)] [charset(UTF16)] uint16 *system_name, */
-/* IDL: [out] [unique(1)] [in] lsa_String *account_name, */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [out] [in] lsa_String *account_name, */
 /* IDL: [out] [in] [unique(1)] lsa_StringPointer *authority_name */
 /* IDL: ); */
 
@@ -9824,7 +9820,7 @@ lsarpc_dissect_element_lsa_QueryInfoPolicy2_info_(tvbuff_t *tvb _U_, int offset
 /* IDL: NTSTATUS lsa_QueryInfoPolicy2( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] lsa_PolicyInfo level, */
-/* IDL: [switch_is(level)] [unique(1)] [out] lsa_PolicyInformation *info */
+/* IDL: [out] [unique(1)] [switch_is(level)] lsa_PolicyInformation *info */
 /* IDL: ); */
 
 static int
@@ -9898,7 +9894,7 @@ lsarpc_dissect_element_lsa_SetInfoPolicy2_info_(tvbuff_t *tvb _U_, int offset _U
 /* IDL: NTSTATUS lsa_SetInfoPolicy2( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] lsa_PolicyInfo level, */
-/* IDL: [switch_is(level)] [ref] [in] lsa_PolicyInformation *info */
+/* IDL: [in] [ref] [switch_is(level)] lsa_PolicyInformation *info */
 /* IDL: ); */
 
 static int
@@ -9977,10 +9973,10 @@ lsarpc_dissect_element_lsa_QueryTrustedDomainInfoByName_info_(tvbuff_t *tvb _U_,
 }
 
 /* IDL: NTSTATUS lsa_QueryTrustedDomainInfoByName( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] lsa_String trusted_domain, */
 /* IDL: [in] lsa_TrustDomInfoEnum level, */
-/* IDL: [out] [unique(1)] [switch_is(level)] lsa_TrustedDomainInfo *info */
+/* IDL: [switch_is(level)] [unique(1)] [out] lsa_TrustedDomainInfo *info */
 /* IDL: ); */
 
 static int
@@ -10062,10 +10058,10 @@ lsarpc_dissect_element_lsa_SetTrustedDomainInfoByName_info_(tvbuff_t *tvb _U_, i
 }
 
 /* IDL: NTSTATUS lsa_SetTrustedDomainInfoByName( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] lsa_String trusted_domain, */
 /* IDL: [in] lsa_TrustDomInfoEnum level, */
-/* IDL: [switch_is(level)] [in] [unique(1)] lsa_TrustedDomainInfo *info */
+/* IDL: [unique(1)] [switch_is(level)] [in] lsa_TrustedDomainInfo *info */
 /* IDL: ); */
 
 static int
@@ -10154,9 +10150,9 @@ lsarpc_dissect_element_lsa_EnumTrustedDomainsEx_max_size(tvbuff_t *tvb _U_, int
 }
 
 /* IDL: NTSTATUS lsa_EnumTrustedDomainsEx( */
-/* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [out] [in] [ref] uint32 *resume_handle, */
-/* IDL: [out] [ref] lsa_DomainListEx *domains, */
+/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [out] [ref] [in] uint32 *resume_handle, */
+/* IDL: [ref] [out] lsa_DomainListEx *domains, */
 /* IDL: [in] uint32 max_size */
 /* IDL: ); */
 
@@ -10235,7 +10231,7 @@ lsarpc_dissect_element_lsa_CloseTrustedDomainEx_handle_(tvbuff_t *tvb _U_, int o
 }
 
 /* IDL: NTSTATUS lsa_CloseTrustedDomainEx( */
-/* IDL: [out] [in] [ref] policy_handle *handle */
+/* IDL: [out] [ref] [in] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -10305,9 +10301,9 @@ lsarpc_dissect_element_lsa_QueryDomainInformationPolicy_info_(tvbuff_t *tvb _U_,
 }
 
 /* IDL: NTSTATUS lsa_QueryDomainInformationPolicy( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] lsa_DomainInfoEnum level, */
-/* IDL: [unique(1)] [out] [switch_is(level)] lsa_DomainInformationPolicy *info */
+/* IDL: [out] [unique(1)] [switch_is(level)] lsa_DomainInformationPolicy *info */
 /* IDL: ); */
 
 static int
@@ -10379,9 +10375,9 @@ lsarpc_dissect_element_lsa_SetDomainInformationPolicy_info_(tvbuff_t *tvb _U_, i
 }
 
 /* IDL: NTSTATUS lsa_SetDomainInformationPolicy( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] lsa_DomainInfoEnum level, */
-/* IDL: [switch_is(level)] [unique(1)] [in] lsa_DomainInformationPolicy *info */
+/* IDL: [in] [switch_is(level)] [unique(1)] lsa_DomainInformationPolicy *info */
 /* IDL: ); */
 
 static int
@@ -10460,10 +10456,10 @@ lsarpc_dissect_element_lsa_OpenTrustedDomainByName_trustdom_handle_(tvbuff_t *tv
 }
 
 /* IDL: NTSTATUS lsa_OpenTrustedDomainByName( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] lsa_String name, */
 /* IDL: [in] lsa_DomainAccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *trustdom_handle */
+/* IDL: [ref] [out] policy_handle *trustdom_handle */
 /* IDL: ); */
 
 static int
@@ -10628,10 +10624,10 @@ lsarpc_dissect_element_lsa_LookupSids2_unknown2(tvbuff_t *tvb _U_, int offset _U
 /* IDL: NTSTATUS lsa_LookupSids2( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] [ref] lsa_SidArray *sids, */
-/* IDL: [unique(1)] [out] lsa_RefDomainList *domains, */
-/* IDL: [ref] [out] [in] lsa_TransNameArray2 *names, */
+/* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */
+/* IDL: [in] [ref] [out] lsa_TransNameArray2 *names, */
 /* IDL: [in] uint16 level, */
-/* IDL: [out] [in] [ref] uint32 *count, */
+/* IDL: [in] [ref] [out] uint32 *count, */
 /* IDL: [in] uint32 unknown1, */
 /* IDL: [in] uint32 unknown2 */
 /* IDL: ); */
@@ -10785,13 +10781,13 @@ lsarpc_dissect_element_lsa_LookupNames2_unknown2(tvbuff_t *tvb _U_, int offset _
 }
 
 /* IDL: NTSTATUS lsa_LookupNames2( */
-/* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [range(0,1000)] [in] uint32 num_names, */
+/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [range(0,1000)] uint32 num_names, */
 /* IDL: [size_is(num_names)] [in] lsa_String names[*], */
-/* IDL: [unique(1)] [out] lsa_RefDomainList *domains, */
-/* IDL: [ref] [out] [in] lsa_TransSidArray2 *sids, */
+/* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */
+/* IDL: [in] [ref] [out] lsa_TransSidArray2 *sids, */
 /* IDL: [in] lsa_LookupNamesLevel level, */
-/* IDL: [out] [in] [ref] uint32 *count, */
+/* IDL: [out] [ref] [in] uint32 *count, */
 /* IDL: [in] uint32 unknown1, */
 /* IDL: [in] uint32 unknown2 */
 /* IDL: ); */
@@ -11174,11 +11170,11 @@ lsarpc_dissect_element_lsa_LookupNames3_unknown2(tvbuff_t *tvb _U_, int offset _
 /* IDL: NTSTATUS lsa_LookupNames3( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [range(0,1000)] [in] uint32 num_names, */
-/* IDL: [in] [size_is(num_names)] lsa_String names[*], */
-/* IDL: [unique(1)] [out] lsa_RefDomainList *domains, */
-/* IDL: [in] [out] [ref] lsa_TransSidArray3 *sids, */
+/* IDL: [size_is(num_names)] [in] lsa_String names[*], */
+/* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */
+/* IDL: [in] [ref] [out] lsa_TransSidArray3 *sids, */
 /* IDL: [in] lsa_LookupNamesLevel level, */
-/* IDL: [out] [in] [ref] uint32 *count, */
+/* IDL: [out] [ref] [in] uint32 *count, */
 /* IDL: [in] uint32 unknown1, */
 /* IDL: [in] uint32 unknown2 */
 /* IDL: ); */
@@ -11395,9 +11391,9 @@ lsarpc_dissect_element_lsa_lsaRQueryForestTrustInformation_forest_trust_info__(t
 
 /* IDL: NTSTATUS lsa_lsaRQueryForestTrustInformation( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] lsa_String *trusted_domain_name, */
+/* IDL: [in] [ref] lsa_String *trusted_domain_name, */
 /* IDL: [in] uint16 unknown, */
-/* IDL: [ref] [out] lsa_ForestTrustInformation **forest_trust_info */
+/* IDL: [out] [ref] lsa_ForestTrustInformation **forest_trust_info */
 /* IDL: ); */
 
 static int
@@ -11570,10 +11566,10 @@ lsarpc_dissect_element_lsa_LookupSids3_unknown2(tvbuff_t *tvb _U_, int offset _U
 
 /* IDL: NTSTATUS lsa_LookupSids3( */
 /* IDL: [in] [ref] lsa_SidArray *sids, */
-/* IDL: [unique(1)] [out] lsa_RefDomainList *domains, */
-/* IDL: [ref] [out] [in] lsa_TransNameArray2 *names, */
+/* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */
+/* IDL: [in] [ref] [out] lsa_TransNameArray2 *names, */
 /* IDL: [in] uint16 level, */
-/* IDL: [ref] [in] [out] uint32 *count, */
+/* IDL: [in] [ref] [out] uint32 *count, */
 /* IDL: [in] uint32 unknown1, */
 /* IDL: [in] uint32 unknown2 */
 /* IDL: ); */
@@ -11711,10 +11707,10 @@ lsarpc_dissect_element_lsa_LookupNames4_unknown2(tvbuff_t *tvb _U_, int offset _
 /* IDL: NTSTATUS lsa_LookupNames4( */
 /* IDL: [range(0,1000)] [in] uint32 num_names, */
 /* IDL: [size_is(num_names)] [in] lsa_String names[*], */
-/* IDL: [unique(1)] [out] lsa_RefDomainList *domains, */
-/* IDL: [in] [out] [ref] lsa_TransSidArray3 *sids, */
+/* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */
+/* IDL: [in] [ref] [out] lsa_TransSidArray3 *sids, */
 /* IDL: [in] lsa_LookupNamesLevel level, */
-/* IDL: [ref] [out] [in] uint32 *count, */
+/* IDL: [out] [ref] [in] uint32 *count, */
 /* IDL: [in] uint32 unknown1, */
 /* IDL: [in] uint32 unknown2 */
 /* IDL: ); */
@@ -12035,848 +12031,848 @@ static dcerpc_sub_dissector lsarpc_dissectors[] = {
 void proto_register_dcerpc_lsarpc(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_lsarpc_lsa_LookupPrivValue_luid,
-	  { "Luid", "lsarpc.lsa_LookupPrivValue.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_level,
-	  { "Level", "lsarpc.lsa_QueryTrustedDomainInfoBySid.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivName_handle,
-	  { "Handle", "lsarpc.lsa_LookupPrivName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_opnum,
-	  { "Operation", "lsarpc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustInformation_count,
-	  { "Count", "lsarpc.lsa_ForestTrustInformation.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenTrustedDomainByName_handle,
-	  { "Handle", "lsarpc.lsa_OpenTrustedDomainByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DefaultQuotaInfo_max_wss,
+		{ "Max Wss", "lsarpc.lsa_DefaultQuotaInfo.max_wss", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids2_sids,
+		{ "Sids", "lsarpc.lsa_LookupSids2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DefaultQuotaInfo_unknown,
+		{ "Unknown", "lsarpc.lsa_DefaultQuotaInfo.unknown", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenPolicy_attr,
+		{ "Attr", "lsarpc.lsa_OpenPolicy.attr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_direction,
+		{ "Trust Direction", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_direction", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_String_size,
+		{ "Size", "lsarpc.lsa_String.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TransNameArray2_count,
+		{ "Count", "lsarpc.lsa_TransNameArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_dom_sid,
+		{ "Dom Sid", "lsarpc.lsa_QueryTrustedDomainInfoBySid.dom_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_efs_blob_len,
+		{ "EFS blob size", "lsarpc.efs.blob_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustedDomainInfo_auth_info,
+		{ "Auth Info", "lsarpc.lsa_TrustedDomainInfo.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_SetInfoPolicy2_handle,
-	  { "Handle", "lsarpc.lsa_SetInfoPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateTrustedDomain_info,
-	  { "Info", "lsarpc.lsa_CreateTrustedDomain.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainListEx_count,
-	  { "Count", "lsarpc.lsa_DomainListEx.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditFullQueryInfo_shutdown_on_full,
-	  { "Shutdown On Full", "lsarpc.lsa_AuditFullQueryInfo.shutdown_on_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids3_unknown2,
-	  { "Unknown2", "lsarpc.lsa_LookupSids3.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Handle", "lsarpc.lsa_SetInfoPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TransNameArray2_names,
+		{ "Names", "lsarpc.lsa_TransNameArray2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_sid,
+		{ "Sid", "lsarpc.lsa_TrustDomainInfoInfoEx.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainList_count,
+		{ "Count", "lsarpc.lsa_DomainList.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DeleteTrustedDomain_handle,
+		{ "Handle", "lsarpc.lsa_DeleteTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenPolicy2_access_mask,
+		{ "Access Mask", "lsarpc.lsa_OpenPolicy2.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames4_unknown2,
+		{ "Unknown2", "lsarpc.lsa_LookupNames4.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_LookupNames_sids,
-	  { "Sids", "lsarpc.lsa_LookupNames.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES,
-	  { "Lsa Account Adjust Privileges", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_PRIVILEGES", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AsciiStringLarge_length,
-	  { "Length", "lsarpc.lsa_AsciiStringLarge.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid3_sid,
-	  { "Sid", "lsarpc.lsa_TranslatedSid3.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET,
-	  { "Lsa Policy Create Secret", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_SECRET", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_count,
-	  { "Incoming Count", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenPolicy_attr,
-	  { "Attr", "lsarpc.lsa_OpenPolicy.attr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DATA_BUF_PTR_buf,
-	  { "Buf", "lsarpc.lsa_DATA_BUF_PTR.buf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoBuffer_secret_type,
-	  { "Secret Type", "lsarpc.lsa_TrustDomainInfoBuffer.secret_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryDomainInformationPolicy_info,
-	  { "Info", "lsarpc.lsa_QueryDomainInformationPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS,
-	  { "Lsa Account Adjust System Access", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids2_unknown1,
-	  { "Unknown1", "lsarpc.lsa_LookupSids2.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_level,
-	  { "Level", "lsarpc.lsa_QueryTrustedDomainInfoByName.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfoEfs_blob_size,
-	  { "Blob Size", "lsarpc.lsa_DomainInfoEfs.blob_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AsciiStringLarge_string,
-	  { "String", "lsarpc.lsa_AsciiStringLarge.string", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainList_domains,
-	  { "Domains", "lsarpc.lsa_DomainList.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QuerySecret_new_val,
-	  { "New Val", "lsarpc.lsa_QuerySecret.new_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Sids", "lsarpc.lsa_LookupNames.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoFullInfo_posix_offset,
+		{ "Posix Offset", "lsarpc.lsa_TrustDomainInfoFullInfo.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_Close_handle,
+		{ "Handle", "lsarpc.lsa_Close.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_status,
+		{ "NT Error", "lsarpc.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustedDomainInfo_info_all,
+		{ "Info All", "lsarpc.lsa_TrustedDomainInfo.info_all", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenPolicy_system_name,
+		{ "System Name", "lsarpc.lsa_OpenPolicy.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME,
+		{ "Lsa Domain Query Domain Name", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_DOMAIN_NAME", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetInfoPolicy2_info,
+		{ "Info", "lsarpc.lsa_SetInfoPolicy2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QuerySecurity_sdbuf,
+		{ "Sdbuf", "lsarpc.lsa_QuerySecurity.sdbuf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetTrustedDomainInfoByName_trusted_domain,
+		{ "Trusted Domain", "lsarpc.lsa_SetTrustedDomainInfoByName.trusted_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AddPrivilegesToAccount_privs,
+		{ "Privs", "lsarpc.lsa_AddPrivilegesToAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfo_trustdom_handle,
+		{ "Trustdom Handle", "lsarpc.lsa_QueryTrustedDomainInfo.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_String_name,
+		{ "String", "lsarpc.lsa.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivDisplayName_disp_name,
+		{ "Disp Name", "lsarpc.lsa_LookupPrivDisplayName.disp_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedName_name,
+		{ "Name", "lsarpc.lsa_TranslatedName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumTrustedDomainsEx_domains,
+		{ "Domains", "lsarpc.lsa_EnumTrustedDomainsEx.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryInfoPolicy_handle,
+		{ "Handle", "lsarpc.lsa_QueryInfoPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids3_sids,
+		{ "Sids", "lsarpc.lsa_LookupSids3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DATA_BUF_size,
+		{ "Size", "lsarpc.lsa_DATA_BUF.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_count,
+		{ "Count", "lsarpc.lsa_LookupNames2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccounts_resume_handle,
+		{ "Resume Handle", "lsarpc.lsa_EnumAccounts.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetTrustedDomainInfoByName_level,
+		{ "Level", "lsarpc.lsa_SetTrustedDomainInfoByName.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustBinaryData_length,
+		{ "Length", "lsarpc.lsa_ForestTrustBinaryData.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_GetUserName_system_name,
+		{ "System Name", "lsarpc.lsa_GetUserName.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoPassword_password,
+		{ "Password", "lsarpc.lsa_TrustDomainInfoPassword.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedName2_unknown,
+		{ "Unknown", "lsarpc.lsa_TranslatedName2.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TransNameArray_count,
+		{ "Count", "lsarpc.lsa_TransNameArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid_rid,
+		{ "Rid", "lsarpc.lsa_TranslatedSid.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SidPtr_sid,
+		{ "Sid", "lsarpc.lsa_SidPtr.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RefDomainList_max_size,
+		{ "Max Size", "lsarpc.lsa_RefDomainList.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateSecret_access_mask,
+		{ "Access Mask", "lsarpc.lsa_CreateSecret.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_DATA_BUF2_size,
-	  { "Size", "lsarpc.lsa_DATA_BUF2.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames_count,
-	  { "Count", "lsarpc.lsa_LookupNames.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Size", "lsarpc.lsa_DATA_BUF2.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_domain_access_mask,
+		{ "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE,
+		{ "Lsa Policy Create Privilege", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_PRIVILEGE", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccounts_handle,
+		{ "Handle", "lsarpc.lsa_EnumAccounts.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenPolicy_access_mask,
+		{ "Access Mask", "lsarpc.lsa_OpenPolicy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QosInfo_effective_only,
+		{ "Effective Only", "lsarpc.lsa_QosInfo.effective_only", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DnsDomainInfo_sid,
+		{ "Sid", "lsarpc.lsa_DnsDomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid_sid_index,
+		{ "Sid Index", "lsarpc.lsa_TranslatedSid.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid3_unknown,
+		{ "Unknown", "lsarpc.lsa_TranslatedSid3.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ObjectAttribute_attributes,
+		{ "Attributes", "lsarpc.lsa_ObjectAttribute.attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetTrustedDomainInfoByName_handle,
+		{ "Handle", "lsarpc.lsa_SetTrustedDomainInfoByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DefaultQuotaInfo_pagefile,
+		{ "Pagefile", "lsarpc.lsa_DefaultQuotaInfo.pagefile", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_sids,
+		{ "Sids", "lsarpc.lsa_LookupNames2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_handle,
+		{ "Handle", "lsarpc.lsa_QueryTrustedDomainInfoBySid.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_db,
+		{ "Db", "lsarpc.lsa_PolicyInformation.db", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_unknown,
+		{ "Unknown", "lsarpc.lsa_lsaRQueryForestTrustInformation.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AddAccountRights_sid,
+		{ "Sid", "lsarpc.lsa_AddAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames4_unknown1,
+		{ "Unknown1", "lsarpc.lsa_LookupNames4.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames3_num_names,
+		{ "Num Names", "lsarpc.lsa_LookupNames3.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_quota,
+		{ "Quota", "lsarpc.lsa_PolicyInformation.quota", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_String_length,
+		{ "Length", "lsarpc.lsa_String.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TrustDomainInfoPassword_old_password,
-	  { "Old Password", "lsarpc.lsa_TrustDomainInfoPassword.old_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenPolicy_system_name,
-	  { "System Name", "lsarpc.lsa_OpenPolicy.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccountsWithUserRight_sids,
-	  { "Sids", "lsarpc.lsa_EnumAccountsWithUserRight.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoAll_auth_info,
-	  { "Auth Info", "lsarpc.lsa_TrustDomainInfoInfoAll.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN,
-	  { "Lsa Policy Server Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SERVER_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN_tfs), ( 0x00000400 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LUIDAttribute_attribute,
-	  { "Attribute", "lsarpc.lsa_LUIDAttribute.attribute", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateTrustedDomain_trustdom_handle,
-	  { "Trustdom Handle", "lsarpc.lsa_CreateTrustedDomain.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Old Password", "lsarpc.lsa_TrustDomainInfoPassword.old_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames4_sids,
+		{ "Sids", "lsarpc.lsa_LookupNames4.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ObjectAttribute_object_name,
+		{ "Object Name", "lsarpc.lsa_ObjectAttribute.object_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_AuditLogInfo_percent_full,
-	  { "Percent Full", "lsarpc.lsa_AuditLogInfo.percent_full", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS,
-	  { "Lsa Policy Set Audit Requirements", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SET_AUDIT_REQUIREMENTS", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfoKerberos_unknown6,
-	  { "Unknown6", "lsarpc.lsa_DomainInfoKerberos.unknown6", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AddPrivilegesToAccount_handle,
-	  { "Handle", "lsarpc.lsa_AddPrivilegesToAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames_num_names,
-	  { "Num Names", "lsarpc.lsa_LookupNames.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_current_auth_info,
-	  { "Incoming Current Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_current_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids2_count,
-	  { "Count", "lsarpc.lsa_LookupSids2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Percent Full", "lsarpc.lsa_AuditLogInfo.percent_full", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInformationPolicy_kerberos_info,
+		{ "Kerberos Info", "lsarpc.lsa_DomainInformationPolicy.kerberos_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_StringPointer_string,
+		{ "String", "lsarpc.lsa_StringPointer.string", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateTrustedDomain_info,
+		{ "Info", "lsarpc.lsa_CreateTrustedDomain.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid2_sid_type,
+		{ "Sid Type", "lsarpc.lsa_TranslatedSid2.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenPolicy_handle,
+		{ "Handle", "lsarpc.lsa_OpenPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetInfoPolicy_handle,
+		{ "Handle", "lsarpc.lsa_SetInfoPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateSecret_name,
+		{ "Name", "lsarpc.lsa_CreateSecret.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivDisplayName_handle,
+		{ "Handle", "lsarpc.lsa_LookupPrivDisplayName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_lifetime,
+		{ "User Tkt Lifetime", "lsarpc.lsa_DomainInfoKerberos.user_tkt_lifetime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN,
+		{ "Lsa Policy Server Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SERVER_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN_tfs), ( 0x00000400 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustDomainInfo_dns_domain_name,
+		{ "Dns Domain Name", "lsarpc.lsa_ForestTrustDomainInfo.dns_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditEventsInfo_count,
+		{ "Count", "lsarpc.lsa_AuditEventsInfo.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_names,
+		{ "Names", "lsarpc.lsa_LookupNames2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SidArray_sids,
+		{ "Sids", "lsarpc.lsa_SidArray.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QuerySecret_old_val,
+		{ "Old Val", "lsarpc.lsa_QuerySecret.old_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES,
+		{ "Lsa Account Adjust Privileges", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_PRIVILEGES", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_level,
+		{ "Level", "lsarpc.lsa_QueryTrustedDomainInfoBySid.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_PrivEntry_name,
-	  { "Name", "lsarpc.lsa_PrivEntry.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoBasic_sid,
-	  { "Sid", "lsarpc.lsa_TrustDomainInfoBasic.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TransNameArray_names,
-	  { "Names", "lsarpc.lsa_TransNameArray.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DATA_BUF_size,
-	  { "Size", "lsarpc.lsa_DATA_BUF.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateAccount_acct_handle,
-	  { "Acct Handle", "lsarpc.lsa_CreateAccount.acct_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumTrustDom_handle,
-	  { "Handle", "lsarpc.lsa_EnumTrustDom.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Name", "lsarpc.lsa_PrivEntry.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfo11_data1,
+		{ "Data1", "lsarpc.lsa_TrustDomainInfo11.data1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfo_info,
+		{ "Info", "lsarpc.lsa_QueryTrustedDomainInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustedDomainInfo_name,
+		{ "Name", "lsarpc.lsa_TrustedDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RemoveAccountRights_sid,
+		{ "Sid", "lsarpc.lsa_RemoveAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivValue_luid,
+		{ "Luid", "lsarpc.lsa_LookupPrivValue.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids_names,
+		{ "Names", "lsarpc.lsa_LookupSids.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_SetInfoPolicy_level,
-	  { "Level", "lsarpc.lsa_SetInfoPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateSecret_sec_handle,
-	  { "Sec Handle", "lsarpc.lsa_CreateSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivValue_name,
-	  { "Name", "lsarpc.lsa_LookupPrivValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumPrivs_privs,
-	  { "Privs", "lsarpc.lsa_EnumPrivs.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_unknown2,
-	  { "Unknown2", "lsarpc.lsa_LookupNames2.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames4_unknown1,
-	  { "Unknown1", "lsarpc.lsa_LookupNames4.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RemovePrivilegesFromAccount_privs,
-	  { "Privs", "lsarpc.lsa_RemovePrivilegesFromAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX,
-	  { "Lsa Domain Query Posix", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_POSIX", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames3_count,
-	  { "Count", "lsarpc.lsa_LookupNames3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_secret_access_mask,
-	  { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoFullInfo_info_ex,
-	  { "Info Ex", "lsarpc.lsa_TrustDomainInfoFullInfo.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids3_domains,
-	  { "Domains", "lsarpc.lsa_LookupSids3.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION,
-	  { "Lsa Policy View Local Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_VIEW_LOCAL_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids3_level,
-	  { "Level", "lsarpc.lsa_LookupSids3.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames4_unknown2,
-	  { "Unknown2", "lsarpc.lsa_LookupNames4.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AddAccountRights_sid,
-	  { "Sid", "lsarpc.lsa_AddAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_Strings_names,
-	  { "Names", "lsarpc.lsa_Strings.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumTrustedDomainsEx_domains,
-	  { "Domains", "lsarpc.lsa_EnumTrustedDomainsEx.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RightSet_count,
-	  { "Count", "lsarpc.lsa_RightSet.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedName2_sid_type,
-	  { "Sid Type", "lsarpc.lsa_TranslatedName2.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumPrivsAccount_privs,
-	  { "Privs", "lsarpc.lsa_EnumPrivsAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DATA_BUF_data,
-	  { "Data", "lsarpc.lsa_DATA_BUF.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateAccount_handle,
-	  { "Handle", "lsarpc.lsa_CreateAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DefaultQuotaInfo_pagefile,
-	  { "Pagefile", "lsarpc.lsa_DefaultQuotaInfo.pagefile", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PDAccountInfo_name,
-	  { "Name", "lsarpc.lsa_PDAccountInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_StringLarge_size,
-	  { "Size", "lsarpc.lsa_StringLarge.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumTrustedDomainsEx_max_size,
-	  { "Max Size", "lsarpc.lsa_EnumTrustedDomainsEx.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoAll_data1,
-	  { "Data1", "lsarpc.lsa_TrustDomainInfoInfoAll.data1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccounts_handle,
-	  { "Handle", "lsarpc.lsa_EnumAccounts.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames_level,
-	  { "Level", "lsarpc.lsa_LookupNames.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustDomainInfo_dns_domain_name,
-	  { "Dns Domain Name", "lsarpc.lsa_ForestTrustDomainInfo.dns_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Level", "lsarpc.lsa_SetInfoPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_PrivArray_privs,
-	  { "Privs", "lsarpc.lsa_PrivArray.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid_sid_type,
-	  { "Sid Type", "lsarpc.lsa_TranslatedSid.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE,
-	  { "Lsa Secret Set Value", "lsarpc.lsa_SecretAccessMask.LSA_SECRET_SET_VALUE", FT_BOOLEAN, 32, TFS(&lsa_SecretAccessMask_LSA_SECRET_SET_VALUE_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedName_sid_index,
-	  { "Sid Index", "lsarpc.lsa_TranslatedName.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenTrustedDomain_access_mask,
-	  { "Access Mask", "lsarpc.lsa_OpenTrustedDomain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivName_luid,
-	  { "Luid", "lsarpc.lsa_LookupPrivName.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_domain_access_mask,
-	  { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids_handle,
-	  { "Handle", "lsarpc.lsa_LookupSids.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_role,
-	  { "Role", "lsarpc.lsa_PolicyInformation.role", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateTrustedDomain_access_mask,
-	  { "Access Mask", "lsarpc.lsa_CreateTrustedDomain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid2_sid_index,
-	  { "Sid Index", "lsarpc.lsa_TranslatedSid2.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_pd,
-	  { "Pd", "lsarpc.lsa_PolicyInformation.pd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DeleteTrustedDomain_handle,
-	  { "Handle", "lsarpc.lsa_DeleteTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustedDomainInfo_info11,
-	  { "Info11", "lsarpc.lsa_TrustedDomainInfo.info11", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetDomainInformationPolicy_info,
-	  { "Info", "lsarpc.lsa_SetDomainInformationPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivName_name,
-	  { "Name", "lsarpc.lsa_LookupPrivName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Privs", "lsarpc.lsa_PrivArray.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_DomainListEx_domains,
-	  { "Domains", "lsarpc.lsa_DomainListEx.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_db,
-	  { "Db", "lsarpc.lsa_PolicyInformation.db", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditLogInfo_retention_time,
-	  { "Retention Time", "lsarpc.lsa_AuditLogInfo.retention_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryInfoPolicy2_info,
-	  { "Info", "lsarpc.lsa_QueryInfoPolicy2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_audit_events,
-	  { "Audit Events", "lsarpc.lsa_PolicyInformation.audit_events", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_sid,
-	  { "Sid", "lsarpc.lsa_TrustDomainInfoInfoEx.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_String_size,
-	  { "Size", "lsarpc.lsa_String.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RemovePrivilegesFromAccount_handle,
-	  { "Handle", "lsarpc.lsa_RemovePrivilegesFromAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Domains", "lsarpc.lsa_DomainListEx.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AddAccountRights_handle,
+		{ "Handle", "lsarpc.lsa_AddAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_unknown2,
+		{ "Unknown2", "lsarpc.lsa_LookupNames2.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustInformation_entries,
+		{ "Entries", "lsarpc.lsa_ForestTrustInformation.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_AuditEventsInfo_auditing_mode,
-	  { "Auditing Mode", "lsarpc.lsa_AuditEventsInfo.auditing_mode", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Auditing Mode", "lsarpc.lsa_AuditEventsInfo.auditing_mode", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE,
+		{ "Lsa Secret Set Value", "lsarpc.lsa_SecretAccessMask.LSA_SECRET_SET_VALUE", FT_BOOLEAN, 32, TFS(&lsa_SecretAccessMask_LSA_SECRET_SET_VALUE_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames3_unknown1,
+		{ "Unknown1", "lsarpc.lsa_LookupNames3.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids_count,
+		{ "Count", "lsarpc.lsa_LookupSids.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames_num_names,
+		{ "Num Names", "lsarpc.lsa_LookupNames.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AddAccountRights_rights,
+		{ "Rights", "lsarpc.lsa_AddAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION,
+		{ "Lsa Policy Get Private Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_GET_PRIVATE_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumPrivs_resume_handle,
+		{ "Resume Handle", "lsarpc.lsa_EnumPrivs.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedName2_name,
+		{ "Name", "lsarpc.lsa_TranslatedName2.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetInfoPolicy_info,
+		{ "Info", "lsarpc.lsa_SetInfoPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenAccount_access_mask,
+		{ "Access Mask", "lsarpc.lsa_OpenAccount.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_count,
+		{ "Outgoing Count", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TransSidArray2_sids,
+		{ "Sids", "lsarpc.lsa_TransSidArray2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DATA_BUF_PTR_buf,
+		{ "Buf", "lsarpc.lsa_DATA_BUF_PTR.buf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TrustedDomainInfo_password,
-	  { "Password", "lsarpc.lsa_TrustedDomainInfo.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditLogInfo_shutdown_in_progress,
-	  { "Shutdown In Progress", "lsarpc.lsa_AuditLogInfo.shutdown_in_progress", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_String_string,
-	  { "String", "lsarpc.lsa_String.string", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoAll_info_ex,
-	  { "Info Ex", "lsarpc.lsa_TrustDomainInfoInfoAll.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Password", "lsarpc.lsa_TrustedDomainInfo.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW,
+		{ "Lsa Account View", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_VIEW", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_VIEW_tfs), ( 0x00000001 ), NULL, HFILL }},
 	{ &hf_lsarpc_lsa_CloseTrustedDomainEx_handle,
-	  { "Handle", "lsarpc.lsa_CloseTrustedDomainEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumTrustDom_resume_handle,
-	  { "Resume Handle", "lsarpc.lsa_EnumTrustDom.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_handle,
-	  { "Handle", "lsarpc.lsa_QueryTrustedDomainInfoBySid.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES,
-	  { "Lsa Policy Lookup Names", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_LOOKUP_NAMES", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES_tfs), ( 0x00000800 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_auditfullset,
-	  { "Auditfullset", "lsarpc.lsa_PolicyInformation.auditfullset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids_domains,
-	  { "Domains", "lsarpc.lsa_LookupSids.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DefaultQuotaInfo_non_paged_pool,
-	  { "Non Paged Pool", "lsarpc.lsa_DefaultQuotaInfo.non_paged_pool", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames4_count,
-	  { "Count", "lsarpc.lsa_LookupNames4.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_names,
-	  { "Names", "lsarpc.lookup.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_renewaltime,
-	  { "User Tkt Renewaltime", "lsarpc.lsa_DomainInfoKerberos.user_tkt_renewaltime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames3_domains,
-	  { "Domains", "lsarpc.lsa_LookupNames3.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_account_access_mask,
-	  { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInformationPolicy_efs_info,
-	  { "Efs Info", "lsarpc.lsa_DomainInformationPolicy.efs_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateSecret_name,
-	  { "Name", "lsarpc.lsa_CreateSecret.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ServerRole_role,
-	  { "Role", "lsarpc.lsa_ServerRole.role", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyServerRole_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustDomainInfo_netbios_domain_name,
-	  { "Netbios Domain Name", "lsarpc.lsa_ForestTrustDomainInfo.netbios_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedName2_name,
-	  { "Name", "lsarpc.lsa_TranslatedName2.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoPassword_password,
-	  { "Password", "lsarpc.lsa_TrustDomainInfoPassword.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PrivilegeSet_count,
-	  { "Count", "lsarpc.lsa_PrivilegeSet.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_trusted_domain,
-	  { "Trusted Domain", "lsarpc.lsa_QueryTrustedDomainInfoByName.trusted_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfo11_info_ex,
-	  { "Info Ex", "lsarpc.lsa_TrustDomainInfo11.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DeleteTrustedDomain_dom_sid,
-	  { "Dom Sid", "lsarpc.lsa_DeleteTrustedDomain.dom_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustData_top_level_name,
-	  { "Top Level Name", "lsarpc.lsa_ForestTrustData.top_level_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PrivArray_count,
-	  { "Count", "lsarpc.lsa_PrivArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS,
-	  { "Lsa Policy Set Default Quota Limits", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS_tfs), ( 0x00000080 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenPolicy_handle,
-	  { "Handle", "lsarpc.lsa_OpenPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetSecret_sec_handle,
-	  { "Sec Handle", "lsarpc.lsa_SetSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ObjectAttribute_root_dir,
-	  { "Root Dir", "lsarpc.lsa_ObjectAttribute.root_dir", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetTrustedDomainInfoByName_handle,
-	  { "Handle", "lsarpc.lsa_SetTrustedDomainInfoByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenSecret_sec_handle,
-	  { "Sec Handle", "lsarpc.lsa_OpenSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DnsDomainInfo_sid,
-	  { "Sid", "lsarpc.lsa_DnsDomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Handle", "lsarpc.lsa_CloseTrustedDomainEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfo_name,
+		{ "Name", "lsarpc.lsa_DomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RemovePrivilegesFromAccount_remove_all,
+		{ "Remove All", "lsarpc.lsa_RemovePrivilegesFromAccount.remove_all", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_StringLarge_length,
+		{ "Length", "lsarpc.lsa_StringLarge.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_EnumAccountRights_sid,
-	  { "Sid", "lsarpc.lsa_EnumAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoAll_posix_offset,
-	  { "Posix Offset", "lsarpc.lsa_TrustDomainInfoInfoAll.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivDisplayName_language_id,
-	  { "Language Id", "lsarpc.lsa_LookupPrivDisplayName.language_id", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames3_num_names,
-	  { "Num Names", "lsarpc.lsa_LookupNames3.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QuerySecret_sec_handle,
-	  { "Sec Handle", "lsarpc.lsa_QuerySecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenTrustedDomainByName_name,
-	  { "Name", "lsarpc.lsa_OpenTrustedDomainByName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfoKerberos_clock_skew,
-	  { "Clock Skew", "lsarpc.lsa_DomainInfoKerberos.clock_skew", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumTrustedDomainsEx_handle,
-	  { "Handle", "lsarpc.lsa_EnumTrustedDomainsEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid3_unknown,
-	  { "Unknown", "lsarpc.lsa_TranslatedSid3.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ObjectAttribute_object_name,
-	  { "Object Name", "lsarpc.lsa_ObjectAttribute.object_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetInfoPolicy2_info,
-	  { "Info", "lsarpc.lsa_SetInfoPolicy2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryInfoPolicy_level,
-	  { "Level", "lsarpc.lsa_QueryInfoPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_attributes,
-	  { "Trust Attributes", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AsciiStringLarge_size,
-	  { "Size", "lsarpc.lsa_AsciiStringLarge.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_lifetime,
-	  { "User Tkt Lifetime", "lsarpc.lsa_DomainInfoKerberos.user_tkt_lifetime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoFullInfo_posix_offset,
-	  { "Posix Offset", "lsarpc.lsa_TrustDomainInfoFullInfo.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustedDomainInfo_auth_info,
-	  { "Auth Info", "lsarpc.lsa_TrustedDomainInfo.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_domain_name,
-	  { "Domain Name", "lsarpc.lsa_TrustDomainInfoInfoEx.domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames4_sids,
-	  { "Sids", "lsarpc.lsa_LookupNames4.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedName_sid_type,
-	  { "Sid Type", "lsarpc.lsa_TranslatedName.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenPolicy2_system_name,
-	  { "System Name", "lsarpc.lsa_OpenPolicy2.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids3_unknown1,
-	  { "Unknown1", "lsarpc.lsa_LookupSids3.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Sid", "lsarpc.lsa_EnumAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES,
+		{ "Lsa Policy Lookup Names", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_LOOKUP_NAMES", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES_tfs), ( 0x00000800 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_replica,
+		{ "Replica", "lsarpc.lsa_PolicyInformation.replica", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids2_names,
+		{ "Names", "lsarpc.lsa_LookupSids2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivName_name,
+		{ "Name", "lsarpc.lsa_LookupPrivName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_info,
+		{ "Info", "lsarpc.lsa_QueryTrustedDomainInfoBySid.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid3_sid,
+		{ "Sid", "lsarpc.lsa_TranslatedSid3.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids2_unknown1,
+		{ "Unknown1", "lsarpc.lsa_LookupSids2.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_StringLarge_size,
+		{ "Size", "lsarpc.lsa_StringLarge.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS,
+		{ "Lsa Account Adjust System Access", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid2_unknown,
+		{ "Unknown", "lsarpc.lsa_TranslatedSid2.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_audit_log,
+		{ "Audit Log", "lsarpc.lsa_PolicyInformation.audit_log", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivName_luid,
+		{ "Luid", "lsarpc.lsa_LookupPrivName.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_ObjectAttribute_sec_desc,
-	  { "Sec Desc", "lsarpc.lsa_ObjectAttribute.sec_desc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfo_sid,
-	  { "Sid", "lsarpc.lsa_DomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditLogInfo_time_to_shutdown,
-	  { "Time To Shutdown", "lsarpc.lsa_AuditLogInfo.time_to_shutdown", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RefDomainList_max_size,
-	  { "Max Size", "lsarpc.lsa_RefDomainList.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RemoveAccountRights_rights,
-	  { "Rights", "lsarpc.lsa_RemoveAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_GetUserName_authority_name,
-	  { "Authority Name", "lsarpc.lsa_GetUserName.authority_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TransSidArray2_sids,
-	  { "Sids", "lsarpc.lsa_TransSidArray2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedName_name,
-	  { "Name", "lsarpc.lsa_TranslatedName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS,
-	  { "Lsa Domain Query Controllers", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_CONTROLLERS", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoFullInfo_auth_info,
-	  { "Auth Info", "lsarpc.lsa_TrustDomainInfoFullInfo.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE,
-	  { "Lsa Policy Create Privilege", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_PRIVILEGE", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumPrivs_resume_handle,
-	  { "Resume Handle", "lsarpc.lsa_EnumPrivs.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustInformation_entries,
-	  { "Entries", "lsarpc.lsa_ForestTrustInformation.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SidPtr_sid,
-	  { "Sid", "lsarpc.lsa_SidPtr.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_sids,
-	  { "Sids", "lsarpc.lsa_LookupNames2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids3_names,
-	  { "Names", "lsarpc.lsa_LookupSids3.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoPosixOffset_posix_offset,
-	  { "Posix Offset", "lsarpc.lsa_TrustDomainInfoPosixOffset.posix_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivDisplayName_handle,
-	  { "Handle", "lsarpc.lsa_LookupPrivDisplayName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_Close_handle,
-	  { "Handle", "lsarpc.lsa_Close.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivValue_handle,
-	  { "Handle", "lsarpc.lsa_LookupPrivValue.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivDisplayName_name,
-	  { "Name", "lsarpc.lsa_LookupPrivDisplayName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RemoveAccountRights_handle,
-	  { "Handle", "lsarpc.lsa_RemoveAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids3_sids,
-	  { "Sids", "lsarpc.lsa_LookupSids3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccounts_sids,
-	  { "Sids", "lsarpc.lsa_EnumAccounts.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumTrustDom_domains,
-	  { "Domains", "lsarpc.lsa_EnumTrustDom.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN,
-	  { "Lsa Policy Audit Log Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_AUDIT_LOG_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_account_domain,
-	  { "Account Domain", "lsarpc.lsa_PolicyInformation.account_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Sec Desc", "lsarpc.lsa_ObjectAttribute.sec_desc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenSecret_access_mask,
+		{ "Access Mask", "lsarpc.lsa_OpenSecret.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LUID_high,
+		{ "High", "lsarpc.lsa_LUID.high", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_attributes,
+		{ "Trust Attributes", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RefDomainList_count,
+		{ "Count", "lsarpc.lsa_RefDomainList.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames4_level,
+		{ "Level", "lsarpc.lsa_LookupNames4.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids3_unknown2,
+		{ "Unknown2", "lsarpc.lsa_LookupSids3.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateTrustedDomain_trustdom_handle,
+		{ "Trustdom Handle", "lsarpc.lsa_CreateTrustedDomain.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditLogInfo_unknown,
+		{ "Unknown", "lsarpc.lsa_AuditLogInfo.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustedDomainInfo_info11,
+		{ "Info11", "lsarpc.lsa_TrustedDomainInfo.info11", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_current_auth_info,
+		{ "Outgoing Current Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_current_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_level,
+		{ "Level", "lsarpc.lsa_LookupNames2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET,
+		{ "Lsa Policy Create Secret", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_SECRET", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT,
+		{ "Lsa Policy Create Account", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_ACCOUNT", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid2_rid,
+		{ "Rid", "lsarpc.lsa_TranslatedSid2.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AsciiString_length,
+		{ "Length", "lsarpc.lsa_AsciiString.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AsciiStringLarge_length,
+		{ "Length", "lsarpc.lsa_AsciiStringLarge.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryDomainInformationPolicy_level,
+		{ "Level", "lsarpc.lsa_QueryDomainInformationPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_DomainInfoEnum_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AsciiString_string,
+		{ "String", "lsarpc.lsa_AsciiString.string", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS,
+		{ "Lsa Policy Set Audit Requirements", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SET_AUDIT_REQUIREMENTS", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS_tfs), ( 0x00000100 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryInfoPolicy2_info,
+		{ "Info", "lsarpc.lsa_QueryInfoPolicy2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenTrustedDomainByName_handle,
+		{ "Handle", "lsarpc.lsa_OpenTrustedDomainByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_DefaultQuotaInfo_paged_pool,
-	  { "Paged Pool", "lsarpc.lsa_DefaultQuotaInfo.paged_pool", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivDisplayName_unknown,
-	  { "Unknown", "lsarpc.lsa_LookupPrivDisplayName.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_count,
-	  { "Outgoing Count", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DnsDomainInfo_domain_guid,
-	  { "Domain Guid", "lsarpc.lsa_DnsDomainInfo.domain_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames3_unknown1,
-	  { "Unknown1", "lsarpc.lsa_LookupNames3.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Paged Pool", "lsarpc.lsa_DefaultQuotaInfo.paged_pool", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenTrustedDomainByName_trustdom_handle,
+		{ "Trustdom Handle", "lsarpc.lsa_OpenTrustedDomainByName.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LUIDAttribute_attribute,
+		{ "Attribute", "lsarpc.lsa_LUIDAttribute.attribute", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RemoveAccountRights_handle,
+		{ "Handle", "lsarpc.lsa_RemoveAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditLogInfo_shutdown_in_progress,
+		{ "Shutdown In Progress", "lsarpc.lsa_AuditLogInfo.shutdown_in_progress", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_GetUserName_account_name,
+		{ "Account Name", "lsarpc.lsa_GetUserName.account_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QuerySecret_new_val,
+		{ "New Val", "lsarpc.lsa_QuerySecret.new_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateAccount_access_mask,
+		{ "Access Mask", "lsarpc.lsa_CreateAccount.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateTrustedDomain_handle,
+		{ "Handle", "lsarpc.lsa_CreateTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_handle,
+		{ "Handle", "lsarpc.lsa_LookupNames2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_LookupSids_level,
-	  { "Level", "lsarpc.lsa_LookupSids.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid_sid_index,
-	  { "Sid Index", "lsarpc.lsa_TranslatedSid.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Level", "lsarpc.lsa_LookupSids.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenPolicy2_system_name,
+		{ "System Name", "lsarpc.lsa_OpenPolicy2.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_num_names,
+		{ "Num Names", "lsarpc.lsa_LookupNames2.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_info,
+		{ "Info", "lsarpc.lsa_QueryTrustedDomainInfoByName.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainListEx_count,
+		{ "Count", "lsarpc.lsa_DomainListEx.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_Strings_count,
+		{ "Count", "lsarpc.lsa_Strings.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RightSet_names,
+		{ "Names", "lsarpc.lsa_RightSet.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumTrustedDomainsEx_max_size,
+		{ "Max Size", "lsarpc.lsa_EnumTrustedDomainsEx.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetDomainInformationPolicy_handle,
+		{ "Handle", "lsarpc.lsa_SetDomainInformationPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RightAttribute_name,
+		{ "Name", "lsarpc.lsa_RightAttribute.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustRecord_flags,
+		{ "Flags", "lsarpc.lsa_ForestTrustRecord.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_netbios_name,
+		{ "Netbios Name", "lsarpc.lsa_TrustDomainInfoInfoEx.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TrustedDomainInfo_info_ex,
-	  { "Info Ex", "lsarpc.lsa_TrustedDomainInfo.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccounts_resume_handle,
-	  { "Resume Handle", "lsarpc.lsa_EnumAccounts.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryDomainInformationPolicy_level,
-	  { "Level", "lsarpc.lsa_QueryDomainInformationPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_DomainInfoEnum_vals), 0, NULL, HFILL }},
+		{ "Info Ex", "lsarpc.lsa_TrustedDomainInfo.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditLogInfo_retention_time,
+		{ "Retention Time", "lsarpc.lsa_AuditLogInfo.retention_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustRecord_unknown,
+		{ "Unknown", "lsarpc.lsa_ForestTrustRecord.unknown", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumPrivs_handle,
+		{ "Handle", "lsarpc.lsa_EnumPrivs.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedName2_sid_index,
+		{ "Sid Index", "lsarpc.lsa_TranslatedName2.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryInfoPolicy_info,
+		{ "Info", "lsarpc.lsa_QueryInfoPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TrustedDomainInfo_full_info,
-	  { "Full Info", "lsarpc.lsa_TrustedDomainInfo.full_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Full Info", "lsarpc.lsa_TrustedDomainInfo.full_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid3_sid_index,
+		{ "Sid Index", "lsarpc.lsa_TranslatedSid3.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS,
+		{ "Lsa Domain Set Controllers", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_CONTROLLERS", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames3_count,
+		{ "Count", "lsarpc.lsa_LookupNames3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenTrustedDomain_trustdom_handle,
+		{ "Trustdom Handle", "lsarpc.lsa_OpenTrustedDomain.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfoEfs_efs_blob,
+		{ "Efs Blob", "lsarpc.lsa_DomainInfoEfs.efs_blob", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenAccount_handle,
+		{ "Handle", "lsarpc.lsa_OpenAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PrivilegeSet_set,
+		{ "Set", "lsarpc.lsa_PrivilegeSet.set", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumTrustedDomainsEx_resume_handle,
+		{ "Resume Handle", "lsarpc.lsa_EnumTrustedDomainsEx.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids2_handle,
+		{ "Handle", "lsarpc.lsa_LookupSids2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QuerySecret_sec_handle,
+		{ "Sec Handle", "lsarpc.lsa_QuerySecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_auditfullquery,
+		{ "Auditfullquery", "lsarpc.lsa_PolicyInformation.auditfullquery", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustInformation_count,
+		{ "Count", "lsarpc.lsa_ForestTrustInformation.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_StringLarge_string,
+		{ "String", "lsarpc.lsa_StringLarge.string", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX,
+		{ "Lsa Domain Query Posix", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_POSIX", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TransNameArray_names,
+		{ "Names", "lsarpc.lsa_TransNameArray.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_DATA_BUF_length,
-	  { "Length", "lsarpc.lsa_DATA_BUF.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames4_domains,
-	  { "Domains", "lsarpc.lsa_LookupNames4.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfo_trustdom_handle,
-	  { "Trustdom Handle", "lsarpc.lsa_QueryTrustedDomainInfo.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetTrustedDomainInfoByName_level,
-	  { "Level", "lsarpc.lsa_SetTrustedDomainInfoByName.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT,
-	  { "Lsa Policy Create Account", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_ACCOUNT", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenSecret_access_mask,
-	  { "Access Mask", "lsarpc.lsa_OpenSecret.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TransSidArray2_count,
-	  { "Count", "lsarpc.lsa_TransSidArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AsciiString_size,
-	  { "Size", "lsarpc.lsa_AsciiString.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_quota,
-	  { "Quota", "lsarpc.lsa_PolicyInformation.quota", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AddAccountRights_rights,
-	  { "Rights", "lsarpc.lsa_AddAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustData_top_level_name_ex,
-	  { "Top Level Name Ex", "lsarpc.lsa_ForestTrustData.top_level_name_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_Strings_count,
-	  { "Count", "lsarpc.lsa_Strings.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustData_data,
-	  { "Data", "lsarpc.lsa_ForestTrustData.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Length", "lsarpc.lsa_DATA_BUF.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccounts_num_entries,
+		{ "Num Entries", "lsarpc.lsa_EnumAccounts.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoAll_posix_offset,
+		{ "Posix Offset", "lsarpc.lsa_TrustDomainInfoInfoAll.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoBuffer_last_update_time,
+		{ "Last Update Time", "lsarpc.lsa_TrustDomainInfoBuffer.last_update_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryInfoPolicy2_handle,
+		{ "Handle", "lsarpc.lsa_QueryInfoPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_type,
-	  { "Trust Type", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Trust Type", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_pd,
+		{ "Pd", "lsarpc.lsa_PolicyInformation.pd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PrivilegeSet_count,
+		{ "Count", "lsarpc.lsa_PrivilegeSet.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_DATA_BUF2_data,
-	  { "Data", "lsarpc.lsa_DATA_BUF2.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetInfoPolicy_info,
-	  { "Info", "lsarpc.lsa_SetInfoPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetSecret_new_val,
-	  { "New Val", "lsarpc.lsa_SetSecret.new_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid3_sid_index,
-	  { "Sid Index", "lsarpc.lsa_TranslatedSid3.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TransNameArray2_count,
-	  { "Count", "lsarpc.lsa_TransNameArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_Delete_handle,
-	  { "Handle", "lsarpc.lsa_Delete.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumPrivs_max_count,
-	  { "Max Count", "lsarpc.lsa_EnumPrivs.max_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateSecret_access_mask,
-	  { "Access Mask", "lsarpc.lsa_CreateSecret.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_status,
-	  { "NT Error", "lsarpc.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustRecord_forest_trust_data,
-	  { "Forest Trust Data", "lsarpc.lsa_ForestTrustRecord.forest_trust_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenTrustedDomain_trustdom_handle,
-	  { "Trustdom Handle", "lsarpc.lsa_OpenTrustedDomain.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_forest_trust_info,
-	  { "Forest Trust Info", "lsarpc.lsa_lsaRQueryForestTrustInformation.forest_trust_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN,
-	  { "Lsa Policy Trust Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_TRUST_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ObjectAttribute_sec_qos,
-	  { "Sec Qos", "lsarpc.lsa_ObjectAttribute.sec_qos", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids2_sids,
-	  { "Sids", "lsarpc.lsa_LookupSids2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DnsDomainInfo_dns_domain,
-	  { "Dns Domain", "lsarpc.lsa_DnsDomainInfo.dns_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetDomainInformationPolicy_handle,
-	  { "Handle", "lsarpc.lsa_SetDomainInformationPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PrivilegeSet_unknown,
-	  { "Unknown", "lsarpc.lsa_PrivilegeSet.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfoKerberos_service_tkt_lifetime,
-	  { "Service Tkt Lifetime", "lsarpc.lsa_DomainInfoKerberos.service_tkt_lifetime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_StringLarge_length,
-	  { "Length", "lsarpc.lsa_StringLarge.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenTrustedDomain_sid,
-	  { "Sid", "lsarpc.lsa_OpenTrustedDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QuerySecurity_sdbuf,
-	  { "Sdbuf", "lsarpc.lsa_QuerySecurity.sdbuf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenTrustedDomainByName_access_mask,
-	  { "Access Mask", "lsarpc.lsa_OpenTrustedDomainByName.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfo_name,
-	  { "Name", "lsarpc.lsa_DomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ModificationInfo_db_create_time,
-	  { "Db Create Time", "lsarpc.lsa_ModificationInfo.db_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids_sids,
-	  { "Sids", "lsarpc.lsa_LookupSids.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_current_auth_info,
-	  { "Outgoing Current Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_current_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames_names,
-	  { "Names", "lsarpc.lsa_LookupNames.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustBinaryData_data,
-	  { "Data", "lsarpc.lsa_ForestTrustBinaryData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_handle,
-	  { "Handle", "lsarpc.lsa_lsaRQueryForestTrustInformation.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames3_sids,
-	  { "Sids", "lsarpc.lsa_LookupNames3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Data", "lsarpc.lsa_DATA_BUF2.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_domain,
+		{ "Domain", "lsarpc.lsa_PolicyInformation.domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoAll_data1,
+		{ "Data1", "lsarpc.lsa_TrustDomainInfoInfoAll.data1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_AuditLogInfo_log_size,
-	  { "Log Size", "lsarpc.lsa_AuditLogInfo.log_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenTrustedDomainByName_trustdom_handle,
-	  { "Trustdom Handle", "lsarpc.lsa_OpenTrustedDomainByName.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DnsDomainInfo_name,
-	  { "Name", "lsarpc.lsa_DnsDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ObjectAttribute_len,
-	  { "Len", "lsarpc.lsa_ObjectAttribute.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumTrustedDomainsEx_resume_handle,
-	  { "Resume Handle", "lsarpc.lsa_EnumTrustedDomainsEx.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_sec_desc_buf_len,
-	  { "Sec Desc Buf Len", "lsarpc.sec_desc_buf_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_efs_blob_len,
-	  { "EFS blob size", "lsarpc.efs.blob_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInformationPolicy_kerberos_info,
-	  { "Kerberos Info", "lsarpc.lsa_DomainInformationPolicy.kerberos_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateAccount_access_mask,
-	  { "Access Mask", "lsarpc.lsa_CreateAccount.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_StringPointer_string,
-	  { "String", "lsarpc.lsa_StringPointer.string", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditEventsInfo_count,
-	  { "Count", "lsarpc.lsa_AuditEventsInfo.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ObjectAttribute_attributes,
-	  { "Attributes", "lsarpc.lsa_ObjectAttribute.attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PrivEntry_luid,
-	  { "Luid", "lsarpc.lsa_PrivEntry.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Log Size", "lsarpc.lsa_AuditLogInfo.log_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AsciiStringLarge_size,
+		{ "Size", "lsarpc.lsa_AsciiStringLarge.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_SetTrustedDomainInfoByName_info,
-	  { "Info", "lsarpc.lsa_SetTrustedDomainInfoByName.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QosInfo_impersonation_level,
-	  { "Impersonation Level", "lsarpc.lsa_QosInfo.impersonation_level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SecurityImpersonationLevel_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateTrustedDomain_handle,
-	  { "Handle", "lsarpc.lsa_CreateTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfo_info,
-	  { "Info", "lsarpc.lsa_QueryTrustedDomainInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditEventsInfo_settings,
-	  { "Settings", "lsarpc.lsa_AuditEventsInfo.settings", FT_UINT32, BASE_DEC, VALS(lsarpc_lsa_PolicyAuditPolicy_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW,
-	  { "Lsa Account View", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_VIEW", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_VIEW_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoBuffer_last_update_time,
-	  { "Last Update Time", "lsarpc.lsa_TrustDomainInfoBuffer.last_update_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_level,
-	  { "Level", "lsarpc.lsa_LookupNames2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QuerySecurity_handle,
-	  { "Handle", "lsarpc.lsa_QuerySecurity.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LUID_low,
-	  { "Low", "lsarpc.lsa_LUID.low", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Info", "lsarpc.lsa_SetTrustedDomainInfoByName.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumTrustedDomainsEx_handle,
+		{ "Handle", "lsarpc.lsa_EnumTrustedDomainsEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccountsWithUserRight_sids,
+		{ "Sids", "lsarpc.lsa_EnumAccountsWithUserRight.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids2_domains,
+		{ "Domains", "lsarpc.lsa_LookupSids2.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditFullSetInfo_shutdown_on_full,
+		{ "Shutdown On Full", "lsarpc.lsa_AuditFullSetInfo.shutdown_on_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_dns,
+		{ "Dns", "lsarpc.lsa_PolicyInformation.dns", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_Delete_handle,
+		{ "Handle", "lsarpc.lsa_Delete.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateAccount_handle,
+		{ "Handle", "lsarpc.lsa_CreateAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_current_auth_info,
+		{ "Incoming Current Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_current_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN,
+		{ "Lsa Policy Trust Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_TRUST_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames_domains,
+		{ "Domains", "lsarpc.lsa_LookupNames.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_names,
+		{ "Names", "lsarpc.lookup.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_EnumPrivsAccount_handle,
-	  { "Handle", "lsarpc.lsa_EnumPrivsAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RemovePrivilegesFromAccount_remove_all,
-	  { "Remove All", "lsarpc.lsa_RemovePrivilegesFromAccount.remove_all", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedName2_sid_index,
-	  { "Sid Index", "lsarpc.lsa_TranslatedName2.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Handle", "lsarpc.lsa_EnumPrivsAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoBuffer_data,
+		{ "Data", "lsarpc.lsa_TrustDomainInfoBuffer.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditLogInfo_next_audit_record,
+		{ "Next Audit Record", "lsarpc.lsa_AuditLogInfo.next_audit_record", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfo_sid,
+		{ "Sid", "lsarpc.lsa_DomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids3_domains,
+		{ "Domains", "lsarpc.lsa_LookupSids3.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_DomainInfoKerberos_enforce_restrictions,
-	  { "Enforce Restrictions", "lsarpc.lsa_DomainInfoKerberos.enforce_restrictions", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QosInfo_context_mode,
-	  { "Context Mode", "lsarpc.lsa_QosInfo.context_mode", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumPrivs_handle,
-	  { "Handle", "lsarpc.lsa_EnumPrivs.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames3_names,
-	  { "Names", "lsarpc.lsa_LookupNames3.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditLogInfo_unknown,
-	  { "Unknown", "lsarpc.lsa_AuditLogInfo.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AddPrivilegesToAccount_privs,
-	  { "Privs", "lsarpc.lsa_AddPrivilegesToAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustRecord_unknown,
-	  { "Unknown", "lsarpc.lsa_ForestTrustRecord.unknown", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid_rid,
-	  { "Rid", "lsarpc.lsa_TranslatedSid.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AddAccountRights_handle,
-	  { "Handle", "lsarpc.lsa_AddAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TransSidArray_sids,
-	  { "Sids", "lsarpc.lsa_TransSidArray.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LUID_high,
-	  { "High", "lsarpc.lsa_LUID.high", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ReplicaSourceInfo_source,
-	  { "Source", "lsarpc.lsa_ReplicaSourceInfo.source", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames4_names,
-	  { "Names", "lsarpc.lsa_LookupNames4.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids2_unknown2,
-	  { "Unknown2", "lsarpc.lsa_LookupSids2.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_dom_sid,
-	  { "Dom Sid", "lsarpc.lsa_QueryTrustedDomainInfoBySid.dom_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames_domains,
-	  { "Domains", "lsarpc.lsa_LookupNames.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DefaultQuotaInfo_min_wss,
-	  { "Min Wss", "lsarpc.lsa_DefaultQuotaInfo.min_wss", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TransNameArray_count,
-	  { "Count", "lsarpc.lsa_TransNameArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustBinaryData_length,
-	  { "Length", "lsarpc.lsa_ForestTrustBinaryData.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustedDomainInfo_info_all,
-	  { "Info All", "lsarpc.lsa_TrustedDomainInfo.info_all", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoName_netbios_name,
-	  { "Netbios Name", "lsarpc.lsa_TrustDomainInfoName.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_info,
-	  { "Info", "lsarpc.lsa_QueryTrustedDomainInfoBySid.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Enforce Restrictions", "lsarpc.lsa_DomainInfoKerberos.enforce_restrictions", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedName2_sid_type,
+		{ "Sid Type", "lsarpc.lsa_TranslatedName2.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditLogInfo_time_to_shutdown,
+		{ "Time To Shutdown", "lsarpc.lsa_AuditLogInfo.time_to_shutdown", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION,
+		{ "Lsa Policy View Local Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_VIEW_LOCAL_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccountRights_handle,
+		{ "Handle", "lsarpc.lsa_EnumAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustDomainInfo_netbios_domain_name,
+		{ "Netbios Domain Name", "lsarpc.lsa_ForestTrustDomainInfo.netbios_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_level,
+		{ "Level", "lsarpc.lsa_QueryTrustedDomainInfoByName.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_CreateSecret_handle,
-	  { "Handle", "lsarpc.lsa_CreateSecret.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_handle,
-	  { "Handle", "lsarpc.lsa_LookupNames2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainList_count,
-	  { "Count", "lsarpc.lsa_DomainList.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustedDomainInfo_name,
-	  { "Name", "lsarpc.lsa_TrustedDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids2_level,
-	  { "Level", "lsarpc.lsa_LookupSids2.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetDomainInformationPolicy_level,
-	  { "Level", "lsarpc.lsa_SetDomainInformationPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_DomainInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccounts_num_entries,
-	  { "Num Entries", "lsarpc.lsa_EnumAccounts.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_previous_auth_info,
-	  { "Incoming Previous Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_previous_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoBasic_netbios_name,
-	  { "Netbios Name", "lsarpc.lsa_TrustDomainInfoBasic.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_domains,
-	  { "Domains", "lsarpc.lsa_LookupNames2.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE,
-	  { "Lsa Secret Query Value", "lsarpc.lsa_SecretAccessMask.LSA_SECRET_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RightAttribute_name,
-	  { "Name", "lsarpc.lsa_RightAttribute.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_replica,
-	  { "Replica", "lsarpc.lsa_PolicyInformation.replica", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AsciiString_length,
-	  { "Length", "lsarpc.lsa_AsciiString.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenAccount_handle,
-	  { "Handle", "lsarpc.lsa_OpenAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_CreateAccount_sid,
-	  { "Sid", "lsarpc.lsa_CreateAccount.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_String_length,
-	  { "Length", "lsarpc.lsa_String.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_GetUserName_account_name,
-	  { "Account Name", "lsarpc.lsa_GetUserName.account_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryInfoPolicy2_level,
-	  { "Level", "lsarpc.lsa_QueryInfoPolicy2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_dns,
-	  { "Dns", "lsarpc.lsa_PolicyInformation.dns", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Handle", "lsarpc.lsa_CreateSecret.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenAccount_acct_handle,
+		{ "Acct Handle", "lsarpc.lsa_OpenAccount.acct_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames3_domains,
+		{ "Domains", "lsarpc.lsa_LookupNames3.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_account_access_mask,
+		{ "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames_level,
+		{ "Level", "lsarpc.lsa_LookupNames.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoAll_auth_info,
+		{ "Auth Info", "lsarpc.lsa_TrustDomainInfoInfoAll.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenAccount_sid,
+		{ "Sid", "lsarpc.lsa_OpenAccount.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_LookupNames3_unknown2,
-	  { "Unknown2", "lsarpc.lsa_LookupNames3.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_direction,
-	  { "Trust Direction", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_direction", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids3_count,
-	  { "Count", "lsarpc.lsa_LookupSids3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown2", "lsarpc.lsa_LookupNames3.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivValue_name,
+		{ "Name", "lsarpc.lsa_LookupPrivValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_String_string,
+		{ "String", "lsarpc.lsa_String.string", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN,
+		{ "Lsa Policy Audit Log Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_AUDIT_LOG_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN_tfs), ( 0x00000200 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumTrustDom_handle,
+		{ "Handle", "lsarpc.lsa_EnumTrustDom.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenTrustedDomain_access_mask,
+		{ "Access Mask", "lsarpc.lsa_OpenTrustedDomain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames3_handle,
+		{ "Handle", "lsarpc.lsa_LookupNames3.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_sec_desc_buf_len,
+		{ "Sec Desc Buf Len", "lsarpc.sec_desc_buf_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumPrivsAccount_privs,
+		{ "Privs", "lsarpc.lsa_EnumPrivsAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid_sid_type,
+		{ "Sid Type", "lsarpc.lsa_TranslatedSid.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_domain_name,
+		{ "Domain Name", "lsarpc.lsa_TrustDomainInfoInfoEx.domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumTrustDom_domains,
+		{ "Domains", "lsarpc.lsa_EnumTrustDom.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccountRights_rights,
+		{ "Rights", "lsarpc.lsa_EnumAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids_handle,
+		{ "Handle", "lsarpc.lsa_LookupSids.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedName_sid_index,
+		{ "Sid Index", "lsarpc.lsa_TranslatedName.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX,
+		{ "Lsa Domain Set Posix", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_POSIX", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ObjectAttribute_root_dir,
+		{ "Root Dir", "lsarpc.lsa_ObjectAttribute.root_dir", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids3_level,
+		{ "Level", "lsarpc.lsa_LookupSids3.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfo11_info_ex,
+		{ "Info Ex", "lsarpc.lsa_TrustDomainInfo11.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccountsWithUserRight_name,
+		{ "Name", "lsarpc.lsa_EnumAccountsWithUserRight.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_auditfullset,
+		{ "Auditfullset", "lsarpc.lsa_PolicyInformation.auditfullset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TransSidArray3_sids,
-	  { "Sids", "lsarpc.lsa_TransSidArray3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetSecret_old_val,
-	  { "Old Val", "lsarpc.lsa_SetSecret.old_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_unknown,
-	  { "Unknown", "lsarpc.lsa_lsaRQueryForestTrustInformation.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_audit_log,
-	  { "Audit Log", "lsarpc.lsa_PolicyInformation.audit_log", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Sids", "lsarpc.lsa_TransSidArray3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivName_handle,
+		{ "Handle", "lsarpc.lsa_LookupPrivName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenPolicy2_attr,
+		{ "Attr", "lsarpc.lsa_OpenPolicy2.attr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TransSidArray3_count,
-	  { "Count", "lsarpc.lsa_TransSidArray3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME,
-	  { "Lsa Domain Query Domain Name", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_DOMAIN_NAME", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_GetUserName_system_name,
-	  { "System Name", "lsarpc.lsa_GetUserName.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetInfoPolicy_handle,
-	  { "Handle", "lsarpc.lsa_SetInfoPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustedDomainInfo_info_basic,
-	  { "Info Basic", "lsarpc.lsa_TrustedDomainInfo.info_basic", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH,
-	  { "Lsa Domain Set Auth", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_AUTH", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SidArray_sids,
-	  { "Sids", "lsarpc.lsa_SidArray.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids2_names,
-	  { "Names", "lsarpc.lsa_LookupSids2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_handle,
-	  { "Handle", "lsarpc.lsa_QueryTrustedDomainInfoByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids2_domains,
-	  { "Domains", "lsarpc.lsa_LookupSids2.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryInfoPolicy_handle,
-	  { "Handle", "lsarpc.lsa_QueryInfoPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION,
-	  { "Lsa Policy Get Private Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_GET_PRIVATE_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RightSet_names,
-	  { "Names", "lsarpc.lsa_RightSet.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QuerySecurity_sec_info,
-	  { "Sec Info", "lsarpc.lsa_QuerySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DnsDomainInfo_dns_forest,
-	  { "Dns Forest", "lsarpc.lsa_DnsDomainInfo.dns_forest", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Count", "lsarpc.lsa_TransSidArray3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfo_level,
+		{ "Level", "lsarpc.lsa_QueryTrustedDomainInfo.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfoEfs_blob_size,
+		{ "Blob Size", "lsarpc.lsa_DomainInfoEfs.blob_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_role,
+		{ "Role", "lsarpc.lsa_PolicyInformation.role", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids3_unknown1,
+		{ "Unknown1", "lsarpc.lsa_LookupSids3.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RightSet_count,
+		{ "Count", "lsarpc.lsa_RightSet.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfoKerberos_service_tkt_lifetime,
+		{ "Service Tkt Lifetime", "lsarpc.lsa_DomainInfoKerberos.service_tkt_lifetime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivDisplayName_name,
+		{ "Name", "lsarpc.lsa_LookupPrivDisplayName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustData_data,
+		{ "Data", "lsarpc.lsa_ForestTrustData.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoBasic_netbios_name,
+		{ "Netbios Name", "lsarpc.lsa_TrustDomainInfoBasic.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DeleteTrustedDomain_dom_sid,
+		{ "Dom Sid", "lsarpc.lsa_DeleteTrustedDomain.dom_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetSecret_old_val,
+		{ "Old Val", "lsarpc.lsa_SetSecret.old_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ObjectAttribute_sec_qos,
+		{ "Sec Qos", "lsarpc.lsa_ObjectAttribute.sec_qos", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames_names,
+		{ "Names", "lsarpc.lsa_LookupNames.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames_count,
+		{ "Count", "lsarpc.lsa_LookupNames.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedName_sid_type,
+		{ "Sid Type", "lsarpc.lsa_TranslatedName.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_QuerySecret_new_mtime,
-	  { "New Mtime", "lsarpc.lsa_QuerySecret.new_mtime", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid2_sid_type,
-	  { "Sid Type", "lsarpc.lsa_TranslatedSid2.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SidArray_num_sids,
-	  { "Num Sids", "lsarpc.lsa_SidArray.num_sids", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccountsWithUserRight_name,
-	  { "Name", "lsarpc.lsa_EnumAccountsWithUserRight.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditFullQueryInfo_log_is_full,
-	  { "Log Is Full", "lsarpc.lsa_AuditFullQueryInfo.log_is_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetInfoPolicy2_level,
-	  { "Level", "lsarpc.lsa_SetInfoPolicy2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccountsWithUserRight_handle,
-	  { "Handle", "lsarpc.lsa_EnumAccountsWithUserRight.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RemoveAccountRights_unknown,
-	  { "Unknown", "lsarpc.lsa_RemoveAccountRights.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid2_unknown,
-	  { "Unknown", "lsarpc.lsa_TranslatedSid2.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TransSidArray_count,
-	  { "Count", "lsarpc.lsa_TransSidArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_StringLarge_string,
-	  { "String", "lsarpc.lsa_StringLarge.string", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenAccount_acct_handle,
-	  { "Acct Handle", "lsarpc.lsa_OpenAccount.acct_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DefaultQuotaInfo_unknown,
-	  { "Unknown", "lsarpc.lsa_DefaultQuotaInfo.unknown", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TransNameArray2_names,
-	  { "Names", "lsarpc.lsa_TransNameArray2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "New Mtime", "lsarpc.lsa_QuerySecret.new_mtime", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustedDomainInfo_info_basic,
+		{ "Info Basic", "lsarpc.lsa_TrustedDomainInfo.info_basic", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS,
+		{ "Lsa Policy Set Default Quota Limits", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS_tfs), ( 0x00000080 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryInfoPolicy2_level,
+		{ "Level", "lsarpc.lsa_QueryInfoPolicy2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustData_top_level_name,
+		{ "Top Level Name", "lsarpc.lsa_ForestTrustData.top_level_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoName_netbios_name,
+		{ "Netbios Name", "lsarpc.lsa_TrustDomainInfoName.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QosInfo_impersonation_level,
+		{ "Impersonation Level", "lsarpc.lsa_QosInfo.impersonation_level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SecurityImpersonationLevel_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumTrustDom_max_size,
+		{ "Max Size", "lsarpc.lsa_EnumTrustDom.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames4_count,
+		{ "Count", "lsarpc.lsa_LookupNames4.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_handle,
+		{ "Handle", "lsarpc.lsa_lsaRQueryForestTrustInformation.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_ReplicaSourceInfo_account,
-	  { "Account", "lsarpc.lsa_ReplicaSourceInfo.account", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids_names,
-	  { "Names", "lsarpc.lsa_LookupSids.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustDomainInfo_domain_sid,
-	  { "Domain Sid", "lsarpc.lsa_ForestTrustDomainInfo.domain_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccountRights_rights,
-	  { "Rights", "lsarpc.lsa_EnumAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid3_sid_type,
-	  { "Sid Type", "lsarpc.lsa_TranslatedSid3.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QuerySecret_old_val,
-	  { "Old Val", "lsarpc.lsa_QuerySecret.old_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfo11_data1,
-	  { "Data1", "lsarpc.lsa_TrustDomainInfo11.data1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Account", "lsarpc.lsa_ReplicaSourceInfo.account", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateTrustedDomain_access_mask,
+		{ "Access Mask", "lsarpc.lsa_CreateTrustedDomain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DATA_BUF_data,
+		{ "Data", "lsarpc.lsa_DATA_BUF.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryDomainInformationPolicy_info,
+		{ "Info", "lsarpc.lsa_QueryDomainInformationPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateSecret_sec_handle,
+		{ "Sec Handle", "lsarpc.lsa_CreateSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH,
+		{ "Lsa Domain Query Auth", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_AUTH", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_account_domain,
+		{ "Account Domain", "lsarpc.lsa_PolicyInformation.account_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccountsWithUserRight_handle,
+		{ "Handle", "lsarpc.lsa_EnumAccountsWithUserRight.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_OpenSecret_handle,
-	  { "Handle", "lsarpc.lsa_OpenSecret.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditFullSetInfo_shutdown_on_full,
-	  { "Shutdown On Full", "lsarpc.lsa_AuditFullSetInfo.shutdown_on_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Handle", "lsarpc.lsa_OpenSecret.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DefaultQuotaInfo_min_wss,
+		{ "Min Wss", "lsarpc.lsa_DefaultQuotaInfo.min_wss", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_QueryDomainInformationPolicy_handle,
-	  { "Handle", "lsarpc.lsa_QueryDomainInformationPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryInfoPolicy_info,
-	  { "Info", "lsarpc.lsa_QueryInfoPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX,
-	  { "Lsa Domain Set Posix", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_POSIX", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenPolicy2_attr,
-	  { "Attr", "lsarpc.lsa_OpenPolicy2.attr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_unknown1,
-	  { "Unknown1", "lsarpc.lsa_LookupNames2.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_policy_access_mask,
-	  { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumAccountRights_handle,
-	  { "Handle", "lsarpc.lsa_EnumAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames3_level,
-	  { "Level", "lsarpc.lsa_LookupNames3.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH,
-	  { "Lsa Domain Query Auth", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_AUTH", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RemoveAccountRights_sid,
-	  { "Sid", "lsarpc.lsa_RemoveAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_auditfullquery,
-	  { "Auditfullquery", "lsarpc.lsa_PolicyInformation.auditfullquery", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditFullQueryInfo_unknown,
-	  { "Unknown", "lsarpc.lsa_AuditFullQueryInfo.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AsciiString_string,
-	  { "String", "lsarpc.lsa_AsciiString.string", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoBuffer_data,
-	  { "Data", "lsarpc.lsa_TrustDomainInfoBuffer.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PrivilegeSet_set,
-	  { "Set", "lsarpc.lsa_PrivilegeSet.set", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainInfoEfs_efs_blob,
-	  { "Efs Blob", "lsarpc.lsa_DomainInfoEfs.efs_blob", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LUIDAttribute_luid,
-	  { "Luid", "lsarpc.lsa_LUIDAttribute.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION,
-	  { "Lsa Policy View Audit Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_VIEW_AUDIT_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ForestTrustRecord_flags,
-	  { "Flags", "lsarpc.lsa_ForestTrustRecord.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_SetTrustedDomainInfoByName_trusted_domain,
-	  { "Trusted Domain", "lsarpc.lsa_SetTrustedDomainInfoByName.trusted_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids_count,
-	  { "Count", "lsarpc.lsa_LookupSids.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenAccount_access_mask,
-	  { "Access Mask", "lsarpc.lsa_OpenAccount.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Handle", "lsarpc.lsa_QueryDomainInformationPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids2_count,
+		{ "Count", "lsarpc.lsa_LookupSids2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RemoveAccountRights_unknown,
+		{ "Unknown", "lsarpc.lsa_RemoveAccountRights.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LUID_low,
+		{ "Low", "lsarpc.lsa_LUID.low", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfoKerberos_unknown6,
+		{ "Unknown6", "lsarpc.lsa_DomainInfoKerberos.unknown6", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids2_level,
+		{ "Level", "lsarpc.lsa_LookupSids2.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoFullInfo_info_ex,
+		{ "Info Ex", "lsarpc.lsa_TrustDomainInfoFullInfo.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids_sids,
+		{ "Sids", "lsarpc.lsa_LookupSids.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustRecord_forest_trust_data,
+		{ "Forest Trust Data", "lsarpc.lsa_ForestTrustRecord.forest_trust_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_trusted_domain,
+		{ "Trusted Domain", "lsarpc.lsa_QueryTrustedDomainInfoByName.trusted_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoPosixOffset_posix_offset,
+		{ "Posix Offset", "lsarpc.lsa_TrustDomainInfoPosixOffset.posix_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION,
+		{ "Lsa Policy Notification", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_NOTIFICATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION_tfs), ( 0x00001000 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivDisplayName_unknown,
+		{ "Unknown", "lsarpc.lsa_LookupPrivDisplayName.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DefaultQuotaInfo_non_paged_pool,
+		{ "Non Paged Pool", "lsarpc.lsa_DefaultQuotaInfo.non_paged_pool", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_GetUserName_authority_name,
+		{ "Authority Name", "lsarpc.lsa_GetUserName.authority_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumTrustDom_resume_handle,
+		{ "Resume Handle", "lsarpc.lsa_EnumTrustDom.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_previous_auth_info,
-	  { "Outgoing Previous Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_previous_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedSid2_rid,
-	  { "Rid", "lsarpc.lsa_TranslatedSid2.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames4_num_names,
-	  { "Num Names", "lsarpc.lsa_LookupNames4.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_names,
-	  { "Names", "lsarpc.lsa_LookupNames2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Outgoing Previous Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_previous_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumPrivs_max_count,
+		{ "Max Count", "lsarpc.lsa_EnumPrivs.max_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RemovePrivilegesFromAccount_handle,
+		{ "Handle", "lsarpc.lsa_RemovePrivilegesFromAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids3_count,
+		{ "Count", "lsarpc.lsa_LookupSids3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION,
+		{ "Lsa Policy View Audit Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_VIEW_AUDIT_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateAccount_sid,
+		{ "Sid", "lsarpc.lsa_CreateAccount.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumPrivs_privs,
+		{ "Privs", "lsarpc.lsa_EnumPrivs.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditFullQueryInfo_log_is_full,
+		{ "Log Is Full", "lsarpc.lsa_AuditFullQueryInfo.log_is_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SidArray_num_sids,
+		{ "Num Sids", "lsarpc.lsa_SidArray.num_sids", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PolicyInformation_audit_events,
+		{ "Audit Events", "lsarpc.lsa_PolicyInformation.audit_events", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_ForestTrustRecord_level,
-	  { "Level", "lsarpc.lsa_ForestTrustRecord.level", FT_UINT32, BASE_DEC, VALS(lsarpc_lsa_ForestTrustRecordType_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_RefDomainList_count,
-	  { "Count", "lsarpc.lsa_RefDomainList.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS,
-	  { "Lsa Domain Set Controllers", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_CONTROLLERS", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS_tfs), ( 0x00000004 ), NULL, HFILL }},
+		{ "Level", "lsarpc.lsa_ForestTrustRecord.level", FT_UINT32, BASE_DEC, VALS(lsarpc_lsa_ForestTrustRecordType_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoBasic_sid,
+		{ "Sid", "lsarpc.lsa_TrustDomainInfoBasic.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames4_names,
+		{ "Names", "lsarpc.lsa_LookupNames4.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AddPrivilegesToAccount_handle,
+		{ "Handle", "lsarpc.lsa_AddPrivilegesToAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivValue_handle,
+		{ "Handle", "lsarpc.lsa_LookupPrivValue.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_TrustedDomainInfo_posix_offset,
-	  { "Posix Offset", "lsarpc.lsa_TrustedDomainInfo.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenPolicy_access_mask,
-	  { "Access Mask", "lsarpc.lsa_OpenPolicy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TranslatedName2_unknown,
-	  { "Unknown", "lsarpc.lsa_TranslatedName2.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QosInfo_effective_only,
-	  { "Effective Only", "lsarpc.lsa_QosInfo.effective_only", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_AuditLogInfo_next_audit_record,
-	  { "Next Audit Record", "lsarpc.lsa_AuditLogInfo.next_audit_record", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Posix Offset", "lsarpc.lsa_TrustedDomainInfo.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenTrustedDomain_handle,
+		{ "Handle", "lsarpc.lsa_OpenTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ModificationInfo_modified_id,
+		{ "Modified Id", "lsarpc.lsa_ModificationInfo.modified_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenSecret_sec_handle,
+		{ "Sec Handle", "lsarpc.lsa_OpenSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ModificationInfo_db_create_time,
+		{ "Db Create Time", "lsarpc.lsa_ModificationInfo.db_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoBuffer_secret_type,
+		{ "Secret Type", "lsarpc.lsa_TrustDomainInfoBuffer.secret_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LUIDAttribute_luid,
+		{ "Luid", "lsarpc.lsa_LUIDAttribute.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PDAccountInfo_name,
+		{ "Name", "lsarpc.lsa_PDAccountInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupPrivDisplayName_language_id,
+		{ "Language Id", "lsarpc.lsa_LookupPrivDisplayName.language_id", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RemovePrivilegesFromAccount_privs,
+		{ "Privs", "lsarpc.lsa_RemovePrivilegesFromAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustDomainInfo_domain_sid,
+		{ "Domain Sid", "lsarpc.lsa_ForestTrustDomainInfo.domain_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid3_sid_type,
+		{ "Sid Type", "lsarpc.lsa_TranslatedSid3.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QuerySecret_old_mtime,
+		{ "Old Mtime", "lsarpc.lsa_QuerySecret.old_mtime", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids2_unknown2,
+		{ "Unknown2", "lsarpc.lsa_LookupSids2.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames3_names,
+		{ "Names", "lsarpc.lsa_LookupNames3.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DnsDomainInfo_dns_forest,
+		{ "Dns Forest", "lsarpc.lsa_DnsDomainInfo.dns_forest", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QuerySecurity_sec_info,
+		{ "Sec Info", "lsarpc.lsa_QuerySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_secret_access_mask,
+		{ "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TranslatedSid2_sid_index,
+		{ "Sid Index", "lsarpc.lsa_TranslatedSid2.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_domains,
+		{ "Domains", "lsarpc.lsa_LookupNames2.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainList_domains,
+		{ "Domains", "lsarpc.lsa_DomainList.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AsciiStringLarge_string,
+		{ "String", "lsarpc.lsa_AsciiStringLarge.string", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditFullQueryInfo_unknown,
+		{ "Unknown", "lsarpc.lsa_AuditFullQueryInfo.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetSecret_sec_handle,
+		{ "Sec Handle", "lsarpc.lsa_SetSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenPolicy2_handle,
+		{ "Handle", "lsarpc.lsa_OpenPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DnsDomainInfo_name,
+		{ "Name", "lsarpc.lsa_DnsDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS,
+		{ "Lsa Domain Query Controllers", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_CONTROLLERS", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames3_level,
+		{ "Level", "lsarpc.lsa_LookupNames3.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames4_domains,
+		{ "Domains", "lsarpc.lsa_LookupNames4.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames4_num_names,
+		{ "Num Names", "lsarpc.lsa_LookupNames4.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoFullInfo_auth_info,
+		{ "Auth Info", "lsarpc.lsa_TrustDomainInfoFullInfo.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QuerySecurity_handle,
+		{ "Handle", "lsarpc.lsa_QuerySecurity.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustData_top_level_name_ex,
+		{ "Top Level Name Ex", "lsarpc.lsa_ForestTrustData.top_level_name_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ServerRole_role,
+		{ "Role", "lsarpc.lsa_ServerRole.role", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyServerRole_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetInfoPolicy2_level,
+		{ "Level", "lsarpc.lsa_SetInfoPolicy2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_handle,
+		{ "Handle", "lsarpc.lsa_QueryTrustedDomainInfoByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenTrustedDomain_sid,
+		{ "Sid", "lsarpc.lsa_OpenTrustedDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames_handle,
+		{ "Handle", "lsarpc.lsa_LookupNames.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames2_unknown1,
+		{ "Unknown1", "lsarpc.lsa_LookupNames2.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ReplicaSourceInfo_source,
+		{ "Source", "lsarpc.lsa_ReplicaSourceInfo.source", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetSecret_new_val,
+		{ "New Val", "lsarpc.lsa_SetSecret.new_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_QosInfo_len,
-	  { "Len", "lsarpc.lsa_QosInfo.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_info,
-	  { "Info", "lsarpc.lsa_QueryTrustedDomainInfoByName.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Len", "lsarpc.lsa_QosInfo.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditFullQueryInfo_shutdown_on_full,
+		{ "Shutdown On Full", "lsarpc.lsa_AuditFullQueryInfo.shutdown_on_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_CreateAccount_acct_handle,
+		{ "Acct Handle", "lsarpc.lsa_CreateAccount.acct_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_ForestTrustData_domain_info,
-	  { "Domain Info", "lsarpc.lsa_ForestTrustData.domain_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QuerySecret_old_mtime,
-	  { "Old Mtime", "lsarpc.lsa_QuerySecret.old_mtime", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryTrustedDomainInfo_level,
-	  { "Level", "lsarpc.lsa_QueryTrustedDomainInfo.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION,
-	  { "Lsa Policy Notification", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_NOTIFICATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION_tfs), ( 0x00001000 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_QueryInfoPolicy2_handle,
-	  { "Handle", "lsarpc.lsa_QueryInfoPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames4_level,
-	  { "Level", "lsarpc.lsa_LookupNames4.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupSids2_handle,
-	  { "Handle", "lsarpc.lsa_LookupSids2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_TrustDomainInfoInfoEx_netbios_name,
-	  { "Netbios Name", "lsarpc.lsa_TrustDomainInfoInfoEx.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenAccount_sid,
-	  { "Sid", "lsarpc.lsa_OpenAccount.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Domain Info", "lsarpc.lsa_ForestTrustData.domain_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenTrustedDomainByName_name,
+		{ "Name", "lsarpc.lsa_OpenTrustedDomainByName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DnsDomainInfo_domain_guid,
+		{ "Domain Guid", "lsarpc.lsa_DnsDomainInfo.domain_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_previous_auth_info,
+		{ "Incoming Previous Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_previous_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ObjectAttribute_len,
+		{ "Len", "lsarpc.lsa_ObjectAttribute.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfoKerberos_clock_skew,
+		{ "Clock Skew", "lsarpc.lsa_DomainInfoKerberos.clock_skew", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_opnum,
+		{ "Operation", "lsarpc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TransSidArray_sids,
+		{ "Sids", "lsarpc.lsa_TransSidArray.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AsciiString_size,
+		{ "Size", "lsarpc.lsa_AsciiString.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_count,
+		{ "Incoming Count", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_renewaltime,
+		{ "User Tkt Renewaltime", "lsarpc.lsa_DomainInfoKerberos.user_tkt_renewaltime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_EnumAccounts_sids,
+		{ "Sids", "lsarpc.lsa_EnumAccounts.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainInformationPolicy_efs_info,
+		{ "Efs Info", "lsarpc.lsa_DomainInformationPolicy.efs_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetDomainInformationPolicy_level,
+		{ "Level", "lsarpc.lsa_SetDomainInformationPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_DomainInfoEnum_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PrivEntry_luid,
+		{ "Luid", "lsarpc.lsa_PrivEntry.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_RefDomainList_domains,
-	  { "Domains", "lsarpc.lsa_RefDomainList.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_String_name,
-	  { "String", "lsarpc.lsa.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_count,
-	  { "Count", "lsarpc.lsa_LookupNames2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_PolicyInformation_domain,
-	  { "Domain", "lsarpc.lsa_PolicyInformation.domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenPolicy2_handle,
-	  { "Handle", "lsarpc.lsa_OpenPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Domains", "lsarpc.lsa_RefDomainList.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_RemoveAccountRights_rights,
+		{ "Rights", "lsarpc.lsa_RemoveAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TrustDomainInfoInfoAll_info_ex,
+		{ "Info Ex", "lsarpc.lsa_TrustDomainInfoInfoAll.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TransSidArray_count,
+		{ "Count", "lsarpc.lsa_TransSidArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QosInfo_context_mode,
+		{ "Context Mode", "lsarpc.lsa_QosInfo.context_mode", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids_domains,
+		{ "Domains", "lsarpc.lsa_LookupSids.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_trusted_domain_name,
-	  { "Trusted Domain Name", "lsarpc.lsa_lsaRQueryForestTrustInformation.trusted_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupPrivDisplayName_disp_name,
-	  { "Disp Name", "lsarpc.lsa_LookupPrivDisplayName.disp_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames3_handle,
-	  { "Handle", "lsarpc.lsa_LookupNames3.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenSecret_name,
-	  { "Name", "lsarpc.lsa_OpenSecret.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames_handle,
-	  { "Handle", "lsarpc.lsa_LookupNames.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_LookupNames2_num_names,
-	  { "Num Names", "lsarpc.lsa_LookupNames2.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Trusted Domain Name", "lsarpc.lsa_lsaRQueryForestTrustInformation.trusted_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupNames3_sids,
+		{ "Sids", "lsarpc.lsa_LookupNames3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_LookupSids3_names,
+		{ "Names", "lsarpc.lsa_LookupSids3.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_forest_trust_info,
+		{ "Forest Trust Info", "lsarpc.lsa_lsaRQueryForestTrustInformation.forest_trust_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SetDomainInformationPolicy_info,
+		{ "Info", "lsarpc.lsa_SetDomainInformationPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PrivArray_count,
+		{ "Count", "lsarpc.lsa_PrivArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenTrustedDomainByName_access_mask,
+		{ "Access Mask", "lsarpc.lsa_OpenTrustedDomainByName.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE,
+		{ "Lsa Secret Query Value", "lsarpc.lsa_SecretAccessMask.LSA_SECRET_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_lsarpc_policy_access_mask,
+		{ "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_AuditEventsInfo_settings,
+		{ "Settings", "lsarpc.lsa_AuditEventsInfo.settings", FT_UINT32, BASE_DEC, VALS(lsarpc_lsa_PolicyAuditPolicy_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_PrivilegeSet_unknown,
+		{ "Unknown", "lsarpc.lsa_PrivilegeSet.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS,
-	  { "Lsa Account Adjust Quotas", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_QUOTAS", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_lsarpc_lsa_DefaultQuotaInfo_max_wss,
-	  { "Max Wss", "lsarpc.lsa_DefaultQuotaInfo.max_wss", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_ModificationInfo_modified_id,
-	  { "Modified Id", "lsarpc.lsa_ModificationInfo.modified_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_EnumTrustDom_max_size,
-	  { "Max Size", "lsarpc.lsa_EnumTrustDom.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenTrustedDomain_handle,
-	  { "Handle", "lsarpc.lsa_OpenTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_lsarpc_lsa_OpenPolicy2_access_mask,
-	  { "Access Mask", "lsarpc.lsa_OpenPolicy2.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Lsa Account Adjust Quotas", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_QUOTAS", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_lsarpc_lsa_QueryInfoPolicy_level,
+		{ "Level", "lsarpc.lsa_QueryInfoPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_TransSidArray2_count,
+		{ "Count", "lsarpc.lsa_TransSidArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DnsDomainInfo_dns_domain,
+		{ "Dns Domain", "lsarpc.lsa_DnsDomainInfo.dns_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_Strings_names,
+		{ "Names", "lsarpc.lsa_Strings.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_OpenSecret_name,
+		{ "Name", "lsarpc.lsa_OpenSecret.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_ForestTrustBinaryData_data,
+		{ "Data", "lsarpc.lsa_ForestTrustBinaryData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH,
+		{ "Lsa Domain Set Auth", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_AUTH", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH_tfs), ( 0x00000020 ), NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-mapi.c b/epan/dissectors/packet-dcerpc-mapi.c
index ebf53b72db..7bf69d8050 100644
--- a/epan/dissectors/packet-dcerpc-mapi.c
+++ b/epan/dissectors/packet-dcerpc-mapi.c
@@ -59,129 +59,129 @@ static gint ett_mapi_mapi_response = -1;
 
 
 /* Header field declarations */
-static gint hf_mapi_property_types = -1;
-static gint hf_mapi_mapi_response_mapi_len = -1;
-static gint hf_mapi_EcDoRpc_max_data = -1;
-static gint hf_mapi_EcDoRpc_mapi_response_ = -1;
-static gint hf_mapi_handle = -1;
-static gint hf_mapi_OpenMessage_recipients_recipients_headers = -1;
-static gint hf_mapi_SPropValue_CTR_d = -1;
-static gint hf_mapi_ulEventType_fnevCriticalError = -1;
-static gint hf_mapi_mapi_request_handles = -1;
-static gint hf_mapi_DATA_BLOB_data = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REQ_u = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_GetProps = -1;
-static gint hf_mapi_ulEventType_fnevReservedForMapi = -1;
-static gint hf_mapi_EcDoConnect_org_group = -1;
+static gint hf_mapi_ulEventType_fnevStatusObjectModified = -1;
 static gint hf_mapi_SPropValue_CTR_i = -1;
-static gint hf_mapi_mapi_request_length = -1;
-static gint hf_mapi_EcDoConnect_store_version = -1;
-static gint hf_mapi_mapi_response_length = -1;
-static gint hf_mapi_EcDoRpc_length = -1;
-static gint hf_mapi_SPropValue_CTR_ft = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_OpenFolder = -1;
-static gint hf_mapi_EcDoConnect_unknown1 = -1;
-static gint hf_mapi_recipient_type_SMTP = -1;
-static gint hf_mapi_FILETIME_dwHighDateTime = -1;
+static gint hf_mapi_RecipExchange_organization_length = -1;
+static gint hf_mapi_OpenMessage_req_max_data = -1;
+static gint hf_mapi_DATA_BLOB_data = -1;
 static gint hf_mapi_OpenMessage_recipients_recipients_headers_ = -1;
-static gint hf_mapi_EcRRegisterPushNotification_sockaddr_len = -1;
+static gint hf_mapi_EcDoRpc_length = -1;
 static gint hf_mapi_OpenFolder_req_folder_id = -1;
-static gint hf_mapi_EcRRegisterPushNotification_sockaddr = -1;
-static gint hf_mapi_SPropValue_CTR_err = -1;
-static gint hf_mapi_ulEventType_fnevStatusObjectModified = -1;
-static gint hf_mapi_ulEventType_fnevObjectCopied = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REPL_u = -1;
-static gint hf_mapi_SPropValue_CTR_lpszA = -1;
-static gint hf_mapi_EcDoRpc_offset = -1;
-static gint hf_mapi_EcDoRpc_mapi_response = -1;
-static gint hf_mapi_OpenMessage_recipients_RecipClass = -1;
-static gint hf_mapi_FILETIME_dwLowDateTime = -1;
-static gint hf_mapi_GetProps_req_properties = -1;
-static gint hf_mapi_EcRRegisterPushNotification_ulEventMask = -1;
-static gint hf_mapi_OpenMessage_req_message_id = -1;
-static gint hf_mapi_SPropValue_CTR_l = -1;
-static gint hf_mapi_input_locale_language = -1;
-static gint hf_mapi_OpenFolder_req_unknown = -1;
+static gint hf_mapi_mapi_request_length = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_OpenFolder = -1;
+static gint hf_mapi_ulEventType_fnevNewMail = -1;
 static gint hf_mapi_SPropValue_CTR_lpguid = -1;
-static gint hf_mapi_EcDoConnect_unknown3 = -1;
-static gint hf_mapi_recipients_headers_prop_count = -1;
+static gint hf_mapi_GetProps_req_properties = -1;
+static gint hf_mapi_EcDoRpc_max_data = -1;
 static gint hf_mapi_OpenMessage_req_folder_handle_idx = -1;
-static gint hf_mapi_OpenMsgStore_req_padding = -1;
-static gint hf_mapi_GetProps_req_unknown = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REQ_mapi_flags = -1;
-static gint hf_mapi_EcRRegisterPushNotification_notifkey = -1;
-static gint hf_mapi_mapi_request_mapi_req = -1;
-static gint hf_mapi_OpenMsgStore_req_codepage = -1;
-static gint hf_mapi_EcDoConnect_code_page = -1;
+static gint hf_mapi_SPropValue_CTR_ft = -1;
 static gint hf_mapi_recipients_headers_username = -1;
-static gint hf_mapi_OpenMessage_req_max_data = -1;
-static gint hf_mapi_OpenMsgStore_req_mailbox = -1;
+static gint hf_mapi_ulEventType_fnevObjectModified = -1;
 static gint hf_mapi_EcDoConnect_emsmdb_client_version = -1;
-static gint hf_mapi_GetProps_repl_layout = -1;
-static gint hf_mapi_EcDoRpc_mapi_request_ = -1;
-static gint hf_mapi_EcDoConnect_unknown4 = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REPL_error_code = -1;
-static gint hf_mapi_opnum = -1;
-static gint hf_mapi_recipients_headers_bitmask = -1;
+static gint hf_mapi_SPropValue_CTR_b = -1;
+static gint hf_mapi_mapi_request_mapi_len = -1;
+static gint hf_mapi_EcRRegisterPushNotification_ulEventMask = -1;
+static gint hf_mapi_recipient_displayname_7bit_lpszA = -1;
+static gint hf_mapi_GetProps_req_unknown = -1;
+static gint hf_mapi_EcRRegisterPushNotification_sockaddr_len = -1;
+static gint hf_mapi_GetProps_repl_prop_data = -1;
 static gint hf_mapi_mapi_response_handles = -1;
-static gint hf_mapi_OpenFolder_req_handle_idx = -1;
-static gint hf_mapi_EcDoConnect_name = -1;
-static gint hf_mapi_EcDoConnect_user = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_GetProps = -1;
-static gint hf_mapi_SPropValue_CTR_dbl = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_Release = -1;
-static gint hf_mapi_EcDoRpc_size = -1;
-static gint hf_mapi_ulEventType_fnevObjectDeleted = -1;
-static gint hf_mapi_EcDoConnect_unknown2 = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_Release = -1;
-static gint hf_mapi_OpenMessage_recipients_codepage = -1;
-static gint hf_mapi_recipients_headers_prop_values = -1;
-static gint hf_mapi_pdu_len = -1;
-static gint hf_mapi_OpenFolder_repl_unknown = -1;
-static gint hf_mapi_RecipExchange_organization_length = -1;
 static gint hf_mapi_DATA_BLOB_length = -1;
+static gint hf_mapi_OpenFolder_repl_unknown = -1;
 static gint hf_mapi_EcRRegisterPushNotification_notif_len = -1;
-static gint hf_mapi_GetProps_repl_prop_data = -1;
-static gint hf_mapi_EcRUnregisterPushNotification_unknown = -1;
-static gint hf_mapi_ulEventType_fnevObjectCreated = -1;
-static gint hf_mapi_OpenMessage_req_message_permissions = -1;
-static gint hf_mapi_EcDoConnect_input_locale = -1;
-static gint hf_mapi_GetProps_req_prop_count = -1;
-static gint hf_mapi_RecipExchange_addr_type = -1;
-static gint hf_mapi_EcRRegisterPushNotification_unknown2 = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REPL_opnum = -1;
+static gint hf_mapi_recipients_headers_layout = -1;
+static gint hf_mapi_EcDoConnect_unknown1 = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REPL_u = -1;
 static gint hf_mapi_SPropValue_CTR_lpszW = -1;
-static gint hf_mapi_ulEventType_fnevTableModified = -1;
-static gint hf_mapi_SPropValue_ulPropTag = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_OpenMsgStore = -1;
-static gint hf_mapi_SPropValue_CTR_b = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REPL_handle_idx = -1;
-static gint hf_mapi_ulEventType_fnevNewMail = -1;
-static gint hf_mapi_input_locale_method = -1;
-static gint hf_mapi_ulEventType_fnevSearchComplete = -1;
-static gint hf_mapi_MAPI_OPNUM = -1;
-static gint hf_mapi_EcDoConnect_alloc_space = -1;
+static gint hf_mapi_handle = -1;
+static gint hf_mapi_SPropValue_CTR_lpszA = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_GetProps = -1;
+static gint hf_mapi_EcDoConnect_name = -1;
+static gint hf_mapi_OpenFolder_req_unknown = -1;
+static gint hf_mapi_input_locale_language = -1;
+static gint hf_mapi_recipients_headers_prop_values = -1;
+static gint hf_mapi_OpenMessage_recipients_recipients_headers = -1;
+static gint hf_mapi_opnum = -1;
 static gint hf_mapi_EcRRegisterPushNotification_retval = -1;
-static gint hf_mapi_OpenMsgStore_req_mailbox_str_size = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_Release = -1;
 static gint hf_mapi_decrypted_data = -1;
+static gint hf_mapi_mapi_request_mapi_req = -1;
+static gint hf_mapi_RecipExchange_addr_type = -1;
+static gint hf_mapi_SPropValue_CTR_dbl = -1;
+static gint hf_mapi_OpenMsgStore_req_mailbox = -1;
+static gint hf_mapi_EcDoRpc_mapi_response = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REPL_error_code = -1;
+static gint hf_mapi_OpenMessage_req_message_permissions = -1;
+static gint hf_mapi_ulEventType_fnevSearchComplete = -1;
+static gint hf_mapi_EcDoRpc_size = -1;
+static gint hf_mapi_recipient_type_SMTP = -1;
 static gint hf_mapi_OpenMessage_req_folder_id = -1;
-static gint hf_mapi_recipient_displayname_7bit_lpszA = -1;
-static gint hf_mapi_ulEventType_fnevObjectMoved = -1;
-static gint hf_mapi_mapi_request_mapi_len = -1;
-static gint hf_mapi_ulEventType_fnevObjectModified = -1;
-static gint hf_mapi_MAPISTATUS_status = -1;
-static gint hf_mapi_recipient_type_EXCHANGE = -1;
-static gint hf_mapi_EcDoRpc_MAPI_REQ_handle_idx = -1;
+static gint hf_mapi_SPropValue_ulPropTag = -1;
 static gint hf_mapi_mapi_response_mapi_repl = -1;
-static gint hf_mapi_EcDoRpc_mapi_request = -1;
-static gint hf_mapi_LPSTR_lppszA = -1;
+static gint hf_mapi_EcDoConnect_org_group = -1;
+static gint hf_mapi_EcDoRpc_mapi_response_ = -1;
+static gint hf_mapi_mapi_response_length = -1;
 static gint hf_mapi_recipient_type = -1;
+static gint hf_mapi_EcRRegisterPushNotification_notifkey = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REQ_u = -1;
 static gint hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_OpenFolder = -1;
+static gint hf_mapi_recipients_headers_prop_count = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_GetProps = -1;
+static gint hf_mapi_mapi_request_handles = -1;
+static gint hf_mapi_EcDoConnect_input_locale = -1;
+static gint hf_mapi_GetProps_req_prop_count = -1;
+static gint hf_mapi_ulEventType_fnevReservedForMapi = -1;
+static gint hf_mapi_OpenMsgStore_req_codepage = -1;
+static gint hf_mapi_LPSTR_lppszA = -1;
+static gint hf_mapi_EcDoRpc_mapi_request_ = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REPL_handle_idx = -1;
+static gint hf_mapi_EcRRegisterPushNotification_unknown2 = -1;
+static gint hf_mapi_SPropValue_CTR_err = -1;
+static gint hf_mapi_EcRRegisterPushNotification_sockaddr = -1;
+static gint hf_mapi_recipient_type_EXCHANGE = -1;
+static gint hf_mapi_OpenFolder_req_handle_idx = -1;
+static gint hf_mapi_SPropValue_CTR_d = -1;
+static gint hf_mapi_EcDoConnect_unknown2 = -1;
+static gint hf_mapi_ulEventType_fnevObjectMoved = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_Release = -1;
+static gint hf_mapi_mapi_response_mapi_len = -1;
+static gint hf_mapi_ulEventType_fnevObjectCopied = -1;
+static gint hf_mapi_ulEventType_fnevCriticalError = -1;
+static gint hf_mapi_FILETIME_dwHighDateTime = -1;
+static gint hf_mapi_EcDoConnect_alloc_space = -1;
+static gint hf_mapi_property_types = -1;
+static gint hf_mapi_OpenMsgStore_req_mailbox_str_size = -1;
+static gint hf_mapi_OpenMessage_recipients_RecipClass = -1;
 static gint hf_mapi_EcDoConnect_session_nb = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REQ_handle_idx = -1;
+static gint hf_mapi_ulEventType_fnevTableModified = -1;
+static gint hf_mapi_OpenMsgStore_req_padding = -1;
+static gint hf_mapi_GetProps_repl_layout = -1;
+static gint hf_mapi_EcDoConnect_code_page = -1;
+static gint hf_mapi_EcDoConnect_unknown3 = -1;
+static gint hf_mapi_OpenMessage_req_message_id = -1;
+static gint hf_mapi_OpenMessage_recipients_codepage = -1;
+static gint hf_mapi_EcRUnregisterPushNotification_unknown = -1;
+static gint hf_mapi_EcDoRpc_mapi_request = -1;
+static gint hf_mapi_ulEventType_fnevObjectCreated = -1;
+static gint hf_mapi_EcDoConnect_store_version = -1;
+static gint hf_mapi_EcDoRpc_offset = -1;
+static gint hf_mapi_SRow_ulRowFlags = -1;
+static gint hf_mapi_MAPI_OPNUM = -1;
 static gint hf_mapi_ulEventType_fnevExtended = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REPL_opnum = -1;
+static gint hf_mapi_ulEventType_fnevObjectDeleted = -1;
+static gint hf_mapi_FILETIME_dwLowDateTime = -1;
 static gint hf_mapi_OpenMsgStore_req_row = -1;
-static gint hf_mapi_SRow_ulRowFlags = -1;
-static gint hf_mapi_recipients_headers_layout = -1;
+static gint hf_mapi_pdu_len = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_OpenMsgStore = -1;
+static gint hf_mapi_input_locale_method = -1;
+static gint hf_mapi_SPropValue_CTR_l = -1;
+static gint hf_mapi_recipients_headers_bitmask = -1;
+static gint hf_mapi_EcDoConnect_user = -1;
+static gint hf_mapi_EcDoConnect_unknown4 = -1;
+static gint hf_mapi_EcDoRpc_MAPI_REQ_mapi_flags = -1;
+static gint hf_mapi_MAPISTATUS_status = -1;
 
 static gint proto_dcerpc_mapi = -1;
 /* Version information */
@@ -4030,12 +4030,10 @@ static int mapi_dissect_element_request_handles_cnf(tvbuff_t *tvb _U_, int offse
 	gint		handles_cnt = 0;
 	int		old_offset;
 	guint32		value;
-	proto_item	*it = NULL;
 	proto_tree	*tr = NULL;
 	reported_len = tvb_reported_length_remaining(tvb, offset);
 	handles_cnt = reported_len / 4;
-	it = proto_tree_add_text(tree, tvb, offset, reported_len, "MAPI Handles: %d", handles_cnt);
-	tr = proto_item_add_subtree(it, ett_mapi_mapi_request);
+	tr = proto_tree_add_subtree_format(tree, tvb, offset, reported_len, ett_mapi_mapi_request, NULL, "MAPI Handles: %d", handles_cnt);
 	for (i = 0; i < handles_cnt; i++) {
 	    old_offset = offset;
 	    value = tvb_get_letohl(tvb, offset);
@@ -7962,15 +7960,15 @@ mapi_dissect_enum_property_types(tvbuff_t *tvb _U_, int offset _U_, packet_info
 }
 
 
-/* IDL: [flag(LIBNDR_FLAG_NOALIGN)] [switch_type(property_types)] union { */
+/* IDL: [switch_type(property_types)] [flag(LIBNDR_FLAG_NOALIGN)] union { */
 /* IDL: [case(PT_I2)] [case(PT_I2)] uint16 i; */
 /* IDL: [case(PT_LONG)] [case(PT_LONG)] uint32 l; */
 /* IDL: [case(PT_DOUBLE)] [case(PT_DOUBLE)] dlong dbl; */
 /* IDL: [case(PT_ERROR)] [case(PT_ERROR)] uint32 err; */
 /* IDL: [case(PT_BOOLEAN)] [case(PT_BOOLEAN)] uint8 b; */
 /* IDL: [case(PT_I8)] [case(PT_I8)] dlong d; */
-/* IDL: [case(PT_STRING8)] [flag(LIBNDR_FLAG_STR_ASCII|LIBNDR_FLAG_STR_NULLTERM)] [case(PT_STRING8)] string lpszA; */
-/* IDL: [case(PT_UNICODE)] [case(PT_UNICODE)] [flag(LIBNDR_FLAG_STR_NULLTERM)] string lpszW; */
+/* IDL: [case(PT_STRING8)] [case(PT_STRING8)] [flag(LIBNDR_FLAG_STR_ASCII|LIBNDR_FLAG_STR_NULLTERM)] string lpszA; */
+/* IDL: [case(PT_UNICODE)] [flag(LIBNDR_FLAG_STR_NULLTERM)] [case(PT_UNICODE)] string lpszW; */
 /* IDL: [case(PT_SYSTIME)] [case(PT_SYSTIME)] FILETIME ft; */
 /* IDL: [case(PT_CLSID)] [case(PT_CLSID)] GUID lpguid; */
 /* IDL: } */
@@ -8065,8 +8063,7 @@ mapi_dissect_SPropValue_CTR(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "SPropValue_CTR");
-		tree = proto_item_add_subtree(item, ett_mapi_SPropValue_CTR);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_mapi_SPropValue_CTR, &item, "SPropValue_CTR");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -8650,7 +8647,7 @@ mapi_dissect_enum_OM_recipient_type(tvbuff_t *tvb _U_, int offset _U_, packet_in
 }
 
 
-/* IDL: [flag(LIBNDR_FLAG_NOALIGN)] [switch_type(OM_recipient_type)] union { */
+/* IDL: [switch_type(OM_recipient_type)] [flag(LIBNDR_FLAG_NOALIGN)] union { */
 /* IDL: [case(0x0)] [case(0x0)] RecipExchange EXCHANGE; */
 /* IDL: [case(0xA)] [case(0xA)] RecipSMTP SMTP; */
 /* IDL: [default] ; */
@@ -8682,8 +8679,7 @@ mapi_dissect_recipient_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "recipient_type");
-		tree = proto_item_add_subtree(item, ett_mapi_recipient_type);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_mapi_recipient_type, &item, "recipient_type");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -8724,8 +8720,8 @@ mapi_dissect_enum_OM_recipient_displayname_7bit(tvbuff_t *tvb _U_, int offset _U
 }
 
 
-/* IDL: [switch_type(OM_recipient_displayname_7bit)] [flag(LIBNDR_FLAG_NOALIGN)] union { */
-/* IDL: [case(0x400)] [flag(LIBNDR_FLAG_STR_ASCII|LIBNDR_FLAG_STR_NULLTERM)] [case(0x400)] string lpszA; */
+/* IDL: [flag(LIBNDR_FLAG_NOALIGN)] [switch_type(OM_recipient_displayname_7bit)] union { */
+/* IDL: [case(0x400)] [case(0x400)] [flag(LIBNDR_FLAG_STR_ASCII|LIBNDR_FLAG_STR_NULLTERM)] string lpszA; */
 /* IDL: [default] ; */
 /* IDL: } */
 
@@ -8747,8 +8743,7 @@ mapi_dissect_recipient_displayname_7bit(tvbuff_t *tvb _U_, int offset _U_, packe
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "recipient_displayname_7bit");
-		tree = proto_item_add_subtree(item, ett_mapi_recipient_displayname_7bit);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_mapi_recipient_displayname_7bit, &item, "recipient_displayname_7bit");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -9221,7 +9216,7 @@ mapi_dissect_bitmap_ulEventType(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 /* IDL: 	uint32 padding; */
 /* IDL: 	uint8 row; */
 /* IDL: 	uint16 mailbox_str_size; */
-/* IDL: 	[unique(1)] [charset(DOS)] uint8 *mailbox; */
+/* IDL: 	[charset(DOS)] [unique(1)] uint8 *mailbox; */
 /* IDL: } */
 
 static int
@@ -9361,8 +9356,7 @@ mapi_dissect_EcDoRpc_MAPI_REQ_UNION(tvbuff_t *tvb _U_, int offset _U_, packet_in
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "EcDoRpc_MAPI_REQ_UNION");
-		tree = proto_item_add_subtree(item, ett_mapi_EcDoRpc_MAPI_REQ_UNION);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_mapi_EcDoRpc_MAPI_REQ_UNION, &item, "EcDoRpc_MAPI_REQ_UNION");
 	}
 
 	offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -9391,7 +9385,7 @@ mapi_dissect_EcDoRpc_MAPI_REQ_UNION(tvbuff_t *tvb _U_, int offset _U_, packet_in
 	return offset;
 }
 
-/* IDL: [switch_type(MAPI_OPNUM)] [public(1)] union { */
+/* IDL: [public(1)] [switch_type(MAPI_OPNUM)] union { */
 /* IDL: [case(op_MAPI_Release)] [case(op_MAPI_Release)] Release_repl mapi_Release; */
 /* IDL: [case(op_MAPI_OpenFolder)] [case(op_MAPI_OpenFolder)] OpenFolder_repl mapi_OpenFolder; */
 /* IDL: [case(op_MAPI_GetProps)] [case(op_MAPI_GetProps)] GetProps_repl mapi_GetProps; */
@@ -9431,8 +9425,7 @@ mapi_dissect_EcDoRpc_MAPI_REPL_UNION(tvbuff_t *tvb _U_, int offset _U_, packet_i
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "EcDoRpc_MAPI_REPL_UNION");
-		tree = proto_item_add_subtree(item, ett_mapi_EcDoRpc_MAPI_REPL_UNION);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_mapi_EcDoRpc_MAPI_REPL_UNION, &item, "EcDoRpc_MAPI_REPL_UNION");
 	}
 
 	offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -10004,12 +9997,12 @@ mapi_dissect_element_EcDoConnect_alloc_space_(tvbuff_t *tvb _U_, int offset _U_,
 /* IDL: [in] uint32 unknown2, */
 /* IDL: [in] uint16 unknown3, */
 /* IDL: [out] uint32 unknown4[3], */
-/* IDL: [out] [ref] uint16 *session_nb, */
-/* IDL: [unique(1)] [out] uint8 *org_group, */
+/* IDL: [ref] [out] uint16 *session_nb, */
+/* IDL: [out] [unique(1)] uint8 *org_group, */
 /* IDL: [out] [unique(1)] uint8 *user, */
 /* IDL: [out] uint16 store_version[3], */
 /* IDL: [out] [in] uint16 emsmdb_client_version[3], */
-/* IDL: [in] [ref] [out] uint32 *alloc_space */
+/* IDL: [ref] [in] [out] uint32 *alloc_space */
 /* IDL: ); */
 
 static int
@@ -10089,7 +10082,7 @@ mapi_dissect_element_EcDoDisconnect_handle_(tvbuff_t *tvb _U_, int offset _U_, p
 }
 
 /* IDL: MAPISTATUS EcDoDisconnect( */
-/* IDL: [ref] [out] [in] policy_handle *handle */
+/* IDL: [out] [in] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -10246,12 +10239,12 @@ mapi_dissect_element_EcDoRpc_max_data(tvbuff_t *tvb _U_, int offset _U_, packet_
 }
 
 /* IDL: MAPISTATUS EcDoRpc( */
-/* IDL: [in] [ref] [out] policy_handle *handle, */
+/* IDL: [out] [ref] [in] policy_handle *handle, */
 /* IDL: [in] [out] uint32 size, */
 /* IDL: [in] [out] uint32 offset, */
-/* IDL: [ref] [flag(LIBNDR_FLAG_REMAINING|LIBNDR_FLAG_NOALIGN)] [in] [subcontext(4)] mapi_request *mapi_request, */
-/* IDL: [flag(LIBNDR_FLAG_REMAINING|LIBNDR_FLAG_NOALIGN)] [subcontext(4)] [out] [ref] mapi_response *mapi_response, */
-/* IDL: [in] [ref] [out] uint16 *length, */
+/* IDL: [flag(LIBNDR_FLAG_REMAINING|LIBNDR_FLAG_NOALIGN)] [in] [ref] [subcontext(4)] mapi_request *mapi_request, */
+/* IDL: [subcontext(4)] [out] [ref] [flag(LIBNDR_FLAG_REMAINING|LIBNDR_FLAG_NOALIGN)] mapi_response *mapi_response, */
+/* IDL: [out] [in] [ref] uint16 *length, */
 /* IDL: [in] uint16 max_data */
 /* IDL: ); */
 
@@ -10417,14 +10410,14 @@ mapi_dissect_element_EcRRegisterPushNotification_retval_(tvbuff_t *tvb _U_, int
 }
 
 /* IDL: MAPISTATUS EcRRegisterPushNotification( */
-/* IDL: [in] [out] [ref] policy_handle *handle, */
+/* IDL: [in] [ref] [out] policy_handle *handle, */
 /* IDL: [in] ulEventType ulEventMask, */
-/* IDL: [in] [size_is(notif_len)] uint8 notifkey[*], */
+/* IDL: [size_is(notif_len)] [in] uint8 notifkey[*], */
 /* IDL: [in] uint16 notif_len, */
 /* IDL: [in] uint32 unknown2, */
 /* IDL: [size_is(sockaddr_len)] [in] uint8 sockaddr[*], */
 /* IDL: [in] uint16 sockaddr_len, */
-/* IDL: [out] [ref] uint32 *retval */
+/* IDL: [ref] [out] uint32 *retval */
 /* IDL: ); */
 
 static int
@@ -10502,7 +10495,7 @@ mapi_dissect_element_EcRUnregisterPushNotification_unknown_(tvbuff_t *tvb _U_, i
 }
 
 /* IDL: MAPISTATUS EcRUnregisterPushNotification( */
-/* IDL: [ref] [out] [in] policy_handle *handle, */
+/* IDL: [in] [ref] [out] policy_handle *handle, */
 /* IDL: [in] uint32 unknown[2] */
 /* IDL: ); */
 
@@ -10633,252 +10626,252 @@ static dcerpc_sub_dissector mapi_dissectors[] = {
 void proto_register_dcerpc_mapi(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_mapi_property_types,
-	  { "Value", "mapi.SPropValue.value", FT_UINT32, BASE_HEX, VALS(mapi_property_types_vals), 0, "NULL", HFILL }},
-	{ &hf_mapi_mapi_response_mapi_len,
-	  { "Mapi Len", "mapi.mapi_response.mapi_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_max_data,
-	  { "Max Data", "mapi.EcDoRpc.max_data", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_mapi_response_,
-	  { "Subcontext length", "mapi.EcDoRpc.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_handle,
-	  { "Handle", "mapi.handle", FT_BYTES, BASE_NONE, NULL, 0, "NULL", HFILL }},
-	{ &hf_mapi_OpenMessage_recipients_recipients_headers,
-	  { "Recipients Headers", "mapi.OpenMessage_recipients.recipients_headers", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_SPropValue_CTR_d,
-	  { "D", "mapi.SPropValue_CTR.d", FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevCriticalError,
-	  { "Fnevcriticalerror", "mapi.ulEventType.fnevCriticalError", FT_BOOLEAN, 16, TFS(&ulEventType_fnevCriticalError_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_mapi_mapi_request_handles,
-	  { "Handles", "mapi.mapi_request.handles", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_DATA_BLOB_data,
-	  { "Data", "mapi.DATA_BLOB.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REQ_u,
-	  { "U", "mapi.EcDoRpc_MAPI_REQ.u", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_GetProps,
-	  { "Mapi Getprops", "mapi.EcDoRpc_MAPI_REPL_UNION.mapi_GetProps", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevReservedForMapi,
-	  { "Fnevreservedformapi", "mapi.ulEventType.fnevReservedForMapi", FT_BOOLEAN, 16, TFS(&ulEventType_fnevReservedForMapi_tfs), ( 0x40000000 ), NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_org_group,
-	  { "Org Group", "mapi.EcDoConnect.org_group", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevStatusObjectModified,
+		{ "Fnevstatusobjectmodified", "mapi.ulEventType.fnevStatusObjectModified", FT_BOOLEAN, 16, TFS(&ulEventType_fnevStatusObjectModified_tfs), ( 0x00000200 ), NULL, HFILL }},
 	{ &hf_mapi_SPropValue_CTR_i,
-	  { "I", "mapi.SPropValue_CTR.i", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_mapi_request_length,
-	  { "Length", "mapi.mapi_request.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_store_version,
-	  { "Store Version", "mapi.EcDoConnect.store_version", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_mapi_response_length,
-	  { "Length", "mapi.mapi_response.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_length,
-	  { "Length", "mapi.EcDoRpc.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_SPropValue_CTR_ft,
-	  { "Ft", "mapi.SPropValue_CTR.ft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_OpenFolder,
-	  { "Mapi Openfolder", "mapi.EcDoRpc_MAPI_REPL_UNION.mapi_OpenFolder", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_unknown1,
-	  { "Unknown1", "mapi.EcDoConnect.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_recipient_type_SMTP,
-	  { "Smtp", "mapi.recipient_type.SMTP", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_FILETIME_dwHighDateTime,
-	  { "Dwhighdatetime", "mapi.FILETIME.dwHighDateTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "I", "mapi.SPropValue_CTR.i", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_RecipExchange_organization_length,
+		{ "Organization Length", "mapi.RecipExchange.organization_length", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenMessage_req_max_data,
+		{ "Max Data", "mapi.OpenMessage_req.max_data", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_DATA_BLOB_data,
+		{ "Data", "mapi.DATA_BLOB.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_OpenMessage_recipients_recipients_headers_,
-	  { "Subcontext length", "mapi.OpenMessage_recipients.subcontext", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcRRegisterPushNotification_sockaddr_len,
-	  { "Sockaddr Len", "mapi.EcRRegisterPushNotification.sockaddr_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Subcontext length", "mapi.OpenMessage_recipients.subcontext", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_length,
+		{ "Length", "mapi.EcDoRpc.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_OpenFolder_req_folder_id,
-	  { "Folder Id", "mapi.OpenFolder_req.folder_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcRRegisterPushNotification_sockaddr,
-	  { "Sockaddr", "mapi.EcRRegisterPushNotification.sockaddr", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_SPropValue_CTR_err,
-	  { "Err", "mapi.SPropValue_CTR.err", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevStatusObjectModified,
-	  { "Fnevstatusobjectmodified", "mapi.ulEventType.fnevStatusObjectModified", FT_BOOLEAN, 16, TFS(&ulEventType_fnevStatusObjectModified_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevObjectCopied,
-	  { "Fnevobjectcopied", "mapi.ulEventType.fnevObjectCopied", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectCopied_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REPL_u,
-	  { "U", "mapi.EcDoRpc_MAPI_REPL.u", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_SPropValue_CTR_lpszA,
-	  { "Lpsza", "mapi.SPropValue_CTR.lpszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_offset,
-	  { "Offset", "mapi.EcDoRpc.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_mapi_response,
-	  { "Mapi Response", "mapi.EcDoRpc.mapi_response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenMessage_recipients_RecipClass,
-	  { "Recipclass", "mapi.OpenMessage_recipients.RecipClass", FT_UINT8, BASE_DEC, VALS(mapi_ulRecipClass_vals), 0, NULL, HFILL }},
-	{ &hf_mapi_FILETIME_dwLowDateTime,
-	  { "Dwlowdatetime", "mapi.FILETIME.dwLowDateTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_GetProps_req_properties,
-	  { "Properties", "mapi.GetProps_req.properties", FT_UINT32, BASE_DEC, VALS(mapi_MAPITAGS_vals), 0, NULL, HFILL }},
-	{ &hf_mapi_EcRRegisterPushNotification_ulEventMask,
-	  { "Uleventmask", "mapi.EcRRegisterPushNotification.ulEventMask", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenMessage_req_message_id,
-	  { "Message Id", "mapi.OpenMessage_req.message_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_SPropValue_CTR_l,
-	  { "L", "mapi.SPropValue_CTR.l", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_input_locale_language,
-	  { "Language", "mapi.input_locale.language", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenFolder_req_unknown,
-	  { "Unknown", "mapi.OpenFolder_req.unknown", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Folder Id", "mapi.OpenFolder_req.folder_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_mapi_request_length,
+		{ "Length", "mapi.mapi_request.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_OpenFolder,
+		{ "Mapi Openfolder", "mapi.EcDoRpc_MAPI_REPL_UNION.mapi_OpenFolder", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevNewMail,
+		{ "Fnevnewmail", "mapi.ulEventType.fnevNewMail", FT_BOOLEAN, 16, TFS(&ulEventType_fnevNewMail_tfs), ( 0x00000002 ), NULL, HFILL }},
 	{ &hf_mapi_SPropValue_CTR_lpguid,
-	  { "Lpguid", "mapi.SPropValue_CTR.lpguid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_unknown3,
-	  { "Unknown3", "mapi.EcDoConnect.unknown3", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_recipients_headers_prop_count,
-	  { "Prop Count", "mapi.recipients_headers.prop_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Lpguid", "mapi.SPropValue_CTR.lpguid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_GetProps_req_properties,
+		{ "Properties", "mapi.GetProps_req.properties", FT_UINT32, BASE_DEC, VALS(mapi_MAPITAGS_vals), 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_max_data,
+		{ "Max Data", "mapi.EcDoRpc.max_data", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_OpenMessage_req_folder_handle_idx,
-	  { "Folder Handle Idx", "mapi.OpenMessage_req.folder_handle_idx", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenMsgStore_req_padding,
-	  { "Padding", "mapi.OpenMsgStore_req.padding", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_GetProps_req_unknown,
-	  { "Unknown", "mapi.GetProps_req.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REQ_mapi_flags,
-	  { "Mapi Flags", "mapi.EcDoRpc_MAPI_REQ.mapi_flags", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcRRegisterPushNotification_notifkey,
-	  { "Notifkey", "mapi.EcRRegisterPushNotification.notifkey", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_mapi_request_mapi_req,
-	  { "Mapi Req", "mapi.mapi_request.mapi_req", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenMsgStore_req_codepage,
-	  { "Codepage", "mapi.OpenMsgStore_req.codepage", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_code_page,
-	  { "Code Page", "mapi.EcDoConnect.code_page", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Folder Handle Idx", "mapi.OpenMessage_req.folder_handle_idx", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_SPropValue_CTR_ft,
+		{ "Ft", "mapi.SPropValue_CTR.ft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_recipients_headers_username,
-	  { "Username", "mapi.recipients_headers.username", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenMessage_req_max_data,
-	  { "Max Data", "mapi.OpenMessage_req.max_data", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenMsgStore_req_mailbox,
-	  { "Mailbox", "mapi.OpenMsgStore_req.mailbox", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Username", "mapi.recipients_headers.username", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevObjectModified,
+		{ "Fnevobjectmodified", "mapi.ulEventType.fnevObjectModified", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectModified_tfs), ( 0x00000010 ), NULL, HFILL }},
 	{ &hf_mapi_EcDoConnect_emsmdb_client_version,
-	  { "Emsmdb Client Version", "mapi.EcDoConnect.emsmdb_client_version", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_GetProps_repl_layout,
-	  { "Layout", "mapi.GetProps_repl.layout", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_mapi_request_,
-	  { "Subcontext length", "mapi.EcDoRpc.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_unknown4,
-	  { "Unknown4", "mapi.EcDoConnect.unknown4", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REPL_error_code,
-	  { "Error Code", "mapi.EcDoRpc_MAPI_REPL.error_code", FT_UINT32, BASE_DEC, VALS(mapi_MAPISTATUS_vals), 0, NULL, HFILL }},
-	{ &hf_mapi_opnum,
-	  { "Operation", "mapi.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_recipients_headers_bitmask,
-	  { "Bitmask", "mapi.recipients_headers.bitmask", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Emsmdb Client Version", "mapi.EcDoConnect.emsmdb_client_version", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_SPropValue_CTR_b,
+		{ "B", "mapi.SPropValue_CTR.b", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_mapi_request_mapi_len,
+		{ "Mapi Len", "mapi.mapi_request.mapi_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcRRegisterPushNotification_ulEventMask,
+		{ "Uleventmask", "mapi.EcRRegisterPushNotification.ulEventMask", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_recipient_displayname_7bit_lpszA,
+		{ "Lpsza", "mapi.recipient_displayname_7bit.lpszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_GetProps_req_unknown,
+		{ "Unknown", "mapi.GetProps_req.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcRRegisterPushNotification_sockaddr_len,
+		{ "Sockaddr Len", "mapi.EcRRegisterPushNotification.sockaddr_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_GetProps_repl_prop_data,
+		{ "Prop Data", "mapi.GetProps_repl.prop_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_mapi_response_handles,
-	  { "Handles", "mapi.mapi_response.handles", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenFolder_req_handle_idx,
-	  { "Handle Idx", "mapi.OpenFolder_req.handle_idx", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_name,
-	  { "Name", "mapi.EcDoConnect.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_user,
-	  { "User", "mapi.EcDoConnect.user", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_GetProps,
-	  { "Mapi Getprops", "mapi.EcDoRpc_MAPI_REQ_UNION.mapi_GetProps", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_SPropValue_CTR_dbl,
-	  { "Dbl", "mapi.SPropValue_CTR.dbl", FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_Release,
-	  { "Mapi Release", "mapi.EcDoRpc_MAPI_REQ_UNION.mapi_Release", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_size,
-	  { "Size", "mapi.EcDoRpc.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevObjectDeleted,
-	  { "Fnevobjectdeleted", "mapi.ulEventType.fnevObjectDeleted", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectDeleted_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_unknown2,
-	  { "Unknown2", "mapi.EcDoConnect.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_Release,
-	  { "Mapi Release", "mapi.EcDoRpc_MAPI_REPL_UNION.mapi_Release", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenMessage_recipients_codepage,
-	  { "Codepage", "mapi.OpenMessage_recipients.codepage", FT_UINT32, BASE_DEC, VALS(mapi_CODEPAGEID_vals), 0, NULL, HFILL }},
-	{ &hf_mapi_recipients_headers_prop_values,
-	  { "Prop Values", "mapi.recipients_headers.prop_values", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_pdu_len,
-	  { "Length", "mapi.pdu.len", FT_UINT16, BASE_HEX, NULL, 0x0, "Size of the command PDU", HFILL }},
-	{ &hf_mapi_OpenFolder_repl_unknown,
-	  { "Unknown", "mapi.OpenFolder_repl.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_RecipExchange_organization_length,
-	  { "Organization Length", "mapi.RecipExchange.organization_length", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Handles", "mapi.mapi_response.handles", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_DATA_BLOB_length,
-	  { "Length", "mapi.DATA_BLOB.length", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Length", "mapi.DATA_BLOB.length", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenFolder_repl_unknown,
+		{ "Unknown", "mapi.OpenFolder_repl.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_EcRRegisterPushNotification_notif_len,
-	  { "Notif Len", "mapi.EcRRegisterPushNotification.notif_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_GetProps_repl_prop_data,
-	  { "Prop Data", "mapi.GetProps_repl.prop_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcRUnregisterPushNotification_unknown,
-	  { "Unknown", "mapi.EcRUnregisterPushNotification.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevObjectCreated,
-	  { "Fnevobjectcreated", "mapi.ulEventType.fnevObjectCreated", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectCreated_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_mapi_OpenMessage_req_message_permissions,
-	  { "Message Permissions", "mapi.OpenMessage_req.message_permissions", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoConnect_input_locale,
-	  { "Input Locale", "mapi.EcDoConnect.input_locale", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_GetProps_req_prop_count,
-	  { "Prop Count", "mapi.GetProps_req.prop_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_RecipExchange_addr_type,
-	  { "Addr Type", "mapi.RecipExchange.addr_type", FT_UINT8, BASE_DEC, VALS(mapi_addr_type_vals), 0, NULL, HFILL }},
-	{ &hf_mapi_EcRRegisterPushNotification_unknown2,
-	  { "Unknown2", "mapi.EcRRegisterPushNotification.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REPL_opnum,
-	  { "Opnum", "mapi.EcDoRpc_MAPI_REPL.opnum", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Notif Len", "mapi.EcRRegisterPushNotification.notif_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_recipients_headers_layout,
+		{ "Layout", "mapi.recipients_headers.layout", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_unknown1,
+		{ "Unknown1", "mapi.EcDoConnect.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REPL_u,
+		{ "U", "mapi.EcDoRpc_MAPI_REPL.u", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_SPropValue_CTR_lpszW,
-	  { "Lpszw", "mapi.SPropValue_CTR.lpszW", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevTableModified,
-	  { "Fnevtablemodified", "mapi.ulEventType.fnevTableModified", FT_BOOLEAN, 16, TFS(&ulEventType_fnevTableModified_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_mapi_SPropValue_ulPropTag,
-	  { "Ulproptag", "mapi.SPropValue.ulPropTag", FT_UINT32, BASE_DEC, VALS(mapi_MAPITAGS_vals), 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_OpenMsgStore,
-	  { "Mapi Openmsgstore", "mapi.EcDoRpc_MAPI_REQ_UNION.mapi_OpenMsgStore", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_SPropValue_CTR_b,
-	  { "B", "mapi.SPropValue_CTR.b", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REPL_handle_idx,
-	  { "Handle Idx", "mapi.EcDoRpc_MAPI_REPL.handle_idx", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevNewMail,
-	  { "Fnevnewmail", "mapi.ulEventType.fnevNewMail", FT_BOOLEAN, 16, TFS(&ulEventType_fnevNewMail_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_mapi_input_locale_method,
-	  { "Method", "mapi.input_locale.method", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevSearchComplete,
-	  { "Fnevsearchcomplete", "mapi.ulEventType.fnevSearchComplete", FT_BOOLEAN, 16, TFS(&ulEventType_fnevSearchComplete_tfs), ( 0x00000080 ), NULL, HFILL }},
-	{ &hf_mapi_MAPI_OPNUM,
-	  { "Opnum", "mapi.EcDoRpc_MAPI_REQ.opnum", FT_UINT8, BASE_HEX, VALS(mapi_MAPI_OPNUM_vals), 0, "NULL", HFILL }},
-	{ &hf_mapi_EcDoConnect_alloc_space,
-	  { "Alloc Space", "mapi.EcDoConnect.alloc_space", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Lpszw", "mapi.SPropValue_CTR.lpszW", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_handle,
+		{ "Handle", "mapi.handle", FT_BYTES, BASE_NONE, NULL, 0, "NULL", HFILL }},
+	{ &hf_mapi_SPropValue_CTR_lpszA,
+		{ "Lpsza", "mapi.SPropValue_CTR.lpszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_GetProps,
+		{ "Mapi Getprops", "mapi.EcDoRpc_MAPI_REQ_UNION.mapi_GetProps", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_name,
+		{ "Name", "mapi.EcDoConnect.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenFolder_req_unknown,
+		{ "Unknown", "mapi.OpenFolder_req.unknown", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_input_locale_language,
+		{ "Language", "mapi.input_locale.language", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_recipients_headers_prop_values,
+		{ "Prop Values", "mapi.recipients_headers.prop_values", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenMessage_recipients_recipients_headers,
+		{ "Recipients Headers", "mapi.OpenMessage_recipients.recipients_headers", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_opnum,
+		{ "Operation", "mapi.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_EcRRegisterPushNotification_retval,
-	  { "Retval", "mapi.EcRRegisterPushNotification.retval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_OpenMsgStore_req_mailbox_str_size,
-	  { "Mailbox Str Size", "mapi.OpenMsgStore_req.mailbox_str_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Retval", "mapi.EcRRegisterPushNotification.retval", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_Release,
+		{ "Mapi Release", "mapi.EcDoRpc_MAPI_REQ_UNION.mapi_Release", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_decrypted_data,
-	  { "Decrypted data", "mapi.decrypted.data", FT_BYTES, BASE_NONE, NULL, 0, "NULL", HFILL }},
+		{ "Decrypted data", "mapi.decrypted.data", FT_BYTES, BASE_NONE, NULL, 0, "NULL", HFILL }},
+	{ &hf_mapi_mapi_request_mapi_req,
+		{ "Mapi Req", "mapi.mapi_request.mapi_req", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_RecipExchange_addr_type,
+		{ "Addr Type", "mapi.RecipExchange.addr_type", FT_UINT8, BASE_DEC, VALS(mapi_addr_type_vals), 0, NULL, HFILL }},
+	{ &hf_mapi_SPropValue_CTR_dbl,
+		{ "Dbl", "mapi.SPropValue_CTR.dbl", FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenMsgStore_req_mailbox,
+		{ "Mailbox", "mapi.OpenMsgStore_req.mailbox", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_mapi_response,
+		{ "Mapi Response", "mapi.EcDoRpc.mapi_response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REPL_error_code,
+		{ "Error Code", "mapi.EcDoRpc_MAPI_REPL.error_code", FT_UINT32, BASE_DEC, VALS(mapi_MAPISTATUS_vals), 0, NULL, HFILL }},
+	{ &hf_mapi_OpenMessage_req_message_permissions,
+		{ "Message Permissions", "mapi.OpenMessage_req.message_permissions", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevSearchComplete,
+		{ "Fnevsearchcomplete", "mapi.ulEventType.fnevSearchComplete", FT_BOOLEAN, 16, TFS(&ulEventType_fnevSearchComplete_tfs), ( 0x00000080 ), NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_size,
+		{ "Size", "mapi.EcDoRpc.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_recipient_type_SMTP,
+		{ "Smtp", "mapi.recipient_type.SMTP", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_OpenMessage_req_folder_id,
-	  { "Folder Id", "mapi.OpenMessage_req.folder_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_recipient_displayname_7bit_lpszA,
-	  { "Lpsza", "mapi.recipient_displayname_7bit.lpszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevObjectMoved,
-	  { "Fnevobjectmoved", "mapi.ulEventType.fnevObjectMoved", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectMoved_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_mapi_mapi_request_mapi_len,
-	  { "Mapi Len", "mapi.mapi_request.mapi_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_ulEventType_fnevObjectModified,
-	  { "Fnevobjectmodified", "mapi.ulEventType.fnevObjectModified", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectModified_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_mapi_MAPISTATUS_status,
-	  { "MAPISTATUS", "mapi.MAPISTATUS_status", FT_UINT32, BASE_HEX, VALS(mapi_MAPISTATUS_vals), 0, NULL, HFILL }},
-	{ &hf_mapi_recipient_type_EXCHANGE,
-	  { "Exchange", "mapi.recipient_type.EXCHANGE", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_MAPI_REQ_handle_idx,
-	  { "Handle Idx", "mapi.EcDoRpc_MAPI_REQ.handle_idx", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Folder Id", "mapi.OpenMessage_req.folder_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_SPropValue_ulPropTag,
+		{ "Ulproptag", "mapi.SPropValue.ulPropTag", FT_UINT32, BASE_DEC, VALS(mapi_MAPITAGS_vals), 0, NULL, HFILL }},
 	{ &hf_mapi_mapi_response_mapi_repl,
-	  { "Mapi Repl", "mapi.mapi_response.mapi_repl", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_EcDoRpc_mapi_request,
-	  { "Mapi Request", "mapi.EcDoRpc.mapi_request", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_LPSTR_lppszA,
-	  { "Lppsza", "mapi.LPSTR.lppszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Mapi Repl", "mapi.mapi_response.mapi_repl", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_org_group,
+		{ "Org Group", "mapi.EcDoConnect.org_group", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_mapi_response_,
+		{ "Subcontext length", "mapi.EcDoRpc.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_mapi_response_length,
+		{ "Length", "mapi.mapi_response.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_recipient_type,
-	  { "Recipient Type", "mapi.recipients_headers.type", FT_UINT16, BASE_HEX, VALS(mapi_OM_recipient_type_vals), 0, "NULL", HFILL }},
+		{ "Recipient Type", "mapi.recipients_headers.type", FT_UINT16, BASE_HEX, VALS(mapi_OM_recipient_type_vals), 0, "NULL", HFILL }},
+	{ &hf_mapi_EcRRegisterPushNotification_notifkey,
+		{ "Notifkey", "mapi.EcRRegisterPushNotification.notifkey", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REQ_u,
+		{ "U", "mapi.EcDoRpc_MAPI_REQ.u", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_OpenFolder,
-	  { "Mapi Openfolder", "mapi.EcDoRpc_MAPI_REQ_UNION.mapi_OpenFolder", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Mapi Openfolder", "mapi.EcDoRpc_MAPI_REQ_UNION.mapi_OpenFolder", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_recipients_headers_prop_count,
+		{ "Prop Count", "mapi.recipients_headers.prop_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_GetProps,
+		{ "Mapi Getprops", "mapi.EcDoRpc_MAPI_REPL_UNION.mapi_GetProps", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_mapi_request_handles,
+		{ "Handles", "mapi.mapi_request.handles", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_input_locale,
+		{ "Input Locale", "mapi.EcDoConnect.input_locale", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_GetProps_req_prop_count,
+		{ "Prop Count", "mapi.GetProps_req.prop_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevReservedForMapi,
+		{ "Fnevreservedformapi", "mapi.ulEventType.fnevReservedForMapi", FT_BOOLEAN, 16, TFS(&ulEventType_fnevReservedForMapi_tfs), ( 0x40000000 ), NULL, HFILL }},
+	{ &hf_mapi_OpenMsgStore_req_codepage,
+		{ "Codepage", "mapi.OpenMsgStore_req.codepage", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_LPSTR_lppszA,
+		{ "Lppsza", "mapi.LPSTR.lppszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_mapi_request_,
+		{ "Subcontext length", "mapi.EcDoRpc.subcontext", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REPL_handle_idx,
+		{ "Handle Idx", "mapi.EcDoRpc_MAPI_REPL.handle_idx", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcRRegisterPushNotification_unknown2,
+		{ "Unknown2", "mapi.EcRRegisterPushNotification.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_SPropValue_CTR_err,
+		{ "Err", "mapi.SPropValue_CTR.err", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcRRegisterPushNotification_sockaddr,
+		{ "Sockaddr", "mapi.EcRRegisterPushNotification.sockaddr", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_recipient_type_EXCHANGE,
+		{ "Exchange", "mapi.recipient_type.EXCHANGE", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenFolder_req_handle_idx,
+		{ "Handle Idx", "mapi.OpenFolder_req.handle_idx", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_SPropValue_CTR_d,
+		{ "D", "mapi.SPropValue_CTR.d", FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_unknown2,
+		{ "Unknown2", "mapi.EcDoConnect.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevObjectMoved,
+		{ "Fnevobjectmoved", "mapi.ulEventType.fnevObjectMoved", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectMoved_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REPL_UNION_mapi_Release,
+		{ "Mapi Release", "mapi.EcDoRpc_MAPI_REPL_UNION.mapi_Release", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_mapi_response_mapi_len,
+		{ "Mapi Len", "mapi.mapi_response.mapi_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevObjectCopied,
+		{ "Fnevobjectcopied", "mapi.ulEventType.fnevObjectCopied", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectCopied_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevCriticalError,
+		{ "Fnevcriticalerror", "mapi.ulEventType.fnevCriticalError", FT_BOOLEAN, 16, TFS(&ulEventType_fnevCriticalError_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_mapi_FILETIME_dwHighDateTime,
+		{ "Dwhighdatetime", "mapi.FILETIME.dwHighDateTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_alloc_space,
+		{ "Alloc Space", "mapi.EcDoConnect.alloc_space", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_property_types,
+		{ "Value", "mapi.SPropValue.value", FT_UINT32, BASE_HEX, VALS(mapi_property_types_vals), 0, "NULL", HFILL }},
+	{ &hf_mapi_OpenMsgStore_req_mailbox_str_size,
+		{ "Mailbox Str Size", "mapi.OpenMsgStore_req.mailbox_str_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenMessage_recipients_RecipClass,
+		{ "Recipclass", "mapi.OpenMessage_recipients.RecipClass", FT_UINT8, BASE_DEC, VALS(mapi_ulRecipClass_vals), 0, NULL, HFILL }},
 	{ &hf_mapi_EcDoConnect_session_nb,
-	  { "Session Nb", "mapi.EcDoConnect.session_nb", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Session Nb", "mapi.EcDoConnect.session_nb", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REQ_handle_idx,
+		{ "Handle Idx", "mapi.EcDoRpc_MAPI_REQ.handle_idx", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevTableModified,
+		{ "Fnevtablemodified", "mapi.ulEventType.fnevTableModified", FT_BOOLEAN, 16, TFS(&ulEventType_fnevTableModified_tfs), ( 0x00000100 ), NULL, HFILL }},
+	{ &hf_mapi_OpenMsgStore_req_padding,
+		{ "Padding", "mapi.OpenMsgStore_req.padding", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_GetProps_repl_layout,
+		{ "Layout", "mapi.GetProps_repl.layout", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_code_page,
+		{ "Code Page", "mapi.EcDoConnect.code_page", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_unknown3,
+		{ "Unknown3", "mapi.EcDoConnect.unknown3", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenMessage_req_message_id,
+		{ "Message Id", "mapi.OpenMessage_req.message_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_OpenMessage_recipients_codepage,
+		{ "Codepage", "mapi.OpenMessage_recipients.codepage", FT_UINT32, BASE_DEC, VALS(mapi_CODEPAGEID_vals), 0, NULL, HFILL }},
+	{ &hf_mapi_EcRUnregisterPushNotification_unknown,
+		{ "Unknown", "mapi.EcRUnregisterPushNotification.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_mapi_request,
+		{ "Mapi Request", "mapi.EcDoRpc.mapi_request", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevObjectCreated,
+		{ "Fnevobjectcreated", "mapi.ulEventType.fnevObjectCreated", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectCreated_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_store_version,
+		{ "Store Version", "mapi.EcDoConnect.store_version", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_offset,
+		{ "Offset", "mapi.EcDoRpc.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_SRow_ulRowFlags,
+		{ "Ulrowflags", "mapi.SRow.ulRowFlags", FT_UINT8, BASE_DEC, VALS(mapi_ulRowFlags_vals), 0, NULL, HFILL }},
+	{ &hf_mapi_MAPI_OPNUM,
+		{ "Opnum", "mapi.EcDoRpc_MAPI_REQ.opnum", FT_UINT8, BASE_HEX, VALS(mapi_MAPI_OPNUM_vals), 0, "NULL", HFILL }},
 	{ &hf_mapi_ulEventType_fnevExtended,
-	  { "Fnevextended", "mapi.ulEventType.fnevExtended", FT_BOOLEAN, 16, TFS(&ulEventType_fnevExtended_tfs), ( 0x80000000 ), NULL, HFILL }},
+		{ "Fnevextended", "mapi.ulEventType.fnevExtended", FT_BOOLEAN, 16, TFS(&ulEventType_fnevExtended_tfs), ( 0x80000000 ), NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REPL_opnum,
+		{ "Opnum", "mapi.EcDoRpc_MAPI_REPL.opnum", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_ulEventType_fnevObjectDeleted,
+		{ "Fnevobjectdeleted", "mapi.ulEventType.fnevObjectDeleted", FT_BOOLEAN, 16, TFS(&ulEventType_fnevObjectDeleted_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_mapi_FILETIME_dwLowDateTime,
+		{ "Dwlowdatetime", "mapi.FILETIME.dwLowDateTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mapi_OpenMsgStore_req_row,
-	  { "Row", "mapi.OpenMsgStore_req.row", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mapi_SRow_ulRowFlags,
-	  { "Ulrowflags", "mapi.SRow.ulRowFlags", FT_UINT8, BASE_DEC, VALS(mapi_ulRowFlags_vals), 0, NULL, HFILL }},
-	{ &hf_mapi_recipients_headers_layout,
-	  { "Layout", "mapi.recipients_headers.layout", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Row", "mapi.OpenMsgStore_req.row", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_pdu_len,
+		{ "Length", "mapi.pdu.len", FT_UINT16, BASE_HEX, NULL, 0x0, "Size of the command PDU", HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REQ_UNION_mapi_OpenMsgStore,
+		{ "Mapi Openmsgstore", "mapi.EcDoRpc_MAPI_REQ_UNION.mapi_OpenMsgStore", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_input_locale_method,
+		{ "Method", "mapi.input_locale.method", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_SPropValue_CTR_l,
+		{ "L", "mapi.SPropValue_CTR.l", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_recipients_headers_bitmask,
+		{ "Bitmask", "mapi.recipients_headers.bitmask", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_user,
+		{ "User", "mapi.EcDoConnect.user", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoConnect_unknown4,
+		{ "Unknown4", "mapi.EcDoConnect.unknown4", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_EcDoRpc_MAPI_REQ_mapi_flags,
+		{ "Mapi Flags", "mapi.EcDoRpc_MAPI_REQ.mapi_flags", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mapi_MAPISTATUS_status,
+		{ "MAPISTATUS", "mapi.MAPISTATUS_status", FT_UINT32, BASE_HEX, VALS(mapi_MAPISTATUS_vals), 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-mdssvc.c b/epan/dissectors/packet-dcerpc-mdssvc.c
index 7f4d6956c2..af1fde4dee 100644
--- a/epan/dissectors/packet-dcerpc-mdssvc.c
+++ b/epan/dissectors/packet-dcerpc-mdssvc.c
@@ -32,43 +32,43 @@ static gint ett_mdssvc_mdssvc_blob = -1;
 
 
 /* Header field declarations */
-static gint hf_mdssvc_mdssvc_open_unkn2 = -1;
-static gint hf_mdssvc_mdssvc_cmd_max_fragment_size2 = -1;
-static gint hf_mdssvc_mdssvc_cmd_status = -1;
-static gint hf_mdssvc_mdssvc_open_share_mount_path = -1;
-static gint hf_mdssvc_mdssvc_cmd_unkn4 = -1;
-static gint hf_mdssvc_mdssvc_cmd_share_handle = -1;
-static gint hf_mdssvc_mdssvc_unknown1_device_id = -1;
-static gint hf_mdssvc_mdssvc_unknown1_unkn4 = -1;
-static gint hf_mdssvc_mdssvc_cmd_unkn3 = -1;
-static gint hf_mdssvc_mdssvc_unknown1_unkn5 = -1;
-static gint hf_mdssvc_mdssvc_open_device_id = -1;
 static gint hf_mdssvc_mdssvc_cmd_max_fragment_size1 = -1;
-static gint hf_mdssvc_mdssvc_cmd_unkn7 = -1;
-static gint hf_mdssvc_mdssvc_unknown1_unkn3 = -1;
-static gint hf_mdssvc_mdssvc_blob_length = -1;
+static gint hf_mdssvc_mdssvc_open_share_path = -1;
+static gint hf_mdssvc_mdssvc_open_share_name = -1;
+static gint hf_mdssvc_mdssvc_unknown1_device_id = -1;
+static gint hf_mdssvc_mdssvc_blob_spotlight_blob = -1;
+static gint hf_mdssvc_mdssvc_cmd_unkn8 = -1;
 static gint hf_mdssvc_mdssvc_blob_size = -1;
+static gint hf_mdssvc_mdssvc_unknown1_unkn4 = -1;
+static gint hf_mdssvc_mdssvc_unknown1_flags = -1;
 static gint hf_mdssvc_mdssvc_unknown1_unkn6 = -1;
 static gint hf_mdssvc_mdssvc_cmd_request_blob = -1;
-static gint hf_mdssvc_opnum = -1;
-static gint hf_mdssvc_mdssvc_unknown1_flags = -1;
-static gint hf_mdssvc_mdssvc_cmd_unkn5 = -1;
-static gint hf_mdssvc_mdssvc_open_share_path = -1;
-static gint hf_mdssvc_mdssvc_cmd_unkn6 = -1;
-static gint hf_mdssvc_mdssvc_unknown1_unkn7 = -1;
-static gint hf_mdssvc_mdssvc_unknown1_unkn1 = -1;
-static gint hf_mdssvc_mdssvc_cmd_response_blob = -1;
-static gint hf_mdssvc_mdssvc_cmd_unkn1 = -1;
-static gint hf_mdssvc_mdssvc_open_unkn3 = -1;
+static gint hf_mdssvc_mdssvc_cmd_unkn7 = -1;
 static gint hf_mdssvc_mdssvc_cmd_device_id = -1;
-static gint hf_mdssvc_mdssvc_open_share_handle = -1;
-static gint hf_mdssvc_mdssvc_cmd_unkn8 = -1;
+static gint hf_mdssvc_mdssvc_cmd_response_blob = -1;
 static gint hf_mdssvc_mdssvc_cmd_flags = -1;
-static gint hf_mdssvc_mdssvc_cmd_unkn9 = -1;
+static gint hf_mdssvc_mdssvc_open_unkn2 = -1;
 static gint hf_mdssvc_mdssvc_unknown1_status = -1;
-static gint hf_mdssvc_mdssvc_open_share_name = -1;
+static gint hf_mdssvc_mdssvc_blob_length = -1;
+static gint hf_mdssvc_mdssvc_unknown1_unkn7 = -1;
+static gint hf_mdssvc_mdssvc_cmd_unkn6 = -1;
+static gint hf_mdssvc_mdssvc_cmd_status = -1;
+static gint hf_mdssvc_mdssvc_cmd_unkn9 = -1;
+static gint hf_mdssvc_mdssvc_unknown1_unkn3 = -1;
+static gint hf_mdssvc_mdssvc_cmd_unkn5 = -1;
+static gint hf_mdssvc_mdssvc_cmd_unkn3 = -1;
+static gint hf_mdssvc_mdssvc_cmd_max_fragment_size2 = -1;
+static gint hf_mdssvc_mdssvc_open_share_handle = -1;
+static gint hf_mdssvc_mdssvc_cmd_unkn4 = -1;
+static gint hf_mdssvc_mdssvc_cmd_unkn1 = -1;
+static gint hf_mdssvc_mdssvc_open_share_mount_path = -1;
+static gint hf_mdssvc_mdssvc_open_device_id = -1;
+static gint hf_mdssvc_mdssvc_unknown1_unkn5 = -1;
+static gint hf_mdssvc_opnum = -1;
+static gint hf_mdssvc_mdssvc_unknown1_unkn1 = -1;
+static gint hf_mdssvc_mdssvc_cmd_share_handle = -1;
 static gint hf_mdssvc_mdssvc_unknown1_share_handle = -1;
-static gint hf_mdssvc_mdssvc_blob_spotlight_blob = -1;
+static gint hf_mdssvc_mdssvc_open_unkn3 = -1;
 
 static gint proto_dcerpc_mdssvc = -1;
 /* Version information */
@@ -149,7 +149,7 @@ mdssvc_dissect_element_blob_spotlight_blob(tvbuff_t *tvb, int offset, packet_inf
 /* IDL: struct { */
 /* IDL: 	uint32 length; */
 /* IDL: 	uint32 size; */
-/* IDL: 	[size_is(size)] [length_is(length)] [unique(1)] uint8 *spotlight_blob; */
+/* IDL: 	[length_is(length)] [size_is(size)] [unique(1)] uint8 *spotlight_blob; */
 /* IDL: } */
 
 static int
@@ -315,13 +315,13 @@ mdssvc_dissect_element_open_share_handle_(tvbuff_t *tvb _U_, int offset _U_, pac
 }
 
 /* IDL: void mdssvc_open( */
-/* IDL: [ref] [in] [out] uint32 *device_id, */
-/* IDL: [in] [ref] [out] uint32 *unkn2, */
+/* IDL: [in] [out] [ref] uint32 *device_id, */
+/* IDL: [ref] [out] [in] uint32 *unkn2, */
 /* IDL: [out] [in] [ref] uint32 *unkn3, */
 /* IDL: [charset(UTF8)] [in] uint8 share_mount_path[*], */
 /* IDL: [in] [charset(UTF8)] uint8 share_name[*], */
-/* IDL: [charset(UTF8)] [size_is(1025)] [out] uint8 share_path[*], */
-/* IDL: [out] [ref] policy_handle *share_handle */
+/* IDL: [size_is(1025)] [charset(UTF8)] [out] uint8 share_path[*], */
+/* IDL: [ref] [out] policy_handle *share_handle */
 /* IDL: ); */
 
 static int
@@ -475,7 +475,7 @@ mdssvc_dissect_element_unknown1_unkn7_(tvbuff_t *tvb _U_, int offset _U_, packet
 /* IDL: [in] uint32 unkn4, */
 /* IDL: [in] uint32 unkn5, */
 /* IDL: [in] uint32 unkn6, */
-/* IDL: [out] [ref] uint32 *status, */
+/* IDL: [ref] [out] uint32 *status, */
 /* IDL: [ref] [out] uint32 *flags, */
 /* IDL: [ref] [out] uint32 *unkn7 */
 /* IDL: ); */
@@ -683,9 +683,9 @@ mdssvc_dissect_element_cmd_unkn9_(tvbuff_t *tvb _U_, int offset _U_, packet_info
 /* IDL: [in] uint32 max_fragment_size2, */
 /* IDL: [in] uint32 unkn7, */
 /* IDL: [in] uint32 unkn8, */
-/* IDL: [out] [ref] uint32 *status, */
+/* IDL: [ref] [out] uint32 *status, */
 /* IDL: [out] [ref] mdssvc_blob *response_blob, */
-/* IDL: [ref] [out] uint32 *unkn9 */
+/* IDL: [out] [ref] uint32 *unkn9 */
 /* IDL: ); */
 
 static int
@@ -751,80 +751,80 @@ static dcerpc_sub_dissector mdssvc_dissectors[] = {
 void proto_register_dcerpc_mdssvc(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_mdssvc_mdssvc_open_unkn2,
-	  { "Unkn2", "mdssvc.mdssvc_open.unkn2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_max_fragment_size2,
-	  { "Max Fragment Size2", "mdssvc.mdssvc_cmd.max_fragment_size2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_status,
-	  { "Status", "mdssvc.mdssvc_cmd.status", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_open_share_mount_path,
-	  { "Share Mount Path", "mdssvc.mdssvc_open.share_mount_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_unkn4,
-	  { "Unkn4", "mdssvc.mdssvc_cmd.unkn4", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_share_handle,
-	  { "Share Handle", "mdssvc.mdssvc_cmd.share_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_unknown1_device_id,
-	  { "Device Id", "mdssvc.mdssvc_unknown1.device_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_unknown1_unkn4,
-	  { "Unkn4", "mdssvc.mdssvc_unknown1.unkn4", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_unkn3,
-	  { "Unkn3", "mdssvc.mdssvc_cmd.unkn3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_unknown1_unkn5,
-	  { "Unkn5", "mdssvc.mdssvc_unknown1.unkn5", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_open_device_id,
-	  { "Device Id", "mdssvc.mdssvc_open.device_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mdssvc_mdssvc_cmd_max_fragment_size1,
-	  { "Max Fragment Size1", "mdssvc.mdssvc_cmd.max_fragment_size1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_unkn7,
-	  { "Unkn7", "mdssvc.mdssvc_cmd.unkn7", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_unknown1_unkn3,
-	  { "Unkn3", "mdssvc.mdssvc_unknown1.unkn3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_blob_length,
-	  { "Length", "mdssvc.mdssvc_blob.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Max Fragment Size1", "mdssvc.mdssvc_cmd.max_fragment_size1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_open_share_path,
+		{ "Share Path", "mdssvc.mdssvc_open.share_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_open_share_name,
+		{ "Share Name", "mdssvc.mdssvc_open.share_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_unknown1_device_id,
+		{ "Device Id", "mdssvc.mdssvc_unknown1.device_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_blob_spotlight_blob,
+		{ "Spotlight Blob", "mdssvc.mdssvc_blob.spotlight_blob", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_unkn8,
+		{ "Unkn8", "mdssvc.mdssvc_cmd.unkn8", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mdssvc_mdssvc_blob_size,
-	  { "Size", "mdssvc.mdssvc_blob.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Size", "mdssvc.mdssvc_blob.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_unknown1_unkn4,
+		{ "Unkn4", "mdssvc.mdssvc_unknown1.unkn4", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_unknown1_flags,
+		{ "Flags", "mdssvc.mdssvc_unknown1.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mdssvc_mdssvc_unknown1_unkn6,
-	  { "Unkn6", "mdssvc.mdssvc_unknown1.unkn6", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unkn6", "mdssvc.mdssvc_unknown1.unkn6", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mdssvc_mdssvc_cmd_request_blob,
-	  { "Request Blob", "mdssvc.mdssvc_cmd.request_blob", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_opnum,
-	  { "Operation", "mdssvc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_unknown1_flags,
-	  { "Flags", "mdssvc.mdssvc_unknown1.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_unkn5,
-	  { "Unkn5", "mdssvc.mdssvc_cmd.unkn5", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_open_share_path,
-	  { "Share Path", "mdssvc.mdssvc_open.share_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_unkn6,
-	  { "Unkn6", "mdssvc.mdssvc_cmd.unkn6", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_unknown1_unkn7,
-	  { "Unkn7", "mdssvc.mdssvc_unknown1.unkn7", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_unknown1_unkn1,
-	  { "Unkn1", "mdssvc.mdssvc_unknown1.unkn1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_response_blob,
-	  { "Response Blob", "mdssvc.mdssvc_cmd.response_blob", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_unkn1,
-	  { "Unkn1", "mdssvc.mdssvc_cmd.unkn1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_open_unkn3,
-	  { "Unkn3", "mdssvc.mdssvc_open.unkn3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Request Blob", "mdssvc.mdssvc_cmd.request_blob", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_unkn7,
+		{ "Unkn7", "mdssvc.mdssvc_cmd.unkn7", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mdssvc_mdssvc_cmd_device_id,
-	  { "Device Id", "mdssvc.mdssvc_cmd.device_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_open_share_handle,
-	  { "Share Handle", "mdssvc.mdssvc_open.share_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_unkn8,
-	  { "Unkn8", "mdssvc.mdssvc_cmd.unkn8", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Device Id", "mdssvc.mdssvc_cmd.device_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_response_blob,
+		{ "Response Blob", "mdssvc.mdssvc_cmd.response_blob", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_mdssvc_mdssvc_cmd_flags,
-	  { "Flags", "mdssvc.mdssvc_cmd.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_cmd_unkn9,
-	  { "Unkn9", "mdssvc.mdssvc_cmd.unkn9", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Flags", "mdssvc.mdssvc_cmd.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_open_unkn2,
+		{ "Unkn2", "mdssvc.mdssvc_open.unkn2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_mdssvc_mdssvc_unknown1_status,
-	  { "Status", "mdssvc.mdssvc_unknown1.status", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_open_share_name,
-	  { "Share Name", "mdssvc.mdssvc_open.share_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Status", "mdssvc.mdssvc_unknown1.status", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_blob_length,
+		{ "Length", "mdssvc.mdssvc_blob.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_unknown1_unkn7,
+		{ "Unkn7", "mdssvc.mdssvc_unknown1.unkn7", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_unkn6,
+		{ "Unkn6", "mdssvc.mdssvc_cmd.unkn6", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_status,
+		{ "Status", "mdssvc.mdssvc_cmd.status", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_unkn9,
+		{ "Unkn9", "mdssvc.mdssvc_cmd.unkn9", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_unknown1_unkn3,
+		{ "Unkn3", "mdssvc.mdssvc_unknown1.unkn3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_unkn5,
+		{ "Unkn5", "mdssvc.mdssvc_cmd.unkn5", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_unkn3,
+		{ "Unkn3", "mdssvc.mdssvc_cmd.unkn3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_max_fragment_size2,
+		{ "Max Fragment Size2", "mdssvc.mdssvc_cmd.max_fragment_size2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_open_share_handle,
+		{ "Share Handle", "mdssvc.mdssvc_open.share_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_unkn4,
+		{ "Unkn4", "mdssvc.mdssvc_cmd.unkn4", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_unkn1,
+		{ "Unkn1", "mdssvc.mdssvc_cmd.unkn1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_open_share_mount_path,
+		{ "Share Mount Path", "mdssvc.mdssvc_open.share_mount_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_open_device_id,
+		{ "Device Id", "mdssvc.mdssvc_open.device_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_unknown1_unkn5,
+		{ "Unkn5", "mdssvc.mdssvc_unknown1.unkn5", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_opnum,
+		{ "Operation", "mdssvc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_unknown1_unkn1,
+		{ "Unkn1", "mdssvc.mdssvc_unknown1.unkn1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_cmd_share_handle,
+		{ "Share Handle", "mdssvc.mdssvc_cmd.share_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_mdssvc_mdssvc_unknown1_share_handle,
-	  { "Share Handle", "mdssvc.mdssvc_unknown1.share_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_mdssvc_mdssvc_blob_spotlight_blob,
-	  { "Spotlight Blob", "mdssvc.mdssvc_blob.spotlight_blob", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Share Handle", "mdssvc.mdssvc_unknown1.share_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_mdssvc_mdssvc_open_unkn3,
+		{ "Unkn3", "mdssvc.mdssvc_open.unkn3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-misc.c b/epan/dissectors/packet-dcerpc-misc.c
index 41329bc0ad..24e62b81a3 100644
--- a/epan/dissectors/packet-dcerpc-misc.c
+++ b/epan/dissectors/packet-dcerpc-misc.c
@@ -36,24 +36,24 @@ static gint ett_misc_winreg_Data = -1;
 
 
 /* Header field declarations */
-static gint hf_misc_policy_handle_handle_type = -1;
-static gint hf_misc_GUID_time_low = -1;
+static gint hf_misc_winreg_Data_string = -1;
 static gint hf_misc_ndr_syntax_id_if_version = -1;
-static gint hf_misc_KRB5_EDATA_NTSTATUS_ntstatus = -1;
-static gint hf_misc_GUID_clock_seq = -1;
-static gint hf_misc_opnum = -1;
-static gint hf_misc_GUID_time_hi_and_version = -1;
+static gint hf_misc_winreg_Data_value = -1;
+static gint hf_misc_winreg_Data_data = -1;
+static gint hf_misc_winreg_Data_string_array = -1;
+static gint hf_misc_policy_handle_handle_type = -1;
 static gint hf_misc_KRB5_EDATA_NTSTATUS_unknown1 = -1;
-static gint hf_misc_KRB5_EDATA_NTSTATUS_unknown2 = -1;
 static gint hf_misc_winreg_Data_binary = -1;
-static gint hf_misc_winreg_Data_string = -1;
-static gint hf_misc_policy_handle_uuid = -1;
-static gint hf_misc_winreg_Data_string_array = -1;
+static gint hf_misc_opnum = -1;
+static gint hf_misc_GUID_time_hi_and_version = -1;
 static gint hf_misc_GUID_time_mid = -1;
-static gint hf_misc_winreg_Data_data = -1;
-static gint hf_misc_ndr_syntax_id_uuid = -1;
 static gint hf_misc_GUID_node = -1;
-static gint hf_misc_winreg_Data_value = -1;
+static gint hf_misc_GUID_time_low = -1;
+static gint hf_misc_policy_handle_uuid = -1;
+static gint hf_misc_KRB5_EDATA_NTSTATUS_unknown2 = -1;
+static gint hf_misc_ndr_syntax_id_uuid = -1;
+static gint hf_misc_KRB5_EDATA_NTSTATUS_ntstatus = -1;
+static gint hf_misc_GUID_clock_seq = -1;
 
 static gint proto_dcerpc_misc = -1;
 /* Version information */
@@ -464,14 +464,14 @@ misc_dissect_enum_winreg_Type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pi
 }
 
 
-/* IDL: [flag(LIBNDR_FLAG_LITTLE_ENDIAN)] [nodiscriminant(1)] [public(1)] union { */
+/* IDL: [public(1)] [flag(LIBNDR_FLAG_LITTLE_ENDIAN)] [nodiscriminant(1)] union { */
 /* IDL: [case(REG_NONE)] [case(REG_NONE)] EMPTY ; */
 /* IDL: [case(REG_SZ)] [flag(LIBNDR_FLAG_STR_NULLTERM)] [case(REG_SZ)] string string; */
-/* IDL: [case(REG_EXPAND_SZ)] [flag(LIBNDR_FLAG_STR_NULLTERM)] [case(REG_EXPAND_SZ)] string string; */
-/* IDL: [case(REG_BINARY)] [flag(LIBNDR_FLAG_REMAINING)] [case(REG_BINARY)] DATA_BLOB binary; */
+/* IDL: [case(REG_EXPAND_SZ)] [case(REG_EXPAND_SZ)] [flag(LIBNDR_FLAG_STR_NULLTERM)] string string; */
+/* IDL: [case(REG_BINARY)] [case(REG_BINARY)] [flag(LIBNDR_FLAG_REMAINING)] DATA_BLOB binary; */
 /* IDL: [case(REG_DWORD)] [case(REG_DWORD)] uint32 value; */
-/* IDL: [case(REG_DWORD_BIG_ENDIAN)] [flag(LIBNDR_FLAG_BIGENDIAN)] [case(REG_DWORD_BIG_ENDIAN)] uint32 value; */
-/* IDL: [case(REG_MULTI_SZ)] [flag(LIBNDR_FLAG_STR_NULLTERM)] [case(REG_MULTI_SZ)] string_array string_array; */
+/* IDL: [case(REG_DWORD_BIG_ENDIAN)] [case(REG_DWORD_BIG_ENDIAN)] [flag(LIBNDR_FLAG_BIGENDIAN)] uint32 value; */
+/* IDL: [case(REG_MULTI_SZ)] [case(REG_MULTI_SZ)] [flag(LIBNDR_FLAG_STR_NULLTERM)] string_array string_array; */
 /* IDL: [default] ; */
 /* IDL: } */
 
@@ -509,8 +509,7 @@ misc_dissect_winreg_Data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "winreg_Data");
-		tree = proto_item_add_subtree(item, ett_misc_winreg_Data);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_misc_winreg_Data, &item, "winreg_Data");
 	}
 
 	switch(level) {
@@ -558,42 +557,42 @@ static dcerpc_sub_dissector misc_dissectors[] = {
 void proto_register_dcerpc_misc(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_misc_policy_handle_handle_type,
-	  { "Handle Type", "misc.policy_handle.handle_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_GUID_time_low,
-	  { "Time Low", "misc.GUID.time_low", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_winreg_Data_string,
+		{ "String", "misc.winreg_Data.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_misc_ndr_syntax_id_if_version,
-	  { "If Version", "misc.ndr_syntax_id.if_version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_KRB5_EDATA_NTSTATUS_ntstatus,
-	  { "Ntstatus", "misc.KRB5_EDATA_NTSTATUS.ntstatus", FT_UINT32, BASE_DEC, VALS(NT_errors), 0, NULL, HFILL }},
-	{ &hf_misc_GUID_clock_seq,
-	  { "Clock Seq", "misc.GUID.clock_seq", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_opnum,
-	  { "Operation", "misc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_GUID_time_hi_and_version,
-	  { "Time Hi And Version", "misc.GUID.time_hi_and_version", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "If Version", "misc.ndr_syntax_id.if_version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_winreg_Data_value,
+		{ "Value", "misc.winreg_Data.value", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_winreg_Data_data,
+		{ "Data", "misc.winreg_Data.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_winreg_Data_string_array,
+		{ "String Array", "misc.winreg_Data.string_array", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_policy_handle_handle_type,
+		{ "Handle Type", "misc.policy_handle.handle_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_misc_KRB5_EDATA_NTSTATUS_unknown1,
-	  { "Unknown1", "misc.KRB5_EDATA_NTSTATUS.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_KRB5_EDATA_NTSTATUS_unknown2,
-	  { "Unknown2", "misc.KRB5_EDATA_NTSTATUS.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown1", "misc.KRB5_EDATA_NTSTATUS.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_misc_winreg_Data_binary,
-	  { "Binary", "misc.winreg_Data.binary", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_winreg_Data_string,
-	  { "String", "misc.winreg_Data.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_policy_handle_uuid,
-	  { "Uuid", "misc.policy_handle.uuid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_winreg_Data_string_array,
-	  { "String Array", "misc.winreg_Data.string_array", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Binary", "misc.winreg_Data.binary", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_opnum,
+		{ "Operation", "misc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_GUID_time_hi_and_version,
+		{ "Time Hi And Version", "misc.GUID.time_hi_and_version", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_misc_GUID_time_mid,
-	  { "Time Mid", "misc.GUID.time_mid", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_winreg_Data_data,
-	  { "Data", "misc.winreg_Data.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_ndr_syntax_id_uuid,
-	  { "Uuid", "misc.ndr_syntax_id.uuid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Time Mid", "misc.GUID.time_mid", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_misc_GUID_node,
-	  { "Node", "misc.GUID.node", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_misc_winreg_Data_value,
-	  { "Value", "misc.winreg_Data.value", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Node", "misc.GUID.node", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_GUID_time_low,
+		{ "Time Low", "misc.GUID.time_low", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_policy_handle_uuid,
+		{ "Uuid", "misc.policy_handle.uuid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_KRB5_EDATA_NTSTATUS_unknown2,
+		{ "Unknown2", "misc.KRB5_EDATA_NTSTATUS.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_ndr_syntax_id_uuid,
+		{ "Uuid", "misc.ndr_syntax_id.uuid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_misc_KRB5_EDATA_NTSTATUS_ntstatus,
+		{ "Ntstatus", "misc.KRB5_EDATA_NTSTATUS.ntstatus", FT_UINT32, BASE_DEC, VALS(NT_errors), 0, NULL, HFILL }},
+	{ &hf_misc_GUID_clock_seq,
+		{ "Clock Seq", "misc.GUID.clock_seq", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-netlogon.c b/epan/dissectors/packet-dcerpc-netlogon.c
index 386447eb19..17a6b37c72 100644
--- a/epan/dissectors/packet-dcerpc-netlogon.c
+++ b/epan/dissectors/packet-dcerpc-netlogon.c
@@ -688,16 +688,13 @@ dissect_ndr_lm_nt_hash_helper(tvbuff_t *tvb, int offset,
                               dcerpc_info *di, guint8 *drep, int hf_index, int levels _U_,
                               gboolean add_subtree)
 {
-    proto_item *item;
     proto_tree *subtree = tree;
 
     if (add_subtree) {
 
-        item = proto_tree_add_text(
-            tree, tvb, offset, 0, "%s",
+        subtree = proto_tree_add_subtree(
+            tree, tvb, offset, 0, ett_LM_OWF_PASSWORD, NULL,
             proto_registrar_get_name(hf_index));
-
-        subtree = proto_item_add_subtree(item,ett_LM_OWF_PASSWORD);
     }
 
     return dissect_ndr_lm_nt_hash_cb(
@@ -999,9 +996,8 @@ netlogon_dissect_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "IDENTITY_INFO:");
-        tree = proto_item_add_subtree(item, ett_IDENTITY_INFO);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_IDENTITY_INFO, &item, "IDENTITY_INFO:");
     }
 
     /* XXX: It would be nice to get the domain and account name
@@ -1056,9 +1052,8 @@ netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
     }
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 16,
-                                   "LM_OWF_PASSWORD:");
-        tree = proto_item_add_subtree(item, ett_LM_OWF_PASSWORD);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 16,
+                                   ett_LM_OWF_PASSWORD, &item, "LM_OWF_PASSWORD:");
     }
 
     proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16,
@@ -1087,9 +1082,8 @@ netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
     }
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 16,
-                                   "NT_OWF_PASSWORD:");
-        tree = proto_item_add_subtree(item, ett_NT_OWF_PASSWORD);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 16,
+                                   ett_NT_OWF_PASSWORD, &item, "NT_OWF_PASSWORD:");
     }
 
     proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16,
@@ -1461,9 +1455,8 @@ netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
     proto_tree *tree=NULL;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "GROUP_MEMBERSHIP:");
-        tree = proto_item_add_subtree(item, ett_GROUP_MEMBERSHIP);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_GROUP_MEMBERSHIP, &item, "GROUP_MEMBERSHIP:");
     }
 
     offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -3404,9 +3397,8 @@ netlogon_dissect_QUOTA_LIMITS(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "QUOTA_LIMTS:");
-        tree = proto_item_add_subtree(item, ett_QUOTA_LIMITS);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_QUOTA_LIMITS, &item, "QUOTA_LIMTS:");
     }
 
     offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -3778,9 +3770,8 @@ netlogon_dissect_CIPHER_VALUE(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "%s", name);
-        tree = proto_item_add_subtree(item, ett_CYPHER_VALUE);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_CYPHER_VALUE, &item, name);
     }
 
     offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep,
@@ -3971,9 +3962,8 @@ netlogon_dissect_DELTA_UNION(tvbuff_t *tvb, int offset,
     guint16 level = 0;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "DELTA_UNION:");
-        tree = proto_item_add_subtree(item, ett_DELTA_UNION);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_DELTA_UNION, &item, "DELTA_UNION:");
     }
 
     offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep,
@@ -4105,9 +4095,8 @@ netlogon_dissect_DELTA_ID_UNION(tvbuff_t *tvb, int offset,
     guint16 level = 0;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "DELTA_ID_UNION:");
-        tree = proto_item_add_subtree(item, ett_DELTA_ID_UNION);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_DELTA_ID_UNION, &item, "DELTA_ID_UNION:");
     }
 
     offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep,
@@ -4220,9 +4209,8 @@ netlogon_dissect_DELTA_ENUM(tvbuff_t *tvb, int offset,
     guint16 type;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "DELTA_ENUM:");
-        tree = proto_item_add_subtree(item, ett_DELTA_ENUM);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_DELTA_ENUM, &item, "DELTA_ENUM:");
     }
 
     offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep,
@@ -5588,9 +5576,8 @@ netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "UNICODE_MULTI:");
-        tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_UNICODE_MULTI, &item, "UNICODE_MULTI:");
     }
 
     offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -5614,9 +5601,8 @@ netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "DOMAIN_CONTROLLER_INFO:");
-        tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_DOMAIN_CONTROLLER_INFO, &item, "DOMAIN_CONTROLLER_INFO:");
     }
 
     offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep,
@@ -5720,11 +5706,9 @@ dissect_ndr_ulongs_as_counted_string(tvbuff_t *tvb, int offset,
 
     if (add_subtree) {
 
-        item = proto_tree_add_text(
-            tree, tvb, offset, 0, "%s",
+        subtree = proto_tree_add_subtree(
+            tree, tvb, offset, 0, ett_nt_counted_longs_as_string, &item,
             proto_registrar_get_name(hf_index));
-
-        subtree = proto_item_add_subtree(item, ett_nt_counted_longs_as_string);
     }
     /* Structure starts with short, but is aligned for longs */
     ALIGN_TO_4_BYTES;
@@ -5802,9 +5786,8 @@ netlogon_dissect_ONE_DOMAIN_INFO(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "ONE_DOMAIN_INFO");
-        tree = proto_item_add_subtree(item, ett_DOMAIN_TRUST_INFO);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_DOMAIN_TRUST_INFO, &item, "ONE_DOMAIN_INFO");
     }
 /*hf_netlogon_dnsdomaininfo*/
     offset = dissect_part_DnsDomainInfo(tvb, offset, pinfo, tree, di, drep, 0, 0);
@@ -5865,9 +5848,8 @@ netlogon_dissect_LSA_POLICY_INFO(tvbuff_t *tvb _U_, int offset,
     }
 
     if(tree){
-        item = proto_tree_add_text(tree, tvb, offset, 0,
-                                   "LSA Policy");
-        subtree = proto_item_add_subtree(item, ett_LSA_POLICY_INFO);
+        subtree = proto_tree_add_subtree(tree, tvb, offset, 0,
+                                   ett_LSA_POLICY_INFO, &item, "LSA Policy");
     }
     offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
                                 hf_netlogon_lsapolicy_len, &len);
@@ -6036,9 +6018,8 @@ netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
     int i;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "UNICODE_STRING_512:");
-        tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_UNICODE_STRING_512, &item, "UNICODE_STRING_512:");
     }
 
     for(i=0;i<512;i++){
@@ -6085,9 +6066,8 @@ netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "TYPE_50:");
-        tree = proto_item_add_subtree(item, ett_TYPE_50);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_TYPE_50, &item, "TYPE_50:");
     }
 
     offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -6123,9 +6103,8 @@ netlogon_dissect_DS_DOMAIN_TRUSTS(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "DS_DOMAIN_TRUSTS");
-        tree = proto_item_add_subtree(item, ett_DS_DOMAIN_TRUSTS);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_DS_DOMAIN_TRUSTS, NULL, "DS_DOMAIN_TRUSTS");
     }
 
     /* name */
@@ -6223,9 +6202,8 @@ netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
     int old_offset=offset;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "TYPE_52:");
-        tree = proto_item_add_subtree(item, ett_TYPE_52);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_TYPE_52, &item, "TYPE_52:");
     }
 
     offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -6266,9 +6244,8 @@ netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
     guint32 level = 0;
 
     if(parent_tree){
-        item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-                                   "TYPE_44:");
-        tree = proto_item_add_subtree(item, ett_TYPE_44);
+        tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+                                   ett_TYPE_44, &item, "TYPE_44:");
     }
 
     offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
@@ -7589,11 +7566,9 @@ static int dissect_secchan_nl_auth_message(tvbuff_t *tvb, int offset,
     int len;
 
     if (tree) {
-        item = proto_tree_add_text(
-            tree, tvb, offset, -1,
+        subtree = proto_tree_add_subtree(
+            tree, tvb, offset, -1, ett_secchan_nl_auth_message, &item,
             "Secure Channel NL_AUTH_MESSAGE");
-        subtree = proto_item_add_subtree(
-            item, ett_secchan_nl_auth_message);
     }
 
     /* We can't use the NDR routines as the DCERPC call data hasn't
diff --git a/epan/dissectors/packet-dcerpc-nspi.c b/epan/dissectors/packet-dcerpc-nspi.c
index ecf198f97b..2c8588abfd 100644
--- a/epan/dissectors/packet-dcerpc-nspi.c
+++ b/epan/dissectors/packet-dcerpc-nspi.c
@@ -58,116 +58,116 @@ static gint ett_nspi_SRowSet = -1;
 
 
 /* Header field declarations */
-static gint hf_nspi_NspiGetHierarchyInfo_unknown2 = -1;
-static gint hf_nspi_NspiGetProps_settings = -1;
-static gint hf_nspi_SRestriction_CTR_resAnd = -1;
-static gint hf_nspi_NspiDNToEph_instance_key = -1;
-static gint hf_nspi_SBinaryArray_cValues = -1;
+static gint hf_nspi_NspiDNToEph_size = -1;
 static gint hf_nspi_NspiGetProps_flag = -1;
-static gint hf_nspi_SLPSTRArray_cValues = -1;
-static gint hf_nspi_MV_UNICODE_STRUCT_lpi = -1;
-static gint hf_nspi_NAME_STRING_str = -1;
-static gint hf_nspi_NspiGetMatches_PropTagArray = -1;
+static gint hf_nspi_NspiGetMatches_instance_key = -1;
+static gint hf_nspi_MAPINAMEID_lpguid = -1;
+static gint hf_nspi_SDateTimeArray_cValues = -1;
 static gint hf_nspi_SPropTagArray_cValues = -1;
+static gint hf_nspi_NspiGetProps_REPL_values = -1;
+static gint hf_nspi_SRow_cValues = -1;
+static gint hf_nspi_NspiGetProps_REQ_properties = -1;
+static gint hf_nspi_SSortOrder_ulOrder = -1;
+static gint hf_nspi_SGuidArray_cValues = -1;
+static gint hf_nspi_SSortOrderSet_cExpanded = -1;
 static gint hf_nspi_SPropertyRestriction_lpProp = -1;
-static gint hf_nspi_SPropValue_CTR_err = -1;
-static gint hf_nspi_NspiDNToEph_size = -1;
-static gint hf_nspi_MAPI_SETTINGS_codepage = -1;
-static gint hf_nspi_instance_key_value = -1;
-static gint hf_nspi_SAndRestriction_lpRes = -1;
-static gint hf_nspi_SRowSet_aRow = -1;
-static gint hf_nspi_SRowSet_cRows = -1;
-static gint hf_nspi_NspiGetHierarchyInfo_RowSet = -1;
-static gint hf_nspi_opnum = -1;
-static gint hf_nspi_NspiGetMatches_instance_key = -1;
-static gint hf_nspi_SRestriction_CTR_resProperty = -1;
-static gint hf_nspi_NspiGetMatches_settings = -1;
-static gint hf_nspi_NspiBind_settings = -1;
-static gint hf_nspi_SBinaryArray_lpbin = -1;
-static gint hf_nspi_SSortOrderSet_aSort = -1;
+static gint hf_nspi_SSortOrderSet_cSorts = -1;
+static gint hf_nspi_SBinary_cb = -1;
+static gint hf_nspi_SRestriction_CTR_resAnd = -1;
+static gint hf_nspi_SDateTimeArray_lpft = -1;
+static gint hf_nspi_SPropValue_CTR_MVbin = -1;
+static gint hf_nspi_MV_UNICODE_STRUCT_cValues = -1;
+static gint hf_nspi_MAPI_SETTINGS_service_provider = -1;
+static gint hf_nspi_NspiQueryRows_instance_key = -1;
+static gint hf_nspi_SGuidArray_lpguid = -1;
+static gint hf_nspi_NspiQueryRows_unknown = -1;
+static gint hf_nspi_MV_UNICODE_STRUCT_lpi = -1;
+static gint hf_nspi_NspiDNToEph_flag = -1;
+static gint hf_nspi_LPSTR_lppszA = -1;
 static gint hf_nspi_SPropValue_CTR_b = -1;
-static gint hf_nspi_SPropValue_CTR_i = -1;
+static gint hf_nspi_MAPINAMEID_lID = -1;
+static gint hf_nspi_NspiGetMatches_unknown2 = -1;
+static gint hf_nspi_NspiQueryRows_REQ_properties = -1;
+static gint hf_nspi_NspiQueryRows_flag = -1;
+static gint hf_nspi_SBinaryArray_cValues = -1;
+static gint hf_nspi_instance_key_cValues = -1;
+static gint hf_nspi_NspiQueryRows_settings = -1;
+static gint hf_nspi_SPropValue_CTR_MVft = -1;
+static gint hf_nspi_SPropValue_CTR_err = -1;
+static gint hf_nspi_MAPI_SETTINGS_handle = -1;
+static gint hf_nspi_NspiGetProps_settings = -1;
+static gint hf_nspi_SPropValue_CTR_bin = -1;
+static gint hf_nspi_NspiGetMatches_PropTagArray = -1;
 static gint hf_nspi_NspiGetMatches_restrictions = -1;
+static gint hf_nspi_SRestriction_PTTYPE = -1;
+static gint hf_nspi_SPropertyRestriction_relop = -1;
+static gint hf_nspi_NspiBind_mapiuid = -1;
+static gint hf_nspi_input_locale_method = -1;
+static gint hf_nspi_NspiGetHierarchyInfo_unknown1 = -1;
+static gint hf_nspi_property_type = -1;
+static gint hf_nspi_SSortOrderSet_cCategories = -1;
+static gint hf_nspi_SPropTagArray_aulPropTag = -1;
+static gint hf_nspi_instance_key_value = -1;
+static gint hf_nspi_MV_LONG_STRUCT_lpl = -1;
 static gint hf_nspi_SPropValue_CTR_MVguid = -1;
+static gint hf_nspi_NspiDNToEph_instance_key = -1;
+static gint hf_nspi_MAPINAMEID_ulKind = -1;
+static gint hf_nspi_SAndRestriction_lpRes = -1;
 static gint hf_nspi_NspiGetMatches_unknown1 = -1;
-static gint hf_nspi_SShortArray_lpi = -1;
+static gint hf_nspi_SPropValue_CTR_MVszA = -1;
+static gint hf_nspi_SSortOrderSet_aSort = -1;
+static gint hf_nspi_SPropValue_ulPropTag = -1;
+static gint hf_nspi_SPropValue_CTR_object = -1;
+static gint hf_nspi_input_locale_language = -1;
+static gint hf_nspi_SSortOrder_ulPropTag = -1;
+static gint hf_nspi_SPropertyRestriction_ulPropTag = -1;
+static gint hf_nspi_NspiBind_unknown = -1;
+static gint hf_nspi_SPropValue_CTR_MVszW = -1;
+static gint hf_nspi_opnum = -1;
 static gint hf_nspi_NspiGetMatches_REQ_properties = -1;
-static gint hf_nspi_MV_LONG_STRUCT_cValues = -1;
-static gint hf_nspi_SPropValue_CTR_lpguid = -1;
-static gint hf_nspi_LPSTR_lppszA = -1;
-static gint hf_nspi_SPropValue_CTR_ft = -1;
-static gint hf_nspi_NspiGetProps_REQ_properties = -1;
-static gint hf_nspi_NspiQueryRows_RowSet = -1;
-static gint hf_nspi_MAPISTATUS_status = -1;
-static gint hf_nspi_SRow_lpProps = -1;
-static gint hf_nspi_instance_key_cValues = -1;
-static gint hf_nspi_NspiQueryRows_settings = -1;
 static gint hf_nspi_SPropValue_CTR_MVl = -1;
-static gint hf_nspi_SDateTimeArray_lpft = -1;
-static gint hf_nspi_SPropValue_CTR_MVszA = -1;
-static gint hf_nspi_NspiGetHierarchyInfo_unknown1 = -1;
-static gint hf_nspi_MV_LONG_STRUCT_lpl = -1;
-static gint hf_nspi_handle = -1;
-static gint hf_nspi_SSortOrderSet_cSorts = -1;
-static gint hf_nspi_NspiQueryRows_REQ_properties = -1;
-static gint hf_nspi_SPropValue_CTR_MVbin = -1;
-static gint hf_nspi_NspiGetHierarchyInfo_settings = -1;
-static gint hf_nspi_SRow_cValues = -1;
-static gint hf_nspi_MAPINAMEID_lpguid = -1;
+static gint hf_nspi_NspiGetMatches_settings = -1;
+static gint hf_nspi_NspiGetMatches_RowSet = -1;
+static gint hf_nspi_SPropValue_CTR_lpszA = -1;
+static gint hf_nspi_MAPI_SETTINGS_flag = -1;
 static gint hf_nspi_NspiUnbind_status = -1;
-static gint hf_nspi_FILETIME_dwHighDateTime = -1;
-static gint hf_nspi_SGuidArray_cValues = -1;
-static gint hf_nspi_SPropValue_CTR_MVszW = -1;
-static gint hf_nspi_SPropertyRestriction_relop = -1;
-static gint hf_nspi_NspiQueryRows_unknown = -1;
-static gint hf_nspi_SPropTagArray_aulPropTag = -1;
-static gint hf_nspi_NspiQueryRows_flag = -1;
-static gint hf_nspi_NspiQueryRows_lRows = -1;
 static gint hf_nspi_SRow_ulAdrEntryPad = -1;
-static gint hf_nspi_SBinary_cb = -1;
-static gint hf_nspi_NspiGetMatches_RowSet = -1;
-static gint hf_nspi_SPropValue_CTR_null = -1;
+static gint hf_nspi_SPropValue_CTR_lpszW = -1;
 static gint hf_nspi_SShortArray_cValues = -1;
-static gint hf_nspi_SPropValue_CTR_bin = -1;
-static gint hf_nspi_input_locale_language = -1;
-static gint hf_nspi_SPropValue_CTR_MVft = -1;
-static gint hf_nspi_NspiGetMatches_unknown2 = -1;
-static gint hf_nspi_input_locale_method = -1;
-static gint hf_nspi_SSortOrderSet_cCategories = -1;
-static gint hf_nspi_SPropertyRestriction_ulPropTag = -1;
-static gint hf_nspi_SBinary_lpb = -1;
-static gint hf_nspi_SPropValue_CTR_l = -1;
-static gint hf_nspi_NspiDNToEph_flag = -1;
-static gint hf_nspi_SDateTimeArray_cValues = -1;
-static gint hf_nspi_SPropValue_CTR_MVi = -1;
-static gint hf_nspi_MAPINAMEID_ulKind = -1;
-static gint hf_nspi_SRestriction_PTTYPE = -1;
+static gint hf_nspi_MAPI_SETTINGS_codepage = -1;
+static gint hf_nspi_SPropValue_dwAlignPad = -1;
 static gint hf_nspi_MAPI_SETTINGS_input_locale = -1;
-static gint hf_nspi_NspiBind_mapiuid = -1;
-static gint hf_nspi_NspiGetProps_REPL_values = -1;
-static gint hf_nspi_MV_UNICODE_STRUCT_cValues = -1;
-static gint hf_nspi_MAPI_SETTINGS_flag = -1;
-static gint hf_nspi_SLPSTRArray_strings = -1;
-static gint hf_nspi_SSortOrder_ulOrder = -1;
-static gint hf_nspi_SPropValue_CTR_lpszA = -1;
-static gint hf_nspi_MAPIUID_ab = -1;
-static gint hf_nspi_SSortOrder_ulPropTag = -1;
-static gint hf_nspi_MAPI_SETTINGS_service_provider = -1;
+static gint hf_nspi_FILETIME_dwHighDateTime = -1;
+static gint hf_nspi_FILETIME_dwLowDateTime = -1;
 static gint hf_nspi_NspiDNToEph_server_dn = -1;
-static gint hf_nspi_SSortOrderSet_cExpanded = -1;
-static gint hf_nspi_NspiGetMatches_unknown3 = -1;
-static gint hf_nspi_MAPI_SETTINGS_handle = -1;
+static gint hf_nspi_SPropValue_CTR_i = -1;
+static gint hf_nspi_SLPSTRArray_strings = -1;
+static gint hf_nspi_MV_LONG_STRUCT_cValues = -1;
 static gint hf_nspi_SAndRestriction_cRes = -1;
-static gint hf_nspi_SPropValue_CTR_lpszW = -1;
-static gint hf_nspi_NspiBind_unknown = -1;
-static gint hf_nspi_FILETIME_dwLowDateTime = -1;
-static gint hf_nspi_SPropValue_dwAlignPad = -1;
-static gint hf_nspi_property_type = -1;
-static gint hf_nspi_MAPINAMEID_lID = -1;
-static gint hf_nspi_SPropValue_ulPropTag = -1;
-static gint hf_nspi_NspiQueryRows_instance_key = -1;
-static gint hf_nspi_SPropValue_CTR_object = -1;
-static gint hf_nspi_SGuidArray_lpguid = -1;
+static gint hf_nspi_SRow_lpProps = -1;
+static gint hf_nspi_NspiGetMatches_unknown3 = -1;
+static gint hf_nspi_NspiQueryRows_lRows = -1;
+static gint hf_nspi_SLPSTRArray_cValues = -1;
+static gint hf_nspi_SRowSet_aRow = -1;
+static gint hf_nspi_NspiGetHierarchyInfo_RowSet = -1;
+static gint hf_nspi_NAME_STRING_str = -1;
+static gint hf_nspi_MAPISTATUS_status = -1;
+static gint hf_nspi_NspiGetHierarchyInfo_settings = -1;
+static gint hf_nspi_NspiQueryRows_RowSet = -1;
+static gint hf_nspi_SPropValue_CTR_l = -1;
+static gint hf_nspi_SBinary_lpb = -1;
+static gint hf_nspi_handle = -1;
+static gint hf_nspi_NspiGetHierarchyInfo_unknown2 = -1;
+static gint hf_nspi_MAPIUID_ab = -1;
+static gint hf_nspi_SRestriction_CTR_resProperty = -1;
+static gint hf_nspi_NspiBind_settings = -1;
+static gint hf_nspi_SPropValue_CTR_lpguid = -1;
+static gint hf_nspi_SPropValue_CTR_ft = -1;
+static gint hf_nspi_SBinaryArray_lpbin = -1;
+static gint hf_nspi_SRowSet_cRows = -1;
+static gint hf_nspi_SPropValue_CTR_null = -1;
+static gint hf_nspi_SPropValue_CTR_MVi = -1;
+static gint hf_nspi_SShortArray_lpi = -1;
 
 static gint proto_dcerpc_nspi = -1;
 /* Version information */
@@ -7572,7 +7572,7 @@ nspi_dissect_struct_MAPI_SETTINGS(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 
 /* IDL: struct { */
-/* IDL: 	[length_is(cValues-1)] [unique(1)] [size_is(cValues-1)] MAPITAGS *aulPropTag; */
+/* IDL: 	[unique(1)] [size_is(cValues-1)] [length_is(cValues-1)] MAPITAGS *aulPropTag; */
 /* IDL: 	uint32 cValues; */
 /* IDL: } */
 
@@ -7641,7 +7641,7 @@ nspi_dissect_struct_SPropTagArray(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 
 /* IDL: struct { */
-/* IDL: 	[unique(1)] [length_is(cValues-1)] [size_is(cValues-1)] uint32 *value; */
+/* IDL: 	[unique(1)] [size_is(cValues-1)] [length_is(cValues-1)] uint32 *value; */
 /* IDL: 	uint32 cValues; */
 /* IDL: } */
 
@@ -7982,8 +7982,7 @@ nspi_dissect_SRestriction_CTR(tvbuff_t *tvb _U_, int offset _U_, packet_info *pi
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "SRestriction_CTR");
-		tree = proto_item_add_subtree(item, ett_nspi_SRestriction_CTR);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_nspi_SRestriction_CTR, &item, "SRestriction_CTR");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -8427,7 +8426,7 @@ nspi_dissect_struct_FILETIME(tvbuff_t *tvb _U_, int offset _U_, packet_info *pin
 
 /* IDL: struct { */
 /* IDL: 	uint32 cValues; */
-/* IDL: 	[unique(1)] [size_is(cValues)] uint16 *lpi; */
+/* IDL: 	[size_is(cValues)] [unique(1)] uint16 *lpi; */
 /* IDL: } */
 
 static int
@@ -8496,7 +8495,7 @@ nspi_dissect_struct_SShortArray(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 
 /* IDL: struct { */
 /* IDL: 	uint32 cValues; */
-/* IDL: 	[unique(1)] [size_is(cValues)] uint32 *lpl; */
+/* IDL: 	[size_is(cValues)] [unique(1)] uint32 *lpl; */
 /* IDL: } */
 
 static int
@@ -8610,7 +8609,7 @@ nspi_dissect_struct_LPSTR(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo
 
 /* IDL: struct { */
 /* IDL: 	uint32 cValues; */
-/* IDL: 	[unique(1)] [size_is(cValues)] LPSTR **strings; */
+/* IDL: 	[size_is(cValues)] [unique(1)] LPSTR **strings; */
 /* IDL: } */
 
 static int
@@ -8687,7 +8686,7 @@ nspi_dissect_struct_SLPSTRArray(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 
 /* IDL: struct { */
 /* IDL: 	uint32 cValues; */
-/* IDL: 	[size_is(cValues)] [unique(1)] SBinary *lpbin; */
+/* IDL: 	[unique(1)] [size_is(cValues)] SBinary *lpbin; */
 /* IDL: } */
 
 static int
@@ -8756,7 +8755,7 @@ nspi_dissect_struct_SBinaryArray(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 /* IDL: struct { */
 /* IDL: 	uint32 cValues; */
-/* IDL: 	[unique(1)] [size_is(cValues)] uint32 *lpguid; */
+/* IDL: 	[size_is(cValues)] [unique(1)] uint32 *lpguid; */
 /* IDL: } */
 
 static int
@@ -8966,8 +8965,8 @@ nspi_dissect_struct_SDateTimeArray(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 /* IDL: [case(PT_BOOLEAN)] [case(PT_BOOLEAN)] uint16 b; */
 /* IDL: [case(PT_STRING8)] [case(PT_STRING8)] [unique(1)] [charset(DOS)] uint8 *lpszA; */
 /* IDL: [case(PT_BINARY)] [case(PT_BINARY)] SBinary bin; */
-/* IDL: [case(PT_UNICODE)] [charset(UTF16)] [unique(1)] [case(PT_UNICODE)] uint16 *lpszW; */
-/* IDL: [case(PT_CLSID)] [case(PT_CLSID)] [unique(1)] MAPIUID *lpguid; */
+/* IDL: [case(PT_UNICODE)] [case(PT_UNICODE)] [unique(1)] [charset(UTF16)] uint16 *lpszW; */
+/* IDL: [case(PT_CLSID)] [unique(1)] [case(PT_CLSID)] MAPIUID *lpguid; */
 /* IDL: [case(PT_SYSTIME)] [case(PT_SYSTIME)] FILETIME ft; */
 /* IDL: [case(PT_ERROR)] [case(PT_ERROR)] MAPISTATUS err; */
 /* IDL: [case(PT_MV_I2)] [case(PT_MV_I2)] SShortArray MVi; */
@@ -9165,8 +9164,7 @@ nspi_dissect_SPropValue_CTR(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "SPropValue_CTR");
-		tree = proto_item_add_subtree(item, ett_nspi_SPropValue_CTR);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_nspi_SPropValue_CTR, &item, "SPropValue_CTR");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -9514,7 +9512,7 @@ nspi_dissect_element_NspiBind_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_
 
 /* IDL: MAPISTATUS NspiBind( */
 /* IDL: [in] uint32 unknown, */
-/* IDL: [ref] [in] MAPI_SETTINGS *settings, */
+/* IDL: [in] [ref] MAPI_SETTINGS *settings, */
 /* IDL: [out] [unique(1)] [in] GUID *mapiuid, */
 /* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
@@ -9750,7 +9748,7 @@ nspi_dissect_element_NspiQueryRows_RowSet__(tvbuff_t *tvb _U_, int offset _U_, p
 /* IDL: [in] uint32 flag, */
 /* IDL: [ref] [in] [out] MAPI_SETTINGS *settings, */
 /* IDL: [in] uint32 lRows, */
-/* IDL: [unique(1)] [in] [size_is(lRows)] uint32 *instance_key, */
+/* IDL: [size_is(lRows)] [in] [unique(1)] uint32 *instance_key, */
 /* IDL: [in] uint32 unknown, */
 /* IDL: [ref] [in] SPropTagArray *REQ_properties, */
 /* IDL: [ref] [out] SRowSet **RowSet */
@@ -9959,16 +9957,16 @@ nspi_dissect_element_NspiGetMatches_RowSet__(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: MAPISTATUS NspiGetMatches( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] uint32 unknown1, */
-/* IDL: [out] [ref] [in] MAPI_SETTINGS *settings, */
-/* IDL: [unique(1)] [in] SPropTagArray *PropTagArray, */
+/* IDL: [in] [ref] [out] MAPI_SETTINGS *settings, */
+/* IDL: [in] [unique(1)] SPropTagArray *PropTagArray, */
 /* IDL: [in] uint32 unknown2, */
-/* IDL: [unique(1)] [in] SRestriction *restrictions, */
+/* IDL: [in] [unique(1)] SRestriction *restrictions, */
 /* IDL: [in] uint32 unknown3, */
 /* IDL: [out] [ref] instance_key *instance_key, */
-/* IDL: [in] [unique(1)] SPropTagArray *REQ_properties, */
-/* IDL: [out] [ref] SRowSet **RowSet */
+/* IDL: [unique(1)] [in] SPropTagArray *REQ_properties, */
+/* IDL: [ref] [out] SRowSet **RowSet */
 /* IDL: ); */
 
 static int
@@ -10107,10 +10105,10 @@ nspi_dissect_element_NspiDNToEph_instance_key_(tvbuff_t *tvb _U_, int offset _U_
 }
 
 /* IDL: MAPISTATUS NspiDNToEph( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] uint32 flag, */
 /* IDL: [in] uint32 size, */
-/* IDL: [in] [size_is(size)] [ref] NAME_STRING *server_dn, */
+/* IDL: [ref] [size_is(size)] [in] NAME_STRING *server_dn, */
 /* IDL: [ref] [out] instance_key *instance_key */
 /* IDL: ); */
 
@@ -10244,10 +10242,10 @@ nspi_dissect_element_NspiGetProps_REPL_values__(tvbuff_t *tvb _U_, int offset _U
 }
 
 /* IDL: MAPISTATUS NspiGetProps( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] uint32 flag, */
 /* IDL: [in] [ref] MAPI_SETTINGS *settings, */
-/* IDL: [in] [ref] SPropTagArray *REQ_properties, */
+/* IDL: [ref] [in] SPropTagArray *REQ_properties, */
 /* IDL: [ref] [out] SRow **REPL_values */
 /* IDL: ); */
 
@@ -10399,7 +10397,7 @@ nspi_dissect_element_NspiGetHierarchyInfo_RowSet__(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: MAPISTATUS NspiGetHierarchyInfo( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] uint32 unknown1, */
 /* IDL: [ref] [in] MAPI_SETTINGS *settings, */
 /* IDL: [ref] [in] [out] uint32 *unknown2, */
@@ -10634,226 +10632,226 @@ static dcerpc_sub_dissector nspi_dissectors[] = {
 void proto_register_dcerpc_nspi(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_nspi_NspiGetHierarchyInfo_unknown2,
-	  { "Unknown2", "nspi.NspiGetHierarchyInfo.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetProps_settings,
-	  { "Settings", "nspi.NspiGetProps.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SRestriction_CTR_resAnd,
-	  { "Resand", "nspi.SRestriction_CTR.resAnd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiDNToEph_instance_key,
-	  { "Instance Key", "nspi.NspiDNToEph.instance_key", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SBinaryArray_cValues,
-	  { "Cvalues", "nspi.SBinaryArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiDNToEph_size,
+		{ "Size", "nspi.NspiDNToEph.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_NspiGetProps_flag,
-	  { "Flag", "nspi.NspiGetProps.flag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SLPSTRArray_cValues,
-	  { "Cvalues", "nspi.SLPSTRArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MV_UNICODE_STRUCT_lpi,
-	  { "Lpi", "nspi.MV_UNICODE_STRUCT.lpi", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NAME_STRING_str,
-	  { "Str", "nspi.NAME_STRING.str", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetMatches_PropTagArray,
-	  { "Proptagarray", "nspi.NspiGetMatches.PropTagArray", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Flag", "nspi.NspiGetProps.flag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetMatches_instance_key,
+		{ "Instance Key", "nspi.NspiGetMatches.instance_key", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MAPINAMEID_lpguid,
+		{ "Lpguid", "nspi.MAPINAMEID.lpguid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SDateTimeArray_cValues,
+		{ "Cvalues", "nspi.SDateTimeArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_SPropTagArray_cValues,
-	  { "Cvalues", "nspi.SPropTagArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Cvalues", "nspi.SPropTagArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetProps_REPL_values,
+		{ "Repl Values", "nspi.NspiGetProps.REPL_values", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SRow_cValues,
+		{ "Cvalues", "nspi.SRow.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetProps_REQ_properties,
+		{ "Req Properties", "nspi.NspiGetProps.REQ_properties", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SSortOrder_ulOrder,
+		{ "Ulorder", "nspi.SSortOrder.ulOrder", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SGuidArray_cValues,
+		{ "Cvalues", "nspi.SGuidArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SSortOrderSet_cExpanded,
+		{ "Cexpanded", "nspi.SSortOrderSet.cExpanded", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_SPropertyRestriction_lpProp,
-	  { "Lpprop", "nspi.SPropertyRestriction.lpProp", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_err,
-	  { "Err", "nspi.SPropValue_CTR.err", FT_UINT32, BASE_DEC, VALS(nspi_MAPISTATUS_vals), 0, NULL, HFILL }},
-	{ &hf_nspi_NspiDNToEph_size,
-	  { "Size", "nspi.NspiDNToEph.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MAPI_SETTINGS_codepage,
-	  { "Codepage", "nspi.MAPI_SETTINGS.codepage", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_instance_key_value,
-	  { "Value", "nspi.instance_key.value", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SAndRestriction_lpRes,
-	  { "Lpres", "nspi.SAndRestriction.lpRes", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SRowSet_aRow,
-	  { "Arow", "nspi.SRowSet.aRow", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SRowSet_cRows,
-	  { "Crows", "nspi.SRowSet.cRows", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetHierarchyInfo_RowSet,
-	  { "Rowset", "nspi.NspiGetHierarchyInfo.RowSet", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_opnum,
-	  { "Operation", "nspi.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetMatches_instance_key,
-	  { "Instance Key", "nspi.NspiGetMatches.instance_key", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SRestriction_CTR_resProperty,
-	  { "Resproperty", "nspi.SRestriction_CTR.resProperty", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetMatches_settings,
-	  { "Settings", "nspi.NspiGetMatches.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiBind_settings,
-	  { "Settings", "nspi.NspiBind.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SBinaryArray_lpbin,
-	  { "Lpbin", "nspi.SBinaryArray.lpbin", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SSortOrderSet_aSort,
-	  { "Asort", "nspi.SSortOrderSet.aSort", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Lpprop", "nspi.SPropertyRestriction.lpProp", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SSortOrderSet_cSorts,
+		{ "Csorts", "nspi.SSortOrderSet.cSorts", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SBinary_cb,
+		{ "Cb", "nspi.SBinary.cb", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SRestriction_CTR_resAnd,
+		{ "Resand", "nspi.SRestriction_CTR.resAnd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SDateTimeArray_lpft,
+		{ "Lpft", "nspi.SDateTimeArray.lpft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_MVbin,
+		{ "Mvbin", "nspi.SPropValue_CTR.MVbin", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MV_UNICODE_STRUCT_cValues,
+		{ "Cvalues", "nspi.MV_UNICODE_STRUCT.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MAPI_SETTINGS_service_provider,
+		{ "Service Provider", "nspi.MAPI_SETTINGS.service_provider", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiQueryRows_instance_key,
+		{ "Instance Key", "nspi.NspiQueryRows.instance_key", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SGuidArray_lpguid,
+		{ "Lpguid", "nspi.SGuidArray.lpguid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiQueryRows_unknown,
+		{ "Unknown", "nspi.NspiQueryRows.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MV_UNICODE_STRUCT_lpi,
+		{ "Lpi", "nspi.MV_UNICODE_STRUCT.lpi", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiDNToEph_flag,
+		{ "Flag", "nspi.NspiDNToEph.flag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_LPSTR_lppszA,
+		{ "Lppsza", "nspi.LPSTR.lppszA", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_SPropValue_CTR_b,
-	  { "B", "nspi.SPropValue_CTR.b", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_i,
-	  { "I", "nspi.SPropValue_CTR.i", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "B", "nspi.SPropValue_CTR.b", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MAPINAMEID_lID,
+		{ "Lid", "nspi.MAPINAMEID.lID", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetMatches_unknown2,
+		{ "Unknown2", "nspi.NspiGetMatches.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiQueryRows_REQ_properties,
+		{ "Req Properties", "nspi.NspiQueryRows.REQ_properties", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiQueryRows_flag,
+		{ "Flag", "nspi.NspiQueryRows.flag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SBinaryArray_cValues,
+		{ "Cvalues", "nspi.SBinaryArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_instance_key_cValues,
+		{ "Cvalues", "nspi.instance_key.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiQueryRows_settings,
+		{ "Settings", "nspi.NspiQueryRows.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_MVft,
+		{ "Mvft", "nspi.SPropValue_CTR.MVft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_err,
+		{ "Err", "nspi.SPropValue_CTR.err", FT_UINT32, BASE_DEC, VALS(nspi_MAPISTATUS_vals), 0, NULL, HFILL }},
+	{ &hf_nspi_MAPI_SETTINGS_handle,
+		{ "Handle", "nspi.MAPI_SETTINGS.handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetProps_settings,
+		{ "Settings", "nspi.NspiGetProps.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_bin,
+		{ "Bin", "nspi.SPropValue_CTR.bin", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetMatches_PropTagArray,
+		{ "Proptagarray", "nspi.NspiGetMatches.PropTagArray", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_NspiGetMatches_restrictions,
-	  { "Restrictions", "nspi.NspiGetMatches.restrictions", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Restrictions", "nspi.NspiGetMatches.restrictions", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SRestriction_PTTYPE,
+		{ "Restriction Type", "nspi.property_type", FT_UINT32, BASE_HEX, VALS(nspi_nspi_RestrictionType_vals), 0, NULL, HFILL }},
+	{ &hf_nspi_SPropertyRestriction_relop,
+		{ "Relop", "nspi.SPropertyRestriction.relop", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiBind_mapiuid,
+		{ "Mapiuid", "nspi.NspiBind.mapiuid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_input_locale_method,
+		{ "Method", "nspi.input_locale.method", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetHierarchyInfo_unknown1,
+		{ "Unknown1", "nspi.NspiGetHierarchyInfo.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_property_type,
+		{ "Value", "nspi.SPropValue.value", FT_UINT32, BASE_HEX, VALS(nspi_property_types_vals), 0, NULL, HFILL }},
+	{ &hf_nspi_SSortOrderSet_cCategories,
+		{ "Ccategories", "nspi.SSortOrderSet.cCategories", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropTagArray_aulPropTag,
+		{ "Aulproptag", "nspi.SPropTagArray.aulPropTag", FT_UINT32, BASE_DEC, VALS(nspi_MAPITAGS_vals), 0, NULL, HFILL }},
+	{ &hf_nspi_instance_key_value,
+		{ "Value", "nspi.instance_key.value", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MV_LONG_STRUCT_lpl,
+		{ "Lpl", "nspi.MV_LONG_STRUCT.lpl", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_SPropValue_CTR_MVguid,
-	  { "Mvguid", "nspi.SPropValue_CTR.MVguid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Mvguid", "nspi.SPropValue_CTR.MVguid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiDNToEph_instance_key,
+		{ "Instance Key", "nspi.NspiDNToEph.instance_key", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MAPINAMEID_ulKind,
+		{ "Ulkind", "nspi.MAPINAMEID.ulKind", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SAndRestriction_lpRes,
+		{ "Lpres", "nspi.SAndRestriction.lpRes", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_NspiGetMatches_unknown1,
-	  { "Unknown1", "nspi.NspiGetMatches.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SShortArray_lpi,
-	  { "Lpi", "nspi.SShortArray.lpi", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown1", "nspi.NspiGetMatches.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_MVszA,
+		{ "Mvsza", "nspi.SPropValue_CTR.MVszA", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SSortOrderSet_aSort,
+		{ "Asort", "nspi.SSortOrderSet.aSort", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_ulPropTag,
+		{ "Ulproptag", "nspi.SPropValue.ulPropTag", FT_UINT32, BASE_DEC, VALS(nspi_MAPITAGS_vals), 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_object,
+		{ "Object", "nspi.SPropValue_CTR.object", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_input_locale_language,
+		{ "Language", "nspi.input_locale.language", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SSortOrder_ulPropTag,
+		{ "Ulproptag", "nspi.SSortOrder.ulPropTag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropertyRestriction_ulPropTag,
+		{ "Ulproptag", "nspi.SPropertyRestriction.ulPropTag", FT_UINT32, BASE_DEC, VALS(nspi_MAPITAGS_vals), 0, NULL, HFILL }},
+	{ &hf_nspi_NspiBind_unknown,
+		{ "Unknown", "nspi.NspiBind.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_MVszW,
+		{ "Mvszw", "nspi.SPropValue_CTR.MVszW", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_opnum,
+		{ "Operation", "nspi.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_NspiGetMatches_REQ_properties,
-	  { "Req Properties", "nspi.NspiGetMatches.REQ_properties", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MV_LONG_STRUCT_cValues,
-	  { "Cvalues", "nspi.MV_LONG_STRUCT.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_lpguid,
-	  { "Lpguid", "nspi.SPropValue_CTR.lpguid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_LPSTR_lppszA,
-	  { "Lppsza", "nspi.LPSTR.lppszA", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_ft,
-	  { "Ft", "nspi.SPropValue_CTR.ft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetProps_REQ_properties,
-	  { "Req Properties", "nspi.NspiGetProps.REQ_properties", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiQueryRows_RowSet,
-	  { "Rowset", "nspi.NspiQueryRows.RowSet", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MAPISTATUS_status,
-	  { "MAPISTATUS", "nspi.MAPISTATUS_status", FT_UINT32, BASE_HEX, VALS(nspi_MAPISTATUS_vals), 0, NULL, HFILL }},
-	{ &hf_nspi_SRow_lpProps,
-	  { "Lpprops", "nspi.SRow.lpProps", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_instance_key_cValues,
-	  { "Cvalues", "nspi.instance_key.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiQueryRows_settings,
-	  { "Settings", "nspi.NspiQueryRows.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Req Properties", "nspi.NspiGetMatches.REQ_properties", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_SPropValue_CTR_MVl,
-	  { "Mvl", "nspi.SPropValue_CTR.MVl", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SDateTimeArray_lpft,
-	  { "Lpft", "nspi.SDateTimeArray.lpft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_MVszA,
-	  { "Mvsza", "nspi.SPropValue_CTR.MVszA", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetHierarchyInfo_unknown1,
-	  { "Unknown1", "nspi.NspiGetHierarchyInfo.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MV_LONG_STRUCT_lpl,
-	  { "Lpl", "nspi.MV_LONG_STRUCT.lpl", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_handle,
-	  { "Handle", "nspi.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SSortOrderSet_cSorts,
-	  { "Csorts", "nspi.SSortOrderSet.cSorts", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiQueryRows_REQ_properties,
-	  { "Req Properties", "nspi.NspiQueryRows.REQ_properties", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_MVbin,
-	  { "Mvbin", "nspi.SPropValue_CTR.MVbin", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetHierarchyInfo_settings,
-	  { "Settings", "nspi.NspiGetHierarchyInfo.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SRow_cValues,
-	  { "Cvalues", "nspi.SRow.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MAPINAMEID_lpguid,
-	  { "Lpguid", "nspi.MAPINAMEID.lpguid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Mvl", "nspi.SPropValue_CTR.MVl", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetMatches_settings,
+		{ "Settings", "nspi.NspiGetMatches.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetMatches_RowSet,
+		{ "Rowset", "nspi.NspiGetMatches.RowSet", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_lpszA,
+		{ "Lpsza", "nspi.SPropValue_CTR.lpszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MAPI_SETTINGS_flag,
+		{ "Flag", "nspi.MAPI_SETTINGS.flag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_NspiUnbind_status,
-	  { "Status", "nspi.NspiUnbind.status", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_FILETIME_dwHighDateTime,
-	  { "Dwhighdatetime", "nspi.FILETIME.dwHighDateTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SGuidArray_cValues,
-	  { "Cvalues", "nspi.SGuidArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_MVszW,
-	  { "Mvszw", "nspi.SPropValue_CTR.MVszW", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropertyRestriction_relop,
-	  { "Relop", "nspi.SPropertyRestriction.relop", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiQueryRows_unknown,
-	  { "Unknown", "nspi.NspiQueryRows.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropTagArray_aulPropTag,
-	  { "Aulproptag", "nspi.SPropTagArray.aulPropTag", FT_UINT32, BASE_DEC, VALS(nspi_MAPITAGS_vals), 0, NULL, HFILL }},
-	{ &hf_nspi_NspiQueryRows_flag,
-	  { "Flag", "nspi.NspiQueryRows.flag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiQueryRows_lRows,
-	  { "Lrows", "nspi.NspiQueryRows.lRows", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Status", "nspi.NspiUnbind.status", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_SRow_ulAdrEntryPad,
-	  { "Uladrentrypad", "nspi.SRow.ulAdrEntryPad", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SBinary_cb,
-	  { "Cb", "nspi.SBinary.cb", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetMatches_RowSet,
-	  { "Rowset", "nspi.NspiGetMatches.RowSet", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_null,
-	  { "Null", "nspi.SPropValue_CTR.null", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Uladrentrypad", "nspi.SRow.ulAdrEntryPad", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_lpszW,
+		{ "Lpszw", "nspi.SPropValue_CTR.lpszW", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_SShortArray_cValues,
-	  { "Cvalues", "nspi.SShortArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_bin,
-	  { "Bin", "nspi.SPropValue_CTR.bin", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_input_locale_language,
-	  { "Language", "nspi.input_locale.language", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_MVft,
-	  { "Mvft", "nspi.SPropValue_CTR.MVft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetMatches_unknown2,
-	  { "Unknown2", "nspi.NspiGetMatches.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_input_locale_method,
-	  { "Method", "nspi.input_locale.method", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SSortOrderSet_cCategories,
-	  { "Ccategories", "nspi.SSortOrderSet.cCategories", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropertyRestriction_ulPropTag,
-	  { "Ulproptag", "nspi.SPropertyRestriction.ulPropTag", FT_UINT32, BASE_DEC, VALS(nspi_MAPITAGS_vals), 0, NULL, HFILL }},
-	{ &hf_nspi_SBinary_lpb,
-	  { "Lpb", "nspi.SBinary.lpb", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_l,
-	  { "L", "nspi.SPropValue_CTR.l", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiDNToEph_flag,
-	  { "Flag", "nspi.NspiDNToEph.flag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SDateTimeArray_cValues,
-	  { "Cvalues", "nspi.SDateTimeArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_MVi,
-	  { "Mvi", "nspi.SPropValue_CTR.MVi", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MAPINAMEID_ulKind,
-	  { "Ulkind", "nspi.MAPINAMEID.ulKind", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SRestriction_PTTYPE,
-	  { "Restriction Type", "nspi.property_type", FT_UINT32, BASE_HEX, VALS(nspi_nspi_RestrictionType_vals), 0, NULL, HFILL }},
+		{ "Cvalues", "nspi.SShortArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MAPI_SETTINGS_codepage,
+		{ "Codepage", "nspi.MAPI_SETTINGS.codepage", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_dwAlignPad,
+		{ "Dwalignpad", "nspi.SPropValue.dwAlignPad", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_MAPI_SETTINGS_input_locale,
-	  { "Input Locale", "nspi.MAPI_SETTINGS.input_locale", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiBind_mapiuid,
-	  { "Mapiuid", "nspi.NspiBind.mapiuid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetProps_REPL_values,
-	  { "Repl Values", "nspi.NspiGetProps.REPL_values", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MV_UNICODE_STRUCT_cValues,
-	  { "Cvalues", "nspi.MV_UNICODE_STRUCT.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MAPI_SETTINGS_flag,
-	  { "Flag", "nspi.MAPI_SETTINGS.flag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SLPSTRArray_strings,
-	  { "Strings", "nspi.SLPSTRArray.strings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SSortOrder_ulOrder,
-	  { "Ulorder", "nspi.SSortOrder.ulOrder", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_lpszA,
-	  { "Lpsza", "nspi.SPropValue_CTR.lpszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MAPIUID_ab,
-	  { "Ab", "nspi.MAPIUID.ab", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SSortOrder_ulPropTag,
-	  { "Ulproptag", "nspi.SSortOrder.ulPropTag", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MAPI_SETTINGS_service_provider,
-	  { "Service Provider", "nspi.MAPI_SETTINGS.service_provider", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Input Locale", "nspi.MAPI_SETTINGS.input_locale", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_FILETIME_dwHighDateTime,
+		{ "Dwhighdatetime", "nspi.FILETIME.dwHighDateTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_FILETIME_dwLowDateTime,
+		{ "Dwlowdatetime", "nspi.FILETIME.dwLowDateTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_NspiDNToEph_server_dn,
-	  { "Server Dn", "nspi.NspiDNToEph.server_dn", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SSortOrderSet_cExpanded,
-	  { "Cexpanded", "nspi.SSortOrderSet.cExpanded", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiGetMatches_unknown3,
-	  { "Unknown3", "nspi.NspiGetMatches.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_MAPI_SETTINGS_handle,
-	  { "Handle", "nspi.MAPI_SETTINGS.handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Server Dn", "nspi.NspiDNToEph.server_dn", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_i,
+		{ "I", "nspi.SPropValue_CTR.i", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SLPSTRArray_strings,
+		{ "Strings", "nspi.SLPSTRArray.strings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MV_LONG_STRUCT_cValues,
+		{ "Cvalues", "nspi.MV_LONG_STRUCT.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_nspi_SAndRestriction_cRes,
-	  { "Cres", "nspi.SAndRestriction.cRes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_lpszW,
-	  { "Lpszw", "nspi.SPropValue_CTR.lpszW", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_NspiBind_unknown,
-	  { "Unknown", "nspi.NspiBind.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_FILETIME_dwLowDateTime,
-	  { "Dwlowdatetime", "nspi.FILETIME.dwLowDateTime", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_dwAlignPad,
-	  { "Dwalignpad", "nspi.SPropValue.dwAlignPad", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_property_type,
-	  { "Value", "nspi.SPropValue.value", FT_UINT32, BASE_HEX, VALS(nspi_property_types_vals), 0, NULL, HFILL }},
-	{ &hf_nspi_MAPINAMEID_lID,
-	  { "Lid", "nspi.MAPINAMEID.lID", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_ulPropTag,
-	  { "Ulproptag", "nspi.SPropValue.ulPropTag", FT_UINT32, BASE_DEC, VALS(nspi_MAPITAGS_vals), 0, NULL, HFILL }},
-	{ &hf_nspi_NspiQueryRows_instance_key,
-	  { "Instance Key", "nspi.NspiQueryRows.instance_key", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SPropValue_CTR_object,
-	  { "Object", "nspi.SPropValue_CTR.object", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_nspi_SGuidArray_lpguid,
-	  { "Lpguid", "nspi.SGuidArray.lpguid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Cres", "nspi.SAndRestriction.cRes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SRow_lpProps,
+		{ "Lpprops", "nspi.SRow.lpProps", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetMatches_unknown3,
+		{ "Unknown3", "nspi.NspiGetMatches.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiQueryRows_lRows,
+		{ "Lrows", "nspi.NspiQueryRows.lRows", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SLPSTRArray_cValues,
+		{ "Cvalues", "nspi.SLPSTRArray.cValues", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SRowSet_aRow,
+		{ "Arow", "nspi.SRowSet.aRow", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetHierarchyInfo_RowSet,
+		{ "Rowset", "nspi.NspiGetHierarchyInfo.RowSet", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NAME_STRING_str,
+		{ "Str", "nspi.NAME_STRING.str", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MAPISTATUS_status,
+		{ "MAPISTATUS", "nspi.MAPISTATUS_status", FT_UINT32, BASE_HEX, VALS(nspi_MAPISTATUS_vals), 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetHierarchyInfo_settings,
+		{ "Settings", "nspi.NspiGetHierarchyInfo.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiQueryRows_RowSet,
+		{ "Rowset", "nspi.NspiQueryRows.RowSet", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_l,
+		{ "L", "nspi.SPropValue_CTR.l", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SBinary_lpb,
+		{ "Lpb", "nspi.SBinary.lpb", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_handle,
+		{ "Handle", "nspi.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiGetHierarchyInfo_unknown2,
+		{ "Unknown2", "nspi.NspiGetHierarchyInfo.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_MAPIUID_ab,
+		{ "Ab", "nspi.MAPIUID.ab", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SRestriction_CTR_resProperty,
+		{ "Resproperty", "nspi.SRestriction_CTR.resProperty", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_NspiBind_settings,
+		{ "Settings", "nspi.NspiBind.settings", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_lpguid,
+		{ "Lpguid", "nspi.SPropValue_CTR.lpguid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_ft,
+		{ "Ft", "nspi.SPropValue_CTR.ft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SBinaryArray_lpbin,
+		{ "Lpbin", "nspi.SBinaryArray.lpbin", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SRowSet_cRows,
+		{ "Crows", "nspi.SRowSet.cRows", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_null,
+		{ "Null", "nspi.SPropValue_CTR.null", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SPropValue_CTR_MVi,
+		{ "Mvi", "nspi.SPropValue_CTR.MVi", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_nspi_SShortArray_lpi,
+		{ "Lpi", "nspi.SShortArray.lpi", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-nt.c b/epan/dissectors/packet-dcerpc-nt.c
index 6bd61cbd51..131d2e0f60 100644
--- a/epan/dissectors/packet-dcerpc-nt.c
+++ b/epan/dissectors/packet-dcerpc-nt.c
@@ -84,11 +84,9 @@ dissect_ndr_datablob(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	guint3264 len;
 	proto_tree *subtree;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "%s",
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_nt_data_blob, &item,
 			proto_registrar_get_name(hf_index));
 
-	subtree = proto_item_add_subtree(item, ett_nt_data_blob);
-
 	if (use_remaining_space) {
 		len = tvb_length_remaining (tvb, offset);
 	} else {
@@ -185,11 +183,9 @@ dissect_ndr_counted_string_helper(tvbuff_t *tvb, int offset,
 
 	if (add_subtree) {
 
-		item = proto_tree_add_text(
-			tree, tvb, offset, 0, "%s",
+		subtree = proto_tree_add_subtree(
+			tree, tvb, offset, 0, ett_nt_counted_string, &item,
 			proto_registrar_get_name(hf_index));
-
-		subtree = proto_item_add_subtree(item, ett_nt_counted_string);
 	}
 
 	/*
@@ -250,11 +246,9 @@ dissect_ndr_counted_byte_array_cb(tvbuff_t *tvb, int offset,
 	if (di->conformant_run)
 		return offset;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "%s",
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_nt_counted_byte_array, &item,
 		proto_registrar_get_name(hf_index));
 
-	subtree = proto_item_add_subtree(item, ett_nt_counted_byte_array);
-
 	/*
 	   struct {
 	       short len;
@@ -358,11 +352,9 @@ dissect_ndr_counted_ascii_string_cb(tvbuff_t *tvb, int offset,
 	if (di->conformant_run)
 		return offset;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "%s",
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_nt_counted_ascii_string, &item,
 		proto_registrar_get_name(hf_index));
 
-	subtree = proto_item_add_subtree(item, ett_nt_counted_ascii_string);
-
 	/*
 	   struct {
 	       short len;
@@ -431,8 +423,7 @@ dissect_ndr_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree
 	hf_info=proto_registrar_get_nth(hfindex);
 
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, 0, "%s: ", hf_info->name);
-		tree = proto_item_add_subtree(item, ett_lsa_String);
+		tree = proto_tree_add_subtree_format(parent_tree, tvb, offset, 0, ett_lsa_String, &item, "%s: ", hf_info->name);
 	}
 
 	offset = PIDL_dissect_uint16(tvb, offset, pinfo, tree, di, drep, hf_lsa_String_name_len, 0);
@@ -962,19 +953,15 @@ dissect_nt_hnd(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 
 	switch(type){
 	case HND_TYPE_CTX_HANDLE:
-		item = proto_tree_add_text(tree, tvb, offset, sizeof(e_ctx_hnd),
-					   "Policy Handle");
-
-		subtree = proto_item_add_subtree(item, ett_nt_policy_hnd);
+		subtree = proto_tree_add_subtree(tree, tvb, offset, sizeof(e_ctx_hnd),
+					   ett_nt_policy_hnd, &item, "Policy Handle");
 
 		offset = dissect_ndr_ctx_hnd(tvb, offset, pinfo, subtree, di, drep,
 					     hfindex, &hnd);
 		break;
 	case HND_TYPE_GUID:
-		item = proto_tree_add_text(tree, tvb, offset, 16,
-					   "GUID handle");
-
-		subtree = proto_item_add_subtree(item, ett_nt_policy_hnd);
+		subtree = proto_tree_add_subtree(tree, tvb, offset, 16,
+					   ett_nt_policy_hnd, &item, "GUID handle");
 
 		hnd.attributes=0;
 		offset=dissect_ndr_uuid_t(tvb, offset, pinfo, subtree, di, drep, hfindex, &hnd.uuid);
@@ -1509,9 +1496,8 @@ dissect_ndr_nt_PSID(tvbuff_t *tvb, int offset,
 	int old_offset=offset;
 
 	if(parent_tree){
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1,
-			"SID pointer:");
-		tree = proto_item_add_subtree(item, ett_nt_sid_pointer);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+			ett_nt_sid_pointer, &item, "SID pointer:");
 	}
 
 	offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep,
@@ -1649,9 +1635,8 @@ dissect_LOGON_HOURS_hours(tvbuff_t *tvb, int offset,
 	int old_offset=offset;
 
 	if(parent_tree){
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1,
-			"LOGON_HOURS:");
-		tree = proto_item_add_subtree(item, ett_nt_logon_hours_hours);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+			ett_nt_logon_hours_hours, &item, "LOGON_HOURS:");
 	}
 
 	offset = dissect_ndr_ucvarray(tvb, offset, pinfo, tree, di, drep,
@@ -1676,9 +1661,8 @@ dissect_ndr_nt_LOGON_HOURS(tvbuff_t *tvb, int offset,
 	ALIGN_TO_4_BYTES;  /* strcture starts with short, but is aligned for longs */
 
 	if(parent_tree){
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1,
-			"LOGON_HOURS:");
-		tree = proto_item_add_subtree(item, ett_nt_logon_hours);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+			ett_nt_logon_hours, &item, "LOGON_HOURS:");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep,
@@ -1727,9 +1711,8 @@ dissect_ndr_nt_PSID_ARRAY(tvbuff_t *tvb, int offset,
 	int old_offset=offset;
 
 	if(parent_tree){
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1,
-			"SID array:");
-		tree = proto_item_add_subtree(item, ett_nt_sid_array);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+			ett_nt_sid_array, &item, "SID array:");
 	}
 
 	ALIGN_TO_5_BYTES;
@@ -1761,9 +1744,8 @@ dissect_ndr_nt_SID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
 	proto_tree *tree=NULL;
 
 	if(parent_tree){
-		item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-			"SID_AND_ATTRIBUTES:");
-		tree = proto_item_add_subtree(item, ett_nt_sid_and_attributes);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+			ett_nt_sid_and_attributes, &item, "SID_AND_ATTRIBUTES:");
 	}
 
 	offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep);
@@ -1786,9 +1768,8 @@ dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
 	int old_offset=offset;
 
 	if(parent_tree){
-		item = proto_tree_add_text(parent_tree, tvb, offset, 0,
-			"SID_AND_ATTRIBUTES array:");
-		tree = proto_item_add_subtree(item, ett_nt_sid_and_attributes_array);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
+			ett_nt_sid_and_attributes_array, &item, "SID_AND_ATTRIBUTES array:");
 	}
 
 	/*offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep,
diff --git a/epan/dissectors/packet-dcerpc-rfr.c b/epan/dissectors/packet-dcerpc-rfr.c
index 86d184a5ea..2eef4c9c99 100644
--- a/epan/dissectors/packet-dcerpc-rfr.c
+++ b/epan/dissectors/packet-dcerpc-rfr.c
@@ -32,15 +32,15 @@ static gint ett_dcerpc_rfr = -1;
 
 /* Header field declarations */
 static gint hf_rfr_RfrGetFQDNFromLegacyDN_szMailboxServerDN = -1;
+static gint hf_rfr_MAPISTATUS_status = -1;
+static gint hf_rfr_RfrGetFQDNFromLegacyDN_ulFlags = -1;
 static gint hf_rfr_RfrGetFQDNFromLegacyDN_cbMailboxServerDN = -1;
 static gint hf_rfr_RfrGetFQDNFromLegacyDN_ppszServerFQDN = -1;
-static gint hf_rfr_RfrGetFQDNFromLegacyDN_ulFlags = -1;
+static gint hf_rfr_RfrGetNewDSA_ulFlags = -1;
 static gint hf_rfr_RfrGetNewDSA_pUserDN = -1;
-static gint hf_rfr_RfrGetNewDSA_ppszUnused = -1;
-static gint hf_rfr_opnum = -1;
-static gint hf_rfr_MAPISTATUS_status = -1;
 static gint hf_rfr_RfrGetNewDSA_ppszServer = -1;
-static gint hf_rfr_RfrGetNewDSA_ulFlags = -1;
+static gint hf_rfr_opnum = -1;
+static gint hf_rfr_RfrGetNewDSA_ppszUnused = -1;
 
 static gint proto_dcerpc_rfr = -1;
 /* Version information */
@@ -315,9 +315,9 @@ rfr_dissect_element_RfrGetNewDSA_ppszServer__(tvbuff_t *tvb _U_, int offset _U_,
 
 /* IDL: MAPISTATUS RfrGetNewDSA( */
 /* IDL: [in] uint32 ulFlags, */
-/* IDL: [ref] [charset(DOS)] [in] uint8 *pUserDN, */
-/* IDL: [out] [unique(1)] [in] [charset(DOS)] uint8 **ppszUnused, */
-/* IDL: [charset(DOS)] [in] [out] [unique(1)] uint8 **ppszServer */
+/* IDL: [in] [ref] [charset(DOS)] uint8 *pUserDN, */
+/* IDL: [charset(DOS)] [unique(1)] [out] [in] uint8 **ppszUnused, */
+/* IDL: [charset(DOS)] [unique(1)] [out] [in] uint8 **ppszServer */
 /* IDL: ); */
 
 static int
@@ -418,9 +418,9 @@ rfr_dissect_element_RfrGetFQDNFromLegacyDN_ppszServerFQDN__(tvbuff_t *tvb _U_, i
 
 /* IDL: MAPISTATUS RfrGetFQDNFromLegacyDN( */
 /* IDL: [in] uint32 ulFlags, */
-/* IDL: [range(10,1024)] [in] uint32 cbMailboxServerDN, */
-/* IDL: [size_is(cbMailboxServerDN)] [in] [ref] [charset(DOS)] uint8 *szMailboxServerDN, */
-/* IDL: [out] [ref] [charset(DOS)] uint8 **ppszServerFQDN */
+/* IDL: [in] [range(10,1024)] uint32 cbMailboxServerDN, */
+/* IDL: [size_is(cbMailboxServerDN)] [charset(DOS)] [ref] [in] uint8 *szMailboxServerDN, */
+/* IDL: [out] [charset(DOS)] [ref] uint8 **ppszServerFQDN */
 /* IDL: ); */
 
 static int
@@ -465,25 +465,25 @@ void proto_register_dcerpc_rfr(void)
 {
 	static hf_register_info hf[] = {
 	{ &hf_rfr_RfrGetFQDNFromLegacyDN_szMailboxServerDN,
-	  { "Szmailboxserverdn", "rfr.RfrGetFQDNFromLegacyDN.szMailboxServerDN", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Szmailboxserverdn", "rfr.RfrGetFQDNFromLegacyDN.szMailboxServerDN", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_rfr_MAPISTATUS_status,
+		{ "MAPISTATUS", "rfr.MAPISTATUS_status", FT_UINT32, BASE_HEX, VALS(rfr_MAPISTATUS_vals), 0, NULL, HFILL }},
+	{ &hf_rfr_RfrGetFQDNFromLegacyDN_ulFlags,
+		{ "Ulflags", "rfr.RfrGetFQDNFromLegacyDN.ulFlags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_rfr_RfrGetFQDNFromLegacyDN_cbMailboxServerDN,
-	  { "Cbmailboxserverdn", "rfr.RfrGetFQDNFromLegacyDN.cbMailboxServerDN", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Cbmailboxserverdn", "rfr.RfrGetFQDNFromLegacyDN.cbMailboxServerDN", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_rfr_RfrGetFQDNFromLegacyDN_ppszServerFQDN,
-	  { "Ppszserverfqdn", "rfr.RfrGetFQDNFromLegacyDN.ppszServerFQDN", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_rfr_RfrGetFQDNFromLegacyDN_ulFlags,
-	  { "Ulflags", "rfr.RfrGetFQDNFromLegacyDN.ulFlags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Ppszserverfqdn", "rfr.RfrGetFQDNFromLegacyDN.ppszServerFQDN", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_rfr_RfrGetNewDSA_ulFlags,
+		{ "Ulflags", "rfr.RfrGetNewDSA.ulFlags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_rfr_RfrGetNewDSA_pUserDN,
-	  { "Puserdn", "rfr.RfrGetNewDSA.pUserDN", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_rfr_RfrGetNewDSA_ppszUnused,
-	  { "Ppszunused", "rfr.RfrGetNewDSA.ppszUnused", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_rfr_opnum,
-	  { "Operation", "rfr.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_rfr_MAPISTATUS_status,
-	  { "MAPISTATUS", "rfr.MAPISTATUS_status", FT_UINT32, BASE_HEX, VALS(rfr_MAPISTATUS_vals), 0, NULL, HFILL }},
+		{ "Puserdn", "rfr.RfrGetNewDSA.pUserDN", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_rfr_RfrGetNewDSA_ppszServer,
-	  { "Ppszserver", "rfr.RfrGetNewDSA.ppszServer", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_rfr_RfrGetNewDSA_ulFlags,
-	  { "Ulflags", "rfr.RfrGetNewDSA.ulFlags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Ppszserver", "rfr.RfrGetNewDSA.ppszServer", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_rfr_opnum,
+		{ "Operation", "rfr.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_rfr_RfrGetNewDSA_ppszUnused,
+		{ "Ppszunused", "rfr.RfrGetNewDSA.ppszUnused", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-rs_pgo.c b/epan/dissectors/packet-dcerpc-rs_pgo.c
index d072527587..8065625e27 100644
--- a/epan/dissectors/packet-dcerpc-rs_pgo.c
+++ b/epan/dissectors/packet-dcerpc-rs_pgo.c
@@ -141,8 +141,7 @@ dissect_error_status_t (tvbuff_t * tvb, int offset,
     return offset;
   }
 
-  item = proto_tree_add_text (parent_tree, tvb, offset, -1, "error_status_t");
-  tree = proto_item_add_subtree (item, ett_error_status_t);
+  tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_error_status_t, &item, "error_status_t");
 
   offset =
     dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep, hf_error_status_t,
@@ -181,9 +180,8 @@ dissect    sec_rgy_pname const signed32        sec_rgy_pname_t_size  = 257; * In
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1, "sec_rgy_pname_t");
-      tree = proto_item_add_subtree (item, ett_sec_rgy_pname_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_sec_rgy_pname_t, &item, "sec_rgy_pname_t");
     }
 
   offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep,
@@ -240,10 +238,9 @@ dissect_sec_rgy_pgo_flags_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1,
-                             "sec_rgy_pgo_flags_t ");
-      tree = proto_item_add_subtree (item, ett_sec_rgy_pgo_flags_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+                             ett_sec_rgy_pgo_flags_t, &item, "sec_rgy_pgo_flags_t ");
     }
 
   offset =
@@ -339,9 +336,8 @@ dissect_rs_cache_data_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1, "rs_cache_data_t");
-      tree = proto_item_add_subtree (item, ett_rs_cache_data_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_rs_cache_data_t, &item, "rs_cache_data_t");
     }
 
 
@@ -392,9 +388,8 @@ dissect_sec_rgy_name_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1, "sec_rgy_name_t");
-      tree = proto_item_add_subtree (item, ett_sec_rgy_name_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_sec_rgy_name_t, &item, "sec_rgy_name_t");
     }
 
   offset =
@@ -449,9 +444,8 @@ dissect_sec_rgy_domain_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1, "sec_rgy_domain_t");
-      tree = proto_item_add_subtree (item, ett_sec_rgy_domain_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_sec_rgy_domain_t, &item, "sec_rgy_domain_t");
     }
 
 
@@ -498,10 +492,9 @@ dissect_sec_rgy_pgo_item_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1,
-                             " sec_rgy_pgo_item_t ");
-      tree = proto_item_add_subtree (item, ett_sec_rgy_pgo_item_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+                             ett_sec_rgy_pgo_item_t, &item, " sec_rgy_pgo_item_t ");
     }
 
   offset =
@@ -560,10 +553,9 @@ dissect_sec_rgy_cursor_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1,
-                             " sec_rgy_cursor_t ");
-      tree = proto_item_add_subtree (item, ett_sec_rgy_cursor_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+                             ett_sec_rgy_cursor_t, &item, " sec_rgy_cursor_t ");
     }
 
   offset =
@@ -615,9 +607,8 @@ dissect_rs_pgo_query_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1, "rs_pgo_query_t ");
-      tree = proto_item_add_subtree (item, ett_rs_pgo_query_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_rs_pgo_query_t, &item, "rs_pgo_query_t ");
     }
   offset =
     dissect_ndr_uint8 (tvb, offset, pinfo, tree, di, drep, hf_rs_pgo_query_t,
@@ -678,10 +669,9 @@ dissect_rs_pgo_id_key_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1,
-                             "rs_pgo_id_key_t ");
-      tree = proto_item_add_subtree (item, ett_rs_pgo_id_key_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+                             ett_rs_pgo_id_key_t, &item, "rs_pgo_id_key_t ");
     }
 
   offset =
@@ -725,10 +715,9 @@ dissect_rs_pgo_result_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1,
-                             "rs_pgo_result_t ");
-      tree = proto_item_add_subtree (item, ett_rs_pgo_result_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+                             ett_rs_pgo_result_t, &item, "rs_pgo_result_t ");
     }
 
   offset = dissect_sec_rgy_name_t (tvb, offset, pinfo, tree, di, drep);
@@ -770,10 +759,9 @@ r
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1,
-                             " rs_pgo_unix_num_key_t ");
-      tree = proto_item_add_subtree (item, ett_rs_pgo_unix_num_key_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+                             ett_rs_pgo_unix_num_key_t, &item, " rs_pgo_unix_num_key_t ");
     }
 
   offset =
@@ -837,10 +825,9 @@ dissect_rs_pgo_query_key_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item =
-        proto_tree_add_text (parent_tree, tvb, offset, -1,
-                             "rs_pgo_query_key_t ");
-      tree = proto_item_add_subtree (item, ett_rs_pgo_query_key_t);
+      tree =
+        proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+                             ett_rs_pgo_query_key_t, &item, "rs_pgo_query_key_t ");
     }
   offset =
     dissect_ndr_uint16 (tvb, offset, pinfo, tree, di, drep, hf_rs_pgo_query_key_t,
@@ -909,9 +896,8 @@ dissect_rs_pgo_query_result_t (tvbuff_t * tvb, int offset,
 
   if (parent_tree)
     {
-      item = proto_tree_add_text (parent_tree, tvb, offset, -1,
-                                  "rs_pgo_query_result_t");
-      tree = proto_item_add_subtree (item, ett_rs_pgo_query_result_t);
+      tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
+                                  ett_rs_pgo_query_result_t, &item, "rs_pgo_query_result_t");
     }
 
   offset =
diff --git a/epan/dissectors/packet-dcerpc-samr.c b/epan/dissectors/packet-dcerpc-samr.c
index c12d787cc3..e9c5ff1431 100644
--- a/epan/dissectors/packet-dcerpc-samr.c
+++ b/epan/dissectors/packet-dcerpc-samr.c
@@ -116,559 +116,559 @@ static gint ett_samr_samr_ValidatePasswordReq = -1;
 
 
 /* Header field declarations */
-static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_LAST_SET = -1;
-static gint hf_samr_samr_UserInfo23_password = -1;
-static gint hf_samr_samr_UserInfo21_description = -1;
-static gint hf_samr_samr_QueryDisplayInfo3_total_size = -1;
-static gint hf_samr_samr_UserInfo20_parameters = -1;
-static gint hf_samr_samr_DomainInfo_info5 = -1;
-static gint hf_samr_samr_QueryDisplayInfo_buf_size = -1;
-static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_ADD_MEMBER = -1;
-static gint hf_samr_samr_RemoveMemberFromForeignDomain_sid = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_COUNTRY_CODE = -1;
-static gint hf_samr_samr_UserInfo5_full_name = -1;
-static gint hf_samr_samr_QueryDisplayInfo3_max_entries = -1;
-static gint hf_samr_samr_DispInfoAscii_count = -1;
-static gint hf_samr_samr_ChangePasswordUser3_lm_verifier = -1;
-static gint hf_samr_samr_ChangePasswordUser2_nt_password = -1;
-static gint hf_samr_samr_SetDomainInfo_info = -1;
-static gint hf_samr_samr_AddMultipleMembersToAlias_sids = -1;
-static gint hf_samr_samr_DispInfo_info3 = -1;
-static gint hf_samr_samr_ValidatePasswordReq1_password_matched = -1;
-static gint hf_samr_samr_DispEntryFull_acct_flags = -1;
-static gint hf_samr_samr_AcctFlags_ACB_WSTRUST = -1;
-static gint hf_samr_samr_UserInfo21_profile_path = -1;
-static gint hf_samr_samr_UserInfo21_last_logoff = -1;
-static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_GET_MEMBERS = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS = -1;
-static gint hf_samr_samr_PwInfo_min_password_length = -1;
-static gint hf_samr_samr_QueryGroupMember_rids = -1;
-static gint hf_samr_samr_AcctFlags_ACB_SMARTCARD_REQUIRED = -1;
-static gint hf_samr_samr_UserInfo21_workstations = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_CODE_PAGE = -1;
+static gint hf_samr_samr_UserInfo18_nt_pwd_active = -1;
+static gint hf_samr_samr_UserInfo21_last_password_change = -1;
+static gint hf_samr_samr_UserInfo_info6 = -1;
+static gint hf_samr_opnum = -1;
+static gint hf_samr_samr_LogonHours_bits = -1;
+static gint hf_samr_samr_EnumDomains_sam = -1;
+static gint hf_samr_samr_QuerySecurity_sec_info = -1;
+static gint hf_samr_samr_RidTypeArray_count = -1;
+static gint hf_samr_samr_DispInfo_info4 = -1;
+static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_STORE_CLEARTEXT = -1;
 static gint hf_samr_samr_AcctFlags_ACB_NORMAL = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_LOC_COM = -1;
-static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_INITIALIZE_SERVER = -1;
-static gint hf_samr_samr_UserInfo_info7 = -1;
-static gint hf_samr_samr_GroupInfoAttributes_attributes = -1;
-static gint hf_samr_samr_ChangePasswordUser3_server = -1;
-static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_LOOKUP_INFO = -1;
-static gint hf_samr_samr_ConnectInfo1_unknown2 = -1;
-static gint hf_samr_samr_GetDisplayEnumerationIndex2_idx = -1;
+static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_TIME = -1;
+static gint hf_samr_samr_Connect5_level_in = -1;
+static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_LAST_SET = -1;
+static gint hf_samr_samr_AcctFlags_ACB_SVRTRUST = -1;
+static gint hf_samr_samr_RemoveMultipleMembersFromAlias_sids = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LOGON_SCRIPT = -1;
+static gint hf_samr_samr_QueryDisplayInfo2_start_idx = -1;
+static gint hf_samr_samr_SetAliasInfo_info = -1;
+static gint hf_samr_samr_UserInfo9_primary_gid = -1;
 static gint hf_samr_samr_EnumDomainGroups_max_size = -1;
-static gint hf_samr_samr_UserInfo3_acct_flags = -1;
-static gint hf_samr_samr_DomInfo6_primary = -1;
-static gint hf_samr_samr_SetUserInfo_level = -1;
-static gint hf_samr_samr_SetUserInfo2_level = -1;
-static gint hf_samr_samr_UserInfo5_acct_expiry = -1;
-static gint hf_samr_samr_GroupAttrs_SE_GROUP_RESOURCE = -1;
-static gint hf_samr_samr_ChangePasswordUser_cross2_present = -1;
-static gint hf_samr_samr_CreateUser_account_name = -1;
+static gint hf_samr_domain_handle = -1;
+static gint hf_samr_samr_ChangePasswordUser3_nt_password = -1;
+static gint hf_samr_samr_AcctFlags_ACB_AUTOLOCK = -1;
+static gint hf_samr_samr_ChangePasswordUser2_lm_verifier = -1;
+static gint hf_samr_samr_UserInfo_info25 = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_PRIVATE_DATA = -1;
+static gint hf_samr_samr_GroupInfoAll_num_members = -1;
+static gint hf_samr_samr_DomGeneralInformation2_general = -1;
+static gint hf_samr_samr_AcctFlags_ACB_USE_DES_KEY_ONLY = -1;
+static gint hf_samr_samr_UserInfo21_full_name = -1;
+static gint hf_samr_samr_GroupInfo_attributes = -1;
+static gint hf_samr_samr_QueryDisplayInfo3_returned_size = -1;
+static gint hf_samr_samr_UserInfo21_buf_count = -1;
+static gint hf_samr_samr_EnumDomainAliases_sam = -1;
+static gint hf_samr_samr_ValidationBlob_length = -1;
+static gint hf_samr_samr_DomGeneralInformation_domain_server_state = -1;
+static gint hf_samr_user_handle = -1;
+static gint hf_samr_samr_UserInfo21_code_page = -1;
+static gint hf_samr_samr_QueryDomainInfo_info = -1;
+static gint hf_samr_samr_ValidatePasswordReq2_password_matched = -1;
+static gint hf_samr_samr_DomInfo12_lockout_threshold = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_PROFILE_PATH = -1;
+static gint hf_samr_samr_RidWithAttributeArray_rids = -1;
+static gint hf_samr_samr_DispEntryFull_account_name = -1;
+static gint hf_samr_samr_GetAliasMembership_rids = -1;
+static gint hf_samr_samr_UserInfo3_full_name = -1;
 static gint hf_samr_samr_DomGeneralInformation_oem_information = -1;
-static gint hf_samr_samr_ChangePasswordUser_lm_cross = -1;
-static gint hf_samr_samr_DomOEMInformation_oem_information = -1;
-static gint hf_samr_rid = -1;
-static gint hf_samr_samr_UserInfo2_country_code = -1;
-static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_SET_INFO = -1;
-static gint hf_samr_samr_QueryDisplayInfo2_buf_size = -1;
-static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_CONNECT_TO_SERVER = -1;
-static gint hf_samr_samr_UserInfo6_account_name = -1;
-static gint hf_samr_samr_UserInfo21_home_directory = -1;
-static gint hf_samr_samr_UserInfo21_logon_count = -1;
-static gint hf_samr_samr_ChangePasswordUser2_lm_password = -1;
-static gint hf_samr_samr_QueryDisplayInfo2_total_size = -1;
-static gint hf_samr_samr_DomInfo1_min_password_age = -1;
-static gint hf_samr_samr_RidWithAttribute_attributes = -1;
-static gint hf_samr_samr_QueryDisplayInfo2_level = -1;
-static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_STORE_CLEARTEXT = -1;
-static gint hf_samr_samr_UserInfo4_logon_hours = -1;
-static gint hf_samr_samr_ChangePasswordUser_lm_present = -1;
-static gint hf_samr_alias_access_mask = -1;
-static gint hf_samr_samr_DomInfo12_lockout_duration = -1;
-static gint hf_samr_samr_LookupDomain_domain_name = -1;
-static gint hf_samr_samr_AcctFlags_ACB_NOT_DELEGATED = -1;
-static gint hf_samr_samr_ChangePasswordUser3_password3 = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LM_PASSWORD_PRESENT = -1;
-static gint hf_samr_samr_GroupInfoAll_attributes = -1;
-static gint hf_samr_samr_QueryDisplayInfo_start_idx = -1;
-static gint hf_samr_samr_DispEntryAscii_account_name = -1;
-static gint hf_samr_samr_SetGroupInfo_level = -1;
-static gint hf_samr_samr_SetUserInfo2_info = -1;
-static gint hf_samr_samr_DispEntryGeneral_idx = -1;
-static gint hf_samr_samr_GroupInfo_name = -1;
-static gint hf_samr_samr_GetDisplayEnumerationIndex2_level = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_USER = -1;
-static gint hf_samr_samr_UserInfo3_account_name = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_PARAMETERS = -1;
-static gint hf_samr_samr_DomainInfo_oem = -1;
-static gint hf_samr_samr_DomainInfo_info8 = -1;
-static gint hf_samr_samr_QueryDisplayInfo3_info = -1;
-static gint hf_samr_samr_UserInfo3_force_password_change = -1;
-static gint hf_samr_samr_DomInfo9_domain_server_state = -1;
-static gint hf_samr_samr_UserInfo3_logon_count = -1;
+static gint hf_samr_samr_UserInfo5_bad_password_count = -1;
+static gint hf_samr_samr_GetDisplayEnumerationIndex_name = -1;
+static gint hf_samr_samr_QueryDisplayInfo3_max_entries = -1;
+static gint hf_samr_samr_RidToSid_sid = -1;
 static gint hf_samr_samr_AliasInfoAll_num_members = -1;
+static gint hf_samr_samr_UserInfo26_password_expired = -1;
+static gint hf_samr_samr_AcctFlags_ACB_DONT_REQUIRE_PREAUTH = -1;
+static gint hf_samr_samr_UserInfo2_code_page = -1;
+static gint hf_samr_samr_DispInfo_info1 = -1;
+static gint hf_samr_samr_UserInfo3_logon_script = -1;
+static gint hf_samr_samr_DispEntryGeneral_acct_flags = -1;
+static gint hf_samr_group_access_mask = -1;
+static gint hf_samr_samr_AcctFlags_ACB_TRUSTED_FOR_DELEGATION = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_ALLOW_PWD_CHANGE = -1;
+static gint hf_samr_alias_handle = -1;
+static gint hf_samr_samr_ChangePasswordUser3_account = -1;
+static gint hf_samr_samr_UserInfo5_workstations = -1;
 static gint hf_samr_samr_EnumDomainUsers_max_size = -1;
-static gint hf_samr_samr_UserInfo2_unknown = -1;
-static gint hf_samr_samr_DomainInfo_general2 = -1;
-static gint hf_samr_samr_ChangePasswordUser2_server = -1;
-static gint hf_samr_samr_LookupNames_types = -1;
-static gint hf_samr_samr_UserInfo5_acct_flags = -1;
-static gint hf_samr_samr_LookupNames_rids = -1;
-static gint hf_samr_samr_QueryDisplayInfo_returned_size = -1;
-static gint hf_samr_samr_OemChangePasswordUser2_server = -1;
-static gint hf_samr_samr_QueryDomainInfo_info = -1;
-static gint hf_samr_samr_QueryUserInfo2_level = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_ALIAS = -1;
-static gint hf_samr_samr_DomainInfo_info12 = -1;
-static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_SHUTDOWN_SERVER = -1;
-static gint hf_samr_samr_ValidatePasswordReq2_account = -1;
-static gint hf_samr_handle = -1;
-static gint hf_samr_samr_ValidatePasswordReq2_password = -1;
-static gint hf_samr_samr_UserInfo_info5 = -1;
-static gint hf_samr_samr_UserInfo5_logon_hours = -1;
-static gint hf_samr_samr_UserInfo3_allow_password_change = -1;
-static gint hf_samr_samr_RidWithAttributeArray_count = -1;
+static gint hf_samr_samr_DomInfo6_primary = -1;
+static gint hf_samr_samr_DomInfo1_max_password_age = -1;
+static gint hf_samr_samr_PwInfo_min_password_length = -1;
+static gint hf_samr_samr_ValidatePasswordInfo_last_password_change = -1;
+static gint hf_samr_samr_DomGeneralInformation_sequence_num = -1;
+static gint hf_samr_samr_QueryDisplayInfo_level = -1;
+static gint hf_samr_samr_DispEntryFull_acct_flags = -1;
+static gint hf_samr_samr_DomGeneralInformation_primary = -1;
+static gint hf_samr_samr_UserInfo5_home_drive = -1;
+static gint hf_samr_samr_DomainInfo_info1 = -1;
+static gint hf_samr_samr_UserInfo_info13 = -1;
+static gint hf_samr_samr_UserInfo21_last_logoff = -1;
+static gint hf_samr_samr_AddMultipleMembersToAlias_sids = -1;
+static gint hf_samr_samr_UserInfo5_home_directory = -1;
+static gint hf_samr_samr_DomInfo9_domain_server_state = -1;
+static gint hf_samr_samr_AcctFlags_ACB_NO_AUTH_DATA_REQD = -1;
+static gint hf_samr_samr_GroupAttrs_SE_GROUP_ENABLED = -1;
+static gint hf_samr_samr_QueryDisplayInfo2_info = -1;
+static gint hf_samr_samr_SetDomainInfo_level = -1;
+static gint hf_samr_samr_SetDsrmPassword_name = -1;
+static gint hf_samr_samr_QueryDisplayInfo2_total_size = -1;
+static gint hf_samr_samr_QueryDisplayInfo2_max_entries = -1;
+static gint hf_samr_samr_UserInfo21_country_code = -1;
+static gint hf_samr_samr_SetBootKeyInformation_unknown3 = -1;
+static gint hf_samr_samr_UserInfo5_last_password_change = -1;
+static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_CONNECT_TO_SERVER = -1;
+static gint hf_samr_samr_ChangePasswordUser2_lm_change = -1;
+static gint hf_samr_samr_QueryAliasInfo_info = -1;
+static gint hf_samr_samr_SetDsrmPassword_hash = -1;
+static gint hf_samr_samr_ChangePasswordUser3_lm_change = -1;
+static gint hf_samr_samr_DomInfo12_lockout_window = -1;
+static gint hf_samr_samr_AcctFlags_ACB_DOMTRUST = -1;
+static gint hf_samr_samr_UserInfo14_workstations = -1;
+static gint hf_samr_samr_DispEntryFull_idx = -1;
+static gint hf_samr_samr_DispEntryFullGroup_idx = -1;
+static gint hf_samr_samr_UserInfo21_bad_password_count = -1;
 static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_ATTRIBUTES = -1;
-static gint hf_samr_samr_UserInfo_info12 = -1;
-static gint hf_samr_samr_EnumDomainGroups_resume_handle = -1;
+static gint hf_samr_samr_QueryDisplayInfo3_level = -1;
+static gint hf_samr_samr_DomInfo8_sequence_num = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_PASSWORD = -1;
+static gint hf_samr_samr_LookupNames_names = -1;
+static gint hf_samr_alias_access_mask = -1;
+static gint hf_samr_samr_UserInfo_info14 = -1;
+static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_REMOVE_MEMBER = -1;
+static gint hf_samr_samr_DispEntryFullGroup_description = -1;
 static gint hf_samr_samr_UserInfo17_acct_expiry = -1;
-static gint hf_samr_samr_ConnectInfo_info1 = -1;
-static gint hf_samr_samr_EnumDomainAliases_num_entries = -1;
-static gint hf_samr_samr_UserInfo21_lm_password_set = -1;
+static gint hf_samr_samr_QueryDisplayInfo_info = -1;
+static gint hf_samr_samr_SetMemberAttributesOfGroup_unknown1 = -1;
+static gint hf_samr_samr_UserInfo21_logon_count = -1;
+static gint hf_samr_samr_UserInfo_info10 = -1;
+static gint hf_samr_samr_ValidatePasswordRepCtr_status = -1;
+static gint hf_samr_samr_DomainInfo_general = -1;
+static gint hf_samr_samr_UserInfo_info1 = -1;
 static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCOUNT_NAME = -1;
-static gint hf_samr_samr_EnumDomains_connect_handle = -1;
+static gint hf_samr_samr_ValidatePassword_req = -1;
+static gint hf_samr_samr_ChangePasswordUser2_account = -1;
+static gint hf_samr_samr_UserInfo21_fields_present = -1;
+static gint hf_samr_samr_QueryDisplayInfo_max_entries = -1;
+static gint hf_samr_samr_UserInfo4_logon_hours = -1;
+static gint hf_samr_samr_EnumDomainUsers_resume_handle = -1;
+static gint hf_samr_samr_UserInfo_info20 = -1;
+static gint hf_samr_samr_Connect5_info_in = -1;
+static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_LENGTH = -1;
+static gint hf_samr_samr_UserInfo1_description = -1;
+static gint hf_samr_samr_ChangePasswordUser3_nt_verifier = -1;
+static gint hf_samr_samr_CreateUser2_account_name = -1;
+static gint hf_samr_samr_ConnectInfo_info1 = -1;
+static gint hf_samr_samr_ChangePasswordUser_new_nt_crypted = -1;
+static gint hf_samr_samr_DispEntryAscii_account_name = -1;
+static gint hf_samr_samr_ValidatePasswordReq1_info = -1;
 static gint hf_samr_samr_SetUserInfo_info = -1;
-static gint hf_samr_samr_QueryDomainInfo_level = -1;
-static gint hf_samr_samr_ValidatePassword_level = -1;
-static gint hf_samr_samr_EnumDomainUsers_sam = -1;
-static gint hf_samr_samr_UserInfo26_password_expired = -1;
-static gint hf_samr_samr_ValidatePasswordReq3_password = -1;
-static gint hf_samr_samr_DeleteAliasMember_sid = -1;
-static gint hf_samr_samr_UserInfo26_password = -1;
-static gint hf_samr_samr_UserInfo5_home_drive = -1;
-static gint hf_samr_samr_AliasInfoAll_description = -1;
-static gint hf_samr_samr_ChangePasswordUser3_nt_password = -1;
-static gint hf_samr_samr_OemChangePasswordUser2_account = -1;
-static gint hf_samr_samr_DispInfo_info4 = -1;
-static gint hf_samr_samr_GroupInfo_attributes = -1;
 static gint hf_samr_samr_AcctFlags_ACB_PWNOTREQ = -1;
-static gint hf_samr_samr_AliasInfo_all = -1;
-static gint hf_samr_samr_DomGeneralInformation_num_aliases = -1;
-static gint hf_samr_samr_ValidatePasswordRep_ctr1 = -1;
-static gint hf_samr_samr_UserInfo21_password_expired = -1;
-static gint hf_samr_samr_DispEntryFullGroup_idx = -1;
-static gint hf_samr_samr_UserInfo21_country_code = -1;
-static gint hf_samr_samr_GroupAttrs_SE_GROUP_USE_FOR_DENY_ONLY = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_COMMENT = -1;
-static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_GET_MEMBERS = -1;
-static gint hf_samr_samr_UserInfo14_workstations = -1;
-static gint hf_samr_samr_GroupInfoDescription_description = -1;
-static gint hf_samr_samr_RidWithAttributeArray_rids = -1;
-static gint hf_samr_samr_UserInfo21_acct_flags = -1;
-static gint hf_samr_samr_CreateUser2_acct_flags = -1;
+static gint hf_samr_samr_UserInfo5_last_logoff = -1;
 static gint hf_samr_samr_CryptPasswordEx_data = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_NAME_ETC = -1;
-static gint hf_samr_samr_ValidatePasswordReq3_info = -1;
-static gint hf_samr_samr_DispInfoGeneral_entries = -1;
-static gint hf_samr_samr_GetMembersInAlias_sids = -1;
-static gint hf_samr_samr_EnumDomainGroups_num_entries = -1;
-static gint hf_samr_samr_SetBootKeyInformation_unknown1 = -1;
-static gint hf_samr_samr_ValidatePasswordReq2_password_matched = -1;
-static gint hf_samr_samr_DispEntryFull_description = -1;
-static gint hf_samr_samr_UserInfo21_parameters = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT = -1;
-static gint hf_samr_samr_DispEntryAscii_idx = -1;
-static gint hf_samr_samr_ValidatePasswordReq3_clear_lockout = -1;
-static gint hf_samr_samr_DomGeneralInformation_role = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_WORKSTATIONS = -1;
+static gint hf_samr_samr_LookupRids_num_rids = -1;
 static gint hf_samr_samr_DomInfo5_domain_name = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP = -1;
-static gint hf_samr_samr_EnumDomainUsers_resume_handle = -1;
-static gint hf_samr_samr_UserInfo5_primary_gid = -1;
-static gint hf_samr_samr_UserInfo5_workstations = -1;
-static gint hf_samr_samr_Connect3_unknown = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUPS = -1;
-static gint hf_samr_samr_AcctFlags_ACB_ENC_TXT_PWD_ALLOWED = -1;
-static gint hf_samr_samr_UserInfo5_last_logon = -1;
-static gint hf_samr_samr_UserInfo16_acct_flags = -1;
-static gint hf_samr_samr_DomInfo12_lockout_window = -1;
-static gint hf_samr_samr_ValidatePasswordRep_ctr3 = -1;
-static gint hf_samr_samr_GroupInfo_all2 = -1;
-static gint hf_samr_samr_LookupDomain_sid = -1;
-static gint hf_samr_samr_UserInfo3_home_drive = -1;
-static gint hf_samr_samr_LogonHours_units_per_week = -1;
-static gint hf_samr_samr_EnumDomainAliases_max_size = -1;
-static gint hf_samr_samr_UserInfo21_nt_password_set = -1;
-static gint hf_samr_samr_ValidatePassword_req = -1;
-static gint hf_samr_samr_DomGeneralInformation_num_groups = -1;
 static gint hf_samr_samr_SamArray_entries = -1;
-static gint hf_samr_samr_ValidationBlob_data = -1;
-static gint hf_samr_samr_UserInfo21_code_page = -1;
-static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_LOOKUP_INFO = -1;
-static gint hf_samr_samr_DispInfoFullGroups_count = -1;
-static gint hf_samr_samr_ValidatePasswordRep_ctr2 = -1;
-static gint hf_samr_samr_GetBootKeyInformation_domain_handle = -1;
-static gint hf_samr_samr_UserInfo_info18 = -1;
 static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_ENUM_DOMAINS = -1;
-static gint hf_samr_samr_ChangePasswordUser3_nt_verifier = -1;
-static gint hf_samr_samr_UserInfo_info13 = -1;
-static gint hf_samr_samr_UserInfo21_fields_present = -1;
-static gint hf_samr_samr_UserInfo21_primary_gid = -1;
-static gint hf_samr_samr_GroupInfo_all = -1;
-static gint hf_samr_samr_Connect5_system_name = -1;
-static gint hf_samr_samr_QueryDisplayInfo3_buf_size = -1;
-static gint hf_samr_samr_ChangePasswordUser_old_lm_crypted = -1;
-static gint hf_samr_samr_AcctFlags_ACB_DOMTRUST = -1;
-static gint hf_samr_samr_PasswordProperties_DOMAIN_REFUSE_PASSWORD_CHANGE = -1;
-static gint hf_samr_samr_QueryDisplayInfo_max_entries = -1;
-static gint hf_samr_samr_UserInfo3_last_password_change = -1;
-static gint hf_samr_samr_ValidatePasswordReq2_hash = -1;
-static gint hf_samr_samr_UserInfo5_account_name = -1;
-static gint hf_samr_samr_GetDomPwInfo_info = -1;
-static gint hf_samr_samr_ChangeReject_unknown1 = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_PROFILE_PATH = -1;
-static gint hf_samr_samr_UserInfo_info16 = -1;
-static gint hf_samr_samr_UserInfo21_logon_script = -1;
-static gint hf_samr_sec_desc_buf_len = -1;
-static gint hf_samr_samr_LookupNames_names = -1;
-static gint hf_samr_samr_UserInfo_info14 = -1;
-static gint hf_samr_samr_SetDsrmPassword_name = -1;
-static gint hf_samr_samr_DispEntryGeneral_acct_flags = -1;
-static gint hf_samr_samr_AcctFlags_ACB_PW_EXPIRED = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 = -1;
-static gint hf_samr_samr_UserInfo3_last_logoff = -1;
-static gint hf_samr_samr_QueryUserInfo2_info = -1;
-static gint hf_samr_samr_ValidatePasswordRepCtr_status = -1;
-static gint hf_samr_samr_DomInfo1_max_password_age = -1;
-static gint hf_samr_samr_DispEntryGeneral_full_name = -1;
-static gint hf_samr_samr_GetDisplayEnumerationIndex_name = -1;
-static gint hf_samr_samr_DomInfo13_sequence_num = -1;
-static gint hf_samr_samr_QueryDisplayInfo2_returned_size = -1;
-static gint hf_samr_samr_UserInfo6_full_name = -1;
-static gint hf_samr_samr_ChangePasswordUser2_lm_change = -1;
-static gint hf_samr_samr_LogonHours_bits = -1;
-static gint hf_samr_samr_ChangePasswordUser3_lm_change = -1;
-static gint hf_samr_samr_LookupNames_num_names = -1;
-static gint hf_samr_samr_UserInfo21_logon_hours = -1;
-static gint hf_samr_lsa_Strings_count = -1;
-static gint hf_samr_samr_UserInfo11_logon_script = -1;
-static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_LOOKUP_DOMAIN = -1;
-static gint hf_samr_samr_SetMemberAttributesOfGroup_unknown1 = -1;
-static gint hf_samr_lsa_Strings_names = -1;
-static gint hf_samr_samr_UserInfo21_bad_password_count = -1;
+static gint hf_samr_samr_UserInfo3_account_name = -1;
+static gint hf_samr_samr_AliasInfoAll_description = -1;
 static gint hf_samr_samr_EnumDomains_num_entries = -1;
 static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LOGON_HOURS = -1;
-static gint hf_samr_samr_UserInfo5_last_password_change = -1;
-static gint hf_samr_samr_AcctFlags_ACB_TEMPDUP = -1;
-static gint hf_samr_samr_ChangePasswordUser_new_lm_crypted = -1;
-static gint hf_samr_samr_UserInfo3_primary_gid = -1;
-static gint hf_samr_samr_UserInfo_info3 = -1;
-static gint hf_samr_samr_UserInfo_info23 = -1;
-static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY = -1;
-static gint hf_samr_samr_UserInfo_info17 = -1;
-static gint hf_samr_samr_UserInfo5_home_directory = -1;
-static gint hf_samr_samr_SetDsrmPassword_hash = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_FORCE_PWD_CHANGE = -1;
-static gint hf_samr_samr_UserInfo21_private = -1;
-static gint hf_samr_samr_QueryDisplayInfo2_info = -1;
-static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_LOCKOUT_TIME = -1;
-static gint hf_samr_samr_QueryAliasInfo_info = -1;
-static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_LOCKOUT_ADMINS = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_OWF_PWD = -1;
-static gint hf_samr_samr_DomainInfo_info1 = -1;
-static gint hf_samr_samr_SetSecurity_sdbuf = -1;
-static gint hf_samr_samr_ChangePasswordUser3_dominfo = -1;
-static gint hf_samr_samr_CreateUser2_account_name = -1;
-static gint hf_samr_connect_access_mask = -1;
-static gint hf_samr_samr_CreateDomainGroup_name = -1;
-static gint hf_samr_samr_DispEntryGeneral_account_name = -1;
-static gint hf_samr_samr_ValidatePasswordRepCtr_info = -1;
-static gint hf_samr_samr_ChangePasswordUser2_nt_verifier = -1;
-static gint hf_samr_samr_AddGroupMember_flags = -1;
-static gint hf_samr_samr_UserInfo_info1 = -1;
-static gint hf_samr_samr_UserInfo3_home_directory = -1;
-static gint hf_samr_samr_QueryGroupInfo_level = -1;
-static gint hf_samr_samr_ChangePasswordUser2_account = -1;
-static gint hf_samr_samr_AcctFlags_ACB_TRUSTED_FOR_DELEGATION = -1;
-static gint hf_samr_samr_DomInfo1_password_properties = -1;
-static gint hf_samr_samr_ChangePasswordUser3_lm_password = -1;
-static gint hf_samr_samr_DispInfo_info1 = -1;
-static gint hf_samr_samr_Connect_system_name = -1;
-static gint hf_samr_samr_DomInfo8_sequence_num = -1;
-static gint hf_samr_samr_UserInfo1_account_name = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_RID = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_BAD_PWD_COUNT = -1;
-static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_NO_ANON_CHANGE = -1;
-static gint hf_samr_samr_UserInfo24_password = -1;
-static gint hf_samr_samr_DomInfo12_lockout_threshold = -1;
+static gint hf_samr_samr_ConnectInfo1_client_version = -1;
+static gint hf_samr_samr_UserInfo3_acct_flags = -1;
+static gint hf_samr_samr_EnumDomains_buf_size = -1;
 static gint hf_samr_samr_DomGeneralInformation2_lockout_window = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOCALE = -1;
-static gint hf_samr_alias_handle = -1;
-static gint hf_samr_samr_DispInfoGeneral_count = -1;
-static gint hf_samr_samr_UserInfo3_profile_path = -1;
-static gint hf_samr_samr_AcctFlags_ACB_HOMDIRREQ = -1;
+static gint hf_samr_samr_ChangePasswordUser_new_lm_crypted = -1;
+static gint hf_samr_samr_UserInfo11_logon_script = -1;
+static gint hf_samr_samr_Connect4_client_version = -1;
+static gint hf_samr_samr_GroupAttrs_SE_GROUP_ENABLED_BY_DEFAULT = -1;
+static gint hf_samr_samr_DispInfo_info2 = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_LOGON = -1;
+static gint hf_samr_samr_QueryDisplayInfo2_level = -1;
+static gint hf_samr_samr_UserInfo3_workstations = -1;
+static gint hf_samr_samr_UserInfo1_primary_gid = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_COMMENT = -1;
+static gint hf_samr_samr_UserInfo5_account_name = -1;
+static gint hf_samr_samr_ChangePasswordUser3_password3 = -1;
+static gint hf_samr_samr_UserInfo21_home_directory = -1;
+static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_SET_INFO = -1;
 static gint hf_samr_samr_Ids_count = -1;
-static gint hf_samr_samr_ChangePasswordUser3_reject = -1;
-static gint hf_samr_samr_GroupAttrs_SE_GROUP_MANDATORY = -1;
-static gint hf_samr_samr_GetGroupsForUser_rids = -1;
-static gint hf_samr_samr_UserInfo23_info = -1;
-static gint hf_samr_samr_UserInfo18_password_expired = -1;
-static gint hf_samr_samr_UserInfo25_info = -1;
-static gint hf_samr_samr_OpenDomain_sid = -1;
-static gint hf_samr_samr_GetAliasMembership_sids = -1;
-static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_COMPLEX = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_HOME_DRIVE = -1;
-static gint hf_samr_samr_DispEntryFullGroup_account_name = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_NT_PASSWORD_PRESENT = -1;
-static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_COUNT = -1;
-static gint hf_samr_samr_AddAliasMember_sid = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_PASSWORD = -1;
-static gint hf_samr_samr_GetBootKeyInformation_unknown = -1;
-static gint hf_samr_samr_Connect2_system_name = -1;
+static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_ADD_MEMBER = -1;
+static gint hf_samr_samr_UserInfo1_full_name = -1;
 static gint hf_samr_samr_DomInfo1_password_history_length = -1;
-static gint hf_samr_samr_UserInfo25_password = -1;
-static gint hf_samr_samr_ValidatePasswordInfo_fields_present = -1;
-static gint hf_samr_samr_ValidatePasswordReq_req3 = -1;
-static gint hf_samr_samr_UserInfo7_account_name = -1;
-static gint hf_samr_samr_UserInfo9_primary_gid = -1;
-static gint hf_samr_samr_DomainInfo_info3 = -1;
-static gint hf_samr_samr_UserInfo3_logon_hours = -1;
-static gint hf_samr_samr_UserInfo21_acct_expiry = -1;
-static gint hf_samr_samr_ChangePasswordUser_new_nt_crypted = -1;
-static gint hf_samr_samr_DomainInfo_info6 = -1;
-static gint hf_samr_samr_ChangePasswordUser_nt_present = -1;
-static gint hf_samr_samr_ValidatePasswordReq_req2 = -1;
-static gint hf_samr_samr_SetDomainInfo_level = -1;
-static gint hf_samr_samr_UserInfo21_lm_password = -1;
-static gint hf_samr_samr_GroupInfo_description = -1;
-static gint hf_samr_samr_DispEntryFull_idx = -1;
-static gint hf_samr_samr_EnumDomains_resume_handle = -1;
-static gint hf_samr_samr_DomGeneralInformation_num_users = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_HOME_DIRECTORY = -1;
-static gint hf_samr_samr_QueryDisplayInfo3_level = -1;
-static gint hf_samr_samr_GroupAttrs_SE_GROUP_ENABLED = -1;
-static gint hf_samr_samr_AcctFlags_ACB_SVRTRUST = -1;
-static gint hf_samr_samr_SetMemberAttributesOfGroup_unknown2 = -1;
-static gint hf_samr_samr_UserInfo1_comment = -1;
-static gint hf_samr_samr_AcctFlags_ACB_USE_DES_KEY_ONLY = -1;
-static gint hf_samr_samr_RemoveMultipleMembersFromAlias_sids = -1;
-static gint hf_samr_samr_DomainInfo_info7 = -1;
-static gint hf_samr_samr_DomGeneralInformation2_lockout_duration = -1;
-static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_REMOVE_MEMBER = -1;
-static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_ADD_MEMBER = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_NUM_LOGONS = -1;
-static gint hf_samr_samr_ValidatePasswordReq2_info = -1;
-static gint hf_samr_samr_EnumDomains_buf_size = -1;
-static gint hf_samr_samr_DomGeneralInformation2_lockout_threshold = -1;
-static gint hf_samr_samr_EnumDomainGroups_sam = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_PASSWORD = -1;
-static gint hf_samr_samr_UserInfo21_unknown4 = -1;
-static gint hf_samr_samr_AcctFlags_ACB_PWNOEXP = -1;
-static gint hf_samr_samr_CreateDomAlias_alias_name = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_2 = -1;
-static gint hf_samr_samr_UserInfo_info25 = -1;
-static gint hf_samr_samr_GroupAttrs_SE_GROUP_ENABLED_BY_DEFAULT = -1;
-static gint hf_samr_samr_Connect3_system_name = -1;
-static gint hf_samr_samr_DomInfo3_force_logoff_time = -1;
-static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_TIME = -1;
-static gint hf_samr_samr_DomInfo13_modified_count_at_last_promotion = -1;
-static gint hf_samr_samr_RidTypeArray_types = -1;
-static gint hf_samr_samr_QueryDisplayInfo2_max_entries = -1;
-static gint hf_samr_samr_DomGeneralInformation_force_logoff_time = -1;
-static gint hf_samr_samr_DispInfoFull_entries = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS = -1;
-static gint hf_samr_samr_ChangeReject_reason = -1;
-static gint hf_samr_samr_ValidatePasswordReq3_pwd_must_change_at_next_logon = -1;
+static gint hf_samr_samr_GroupAttrs_SE_GROUP_MANDATORY = -1;
 static gint hf_samr_samr_ChangePasswordUser_nt_cross = -1;
-static gint hf_samr_samr_ChangePasswordUser_cross1_present = -1;
+static gint hf_samr_samr_Password_hash = -1;
+static gint hf_samr_samr_UserInfo_info16 = -1;
+static gint hf_samr_samr_UserInfo21_last_logon = -1;
 static gint hf_samr_samr_UserInfo8_full_name = -1;
-static gint hf_samr_samr_DispInfo_info2 = -1;
-static gint hf_samr_samr_GroupAttrs_SE_GROUP_LOGON_ID = -1;
-static gint hf_samr_samr_SetBootKeyInformation_unknown2 = -1;
-static gint hf_samr_samr_DomGeneralInformation2_general = -1;
-static gint hf_samr_samr_EnumDomainAliases_sam = -1;
-static gint hf_samr_samr_DomGeneralInformation_sequence_num = -1;
-static gint hf_samr_samr_UserInfo21_account_name = -1;
-static gint hf_samr_samr_AcctFlags_ACB_NO_AUTH_DATA_REQD = -1;
-static gint hf_samr_samr_Connect5_info_in = -1;
-static gint hf_samr_samr_Connect5_level_in = -1;
-static gint hf_samr_samr_UserInfo13_description = -1;
-static gint hf_samr_samr_UserInfo18_nt_pwd_active = -1;
-static gint hf_samr_samr_UserInfo_info2 = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_LOGOFF = -1;
-static gint hf_samr_samr_EnumDomainAliases_resume_handle = -1;
-static gint hf_samr_samr_SetBootKeyInformation_unknown3 = -1;
-static gint hf_samr_samr_DispInfoAscii_entries = -1;
-static gint hf_samr_samr_CreateUser2_access_granted = -1;
-static gint hf_samr_samr_GroupInfoAll_num_members = -1;
-static gint hf_samr_samr_UserInfo12_profile_path = -1;
-static gint hf_samr_samr_AcctFlags_ACB_MNS = -1;
-static gint hf_samr_samr_UserInfo1_description = -1;
-static gint hf_samr_samr_UserInfo21_nt_password = -1;
+static gint hf_samr_samr_ChangePasswordUser_cross1_present = -1;
+static gint hf_samr_samr_GetDisplayEnumerationIndex2_name = -1;
+static gint hf_samr_samr_DomInfo13_modified_count_at_last_promotion = -1;
+static gint hf_samr_samr_ChangePasswordUser2_lm_password = -1;
+static gint hf_samr_samr_OemChangePasswordUser2_password = -1;
+static gint hf_samr_samr_QueryDisplayInfo2_buf_size = -1;
+static gint hf_samr_samr_ValidatePasswordReq_req2 = -1;
+static gint hf_samr_samr_RidTypeArray_types = -1;
+static gint hf_samr_samr_QueryDisplayInfo3_info = -1;
 static gint hf_samr_samr_UserInfo_info8 = -1;
-static gint hf_samr_samr_UserInfo_info20 = -1;
+static gint hf_samr_samr_QueryAliasInfo_level = -1;
+static gint hf_samr_samr_UserInfo21_password_expired = -1;
+static gint hf_samr_samr_DomainInfo_info9 = -1;
+static gint hf_samr_samr_UserInfo3_bad_password_count = -1;
+static gint hf_samr_samr_ChangePasswordUser_old_nt_crypted = -1;
+static gint hf_samr_samr_DispEntryGeneral_full_name = -1;
 static gint hf_samr_samr_UserInfo21_buffer = -1;
-static gint hf_samr_status = -1;
+static gint hf_samr_samr_ConnectInfo1_unknown2 = -1;
+static gint hf_samr_samr_LookupDomain_sid = -1;
+static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_CREATE_DOMAIN = -1;
+static gint hf_samr_samr_DeleteAliasMember_sid = -1;
+static gint hf_samr_samr_SetUserInfo2_level = -1;
+static gint hf_samr_samr_SamArray_count = -1;
+static gint hf_samr_samr_DispEntryGeneral_idx = -1;
+static gint hf_samr_samr_ValidatePasswordRep_ctr2 = -1;
+static gint hf_samr_samr_QueryDomainInfo2_info = -1;
 static gint hf_samr_samr_ValidatePasswordInfo_pwd_history_len = -1;
-static gint hf_samr_samr_UserInfo5_logon_count = -1;
-static gint hf_samr_samr_UserInfo21_last_password_change = -1;
-static gint hf_samr_samr_EnumDomains_sam = -1;
-static gint hf_samr_samr_ValidatePasswordReq_req1 = -1;
-static gint hf_samr_group_handle = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCT_FLAGS = -1;
-static gint hf_samr_samr_DispEntryFullGroup_acct_flags = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_PRIVATE_DATA = -1;
-static gint hf_samr_samr_UserInfo5_description = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_PRIMARY_GID = -1;
-static gint hf_samr_samr_DispInfoFullGroups_entries = -1;
+static gint hf_samr_samr_UserInfo_info3 = -1;
+static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_LOCKOUT_ADMINS = -1;
+static gint hf_samr_samr_ValidatePasswordReq3_info = -1;
+static gint hf_samr_status = -1;
+static gint hf_samr_samr_DispInfoFullGroups_count = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LM_PASSWORD_PRESENT = -1;
+static gint hf_samr_samr_Connect_system_name = -1;
+static gint hf_samr_samr_OemChangePasswordUser2_hash = -1;
+static gint hf_samr_samr_UserInfo21_parameters = -1;
+static gint hf_samr_samr_GroupInfo_all2 = -1;
+static gint hf_samr_samr_DomainInfo_general2 = -1;
+static gint hf_samr_samr_DispEntryFullGroup_account_name = -1;
+static gint hf_samr_samr_QueryUserInfo_level = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_DESCRIPTION = -1;
+static gint hf_samr_samr_LookupDomain_domain_name = -1;
+static gint hf_samr_samr_DomainInfo_info7 = -1;
+static gint hf_samr_samr_UserInfo3_profile_path = -1;
+static gint hf_samr_samr_ValidatePasswordRep_ctr3 = -1;
 static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_NO_CLEAR_CHANGE = -1;
-static gint hf_samr_samr_ValidatePasswordInfo_pwd_history = -1;
-static gint hf_samr_samr_GetDisplayEnumerationIndex2_name = -1;
-static gint hf_samr_samr_OemChangePasswordUser2_password = -1;
-static gint hf_samr_samr_QueryDisplayInfo_info = -1;
-static gint hf_samr_samr_UserInfo_info9 = -1;
-static gint hf_samr_samr_UserInfo_info26 = -1;
-static gint hf_samr_samr_ChangePasswordUser2_lm_verifier = -1;
+static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_COUNT = -1;
+static gint hf_samr_samr_QueryUserInfo2_level = -1;
+static gint hf_samr_samr_CreateDomainGroup_name = -1;
+static gint hf_samr_samr_EnumDomainGroups_sam = -1;
+static gint hf_samr_samr_CreateUser2_access_granted = -1;
+static gint hf_samr_samr_SetAliasInfo_level = -1;
+static gint hf_samr_samr_DomGeneralInformation_num_users = -1;
+static gint hf_samr_samr_GroupAttrs_SE_GROUP_RESOURCE = -1;
+static gint hf_samr_samr_UserInfo_info2 = -1;
+static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_LOOKUP_INFO = -1;
+static gint hf_samr_samr_EnumDomainUsers_acct_flags = -1;
 static gint hf_samr_samr_UserInfo10_home_directory = -1;
-static gint hf_samr_samr_CryptPassword_data = -1;
-static gint hf_samr_samr_SetGroupInfo_info = -1;
-static gint hf_samr_samr_UserInfo2_code_page = -1;
-static gint hf_samr_samr_UserInfo5_profile_path = -1;
+static gint hf_samr_samr_ChangeReject_reason = -1;
+static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_LOOKUP_DOMAIN = -1;
+static gint hf_samr_samr_AddAliasMember_sid = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_3 = -1;
+static gint hf_samr_samr_QueryDisplayInfo2_returned_size = -1;
+static gint hf_samr_samr_EnumDomainUsers_num_entries = -1;
+static gint hf_samr_connect_access_mask = -1;
+static gint hf_samr_samr_EnumDomainAliases_resume_handle = -1;
+static gint hf_samr_samr_AcctFlags_ACB_ENC_TXT_PWD_ALLOWED = -1;
+static gint hf_samr_samr_DispInfoAscii_entries = -1;
+static gint hf_samr_samr_DomGeneralInformation2_lockout_threshold = -1;
+static gint hf_samr_samr_AcctFlags_ACB_DISABLED = -1;
 static gint hf_samr_samr_AliasInfoAll_name = -1;
-static gint hf_samr_samr_GetDisplayEnumerationIndex_idx = -1;
-static gint hf_samr_samr_RidToSid_sid = -1;
-static gint hf_samr_samr_DomInfo1_min_password_length = -1;
-static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_SET_INFO = -1;
-static gint hf_samr_samr_UserInfo5_last_logoff = -1;
+static gint hf_samr_samr_GroupInfoAll_description = -1;
+static gint hf_samr_samr_ValidatePasswordReq2_hash = -1;
+static gint hf_samr_samr_UserInfo24_password_expired = -1;
+static gint hf_samr_samr_GroupAttrs_SE_GROUP_LOGON_ID = -1;
 static gint hf_samr_samr_UserInfo18_lm_pwd_active = -1;
-static gint hf_samr_samr_EnumDomainUsers_num_entries = -1;
-static gint hf_samr_samr_Connect4_client_version = -1;
-static gint hf_samr_samr_UserInfo18_lm_pwd = -1;
-static gint hf_samr_samr_UserInfo5_bad_password_count = -1;
-static gint hf_samr_samr_RidTypeArray_count = -1;
-static gint hf_samr_samr_AliasInfo_name = -1;
-static gint hf_samr_samr_UserInfo18_nt_pwd = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOGONINFO = -1;
-static gint hf_samr_connect_handle = -1;
-static gint hf_samr_samr_DomainInfo_info9 = -1;
-static gint hf_samr_samr_GroupAttrs_SE_GROUP_OWNER = -1;
-static gint hf_samr_samr_GetDisplayEnumerationIndex_level = -1;
-static gint hf_samr_samr_Connect5_level_out = -1;
-static gint hf_samr_samr_UserInfo21_comment = -1;
-static gint hf_samr_samr_DispInfo_info5 = -1;
-static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_REMOVE_MEMBER = -1;
-static gint hf_samr_samr_QueryDomainInfo2_info = -1;
-static gint hf_samr_samr_UserInfo5_logon_script = -1;
-static gint hf_samr_samr_DomainInfo_general = -1;
+static gint hf_samr_samr_ValidatePasswordInfo_bad_pwd_count = -1;
+static gint hf_samr_samr_ValidatePasswordReq1_password_matched = -1;
+static gint hf_samr_samr_UserInfo5_description = -1;
+static gint hf_samr_samr_UserInfo21_logon_script = -1;
+static gint hf_samr_samr_UserInfo5_full_name = -1;
+static gint hf_samr_samr_DomGeneralInformation_role = -1;
 static gint hf_samr_samr_UserInfo_info11 = -1;
-static gint hf_samr_samr_DomGeneralInformation_primary = -1;
-static gint hf_samr_samr_UserInfo21_last_logon = -1;
-static gint hf_samr_samr_DomInfo13_domain_create_time = -1;
-static gint hf_samr_samr_UserInfo24_password_expired = -1;
-static gint hf_samr_samr_UserInfo3_full_name = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_DESCRIPTION = -1;
-static gint hf_samr_samr_GetAliasMembership_rids = -1;
-static gint hf_samr_samr_ValidationBlob_length = -1;
-static gint hf_samr_samr_Connect4_system_name = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_EXPIRED_FLAG = -1;
-static gint hf_samr_samr_DomainInfo_info13 = -1;
-static gint hf_samr_samr_ValidatePasswordInfo_last_password_change = -1;
-static gint hf_samr_samr_DomInfo8_domain_create_time = -1;
-static gint hf_samr_samr_Connect5_info_out = -1;
-static gint hf_samr_samr_DispEntryGeneral_description = -1;
-static gint hf_samr_samr_QueryDisplayInfo2_start_idx = -1;
+static gint hf_samr_lsa_Strings_count = -1;
+static gint hf_samr_samr_EnumDomainUsers_sam = -1;
+static gint hf_samr_samr_UserInfo3_home_directory = -1;
+static gint hf_samr_samr_GroupInfo_description = -1;
+static gint hf_samr_samr_SetBootKeyInformation_unknown1 = -1;
+static gint hf_samr_samr_Connect3_system_name = -1;
+static gint hf_samr_samr_SetGroupInfo_level = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUPS = -1;
+static gint hf_samr_samr_QueryGroupMember_rids = -1;
+static gint hf_samr_samr_UserInfo_info12 = -1;
+static gint hf_samr_samr_UserInfo5_acct_expiry = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_NUM_LOGONS = -1;
+static gint hf_samr_samr_UserInfo21_lm_password_set = -1;
+static gint hf_samr_samr_EnumDomainGroups_resume_handle = -1;
+static gint hf_samr_samr_QueryDomainInfo_level = -1;
 static gint hf_samr_samr_GroupInfoAll_name = -1;
-static gint hf_samr_samr_UserInfo_info24 = -1;
+static gint hf_samr_samr_ValidatePasswordReq3_pwd_must_change_at_next_logon = -1;
+static gint hf_samr_samr_ChangePasswordUser_cross2_present = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_LOGOFF = -1;
+static gint hf_samr_samr_DomainInfo_info8 = -1;
 static gint hf_samr_samr_QueryDisplayInfo3_start_idx = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_LOGON = -1;
-static gint hf_samr_samr_UserInfo3_workstations = -1;
-static gint hf_samr_samr_ChangePasswordUser_old_nt_crypted = -1;
-static gint hf_samr_samr_QueryDisplayInfo3_returned_size = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_3 = -1;
-static gint hf_samr_samr_QueryAliasInfo_level = -1;
-static gint hf_samr_samr_SamArray_count = -1;
-static gint hf_samr_samr_QuerySecurity_sdbuf = -1;
-static gint hf_samr_samr_DispEntryFullGroup_description = -1;
-static gint hf_samr_samr_ConnectInfo1_client_version = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_ATTRIBUTES = -1;
-static gint hf_samr_samr_Shutdown_connect_handle = -1;
-static gint hf_samr_samr_UserInfo10_home_drive = -1;
-static gint hf_samr_samr_QueryUserInfo_level = -1;
-static gint hf_samr_samr_AcctFlags_ACB_TRUST_AUTH_DELEGAT = -1;
-static gint hf_samr_samr_DomInfo7_role = -1;
-static gint hf_samr_samr_DomGeneralInformation_domain_server_state = -1;
-static gint hf_samr_samr_OemChangePasswordUser2_hash = -1;
-static gint hf_samr_samr_UserInfo1_full_name = -1;
-static gint hf_samr_samr_AcctFlags_ACB_AUTOLOCK = -1;
-static gint hf_samr_opnum = -1;
-static gint hf_samr_samr_UserInfo3_logon_script = -1;
-static gint hf_samr_samr_ValidatePasswordReq3_hash = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LOGON_SCRIPT = -1;
-static gint hf_samr_samr_EnumDomainUsers_acct_flags = -1;
-static gint hf_samr_samr_SetAliasInfo_info = -1;
-static gint hf_samr_domain_access_mask = -1;
-static gint hf_samr_samr_LookupRids_names = -1;
-static gint hf_samr_user_access_mask = -1;
-static gint hf_samr_samr_DomGeneralInformation_unknown3 = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_FULL_NAME = -1;
-static gint hf_samr_samr_DomGeneralInformation_domain_name = -1;
-static gint hf_samr_samr_SamEntry_idx = -1;
-static gint hf_samr_samr_UserInfo21_buf_count = -1;
+static gint hf_samr_samr_UserInfo5_last_logon = -1;
+static gint hf_samr_samr_UserInfo2_comment = -1;
+static gint hf_samr_samr_AcctFlags_ACB_PW_EXPIRED = -1;
+static gint hf_samr_samr_UserInfo21_private = -1;
+static gint hf_samr_samr_AcctFlags_ACB_WSTRUST = -1;
 static gint hf_samr_samr_ChangeReject_unknown2 = -1;
-static gint hf_samr_samr_UserInfo21_full_name = -1;
-static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_LENGTH = -1;
-static gint hf_samr_samr_UserInfo21_allow_password_change = -1;
-static gint hf_samr_samr_GetUserPwInfo_info = -1;
+static gint hf_samr_samr_DispEntryAscii_idx = -1;
+static gint hf_samr_samr_UserInfo13_description = -1;
+static gint hf_samr_samr_ValidatePassword_rep = -1;
+static gint hf_samr_samr_UserInfo_info21 = -1;
+static gint hf_samr_samr_AliasInfo_description = -1;
+static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY = -1;
+static gint hf_samr_samr_ValidatePasswordReq2_info = -1;
+static gint hf_samr_samr_ChangePasswordUser_lm_cross = -1;
+static gint hf_samr_samr_SetBootKeyInformation_unknown2 = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_PASSWORD = -1;
+static gint hf_samr_samr_ValidationBlob_data = -1;
+static gint hf_samr_samr_UserInfo3_last_password_change = -1;
+static gint hf_samr_samr_DomGeneralInformation2_lockout_duration = -1;
+static gint hf_samr_samr_DomainInfo_info5 = -1;
+static gint hf_samr_samr_ChangePasswordUser_lm_present = -1;
+static gint hf_samr_samr_AcctFlags_ACB_MNS = -1;
+static gint hf_samr_samr_ChangePasswordUser3_server = -1;
+static gint hf_samr_samr_GetDisplayEnumerationIndex_level = -1;
+static gint hf_samr_samr_QueryDisplayInfo_total_size = -1;
+static gint hf_samr_rid = -1;
+static gint hf_samr_samr_UserInfo_info23 = -1;
+static gint hf_samr_samr_UserInfo_info4 = -1;
+static gint hf_samr_samr_UserInfo21_lm_password = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_OWF_PWD = -1;
+static gint hf_samr_samr_LookupNames_types = -1;
+static gint hf_samr_samr_Connect5_level_out = -1;
+static gint hf_samr_samr_DomainInfo_info13 = -1;
+static gint hf_samr_samr_QueryDisplayInfo3_total_size = -1;
+static gint hf_samr_samr_ChangePasswordUser3_reject = -1;
+static gint hf_samr_samr_GroupInfoDescription_description = -1;
+static gint hf_samr_samr_ChangePasswordUser2_nt_password = -1;
+static gint hf_samr_handle = -1;
+static gint hf_samr_samr_QueryUserInfo2_info = -1;
+static gint hf_samr_samr_DomGeneralInformation_force_logoff_time = -1;
+static gint hf_samr_samr_GetMembersInAlias_sids = -1;
+static gint hf_samr_samr_PwInfo_password_properties = -1;
+static gint hf_samr_samr_ValidatePasswordInfo_pwd_history = -1;
+static gint hf_samr_samr_DispEntryGeneral_account_name = -1;
+static gint hf_samr_samr_ChangePasswordUser3_dominfo = -1;
+static gint hf_samr_samr_DomGeneralInformation_num_aliases = -1;
+static gint hf_samr_samr_UserInfo5_logon_count = -1;
+static gint hf_samr_samr_UserInfo21_account_name = -1;
+static gint hf_samr_samr_UserInfo6_account_name = -1;
 static gint hf_samr_samr_SetSecurity_sec_info = -1;
-static gint hf_samr_samr_UserInfo3_last_logon = -1;
-static gint hf_samr_samr_UserInfo3_bad_password_count = -1;
-static gint hf_samr_samr_ChangePasswordUser3_account = -1;
+static gint hf_samr_samr_GroupInfo_name = -1;
+static gint hf_samr_samr_CreateUser_account_name = -1;
+static gint hf_samr_samr_OemChangePasswordUser2_server = -1;
+static gint hf_samr_samr_DomInfo1_password_properties = -1;
+static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_REMOVE_MEMBER = -1;
+static gint hf_samr_samr_SamEntry_name = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_2 = -1;
+static gint hf_samr_samr_ValidatePasswordReq3_account = -1;
+static gint hf_samr_samr_UserInfo21_nt_password = -1;
+static gint hf_samr_samr_UserInfo3_allow_password_change = -1;
+static gint hf_samr_samr_AcctFlags_ACB_SMARTCARD_REQUIRED = -1;
+static gint hf_samr_samr_UserInfo26_password = -1;
 static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_GROUP = -1;
+static gint hf_samr_samr_ValidatePassword_level = -1;
+static gint hf_samr_samr_DomGeneralInformation_num_groups = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS = -1;
+static gint hf_samr_samr_UserInfo3_primary_gid = -1;
+static gint hf_samr_samr_UserInfo_info24 = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_LOC_COM = -1;
+static gint hf_samr_samr_UserInfo2_unknown = -1;
+static gint hf_samr_samr_DispEntryFull_description = -1;
+static gint hf_samr_samr_UserInfo21_acct_flags = -1;
+static gint hf_samr_samr_UserInfo_info5 = -1;
 static gint hf_samr_samr_ValidatePasswordInfo_lockout_time = -1;
-static gint hf_samr_samr_ValidatePasswordInfo_bad_pwd_count = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_ALLOW_PWD_CHANGE = -1;
+static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_ADD_MEMBER = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_1 = -1;
+static gint hf_samr_samr_UserInfo25_info = -1;
+static gint hf_samr_samr_SetDomainInfo_info = -1;
+static gint hf_samr_samr_ValidatePasswordReq3_password = -1;
+static gint hf_samr_samr_QuerySecurity_sdbuf = -1;
+static gint hf_samr_samr_UserInfo25_password = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOGONINFO = -1;
+static gint hf_samr_samr_EnumDomains_connect_handle = -1;
+static gint hf_samr_samr_AcctFlags_ACB_NOT_DELEGATED = -1;
+static gint hf_samr_samr_Shutdown_connect_handle = -1;
+static gint hf_samr_samr_SamEntry_idx = -1;
+static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_SHUTDOWN_SERVER = -1;
+static gint hf_samr_samr_UserInfo21_logon_hours = -1;
+static gint hf_samr_samr_LookupNames_num_names = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 = -1;
+static gint hf_samr_samr_UserInfo21_profile_path = -1;
+static gint hf_samr_samr_GetDomPwInfo_domain_name = -1;
+static gint hf_samr_samr_GetBootKeyInformation_domain_handle = -1;
+static gint hf_samr_samr_UserInfo21_nt_password_set = -1;
+static gint hf_samr_samr_GroupAttrs_SE_GROUP_USE_FOR_DENY_ONLY = -1;
+static gint hf_samr_samr_UserInfo3_logon_count = -1;
+static gint hf_samr_samr_QueryUserInfo_info = -1;
+static gint hf_samr_samr_UserInfo3_force_password_change = -1;
+static gint hf_samr_samr_UserInfo21_description = -1;
+static gint hf_samr_samr_UserInfo_info26 = -1;
 static gint hf_samr_samr_DispInfoFull_count = -1;
-static gint hf_samr_samr_ValidatePasswordReq1_info = -1;
-static gint hf_samr_samr_UserInfo_info4 = -1;
-static gint hf_samr_samr_AcctFlags_ACB_DISABLED = -1;
+static gint hf_samr_samr_EnumDomainAliases_max_size = -1;
+static gint hf_samr_samr_GetAliasMembership_sids = -1;
+static gint hf_samr_samr_UserInfo18_lm_pwd = -1;
+static gint hf_samr_samr_UserInfo_info9 = -1;
+static gint hf_samr_samr_CryptPassword_data = -1;
+static gint hf_samr_samr_UserInfo16_acct_flags = -1;
+static gint hf_samr_samr_DispInfo_info3 = -1;
+static gint hf_samr_samr_UserInfo_info18 = -1;
+static gint hf_samr_samr_UserInfo21_workstations = -1;
+static gint hf_samr_samr_DispEntryFullGroup_acct_flags = -1;
+static gint hf_samr_samr_DomainInfo_info12 = -1;
+static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_GET_MEMBERS = -1;
+static gint hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_LOCKOUT_TIME = -1;
+static gint hf_samr_samr_Connect5_system_name = -1;
+static gint hf_samr_samr_Connect4_system_name = -1;
+static gint hf_samr_samr_Connect3_unknown = -1;
+static gint hf_samr_group_handle = -1;
+static gint hf_samr_samr_ChangePasswordUser_old_lm_crypted = -1;
+static gint hf_samr_samr_ValidatePasswordReq3_hash = -1;
+static gint hf_samr_samr_DomOEMInformation_oem_information = -1;
+static gint hf_samr_samr_ChangePasswordUser2_nt_verifier = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT = -1;
 static gint hf_samr_samr_SetDsrmPassword_unknown = -1;
-static gint hf_samr_samr_UserInfo_info6 = -1;
-static gint hf_samr_samr_AcctFlags_ACB_DONT_REQUIRE_PREAUTH = -1;
-static gint hf_samr_samr_UserInfo_info21 = -1;
-static gint hf_samr_samr_LookupRids_types = -1;
-static gint hf_samr_group_access_mask = -1;
-static gint hf_samr_samr_UserInfo_info10 = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCT_EXPIRY = -1;
+static gint hf_samr_samr_EnumDomains_resume_handle = -1;
+static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_LOOKUP_INFO = -1;
+static gint hf_samr_sec_desc_buf_len = -1;
+static gint hf_samr_samr_SetUserInfo_level = -1;
+static gint hf_samr_samr_RidWithAttribute_attributes = -1;
+static gint hf_samr_samr_SetSecurity_sdbuf = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_SEC_DESC = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_COUNTRY_CODE = -1;
+static gint hf_samr_samr_DomInfo13_sequence_num = -1;
+static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_NO_ANON_CHANGE = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_WORKSTATIONS = -1;
+static gint hf_samr_samr_UserInfo5_acct_flags = -1;
+static gint hf_samr_domain_access_mask = -1;
+static gint hf_samr_samr_ChangeReject_unknown1 = -1;
 static gint hf_samr_samr_ValidatePasswordInfo_bad_password_time = -1;
-static gint hf_samr_samr_SetAliasInfo_level = -1;
-static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP = -1;
-static gint hf_samr_samr_UserInfo21_force_password_change = -1;
-static gint hf_samr_samr_PwInfo_password_properties = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_CODE_PAGE = -1;
-static gint hf_samr_samr_UserInfo1_primary_gid = -1;
-static gint hf_samr_samr_GroupInfoAll_description = -1;
-static gint hf_samr_samr_LookupRids_num_rids = -1;
-static gint hf_samr_samr_AliasInfo_description = -1;
-static gint hf_samr_domain_handle = -1;
-static gint hf_samr_samr_QueryUserInfo_info = -1;
-static gint hf_samr_samr_SamEntry_name = -1;
-static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_CREATE_DOMAIN = -1;
-static gint hf_samr_samr_QueryDisplayInfo_total_size = -1;
+static gint hf_samr_samr_ValidatePasswordReq_req3 = -1;
+static gint hf_samr_samr_UserInfo3_last_logon = -1;
+static gint hf_samr_samr_UserInfo5_primary_gid = -1;
+static gint hf_samr_samr_DomInfo1_min_password_age = -1;
+static gint hf_samr_samr_GetGroupsForUser_rids = -1;
+static gint hf_samr_samr_DispInfoFullGroups_entries = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_ALIAS = -1;
 static gint hf_samr_samr_QueryDomainInfo2_level = -1;
-static gint hf_samr_samr_ValidatePassword_rep = -1;
-static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_1 = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_PWD_CHANGE = -1;
-static gint hf_samr_samr_DispEntryFull_account_name = -1;
-static gint hf_samr_samr_QuerySecurity_sec_info = -1;
+static gint hf_samr_samr_GroupInfo_all = -1;
+static gint hf_samr_samr_UserInfo21_allow_password_change = -1;
+static gint hf_samr_samr_ChangePasswordUser2_server = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_PRIMARY_GID = -1;
+static gint hf_samr_samr_UserInfo23_password = -1;
+static gint hf_samr_samr_DispInfoGeneral_count = -1;
+static gint hf_samr_samr_LookupRids_types = -1;
+static gint hf_samr_samr_RemoveMemberFromForeignDomain_sid = -1;
+static gint hf_samr_samr_UserInfo3_last_logoff = -1;
 static gint hf_samr_samr_QueryGroupInfo_info = -1;
-static gint hf_samr_samr_ValidatePasswordReq3_account = -1;
-static gint hf_samr_user_handle = -1;
-static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_SEC_DESC = -1;
-static gint hf_samr_samr_Password_hash = -1;
-static gint hf_samr_samr_GetDomPwInfo_domain_name = -1;
-static gint hf_samr_samr_QueryDisplayInfo_level = -1;
-static gint hf_samr_samr_UserInfo2_comment = -1;
+static gint hf_samr_samr_UserInfo21_comment = -1;
+static gint hf_samr_samr_UserInfo_info17 = -1;
+static gint hf_samr_samr_ChangePasswordUser3_lm_password = -1;
+static gint hf_samr_samr_UserInfo5_logon_hours = -1;
+static gint hf_samr_samr_DomGeneralInformation_unknown3 = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_BAD_PWD_COUNT = -1;
+static gint hf_samr_samr_GetUserPwInfo_info = -1;
+static gint hf_samr_samr_UserInfo3_logon_hours = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_ATTRIBUTES = -1;
+static gint hf_samr_samr_EnumDomainGroups_num_entries = -1;
+static gint hf_samr_lsa_Strings_names = -1;
+static gint hf_samr_samr_OpenDomain_sid = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LOGON_HOURS = -1;
+static gint hf_samr_samr_ValidatePasswordRep_ctr1 = -1;
 static gint hf_samr_samr_UserInfo21_home_drive = -1;
+static gint hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_GET_MEMBERS = -1;
+static gint hf_samr_samr_LogonHours_units_per_week = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_NT_PASSWORD_PRESENT = -1;
+static gint hf_samr_samr_GroupInfoAll_attributes = -1;
+static gint hf_samr_samr_SetUserInfo2_info = -1;
+static gint hf_samr_samr_QueryDisplayInfo_returned_size = -1;
+static gint hf_samr_samr_UserInfo18_nt_pwd = -1;
+static gint hf_samr_samr_ValidatePasswordReq3_clear_lockout = -1;
+static gint hf_samr_samr_DomInfo12_lockout_duration = -1;
+static gint hf_samr_samr_SetGroupInfo_info = -1;
+static gint hf_samr_samr_AliasInfo_all = -1;
+static gint hf_samr_samr_AcctFlags_ACB_TEMPDUP = -1;
+static gint hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_INITIALIZE_SERVER = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOCALE = -1;
+static gint hf_samr_samr_ValidatePasswordReq2_account = -1;
+static gint hf_samr_samr_UserInfo5_logon_script = -1;
+static gint hf_samr_samr_DispInfo_info5 = -1;
+static gint hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_COMPLEX = -1;
+static gint hf_samr_samr_DomainInfo_info3 = -1;
+static gint hf_samr_samr_UserInfo7_account_name = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_HOME_DRIVE = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_USER = -1;
+static gint hf_samr_samr_CreateUser2_acct_flags = -1;
+static gint hf_samr_samr_ValidatePasswordReq_req1 = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_FORCE_PWD_CHANGE = -1;
+static gint hf_samr_samr_DomInfo3_force_logoff_time = -1;
+static gint hf_samr_samr_GroupInfoAttributes_attributes = -1;
+static gint hf_samr_samr_UserInfo6_full_name = -1;
+static gint hf_samr_samr_AcctFlags_ACB_HOMDIRREQ = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCT_FLAGS = -1;
+static gint hf_samr_samr_UserInfo_info7 = -1;
+static gint hf_samr_user_access_mask = -1;
+static gint hf_samr_samr_ValidatePasswordReq2_password = -1;
+static gint hf_samr_samr_DomainInfo_oem = -1;
+static gint hf_samr_samr_DomGeneralInformation_domain_name = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP = -1;
+static gint hf_samr_samr_DomainInfo_info6 = -1;
+static gint hf_samr_samr_EnumDomainAliases_num_entries = -1;
+static gint hf_samr_samr_DomInfo7_role = -1;
+static gint hf_samr_samr_LookupNames_rids = -1;
+static gint hf_samr_samr_DispInfoGeneral_entries = -1;
+static gint hf_samr_samr_AliasInfo_name = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_EXPIRED_FLAG = -1;
+static gint hf_samr_samr_UserInfo21_primary_gid = -1;
+static gint hf_samr_samr_AcctFlags_ACB_TRUST_AUTH_DELEGAT = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCT_EXPIRY = -1;
+static gint hf_samr_samr_CreateDomAlias_alias_name = -1;
+static gint hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_SET_INFO = -1;
+static gint hf_samr_samr_UserInfo20_parameters = -1;
+static gint hf_samr_samr_QueryDisplayInfo_start_idx = -1;
+static gint hf_samr_samr_Connect5_info_out = -1;
+static gint hf_samr_samr_GetBootKeyInformation_unknown = -1;
+static gint hf_samr_samr_GetDisplayEnumerationIndex2_level = -1;
+static gint hf_samr_samr_GetDisplayEnumerationIndex2_idx = -1;
+static gint hf_samr_samr_UserInfo1_account_name = -1;
+static gint hf_samr_samr_AcctFlags_ACB_PWNOEXP = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_HOME_DIRECTORY = -1;
+static gint hf_samr_samr_OemChangePasswordUser2_account = -1;
+static gint hf_samr_samr_UserInfo21_unknown4 = -1;
+static gint hf_samr_samr_DispInfoAscii_count = -1;
+static gint hf_samr_samr_GetDisplayEnumerationIndex_idx = -1;
+static gint hf_samr_samr_QueryGroupInfo_level = -1;
+static gint hf_samr_samr_LookupRids_names = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_FULL_NAME = -1;
+static gint hf_samr_samr_UserInfo10_home_drive = -1;
+static gint hf_samr_samr_UserInfo3_home_drive = -1;
+static gint hf_samr_samr_QueryDisplayInfo_buf_size = -1;
+static gint hf_samr_samr_DomInfo8_domain_create_time = -1;
+static gint hf_samr_samr_SetMemberAttributesOfGroup_unknown2 = -1;
+static gint hf_samr_samr_AddGroupMember_flags = -1;
+static gint hf_samr_samr_UserInfo21_force_password_change = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_NAME_ETC = -1;
+static gint hf_samr_samr_ValidatePasswordRepCtr_info = -1;
+static gint hf_samr_samr_GroupAttrs_SE_GROUP_OWNER = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_RID = -1;
+static gint hf_samr_samr_UserInfo18_password_expired = -1;
+static gint hf_samr_samr_UserInfo5_profile_path = -1;
+static gint hf_samr_samr_DomInfo1_min_password_length = -1;
+static gint hf_samr_samr_PasswordProperties_DOMAIN_REFUSE_PASSWORD_CHANGE = -1;
+static gint hf_samr_samr_UserInfo12_profile_path = -1;
+static gint hf_samr_samr_ChangePasswordUser_nt_present = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_PARAMETERS = -1;
+static gint hf_samr_samr_RidWithAttributeArray_count = -1;
+static gint hf_samr_samr_DispEntryGeneral_description = -1;
+static gint hf_samr_samr_UserInfo21_acct_expiry = -1;
+static gint hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_PWD_CHANGE = -1;
+static gint hf_samr_samr_UserInfo24_password = -1;
+static gint hf_samr_samr_GetDomPwInfo_info = -1;
+static gint hf_samr_samr_Connect2_system_name = -1;
+static gint hf_samr_connect_handle = -1;
+static gint hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP = -1;
+static gint hf_samr_samr_UserInfo1_comment = -1;
+static gint hf_samr_samr_QueryDisplayInfo3_buf_size = -1;
+static gint hf_samr_samr_DispInfoFull_entries = -1;
+static gint hf_samr_samr_ValidatePasswordInfo_fields_present = -1;
+static gint hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS = -1;
+static gint hf_samr_samr_ChangePasswordUser3_lm_verifier = -1;
+static gint hf_samr_samr_UserInfo23_info = -1;
+static gint hf_samr_samr_UserInfo2_country_code = -1;
+static gint hf_samr_samr_DomInfo13_domain_create_time = -1;
 
 static gint proto_dcerpc_samr = -1;
 /* Version information */
@@ -3743,8 +3743,7 @@ samr_dissect_DomainInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "samr_DomainInfo");
-		tree = proto_item_add_subtree(item, ett_samr_samr_DomainInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_samr_samr_DomainInfo, &item, "samr_DomainInfo");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -3807,7 +3806,7 @@ samr_dissect_DomainInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U
 
 /* IDL: struct { */
 /* IDL: 	[range(0,1024)] uint32 count; */
-/* IDL: 	[unique(1)] [size_is(count)] uint32 *ids; */
+/* IDL: 	[size_is(count)] [unique(1)] uint32 *ids; */
 /* IDL: } */
 
 static int
@@ -4208,8 +4207,7 @@ samr_dissect_GroupInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "samr_GroupInfo");
-		tree = proto_item_add_subtree(item, ett_samr_samr_GroupInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_samr_samr_GroupInfo, &item, "samr_GroupInfo");
 	}
 
 	offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -4463,8 +4461,7 @@ samr_dissect_AliasInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "samr_AliasInfo");
-		tree = proto_item_add_subtree(item, ett_samr_samr_AliasInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_samr_samr_AliasInfo, &item, "samr_AliasInfo");
 	}
 
 	offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -4693,7 +4690,7 @@ samr_dissect_struct_UserInfo2(tvbuff_t *tvb _U_, int offset _U_, packet_info *pi
 
 /* IDL: struct { */
 /* IDL: 	uint16 units_per_week; */
-/* IDL: 	[unique(1)] [size_is(1260)] [length_is(units_per_week/8)] uint8 *bits; */
+/* IDL: 	[size_is(1260)] [unique(1)] [length_is(units_per_week/8)] uint8 *bits; */
 /* IDL: } */
 
 static int
@@ -6236,7 +6233,7 @@ samr_dissect_bitmap_FieldsPresent(tvbuff_t *tvb _U_, int offset _U_, packet_info
 /* IDL: 	lsa_String nt_password; */
 /* IDL: 	lsa_String private; */
 /* IDL: 	uint32 buf_count; */
-/* IDL: 	[size_is(buf_count)] [unique(1)] uint8 *buffer; */
+/* IDL: 	[unique(1)] [size_is(buf_count)] uint8 *buffer; */
 /* IDL: 	uint32 rid; */
 /* IDL: 	uint32 primary_gid; */
 /* IDL: 	samr_AcctFlags acct_flags; */
@@ -7152,8 +7149,7 @@ samr_dissect_UserInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_,
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "samr_UserInfo");
-		tree = proto_item_add_subtree(item, ett_samr_samr_UserInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_samr_samr_UserInfo, &item, "samr_UserInfo");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -7634,7 +7630,7 @@ samr_dissect_struct_DispEntryFull(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[size_is(count)] [unique(1)] samr_DispEntryFull *entries; */
+/* IDL: 	[unique(1)] [size_is(count)] samr_DispEntryFull *entries; */
 /* IDL: } */
 
 static int
@@ -7911,7 +7907,7 @@ samr_dissect_struct_DispEntryAscii(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 
 /* IDL: struct { */
 /* IDL: 	uint32 count; */
-/* IDL: 	[unique(1)] [size_is(count)] samr_DispEntryAscii *entries; */
+/* IDL: 	[size_is(count)] [unique(1)] samr_DispEntryAscii *entries; */
 /* IDL: } */
 
 static int
@@ -8059,8 +8055,7 @@ samr_dissect_DispInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_,
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "samr_DispInfo");
-		tree = proto_item_add_subtree(item, ett_samr_samr_DispInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_samr_samr_DispInfo, &item, "samr_DispInfo");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -8306,8 +8301,7 @@ samr_dissect_ConnectInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "samr_ConnectInfo");
-		tree = proto_item_add_subtree(item, ett_samr_samr_ConnectInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_samr_samr_ConnectInfo, &item, "samr_ConnectInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -8461,7 +8455,7 @@ samr_dissect_enum_ValidationStatus(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 
 /* IDL: struct { */
 /* IDL: 	uint32 length; */
-/* IDL: 	[unique(1)] [size_is(length)] uint8 *data; */
+/* IDL: 	[size_is(length)] [unique(1)] uint8 *data; */
 /* IDL: } */
 
 static int
@@ -8535,7 +8529,7 @@ samr_dissect_struct_ValidationBlob(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 /* IDL: 	NTTIME_hyper lockout_time; */
 /* IDL: 	uint32 bad_pwd_count; */
 /* IDL: 	uint32 pwd_history_len; */
-/* IDL: 	[unique(1)] [size_is(pwd_history_len)] samr_ValidationBlob *pwd_history; */
+/* IDL: 	[size_is(pwd_history_len)] [unique(1)] samr_ValidationBlob *pwd_history; */
 /* IDL: } */
 
 static int
@@ -8745,8 +8739,7 @@ samr_dissect_ValidatePasswordRep(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "samr_ValidatePasswordRep");
-		tree = proto_item_add_subtree(item, ett_samr_samr_ValidatePasswordRep);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_samr_samr_ValidatePasswordRep, &item, "samr_ValidatePasswordRep");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -9047,8 +9040,7 @@ samr_dissect_ValidatePasswordReq(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "samr_ValidatePasswordReq");
-		tree = proto_item_add_subtree(item, ett_samr_samr_ValidatePasswordReq);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_samr_samr_ValidatePasswordReq, &item, "samr_ValidatePasswordReq");
 	}
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -9113,9 +9105,9 @@ samr_dissect_element_Connect_connect_handle_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_Connect( */
-/* IDL: [unique(1)] [in] uint16 *system_name, */
+/* IDL: [in] [unique(1)] uint16 *system_name, */
 /* IDL: [in] samr_ConnectAccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *connect_handle */
+/* IDL: [out] [ref] policy_handle *connect_handle */
 /* IDL: ); */
 
 static int
@@ -9163,7 +9155,7 @@ samr_dissect_element_Close_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_inf
 }
 
 /* IDL: NTSTATUS samr_Close( */
-/* IDL: [ref] [out] [in] policy_handle *handle */
+/* IDL: [in] [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -9448,7 +9440,7 @@ samr_dissect_element_LookupDomain_sid__(tvbuff_t *tvb _U_, int offset _U_, packe
 
 /* IDL: NTSTATUS samr_LookupDomain( */
 /* IDL: [in] [ref] policy_handle *connect_handle, */
-/* IDL: [in] [ref] lsa_String *domain_name, */
+/* IDL: [ref] [in] lsa_String *domain_name, */
 /* IDL: [out] [ref] dom_sid2 **sid */
 /* IDL: ); */
 
@@ -9561,11 +9553,11 @@ samr_dissect_element_EnumDomains_num_entries_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_EnumDomains( */
-/* IDL: [ref] [in] policy_handle *connect_handle, */
-/* IDL: [ref] [out] [in] uint32 *resume_handle, */
-/* IDL: [ref] [out] samr_SamArray **sam, */
+/* IDL: [in] [ref] policy_handle *connect_handle, */
+/* IDL: [in] [ref] [out] uint32 *resume_handle, */
+/* IDL: [out] [ref] samr_SamArray **sam, */
 /* IDL: [in] uint32 buf_size, */
-/* IDL: [out] [ref] uint32 *num_entries */
+/* IDL: [ref] [out] uint32 *num_entries */
 /* IDL: ); */
 
 static int
@@ -9661,7 +9653,7 @@ samr_dissect_element_OpenDomain_domain_handle_(tvbuff_t *tvb _U_, int offset _U_
 }
 
 /* IDL: NTSTATUS samr_OpenDomain( */
-/* IDL: [in] [ref] policy_handle *connect_handle, */
+/* IDL: [ref] [in] policy_handle *connect_handle, */
 /* IDL: [in] samr_DomainAccessMask access_mask, */
 /* IDL: [in] [ref] dom_sid2 *sid, */
 /* IDL: [ref] [out] policy_handle *domain_handle */
@@ -9748,7 +9740,7 @@ samr_dissect_element_QueryDomainInfo_info__(tvbuff_t *tvb _U_, int offset _U_, p
 /* IDL: NTSTATUS samr_QueryDomainInfo( */
 /* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [in] samr_DomainInfoClass level, */
-/* IDL: [switch_is(level)] [ref] [out] samr_DomainInfo **info */
+/* IDL: [out] [ref] [switch_is(level)] samr_DomainInfo **info */
 /* IDL: ); */
 
 static int
@@ -9820,9 +9812,9 @@ samr_dissect_element_SetDomainInfo_info_(tvbuff_t *tvb _U_, int offset _U_, pack
 }
 
 /* IDL: NTSTATUS samr_SetDomainInfo( */
-/* IDL: [in] [ref] policy_handle *domain_handle, */
+/* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [in] samr_DomainInfoClass level, */
-/* IDL: [in] [switch_is(level)] [ref] samr_DomainInfo *info */
+/* IDL: [switch_is(level)] [in] [ref] samr_DomainInfo *info */
 /* IDL: ); */
 
 static int
@@ -9925,10 +9917,10 @@ samr_dissect_element_CreateDomainGroup_rid_(tvbuff_t *tvb _U_, int offset _U_, p
 }
 
 /* IDL: NTSTATUS samr_CreateDomainGroup( */
-/* IDL: [ref] [in] policy_handle *domain_handle, */
-/* IDL: [ref] [in] lsa_String *name, */
+/* IDL: [in] [ref] policy_handle *domain_handle, */
+/* IDL: [in] [ref] lsa_String *name, */
 /* IDL: [in] samr_GroupAccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *group_handle, */
+/* IDL: [out] [ref] policy_handle *group_handle, */
 /* IDL: [out] [ref] uint32 *rid */
 /* IDL: ); */
 
@@ -10047,10 +10039,10 @@ samr_dissect_element_EnumDomainGroups_num_entries_(tvbuff_t *tvb _U_, int offset
 
 /* IDL: NTSTATUS samr_EnumDomainGroups( */
 /* IDL: [ref] [in] policy_handle *domain_handle, */
-/* IDL: [in] [out] [ref] uint32 *resume_handle, */
-/* IDL: [out] [ref] samr_SamArray **sam, */
+/* IDL: [in] [ref] [out] uint32 *resume_handle, */
+/* IDL: [ref] [out] samr_SamArray **sam, */
 /* IDL: [in] uint32 max_size, */
-/* IDL: [out] [ref] uint32 *num_entries */
+/* IDL: [ref] [out] uint32 *num_entries */
 /* IDL: ); */
 
 static int
@@ -10165,8 +10157,8 @@ samr_dissect_element_CreateUser_rid_(tvbuff_t *tvb _U_, int offset _U_, packet_i
 /* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [in] [ref] lsa_String *account_name, */
 /* IDL: [in] samr_UserAccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *user_handle, */
-/* IDL: [out] [ref] uint32 *rid */
+/* IDL: [ref] [out] policy_handle *user_handle, */
+/* IDL: [ref] [out] uint32 *rid */
 /* IDL: ); */
 
 static int
@@ -10291,7 +10283,7 @@ samr_dissect_element_EnumDomainUsers_num_entries_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: NTSTATUS samr_EnumDomainUsers( */
-/* IDL: [in] [ref] policy_handle *domain_handle, */
+/* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [ref] [out] [in] uint32 *resume_handle, */
 /* IDL: [in] samr_AcctFlags acct_flags, */
 /* IDL: [out] [ref] samr_SamArray **sam, */
@@ -10411,7 +10403,7 @@ samr_dissect_element_CreateDomAlias_rid_(tvbuff_t *tvb _U_, int offset _U_, pack
 
 /* IDL: NTSTATUS samr_CreateDomAlias( */
 /* IDL: [ref] [in] policy_handle *domain_handle, */
-/* IDL: [in] [ref] lsa_String *alias_name, */
+/* IDL: [ref] [in] lsa_String *alias_name, */
 /* IDL: [in] samr_AliasAccessMask access_mask, */
 /* IDL: [ref] [out] policy_handle *alias_handle, */
 /* IDL: [ref] [out] uint32 *rid */
@@ -10531,9 +10523,9 @@ samr_dissect_element_EnumDomainAliases_num_entries_(tvbuff_t *tvb _U_, int offse
 }
 
 /* IDL: NTSTATUS samr_EnumDomainAliases( */
-/* IDL: [ref] [in] policy_handle *domain_handle, */
-/* IDL: [in] [ref] [out] uint32 *resume_handle, */
-/* IDL: [ref] [out] samr_SamArray **sam, */
+/* IDL: [in] [ref] policy_handle *domain_handle, */
+/* IDL: [out] [ref] [in] uint32 *resume_handle, */
+/* IDL: [out] [ref] samr_SamArray **sam, */
 /* IDL: [in] uint32 max_size, */
 /* IDL: [out] [ref] uint32 *num_entries */
 /* IDL: ); */
@@ -10739,7 +10731,7 @@ samr_dissect_element_LookupNames_types_(tvbuff_t *tvb _U_, int offset _U_, packe
 /* IDL: NTSTATUS samr_LookupNames( */
 /* IDL: [in] [ref] policy_handle *domain_handle, */
 /* IDL: [in] [range(0,1000)] uint32 num_names, */
-/* IDL: [in] [ref] [length_is(num_names)] [size_is(1000)] lsa_String *names, */
+/* IDL: [size_is(1000)] [ref] [in] [length_is(num_names)] lsa_String *names, */
 /* IDL: [ref] [out] samr_Ids *rids, */
 /* IDL: [out] [ref] samr_Ids *types */
 /* IDL: ); */
@@ -10850,9 +10842,9 @@ samr_dissect_element_LookupRids_types_(tvbuff_t *tvb _U_, int offset _U_, packet
 }
 
 /* IDL: NTSTATUS samr_LookupRids( */
-/* IDL: [ref] [in] policy_handle *domain_handle, */
+/* IDL: [in] [ref] policy_handle *domain_handle, */
 /* IDL: [range(0,1000)] [in] uint32 num_rids, */
-/* IDL: [length_is(num_rids)] [size_is(1000)] [in] uint32 rids[*], */
+/* IDL: [size_is(1000)] [in] [length_is(num_rids)] uint32 rids[*], */
 /* IDL: [ref] [out] lsa_Strings *names, */
 /* IDL: [ref] [out] samr_Ids *types */
 /* IDL: ); */
@@ -10939,7 +10931,7 @@ samr_dissect_element_OpenGroup_group_handle_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_OpenGroup( */
-/* IDL: [in] [ref] policy_handle *domain_handle, */
+/* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [in] samr_GroupAccessMask access_mask, */
 /* IDL: [in] uint32 rid, */
 /* IDL: [out] [ref] policy_handle *group_handle */
@@ -11026,7 +11018,7 @@ samr_dissect_element_QueryGroupInfo_info__(tvbuff_t *tvb _U_, int offset _U_, pa
 /* IDL: NTSTATUS samr_QueryGroupInfo( */
 /* IDL: [ref] [in] policy_handle *group_handle, */
 /* IDL: [in] samr_GroupInfoEnum level, */
-/* IDL: [ref] [switch_is(level)] [out] samr_GroupInfo **info */
+/* IDL: [switch_is(level)] [out] [ref] samr_GroupInfo **info */
 /* IDL: ); */
 
 static int
@@ -11098,9 +11090,9 @@ samr_dissect_element_SetGroupInfo_info_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: NTSTATUS samr_SetGroupInfo( */
-/* IDL: [in] [ref] policy_handle *group_handle, */
+/* IDL: [ref] [in] policy_handle *group_handle, */
 /* IDL: [in] samr_GroupInfoEnum level, */
-/* IDL: [switch_is(level)] [ref] [in] samr_GroupInfo *info */
+/* IDL: [in] [ref] [switch_is(level)] samr_GroupInfo *info */
 /* IDL: ); */
 
 static int
@@ -11163,7 +11155,7 @@ samr_dissect_element_AddGroupMember_flags(tvbuff_t *tvb _U_, int offset _U_, pac
 }
 
 /* IDL: NTSTATUS samr_AddGroupMember( */
-/* IDL: [ref] [in] policy_handle *group_handle, */
+/* IDL: [in] [ref] policy_handle *group_handle, */
 /* IDL: [in] uint32 rid, */
 /* IDL: [in] uint32 flags */
 /* IDL: ); */
@@ -11212,7 +11204,7 @@ samr_dissect_element_DeleteDomainGroup_group_handle_(tvbuff_t *tvb _U_, int offs
 }
 
 /* IDL: NTSTATUS samr_DeleteDomainGroup( */
-/* IDL: [out] [ref] [in] policy_handle *group_handle */
+/* IDL: [in] [ref] [out] policy_handle *group_handle */
 /* IDL: ); */
 
 static int
@@ -11266,7 +11258,7 @@ samr_dissect_element_DeleteGroupMember_rid(tvbuff_t *tvb _U_, int offset _U_, pa
 }
 
 /* IDL: NTSTATUS samr_DeleteGroupMember( */
-/* IDL: [in] [ref] policy_handle *group_handle, */
+/* IDL: [ref] [in] policy_handle *group_handle, */
 /* IDL: [in] uint32 rid */
 /* IDL: ); */
 
@@ -11336,7 +11328,7 @@ samr_dissect_element_QueryGroupMember_rids__(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_QueryGroupMember( */
-/* IDL: [in] [ref] policy_handle *group_handle, */
+/* IDL: [ref] [in] policy_handle *group_handle, */
 /* IDL: [out] [ref] samr_RidTypeArray **rids */
 /* IDL: ); */
 
@@ -11399,7 +11391,7 @@ samr_dissect_element_SetMemberAttributesOfGroup_unknown2(tvbuff_t *tvb _U_, int
 }
 
 /* IDL: NTSTATUS samr_SetMemberAttributesOfGroup( */
-/* IDL: [in] [ref] policy_handle *group_handle, */
+/* IDL: [ref] [in] policy_handle *group_handle, */
 /* IDL: [in] uint32 unknown1, */
 /* IDL: [in] uint32 unknown2 */
 /* IDL: ); */
@@ -11483,7 +11475,7 @@ samr_dissect_element_OpenAlias_alias_handle_(tvbuff_t *tvb _U_, int offset _U_,
 /* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [in] samr_AliasAccessMask access_mask, */
 /* IDL: [in] uint32 rid, */
-/* IDL: [out] [ref] policy_handle *alias_handle */
+/* IDL: [ref] [out] policy_handle *alias_handle */
 /* IDL: ); */
 
 static int
@@ -11567,7 +11559,7 @@ samr_dissect_element_QueryAliasInfo_info__(tvbuff_t *tvb _U_, int offset _U_, pa
 /* IDL: NTSTATUS samr_QueryAliasInfo( */
 /* IDL: [ref] [in] policy_handle *alias_handle, */
 /* IDL: [in] samr_AliasInfoEnum level, */
-/* IDL: [ref] [switch_is(level)] [out] samr_AliasInfo **info */
+/* IDL: [out] [ref] [switch_is(level)] samr_AliasInfo **info */
 /* IDL: ); */
 
 static int
@@ -11639,9 +11631,9 @@ samr_dissect_element_SetAliasInfo_info_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: NTSTATUS samr_SetAliasInfo( */
-/* IDL: [ref] [in] policy_handle *alias_handle, */
+/* IDL: [in] [ref] policy_handle *alias_handle, */
 /* IDL: [in] samr_AliasInfoEnum level, */
-/* IDL: [in] [switch_is(level)] [ref] samr_AliasInfo *info */
+/* IDL: [switch_is(level)] [ref] [in] samr_AliasInfo *info */
 /* IDL: ); */
 
 static int
@@ -11688,7 +11680,7 @@ samr_dissect_element_DeleteDomAlias_alias_handle_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: NTSTATUS samr_DeleteDomAlias( */
-/* IDL: [ref] [out] [in] policy_handle *alias_handle */
+/* IDL: [in] [out] [ref] policy_handle *alias_handle */
 /* IDL: ); */
 
 static int
@@ -11751,7 +11743,7 @@ samr_dissect_element_AddAliasMember_sid_(tvbuff_t *tvb _U_, int offset _U_, pack
 
 /* IDL: NTSTATUS samr_AddAliasMember( */
 /* IDL: [ref] [in] policy_handle *alias_handle, */
-/* IDL: [in] [ref] dom_sid2 *sid */
+/* IDL: [ref] [in] dom_sid2 *sid */
 /* IDL: ); */
 
 static int
@@ -11813,7 +11805,7 @@ samr_dissect_element_DeleteAliasMember_sid_(tvbuff_t *tvb _U_, int offset _U_, p
 
 /* IDL: NTSTATUS samr_DeleteAliasMember( */
 /* IDL: [in] [ref] policy_handle *alias_handle, */
-/* IDL: [in] [ref] dom_sid2 *sid */
+/* IDL: [ref] [in] dom_sid2 *sid */
 /* IDL: ); */
 
 static int
@@ -11875,7 +11867,7 @@ samr_dissect_element_GetMembersInAlias_sids_(tvbuff_t *tvb _U_, int offset _U_,
 
 /* IDL: NTSTATUS samr_GetMembersInAlias( */
 /* IDL: [in] [ref] policy_handle *alias_handle, */
-/* IDL: [ref] [out] lsa_SidArray *sids */
+/* IDL: [out] [ref] lsa_SidArray *sids */
 /* IDL: ); */
 
 static int
@@ -12006,7 +11998,7 @@ samr_dissect_element_DeleteUser_user_handle_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_DeleteUser( */
-/* IDL: [ref] [out] [in] policy_handle *user_handle */
+/* IDL: [in] [ref] [out] policy_handle *user_handle */
 /* IDL: ); */
 
 static int
@@ -12086,7 +12078,7 @@ samr_dissect_element_QueryUserInfo_info__(tvbuff_t *tvb _U_, int offset _U_, pac
 /* IDL: NTSTATUS samr_QueryUserInfo( */
 /* IDL: [ref] [in] policy_handle *user_handle, */
 /* IDL: [in] samr_UserInfoLevel level, */
-/* IDL: [switch_is(level)] [ref] [out] samr_UserInfo **info */
+/* IDL: [out] [ref] [switch_is(level)] samr_UserInfo **info */
 /* IDL: ); */
 
 static int
@@ -12158,9 +12150,9 @@ samr_dissect_element_SetUserInfo_info_(tvbuff_t *tvb _U_, int offset _U_, packet
 }
 
 /* IDL: NTSTATUS samr_SetUserInfo( */
-/* IDL: [in] [ref] policy_handle *user_handle, */
+/* IDL: [ref] [in] policy_handle *user_handle, */
 /* IDL: [in] samr_UserInfoLevel level, */
-/* IDL: [in] [switch_is(level)] [ref] samr_UserInfo *info */
+/* IDL: [switch_is(level)] [ref] [in] samr_UserInfo *info */
 /* IDL: ); */
 
 static int
@@ -12335,17 +12327,17 @@ samr_dissect_element_ChangePasswordUser_lm_cross_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: NTSTATUS samr_ChangePasswordUser( */
-/* IDL: [in] [ref] policy_handle *user_handle, */
+/* IDL: [ref] [in] policy_handle *user_handle, */
 /* IDL: [in] uint8 lm_present, */
 /* IDL: [in] [unique(1)] samr_Password *old_lm_crypted, */
 /* IDL: [in] [unique(1)] samr_Password *new_lm_crypted, */
 /* IDL: [in] uint8 nt_present, */
 /* IDL: [unique(1)] [in] samr_Password *old_nt_crypted, */
-/* IDL: [unique(1)] [in] samr_Password *new_nt_crypted, */
+/* IDL: [in] [unique(1)] samr_Password *new_nt_crypted, */
 /* IDL: [in] uint8 cross1_present, */
 /* IDL: [in] [unique(1)] samr_Password *nt_cross, */
 /* IDL: [in] uint8 cross2_present, */
-/* IDL: [in] [unique(1)] samr_Password *lm_cross */
+/* IDL: [unique(1)] [in] samr_Password *lm_cross */
 /* IDL: ); */
 
 static int
@@ -12433,7 +12425,7 @@ samr_dissect_element_GetGroupsForUser_rids__(tvbuff_t *tvb _U_, int offset _U_,
 
 /* IDL: NTSTATUS samr_GetGroupsForUser( */
 /* IDL: [in] [ref] policy_handle *user_handle, */
-/* IDL: [out] [ref] samr_RidWithAttributeArray **rids */
+/* IDL: [ref] [out] samr_RidWithAttributeArray **rids */
 /* IDL: ); */
 
 static int
@@ -12559,12 +12551,12 @@ samr_dissect_element_QueryDisplayInfo_info_(tvbuff_t *tvb _U_, int offset _U_, p
 }
 
 /* IDL: NTSTATUS samr_QueryDisplayInfo( */
-/* IDL: [in] [ref] policy_handle *domain_handle, */
+/* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [in] samr_DomainDisplayInformation level, */
 /* IDL: [in] uint32 start_idx, */
 /* IDL: [in] uint32 max_entries, */
 /* IDL: [in] uint32 buf_size, */
-/* IDL: [out] [ref] uint32 *total_size, */
+/* IDL: [ref] [out] uint32 *total_size, */
 /* IDL: [ref] [out] uint32 *returned_size, */
 /* IDL: [switch_is(level)] [ref] [out] samr_DispInfo *info */
 /* IDL: ); */
@@ -12666,9 +12658,9 @@ samr_dissect_element_GetDisplayEnumerationIndex_idx_(tvbuff_t *tvb _U_, int offs
 }
 
 /* IDL: NTSTATUS samr_GetDisplayEnumerationIndex( */
-/* IDL: [in] [ref] policy_handle *domain_handle, */
+/* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [in] uint16 level, */
-/* IDL: [ref] [in] lsa_String *name, */
+/* IDL: [in] [ref] lsa_String *name, */
 /* IDL: [ref] [out] uint32 *idx */
 /* IDL: ); */
 
@@ -12822,7 +12814,7 @@ samr_dissect_element_GetUserPwInfo_info_(tvbuff_t *tvb _U_, int offset _U_, pack
 
 /* IDL: NTSTATUS samr_GetUserPwInfo( */
 /* IDL: [ref] [in] policy_handle *user_handle, */
-/* IDL: [ref] [out] samr_PwInfo *info */
+/* IDL: [out] [ref] samr_PwInfo *info */
 /* IDL: ); */
 
 static int
@@ -12962,7 +12954,7 @@ samr_dissect_element_QueryDomainInfo2_info__(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_QueryDomainInfo2( */
-/* IDL: [ref] [in] policy_handle *domain_handle, */
+/* IDL: [in] [ref] policy_handle *domain_handle, */
 /* IDL: [in] samr_DomainInfoClass level, */
 /* IDL: [out] [ref] [switch_is(level)] samr_DomainInfo **info */
 /* IDL: ); */
@@ -13044,7 +13036,7 @@ samr_dissect_element_QueryUserInfo2_info__(tvbuff_t *tvb _U_, int offset _U_, pa
 }
 
 /* IDL: NTSTATUS samr_QueryUserInfo2( */
-/* IDL: [in] [ref] policy_handle *user_handle, */
+/* IDL: [ref] [in] policy_handle *user_handle, */
 /* IDL: [in] samr_UserInfoLevel level, */
 /* IDL: [switch_is(level)] [ref] [out] samr_UserInfo **info */
 /* IDL: ); */
@@ -13180,8 +13172,8 @@ samr_dissect_element_QueryDisplayInfo2_info_(tvbuff_t *tvb _U_, int offset _U_,
 /* IDL: [in] uint32 max_entries, */
 /* IDL: [in] uint32 buf_size, */
 /* IDL: [ref] [out] uint32 *total_size, */
-/* IDL: [ref] [out] uint32 *returned_size, */
-/* IDL: [out] [switch_is(level)] [ref] samr_DispInfo *info */
+/* IDL: [out] [ref] uint32 *returned_size, */
+/* IDL: [out] [ref] [switch_is(level)] samr_DispInfo *info */
 /* IDL: ); */
 
 static int
@@ -13415,7 +13407,7 @@ samr_dissect_element_CreateUser2_rid_(tvbuff_t *tvb _U_, int offset _U_, packet_
 
 /* IDL: NTSTATUS samr_CreateUser2( */
 /* IDL: [ref] [in] policy_handle *domain_handle, */
-/* IDL: [ref] [in] lsa_String *account_name, */
+/* IDL: [in] [ref] lsa_String *account_name, */
 /* IDL: [in] samr_AcctFlags acct_flags, */
 /* IDL: [in] samr_UserAccessMask access_mask, */
 /* IDL: [ref] [out] policy_handle *user_handle, */
@@ -13558,14 +13550,14 @@ samr_dissect_element_QueryDisplayInfo3_info_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_QueryDisplayInfo3( */
-/* IDL: [in] [ref] policy_handle *domain_handle, */
+/* IDL: [ref] [in] policy_handle *domain_handle, */
 /* IDL: [in] samr_DomainDisplayInformation level, */
 /* IDL: [in] uint32 start_idx, */
 /* IDL: [in] uint32 max_entries, */
 /* IDL: [in] uint32 buf_size, */
-/* IDL: [out] [ref] uint32 *total_size, */
+/* IDL: [ref] [out] uint32 *total_size, */
 /* IDL: [ref] [out] uint32 *returned_size, */
-/* IDL: [out] [switch_is(level)] [ref] samr_DispInfo *info */
+/* IDL: [switch_is(level)] [out] [ref] samr_DispInfo *info */
 /* IDL: ); */
 
 static int
@@ -13641,8 +13633,8 @@ samr_dissect_element_AddMultipleMembersToAlias_sids_(tvbuff_t *tvb _U_, int offs
 }
 
 /* IDL: NTSTATUS samr_AddMultipleMembersToAlias( */
-/* IDL: [in] [ref] policy_handle *alias_handle, */
-/* IDL: [in] [ref] lsa_SidArray *sids */
+/* IDL: [ref] [in] policy_handle *alias_handle, */
+/* IDL: [ref] [in] lsa_SidArray *sids */
 /* IDL: ); */
 
 static int
@@ -13703,7 +13695,7 @@ samr_dissect_element_RemoveMultipleMembersFromAlias_sids_(tvbuff_t *tvb _U_, int
 }
 
 /* IDL: NTSTATUS samr_RemoveMultipleMembersFromAlias( */
-/* IDL: [ref] [in] policy_handle *alias_handle, */
+/* IDL: [in] [ref] policy_handle *alias_handle, */
 /* IDL: [ref] [in] lsa_SidArray *sids */
 /* IDL: ); */
 
@@ -13797,9 +13789,9 @@ samr_dissect_element_OemChangePasswordUser2_hash_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: NTSTATUS samr_OemChangePasswordUser2( */
-/* IDL: [in] [unique(1)] lsa_AsciiString *server, */
+/* IDL: [unique(1)] [in] lsa_AsciiString *server, */
 /* IDL: [ref] [in] lsa_AsciiString *account, */
-/* IDL: [in] [unique(1)] samr_CryptPassword *password, */
+/* IDL: [unique(1)] [in] samr_CryptPassword *password, */
 /* IDL: [unique(1)] [in] samr_Password *hash */
 /* IDL: ); */
 
@@ -13937,13 +13929,13 @@ samr_dissect_element_ChangePasswordUser2_lm_verifier_(tvbuff_t *tvb _U_, int off
 }
 
 /* IDL: NTSTATUS samr_ChangePasswordUser2( */
-/* IDL: [in] [unique(1)] lsa_String *server, */
+/* IDL: [unique(1)] [in] lsa_String *server, */
 /* IDL: [ref] [in] lsa_String *account, */
-/* IDL: [in] [unique(1)] samr_CryptPassword *nt_password, */
-/* IDL: [in] [unique(1)] samr_Password *nt_verifier, */
+/* IDL: [unique(1)] [in] samr_CryptPassword *nt_password, */
+/* IDL: [unique(1)] [in] samr_Password *nt_verifier, */
 /* IDL: [in] uint8 lm_change, */
 /* IDL: [unique(1)] [in] samr_CryptPassword *lm_password, */
-/* IDL: [unique(1)] [in] samr_Password *lm_verifier */
+/* IDL: [in] [unique(1)] samr_Password *lm_verifier */
 /* IDL: ); */
 
 static int
@@ -14014,7 +14006,7 @@ samr_dissect_element_GetDomPwInfo_info_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: NTSTATUS samr_GetDomPwInfo( */
-/* IDL: [in] [unique(1)] lsa_String *domain_name, */
+/* IDL: [unique(1)] [in] lsa_String *domain_name, */
 /* IDL: [ref] [out] samr_PwInfo *info */
 /* IDL: ); */
 
@@ -14088,7 +14080,7 @@ samr_dissect_element_Connect2_connect_handle_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_Connect2( */
-/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *system_name, */
 /* IDL: [in] samr_ConnectAccessMask access_mask, */
 /* IDL: [ref] [out] policy_handle *connect_handle */
 /* IDL: ); */
@@ -14162,7 +14154,7 @@ samr_dissect_element_SetUserInfo2_info_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: NTSTATUS samr_SetUserInfo2( */
-/* IDL: [ref] [in] policy_handle *user_handle, */
+/* IDL: [in] [ref] policy_handle *user_handle, */
 /* IDL: [in] samr_UserInfoLevel level, */
 /* IDL: [in] [ref] [switch_is(level)] samr_UserInfo *info */
 /* IDL: ); */
@@ -14303,7 +14295,7 @@ samr_dissect_element_GetBootKeyInformation_unknown_(tvbuff_t *tvb _U_, int offse
 }
 
 /* IDL: NTSTATUS samr_GetBootKeyInformation( */
-/* IDL: [ref] [in] policy_handle *domain_handle, */
+/* IDL: [in] [ref] policy_handle *domain_handle, */
 /* IDL: [out] [ref] uint32 *unknown */
 /* IDL: ); */
 
@@ -14388,7 +14380,7 @@ samr_dissect_element_Connect3_connect_handle_(tvbuff_t *tvb _U_, int offset _U_,
 /* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *system_name, */
 /* IDL: [in] uint32 unknown, */
 /* IDL: [in] samr_ConnectAccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *connect_handle */
+/* IDL: [ref] [out] policy_handle *connect_handle */
 /* IDL: ); */
 
 static int
@@ -14473,7 +14465,7 @@ samr_dissect_element_Connect4_connect_handle_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_Connect4( */
-/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *system_name, */
+/* IDL: [in] [charset(UTF16)] [unique(1)] uint16 *system_name, */
 /* IDL: [in] samr_ConnectVersion client_version, */
 /* IDL: [in] samr_ConnectAccessMask access_mask, */
 /* IDL: [out] [ref] policy_handle *connect_handle */
@@ -14678,16 +14670,16 @@ samr_dissect_element_ChangePasswordUser3_reject__(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: NTSTATUS samr_ChangePasswordUser3( */
-/* IDL: [unique(1)] [in] lsa_String *server, */
-/* IDL: [in] [ref] lsa_String *account, */
-/* IDL: [unique(1)] [in] samr_CryptPassword *nt_password, */
-/* IDL: [unique(1)] [in] samr_Password *nt_verifier, */
+/* IDL: [in] [unique(1)] lsa_String *server, */
+/* IDL: [ref] [in] lsa_String *account, */
+/* IDL: [in] [unique(1)] samr_CryptPassword *nt_password, */
+/* IDL: [in] [unique(1)] samr_Password *nt_verifier, */
 /* IDL: [in] uint8 lm_change, */
 /* IDL: [unique(1)] [in] samr_CryptPassword *lm_password, */
 /* IDL: [in] [unique(1)] samr_Password *lm_verifier, */
-/* IDL: [in] [unique(1)] samr_CryptPassword *password3, */
+/* IDL: [unique(1)] [in] samr_CryptPassword *password3, */
 /* IDL: [ref] [out] samr_DomInfo1 **dominfo, */
-/* IDL: [ref] [out] samr_ChangeReject **reject */
+/* IDL: [out] [ref] samr_ChangeReject **reject */
 /* IDL: ); */
 
 static int
@@ -14833,12 +14825,12 @@ samr_dissect_element_Connect5_connect_handle_(tvbuff_t *tvb _U_, int offset _U_,
 }
 
 /* IDL: NTSTATUS samr_Connect5( */
-/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *system_name, */
 /* IDL: [in] samr_ConnectAccessMask access_mask, */
 /* IDL: [in] uint32 level_in, */
-/* IDL: [ref] [switch_is(level_in)] [in] samr_ConnectInfo *info_in, */
-/* IDL: [ref] [out] uint32 *level_out, */
-/* IDL: [out] [switch_is(*level_out)] [ref] samr_ConnectInfo *info_out, */
+/* IDL: [in] [ref] [switch_is(level_in)] samr_ConnectInfo *info_in, */
+/* IDL: [out] [ref] uint32 *level_out, */
+/* IDL: [ref] [out] [switch_is(*level_out)] samr_ConnectInfo *info_out, */
 /* IDL: [ref] [out] policy_handle *connect_handle */
 /* IDL: ); */
 
@@ -14929,7 +14921,7 @@ samr_dissect_element_RidToSid_sid__(tvbuff_t *tvb _U_, int offset _U_, packet_in
 }
 
 /* IDL: NTSTATUS samr_RidToSid( */
-/* IDL: [ref] [in] policy_handle *domain_handle, */
+/* IDL: [in] [ref] policy_handle *domain_handle, */
 /* IDL: [in] uint32 rid, */
 /* IDL: [out] [ref] dom_sid2 **sid */
 /* IDL: ); */
@@ -15003,7 +14995,7 @@ samr_dissect_element_SetDsrmPassword_hash_(tvbuff_t *tvb _U_, int offset _U_, pa
 }
 
 /* IDL: NTSTATUS samr_SetDsrmPassword( */
-/* IDL: [in] [unique(1)] lsa_String *name, */
+/* IDL: [unique(1)] [in] lsa_String *name, */
 /* IDL: [in] uint32 unknown, */
 /* IDL: [in] [unique(1)] samr_Password *hash */
 /* IDL: ); */
@@ -15085,8 +15077,8 @@ samr_dissect_element_ValidatePassword_rep__(tvbuff_t *tvb _U_, int offset _U_, p
 
 /* IDL: NTSTATUS samr_ValidatePassword( */
 /* IDL: [in] samr_ValidatePasswordLevel level, */
-/* IDL: [switch_is(level)] [ref] [in] samr_ValidatePasswordReq *req, */
-/* IDL: [ref] [switch_is(level)] [out] samr_ValidatePasswordRep **rep */
+/* IDL: [ref] [in] [switch_is(level)] samr_ValidatePasswordReq *req, */
+/* IDL: [ref] [out] [switch_is(level)] samr_ValidatePasswordRep **rep */
 /* IDL: ); */
 
 static int
@@ -15261,1112 +15253,1112 @@ static dcerpc_sub_dissector samr_dissectors[] = {
 void proto_register_dcerpc_samr(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_LAST_SET,
-	  { "Samr Validate Field Password Last Set", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_PASSWORD_LAST_SET", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_LAST_SET_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo23_password,
-	  { "Password", "samr.samr_UserInfo23.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_description,
-	  { "Description", "samr.samr_UserInfo21.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo3_total_size,
-	  { "Total Size", "samr.samr_QueryDisplayInfo3.total_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo20_parameters,
-	  { "Parameters", "samr.samr_UserInfo20.parameters", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info5,
-	  { "Info5", "samr.samr_DomainInfo.info5", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo_buf_size,
-	  { "Buf Size", "samr.samr_QueryDisplayInfo.buf_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_ADD_MEMBER,
-	  { "Samr Alias Access Add Member", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_ADD_MEMBER", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_ADD_MEMBER_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_RemoveMemberFromForeignDomain_sid,
-	  { "Sid", "samr.samr_RemoveMemberFromForeignDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_COUNTRY_CODE,
-	  { "Samr Field Country Code", "samr.samr_FieldsPresent.SAMR_FIELD_COUNTRY_CODE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_COUNTRY_CODE_tfs), ( 0x00400000 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_full_name,
-	  { "Full Name", "samr.samr_UserInfo5.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo3_max_entries,
-	  { "Max Entries", "samr.samr_QueryDisplayInfo3.max_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfoAscii_count,
-	  { "Count", "samr.samr_DispInfoAscii.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_lm_verifier,
-	  { "Lm Verifier", "samr.samr_ChangePasswordUser3.lm_verifier", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser2_nt_password,
-	  { "Nt Password", "samr.samr_ChangePasswordUser2.nt_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetDomainInfo_info,
-	  { "Info", "samr.samr_SetDomainInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AddMultipleMembersToAlias_sids,
-	  { "Sids", "samr.samr_AddMultipleMembersToAlias.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfo_info3,
-	  { "Info3", "samr.samr_DispInfo.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq1_password_matched,
-	  { "Password Matched", "samr.samr_ValidatePasswordReq1.password_matched", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryFull_acct_flags,
-	  { "Acct Flags", "samr.samr_DispEntryFull.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_WSTRUST,
-	  { "Acb Wstrust", "samr.samr_AcctFlags.ACB_WSTRUST", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_WSTRUST_tfs), ( 0x00000080 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_profile_path,
-	  { "Profile Path", "samr.samr_UserInfo21.profile_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_last_logoff,
-	  { "Last Logoff", "samr.samr_UserInfo21.last_logoff", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_GET_MEMBERS,
-	  { "Samr Alias Access Get Members", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_GET_MEMBERS", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_GET_MEMBERS_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
-	  { "Samr Domain Access Enum Accounts", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_samr_samr_PwInfo_min_password_length,
-	  { "Min Password Length", "samr.samr_PwInfo.min_password_length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryGroupMember_rids,
-	  { "Rids", "samr.samr_QueryGroupMember.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_SMARTCARD_REQUIRED,
-	  { "Acb Smartcard Required", "samr.samr_AcctFlags.ACB_SMARTCARD_REQUIRED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_SMARTCARD_REQUIRED_tfs), ( 0x00001000 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_workstations,
-	  { "Workstations", "samr.samr_UserInfo21.workstations", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_CODE_PAGE,
+		{ "Samr Field Code Page", "samr.samr_FieldsPresent.SAMR_FIELD_CODE_PAGE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_CODE_PAGE_tfs), ( 0x00800000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo18_nt_pwd_active,
+		{ "Nt Pwd Active", "samr.samr_UserInfo18.nt_pwd_active", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_last_password_change,
+		{ "Last Password Change", "samr.samr_UserInfo21.last_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info6,
+		{ "Info6", "samr.samr_UserInfo.info6", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_opnum,
+		{ "Operation", "samr.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_LogonHours_bits,
+		{ "Bits", "samr.samr_LogonHours.bits", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomains_sam,
+		{ "Sam", "samr.samr_EnumDomains.sam", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QuerySecurity_sec_info,
+		{ "Sec Info", "samr.samr_QuerySecurity.sec_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_RidTypeArray_count,
+		{ "Count", "samr.samr_RidTypeArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfo_info4,
+		{ "Info4", "samr.samr_DispInfo.info4", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_STORE_CLEARTEXT,
+		{ "Domain Password Store Cleartext", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_STORE_CLEARTEXT", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_STORE_CLEARTEXT_tfs), ( 0x00000010 ), NULL, HFILL }},
 	{ &hf_samr_samr_AcctFlags_ACB_NORMAL,
-	  { "Acb Normal", "samr.samr_AcctFlags.ACB_NORMAL", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_NORMAL_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_LOC_COM,
-	  { "Samr User Access Set Loc Com", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_SET_LOC_COM", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_SET_LOC_COM_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_INITIALIZE_SERVER,
-	  { "Samr Access Initialize Server", "samr.samr_ConnectAccessMask.SAMR_ACCESS_INITIALIZE_SERVER", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_INITIALIZE_SERVER_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info7,
-	  { "Info7", "samr.samr_UserInfo.info7", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfoAttributes_attributes,
-	  { "Attributes", "samr.samr_GroupInfoAttributes.attributes", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_server,
-	  { "Server", "samr.samr_ChangePasswordUser3.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_LOOKUP_INFO,
-	  { "Samr Alias Access Lookup Info", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_LOOKUP_INFO", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_LOOKUP_INFO_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_ConnectInfo1_unknown2,
-	  { "Unknown2", "samr.samr_ConnectInfo1.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetDisplayEnumerationIndex2_idx,
-	  { "Idx", "samr.samr_GetDisplayEnumerationIndex2.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Acb Normal", "samr.samr_AcctFlags.ACB_NORMAL", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_NORMAL_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_TIME,
+		{ "Samr Validate Field Bad Password Time", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_BAD_PASSWORD_TIME", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_TIME_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_Connect5_level_in,
+		{ "Level In", "samr.samr_Connect5.level_in", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_LAST_SET,
+		{ "Samr Validate Field Password Last Set", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_PASSWORD_LAST_SET", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_LAST_SET_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_SVRTRUST,
+		{ "Acb Svrtrust", "samr.samr_AcctFlags.ACB_SVRTRUST", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_SVRTRUST_tfs), ( 0x00000100 ), NULL, HFILL }},
+	{ &hf_samr_samr_RemoveMultipleMembersFromAlias_sids,
+		{ "Sids", "samr.samr_RemoveMultipleMembersFromAlias.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LOGON_SCRIPT,
+		{ "Samr Field Logon Script", "samr.samr_FieldsPresent.SAMR_FIELD_LOGON_SCRIPT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LOGON_SCRIPT_tfs), ( 0x00000100 ), NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo2_start_idx,
+		{ "Start Idx", "samr.samr_QueryDisplayInfo2.start_idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetAliasInfo_info,
+		{ "Info", "samr.samr_SetAliasInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo9_primary_gid,
+		{ "Primary Gid", "samr.samr_UserInfo9.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_EnumDomainGroups_max_size,
-	  { "Max Size", "samr.samr_EnumDomainGroups.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_acct_flags,
-	  { "Acct Flags", "samr.samr_UserInfo3.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo6_primary,
-	  { "Primary", "samr.samr_DomInfo6.primary", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetUserInfo_level,
-	  { "Level", "samr.samr_SetUserInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_UserInfoLevel_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetUserInfo2_level,
-	  { "Level", "samr.samr_SetUserInfo2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_UserInfoLevel_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_acct_expiry,
-	  { "Acct Expiry", "samr.samr_UserInfo5.acct_expiry", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAttrs_SE_GROUP_RESOURCE,
-	  { "Se Group Resource", "samr.samr_GroupAttrs.SE_GROUP_RESOURCE", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_RESOURCE_tfs), ( 0x20000000 ), NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_cross2_present,
-	  { "Cross2 Present", "samr.samr_ChangePasswordUser.cross2_present", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_CreateUser_account_name,
-	  { "Account Name", "samr.samr_CreateUser.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Max Size", "samr.samr_EnumDomainGroups.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_domain_handle,
+		{ "Domain Handle", "samr.domain_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_nt_password,
+		{ "Nt Password", "samr.samr_ChangePasswordUser3.nt_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_AUTOLOCK,
+		{ "Acb Autolock", "samr.samr_AcctFlags.ACB_AUTOLOCK", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_AUTOLOCK_tfs), ( 0x00000400 ), NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser2_lm_verifier,
+		{ "Lm Verifier", "samr.samr_ChangePasswordUser2.lm_verifier", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info25,
+		{ "Info25", "samr.samr_UserInfo.info25", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_PRIVATE_DATA,
+		{ "Samr Field Private Data", "samr.samr_FieldsPresent.SAMR_FIELD_PRIVATE_DATA", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_PRIVATE_DATA_tfs), ( 0x04000000 ), NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfoAll_num_members,
+		{ "Num Members", "samr.samr_GroupInfoAll.num_members", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation2_general,
+		{ "General", "samr.samr_DomGeneralInformation2.general", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_USE_DES_KEY_ONLY,
+		{ "Acb Use Des Key Only", "samr.samr_AcctFlags.ACB_USE_DES_KEY_ONLY", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_USE_DES_KEY_ONLY_tfs), ( 0x00008000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_full_name,
+		{ "Full Name", "samr.samr_UserInfo21.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfo_attributes,
+		{ "Attributes", "samr.samr_GroupInfo.attributes", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo3_returned_size,
+		{ "Returned Size", "samr.samr_QueryDisplayInfo3.returned_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_buf_count,
+		{ "Buf Count", "samr.samr_UserInfo21.buf_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainAliases_sam,
+		{ "Sam", "samr.samr_EnumDomainAliases.sam", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidationBlob_length,
+		{ "Length", "samr.samr_ValidationBlob.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_domain_server_state,
+		{ "Domain Server State", "samr.samr_DomGeneralInformation.domain_server_state", FT_UINT32, BASE_DEC, VALS(samr_samr_DomainServerState_vals), 0, NULL, HFILL }},
+	{ &hf_samr_user_handle,
+		{ "User Handle", "samr.user_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_code_page,
+		{ "Code Page", "samr.samr_UserInfo21.code_page", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDomainInfo_info,
+		{ "Info", "samr.samr_QueryDomainInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq2_password_matched,
+		{ "Password Matched", "samr.samr_ValidatePasswordReq2.password_matched", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo12_lockout_threshold,
+		{ "Lockout Threshold", "samr.samr_DomInfo12.lockout_threshold", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_PROFILE_PATH,
+		{ "Samr Field Profile Path", "samr.samr_FieldsPresent.SAMR_FIELD_PROFILE_PATH", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_PROFILE_PATH_tfs), ( 0x00000200 ), NULL, HFILL }},
+	{ &hf_samr_samr_RidWithAttributeArray_rids,
+		{ "Rids", "samr.samr_RidWithAttributeArray.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryFull_account_name,
+		{ "Account Name", "samr.samr_DispEntryFull.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetAliasMembership_rids,
+		{ "Rids", "samr.samr_GetAliasMembership.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_full_name,
+		{ "Full Name", "samr.samr_UserInfo3.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_DomGeneralInformation_oem_information,
-	  { "Oem Information", "samr.samr_DomGeneralInformation.oem_information", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_lm_cross,
-	  { "Lm Cross", "samr.samr_ChangePasswordUser.lm_cross", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomOEMInformation_oem_information,
-	  { "Oem Information", "samr.samr_DomOEMInformation.oem_information", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_rid,
-	  { "RID", "samr.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo2_country_code,
-	  { "Country Code", "samr.samr_UserInfo2.country_code", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_SET_INFO,
-	  { "Samr Group Access Set Info", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_SET_INFO", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_SET_INFO_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo2_buf_size,
-	  { "Buf Size", "samr.samr_QueryDisplayInfo2.buf_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_CONNECT_TO_SERVER,
-	  { "Samr Access Connect To Server", "samr.samr_ConnectAccessMask.SAMR_ACCESS_CONNECT_TO_SERVER", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_CONNECT_TO_SERVER_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo6_account_name,
-	  { "Account Name", "samr.samr_UserInfo6.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_home_directory,
-	  { "Home Directory", "samr.samr_UserInfo21.home_directory", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_logon_count,
-	  { "Logon Count", "samr.samr_UserInfo21.logon_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser2_lm_password,
-	  { "Lm Password", "samr.samr_ChangePasswordUser2.lm_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo2_total_size,
-	  { "Total Size", "samr.samr_QueryDisplayInfo2.total_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo1_min_password_age,
-	  { "Min Password Age", "samr.samr_DomInfo1.min_password_age", FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_RidWithAttribute_attributes,
-	  { "Attributes", "samr.samr_RidWithAttribute.attributes", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo2_level,
-	  { "Level", "samr.samr_QueryDisplayInfo2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainDisplayInformation_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_STORE_CLEARTEXT,
-	  { "Domain Password Store Cleartext", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_STORE_CLEARTEXT", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_STORE_CLEARTEXT_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo4_logon_hours,
-	  { "Logon Hours", "samr.samr_UserInfo4.logon_hours", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_lm_present,
-	  { "Lm Present", "samr.samr_ChangePasswordUser.lm_present", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_alias_access_mask,
-	  { "Access Mask", "samr.alias.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo12_lockout_duration,
-	  { "Lockout Duration", "samr.samr_DomInfo12.lockout_duration", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupDomain_domain_name,
-	  { "Domain Name", "samr.samr_LookupDomain.domain_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_NOT_DELEGATED,
-	  { "Acb Not Delegated", "samr.samr_AcctFlags.ACB_NOT_DELEGATED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_NOT_DELEGATED_tfs), ( 0x00004000 ), NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_password3,
-	  { "Password3", "samr.samr_ChangePasswordUser3.password3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LM_PASSWORD_PRESENT,
-	  { "Samr Field Lm Password Present", "samr.samr_FieldsPresent.SAMR_FIELD_LM_PASSWORD_PRESENT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LM_PASSWORD_PRESENT_tfs), ( 0x02000000 ), NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfoAll_attributes,
-	  { "Attributes", "samr.samr_GroupInfoAll.attributes", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo_start_idx,
-	  { "Start Idx", "samr.samr_QueryDisplayInfo.start_idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryAscii_account_name,
-	  { "Account Name", "samr.samr_DispEntryAscii.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetGroupInfo_level,
-	  { "Level", "samr.samr_SetGroupInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_GroupInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetUserInfo2_info,
-	  { "Info", "samr.samr_SetUserInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryGeneral_idx,
-	  { "Idx", "samr.samr_DispEntryGeneral.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfo_name,
-	  { "Name", "samr.samr_GroupInfo.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetDisplayEnumerationIndex2_level,
-	  { "Level", "samr.samr_GetDisplayEnumerationIndex2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainDisplayInformation_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_USER,
-	  { "Samr Domain Access Create User", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_CREATE_USER", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_USER_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_account_name,
-	  { "Account Name", "samr.samr_UserInfo3.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_PARAMETERS,
-	  { "Samr Field Parameters", "samr.samr_FieldsPresent.SAMR_FIELD_PARAMETERS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_PARAMETERS_tfs), ( 0x00200000 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_oem,
-	  { "Oem", "samr.samr_DomainInfo.oem", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info8,
-	  { "Info8", "samr.samr_DomainInfo.info8", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo3_info,
-	  { "Info", "samr.samr_QueryDisplayInfo3.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_force_password_change,
-	  { "Force Password Change", "samr.samr_UserInfo3.force_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo9_domain_server_state,
-	  { "Domain Server State", "samr.samr_DomInfo9.domain_server_state", FT_UINT32, BASE_DEC, VALS(samr_samr_DomainServerState_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_logon_count,
-	  { "Logon Count", "samr.samr_UserInfo3.logon_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Oem Information", "samr.samr_DomGeneralInformation.oem_information", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_bad_password_count,
+		{ "Bad Password Count", "samr.samr_UserInfo5.bad_password_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetDisplayEnumerationIndex_name,
+		{ "Name", "samr.samr_GetDisplayEnumerationIndex.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo3_max_entries,
+		{ "Max Entries", "samr.samr_QueryDisplayInfo3.max_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_RidToSid_sid,
+		{ "Sid", "samr.samr_RidToSid.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_AliasInfoAll_num_members,
-	  { "Num Members", "samr.samr_AliasInfoAll.num_members", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Num Members", "samr.samr_AliasInfoAll.num_members", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo26_password_expired,
+		{ "Password Expired", "samr.samr_UserInfo26.password_expired", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_DONT_REQUIRE_PREAUTH,
+		{ "Acb Dont Require Preauth", "samr.samr_AcctFlags.ACB_DONT_REQUIRE_PREAUTH", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_DONT_REQUIRE_PREAUTH_tfs), ( 0x00010000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo2_code_page,
+		{ "Code Page", "samr.samr_UserInfo2.code_page", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfo_info1,
+		{ "Info1", "samr.samr_DispInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_logon_script,
+		{ "Logon Script", "samr.samr_UserInfo3.logon_script", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryGeneral_acct_flags,
+		{ "Acct Flags", "samr.samr_DispEntryGeneral.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_group_access_mask,
+		{ "Access Mask", "samr.group.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_TRUSTED_FOR_DELEGATION,
+		{ "Acb Trusted For Delegation", "samr.samr_AcctFlags.ACB_TRUSTED_FOR_DELEGATION", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_TRUSTED_FOR_DELEGATION_tfs), ( 0x00002000 ), NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_ALLOW_PWD_CHANGE,
+		{ "Samr Field Allow Pwd Change", "samr.samr_FieldsPresent.SAMR_FIELD_ALLOW_PWD_CHANGE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_ALLOW_PWD_CHANGE_tfs), ( 0x00010000 ), NULL, HFILL }},
+	{ &hf_samr_alias_handle,
+		{ "Alias Handle", "samr.alias_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_account,
+		{ "Account", "samr.samr_ChangePasswordUser3.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_workstations,
+		{ "Workstations", "samr.samr_UserInfo5.workstations", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_EnumDomainUsers_max_size,
-	  { "Max Size", "samr.samr_EnumDomainUsers.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo2_unknown,
-	  { "Unknown", "samr.samr_UserInfo2.unknown", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_general2,
-	  { "General2", "samr.samr_DomainInfo.general2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser2_server,
-	  { "Server", "samr.samr_ChangePasswordUser2.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupNames_types,
-	  { "Types", "samr.samr_LookupNames.types", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_acct_flags,
-	  { "Acct Flags", "samr.samr_UserInfo5.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupNames_rids,
-	  { "Rids", "samr.samr_LookupNames.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo_returned_size,
-	  { "Returned Size", "samr.samr_QueryDisplayInfo.returned_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_OemChangePasswordUser2_server,
-	  { "Server", "samr.samr_OemChangePasswordUser2.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDomainInfo_info,
-	  { "Info", "samr.samr_QueryDomainInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryUserInfo2_level,
-	  { "Level", "samr.samr_QueryUserInfo2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_UserInfoLevel_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
-	  { "Samr Domain Access Create Alias", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_CREATE_ALIAS", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_ALIAS_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info12,
-	  { "Info12", "samr.samr_DomainInfo.info12", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_SHUTDOWN_SERVER,
-	  { "Samr Access Shutdown Server", "samr.samr_ConnectAccessMask.SAMR_ACCESS_SHUTDOWN_SERVER", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_SHUTDOWN_SERVER_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq2_account,
-	  { "Account", "samr.samr_ValidatePasswordReq2.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_handle,
-	  { "Handle", "samr.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq2_password,
-	  { "Password", "samr.samr_ValidatePasswordReq2.password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info5,
-	  { "Info5", "samr.samr_UserInfo.info5", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_logon_hours,
-	  { "Logon Hours", "samr.samr_UserInfo5.logon_hours", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_allow_password_change,
-	  { "Allow Password Change", "samr.samr_UserInfo3.allow_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_RidWithAttributeArray_count,
-	  { "Count", "samr.samr_RidWithAttributeArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Max Size", "samr.samr_EnumDomainUsers.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo6_primary,
+		{ "Primary", "samr.samr_DomInfo6.primary", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo1_max_password_age,
+		{ "Max Password Age", "samr.samr_DomInfo1.max_password_age", FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_PwInfo_min_password_length,
+		{ "Min Password Length", "samr.samr_PwInfo.min_password_length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordInfo_last_password_change,
+		{ "Last Password Change", "samr.samr_ValidatePasswordInfo.last_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_sequence_num,
+		{ "Sequence Num", "samr.samr_DomGeneralInformation.sequence_num", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo_level,
+		{ "Level", "samr.samr_QueryDisplayInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainDisplayInformation_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryFull_acct_flags,
+		{ "Acct Flags", "samr.samr_DispEntryFull.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_primary,
+		{ "Primary", "samr.samr_DomGeneralInformation.primary", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_home_drive,
+		{ "Home Drive", "samr.samr_UserInfo5.home_drive", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info1,
+		{ "Info1", "samr.samr_DomainInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info13,
+		{ "Info13", "samr.samr_UserInfo.info13", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_last_logoff,
+		{ "Last Logoff", "samr.samr_UserInfo21.last_logoff", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AddMultipleMembersToAlias_sids,
+		{ "Sids", "samr.samr_AddMultipleMembersToAlias.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_home_directory,
+		{ "Home Directory", "samr.samr_UserInfo5.home_directory", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo9_domain_server_state,
+		{ "Domain Server State", "samr.samr_DomInfo9.domain_server_state", FT_UINT32, BASE_DEC, VALS(samr_samr_DomainServerState_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_NO_AUTH_DATA_REQD,
+		{ "Acb No Auth Data Reqd", "samr.samr_AcctFlags.ACB_NO_AUTH_DATA_REQD", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_NO_AUTH_DATA_REQD_tfs), ( 0x00080000 ), NULL, HFILL }},
+	{ &hf_samr_samr_GroupAttrs_SE_GROUP_ENABLED,
+		{ "Se Group Enabled", "samr.samr_GroupAttrs.SE_GROUP_ENABLED", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_ENABLED_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo2_info,
+		{ "Info", "samr.samr_QueryDisplayInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetDomainInfo_level,
+		{ "Level", "samr.samr_SetDomainInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainInfoClass_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetDsrmPassword_name,
+		{ "Name", "samr.samr_SetDsrmPassword.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo2_total_size,
+		{ "Total Size", "samr.samr_QueryDisplayInfo2.total_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo2_max_entries,
+		{ "Max Entries", "samr.samr_QueryDisplayInfo2.max_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_country_code,
+		{ "Country Code", "samr.samr_UserInfo21.country_code", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetBootKeyInformation_unknown3,
+		{ "Unknown3", "samr.samr_SetBootKeyInformation.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_last_password_change,
+		{ "Last Password Change", "samr.samr_UserInfo5.last_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_CONNECT_TO_SERVER,
+		{ "Samr Access Connect To Server", "samr.samr_ConnectAccessMask.SAMR_ACCESS_CONNECT_TO_SERVER", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_CONNECT_TO_SERVER_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser2_lm_change,
+		{ "Lm Change", "samr.samr_ChangePasswordUser2.lm_change", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryAliasInfo_info,
+		{ "Info", "samr.samr_QueryAliasInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetDsrmPassword_hash,
+		{ "Hash", "samr.samr_SetDsrmPassword.hash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_lm_change,
+		{ "Lm Change", "samr.samr_ChangePasswordUser3.lm_change", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo12_lockout_window,
+		{ "Lockout Window", "samr.samr_DomInfo12.lockout_window", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_DOMTRUST,
+		{ "Acb Domtrust", "samr.samr_AcctFlags.ACB_DOMTRUST", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_DOMTRUST_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo14_workstations,
+		{ "Workstations", "samr.samr_UserInfo14.workstations", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryFull_idx,
+		{ "Idx", "samr.samr_DispEntryFull.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryFullGroup_idx,
+		{ "Idx", "samr.samr_DispEntryFullGroup.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_bad_password_count,
+		{ "Bad Password Count", "samr.samr_UserInfo21.bad_password_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_ATTRIBUTES,
-	  { "Samr User Access Set Attributes", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_SET_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_SET_ATTRIBUTES_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info12,
-	  { "Info12", "samr.samr_UserInfo.info12", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainGroups_resume_handle,
-	  { "Resume Handle", "samr.samr_EnumDomainGroups.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Samr User Access Set Attributes", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_SET_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_SET_ATTRIBUTES_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo3_level,
+		{ "Level", "samr.samr_QueryDisplayInfo3.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainDisplayInformation_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo8_sequence_num,
+		{ "Sequence Num", "samr.samr_DomInfo8.sequence_num", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_PASSWORD,
+		{ "Samr User Access Set Password", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_SET_PASSWORD", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_SET_PASSWORD_tfs), ( 0x00000080 ), NULL, HFILL }},
+	{ &hf_samr_samr_LookupNames_names,
+		{ "Names", "samr.samr_LookupNames.names", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_alias_access_mask,
+		{ "Access Mask", "samr.alias.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info14,
+		{ "Info14", "samr.samr_UserInfo.info14", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_REMOVE_MEMBER,
+		{ "Samr Alias Access Remove Member", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_REMOVE_MEMBER", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_REMOVE_MEMBER_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryFullGroup_description,
+		{ "Description", "samr.samr_DispEntryFullGroup.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_UserInfo17_acct_expiry,
-	  { "Acct Expiry", "samr.samr_UserInfo17.acct_expiry", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ConnectInfo_info1,
-	  { "Info1", "samr.samr_ConnectInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainAliases_num_entries,
-	  { "Num Entries", "samr.samr_EnumDomainAliases.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_lm_password_set,
-	  { "Lm Password Set", "samr.samr_UserInfo21.lm_password_set", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Acct Expiry", "samr.samr_UserInfo17.acct_expiry", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo_info,
+		{ "Info", "samr.samr_QueryDisplayInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetMemberAttributesOfGroup_unknown1,
+		{ "Unknown1", "samr.samr_SetMemberAttributesOfGroup.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_logon_count,
+		{ "Logon Count", "samr.samr_UserInfo21.logon_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info10,
+		{ "Info10", "samr.samr_UserInfo.info10", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordRepCtr_status,
+		{ "Status", "samr.samr_ValidatePasswordRepCtr.status", FT_UINT1632, BASE_DEC, VALS(samr_samr_ValidationStatus_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_general,
+		{ "General", "samr.samr_DomainInfo.general", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info1,
+		{ "Info1", "samr.samr_UserInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCOUNT_NAME,
-	  { "Samr Field Account Name", "samr.samr_FieldsPresent.SAMR_FIELD_ACCOUNT_NAME", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_ACCOUNT_NAME_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomains_connect_handle,
-	  { "Connect Handle", "samr.samr_EnumDomains.connect_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Samr Field Account Name", "samr.samr_FieldsPresent.SAMR_FIELD_ACCOUNT_NAME", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_ACCOUNT_NAME_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePassword_req,
+		{ "Req", "samr.samr_ValidatePassword.req", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser2_account,
+		{ "Account", "samr.samr_ChangePasswordUser2.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_fields_present,
+		{ "Fields Present", "samr.samr_UserInfo21.fields_present", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo_max_entries,
+		{ "Max Entries", "samr.samr_QueryDisplayInfo.max_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo4_logon_hours,
+		{ "Logon Hours", "samr.samr_UserInfo4.logon_hours", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainUsers_resume_handle,
+		{ "Resume Handle", "samr.samr_EnumDomainUsers.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info20,
+		{ "Info20", "samr.samr_UserInfo.info20", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Connect5_info_in,
+		{ "Info In", "samr.samr_Connect5.info_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_LENGTH,
+		{ "Samr Validate Field Password History Length", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_LENGTH", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_LENGTH_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo1_description,
+		{ "Description", "samr.samr_UserInfo1.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_nt_verifier,
+		{ "Nt Verifier", "samr.samr_ChangePasswordUser3.nt_verifier", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_CreateUser2_account_name,
+		{ "Account Name", "samr.samr_CreateUser2.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ConnectInfo_info1,
+		{ "Info1", "samr.samr_ConnectInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_new_nt_crypted,
+		{ "New Nt Crypted", "samr.samr_ChangePasswordUser.new_nt_crypted", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryAscii_account_name,
+		{ "Account Name", "samr.samr_DispEntryAscii.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq1_info,
+		{ "Info", "samr.samr_ValidatePasswordReq1.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_SetUserInfo_info,
-	  { "Info", "samr.samr_SetUserInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDomainInfo_level,
-	  { "Level", "samr.samr_QueryDomainInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainInfoClass_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePassword_level,
-	  { "Level", "samr.samr_ValidatePassword.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_ValidatePasswordLevel_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainUsers_sam,
-	  { "Sam", "samr.samr_EnumDomainUsers.sam", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo26_password_expired,
-	  { "Password Expired", "samr.samr_UserInfo26.password_expired", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq3_password,
-	  { "Password", "samr.samr_ValidatePasswordReq3.password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DeleteAliasMember_sid,
-	  { "Sid", "samr.samr_DeleteAliasMember.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo26_password,
-	  { "Password", "samr.samr_UserInfo26.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_home_drive,
-	  { "Home Drive", "samr.samr_UserInfo5.home_drive", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AliasInfoAll_description,
-	  { "Description", "samr.samr_AliasInfoAll.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_nt_password,
-	  { "Nt Password", "samr.samr_ChangePasswordUser3.nt_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_OemChangePasswordUser2_account,
-	  { "Account", "samr.samr_OemChangePasswordUser2.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfo_info4,
-	  { "Info4", "samr.samr_DispInfo.info4", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfo_attributes,
-	  { "Attributes", "samr.samr_GroupInfo.attributes", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Info", "samr.samr_SetUserInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_AcctFlags_ACB_PWNOTREQ,
-	  { "Acb Pwnotreq", "samr.samr_AcctFlags.ACB_PWNOTREQ", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_PWNOTREQ_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_AliasInfo_all,
-	  { "All", "samr.samr_AliasInfo.all", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_num_aliases,
-	  { "Num Aliases", "samr.samr_DomGeneralInformation.num_aliases", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordRep_ctr1,
-	  { "Ctr1", "samr.samr_ValidatePasswordRep.ctr1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_password_expired,
-	  { "Password Expired", "samr.samr_UserInfo21.password_expired", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryFullGroup_idx,
-	  { "Idx", "samr.samr_DispEntryFullGroup.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_country_code,
-	  { "Country Code", "samr.samr_UserInfo21.country_code", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAttrs_SE_GROUP_USE_FOR_DENY_ONLY,
-	  { "Se Group Use For Deny Only", "samr.samr_GroupAttrs.SE_GROUP_USE_FOR_DENY_ONLY", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_USE_FOR_DENY_ONLY_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_COMMENT,
-	  { "Samr Field Comment", "samr.samr_FieldsPresent.SAMR_FIELD_COMMENT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_COMMENT_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_GET_MEMBERS,
-	  { "Samr Group Access Get Members", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_GET_MEMBERS", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_GET_MEMBERS_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo14_workstations,
-	  { "Workstations", "samr.samr_UserInfo14.workstations", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfoDescription_description,
-	  { "Description", "samr.samr_GroupInfoDescription.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_RidWithAttributeArray_rids,
-	  { "Rids", "samr.samr_RidWithAttributeArray.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_acct_flags,
-	  { "Acct Flags", "samr.samr_UserInfo21.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_CreateUser2_acct_flags,
-	  { "Acct Flags", "samr.samr_CreateUser2.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Acb Pwnotreq", "samr.samr_AcctFlags.ACB_PWNOTREQ", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_PWNOTREQ_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_last_logoff,
+		{ "Last Logoff", "samr.samr_UserInfo5.last_logoff", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_CryptPasswordEx_data,
-	  { "Data", "samr.samr_CryptPasswordEx.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_NAME_ETC,
-	  { "Samr User Access Get Name Etc", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_NAME_ETC", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_NAME_ETC_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq3_info,
-	  { "Info", "samr.samr_ValidatePasswordReq3.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfoGeneral_entries,
-	  { "Entries", "samr.samr_DispInfoGeneral.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetMembersInAlias_sids,
-	  { "Sids", "samr.samr_GetMembersInAlias.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainGroups_num_entries,
-	  { "Num Entries", "samr.samr_EnumDomainGroups.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetBootKeyInformation_unknown1,
-	  { "Unknown1", "samr.samr_SetBootKeyInformation.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq2_password_matched,
-	  { "Password Matched", "samr.samr_ValidatePasswordReq2.password_matched", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryFull_description,
-	  { "Description", "samr.samr_DispEntryFull.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_parameters,
-	  { "Parameters", "samr.samr_UserInfo21.parameters", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
-	  { "Samr Domain Access Open Account", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryAscii_idx,
-	  { "Idx", "samr.samr_DispEntryAscii.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq3_clear_lockout,
-	  { "Clear Lockout", "samr.samr_ValidatePasswordReq3.clear_lockout", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_role,
-	  { "Role", "samr.samr_DomGeneralInformation.role", FT_UINT32, BASE_DEC, VALS(samr_samr_Role_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_WORKSTATIONS,
-	  { "Samr Field Workstations", "samr.samr_FieldsPresent.SAMR_FIELD_WORKSTATIONS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_WORKSTATIONS_tfs), ( 0x00000400 ), NULL, HFILL }},
+		{ "Data", "samr.samr_CryptPasswordEx.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_LookupRids_num_rids,
+		{ "Num Rids", "samr.samr_LookupRids.num_rids", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_DomInfo5_domain_name,
-	  { "Domain Name", "samr.samr_DomInfo5.domain_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP,
-	  { "Samr User Access Change Group Membership", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP_tfs), ( 0x00000400 ), NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainUsers_resume_handle,
-	  { "Resume Handle", "samr.samr_EnumDomainUsers.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_primary_gid,
-	  { "Primary Gid", "samr.samr_UserInfo5.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_workstations,
-	  { "Workstations", "samr.samr_UserInfo5.workstations", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect3_unknown,
-	  { "Unknown", "samr.samr_Connect3.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUPS,
-	  { "Samr User Access Get Groups", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_GROUPS", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUPS_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_ENC_TXT_PWD_ALLOWED,
-	  { "Acb Enc Txt Pwd Allowed", "samr.samr_AcctFlags.ACB_ENC_TXT_PWD_ALLOWED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_ENC_TXT_PWD_ALLOWED_tfs), ( 0x00000800 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_last_logon,
-	  { "Last Logon", "samr.samr_UserInfo5.last_logon", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo16_acct_flags,
-	  { "Acct Flags", "samr.samr_UserInfo16.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo12_lockout_window,
-	  { "Lockout Window", "samr.samr_DomInfo12.lockout_window", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordRep_ctr3,
-	  { "Ctr3", "samr.samr_ValidatePasswordRep.ctr3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfo_all2,
-	  { "All2", "samr.samr_GroupInfo.all2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupDomain_sid,
-	  { "Sid", "samr.samr_LookupDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_home_drive,
-	  { "Home Drive", "samr.samr_UserInfo3.home_drive", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LogonHours_units_per_week,
-	  { "Units Per Week", "samr.samr_LogonHours.units_per_week", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainAliases_max_size,
-	  { "Max Size", "samr.samr_EnumDomainAliases.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_nt_password_set,
-	  { "Nt Password Set", "samr.samr_UserInfo21.nt_password_set", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePassword_req,
-	  { "Req", "samr.samr_ValidatePassword.req", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_num_groups,
-	  { "Num Groups", "samr.samr_DomGeneralInformation.num_groups", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Domain Name", "samr.samr_DomInfo5.domain_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_SamArray_entries,
-	  { "Entries", "samr.samr_SamArray.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidationBlob_data,
-	  { "Data", "samr.samr_ValidationBlob.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_code_page,
-	  { "Code Page", "samr.samr_UserInfo21.code_page", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_LOOKUP_INFO,
-	  { "Samr Group Access Lookup Info", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_LOOKUP_INFO", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_LOOKUP_INFO_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_DispInfoFullGroups_count,
-	  { "Count", "samr.samr_DispInfoFullGroups.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordRep_ctr2,
-	  { "Ctr2", "samr.samr_ValidatePasswordRep.ctr2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetBootKeyInformation_domain_handle,
-	  { "Domain Handle", "samr.samr_GetBootKeyInformation.domain_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info18,
-	  { "Info18", "samr.samr_UserInfo.info18", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Entries", "samr.samr_SamArray.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_ENUM_DOMAINS,
-	  { "Samr Access Enum Domains", "samr.samr_ConnectAccessMask.SAMR_ACCESS_ENUM_DOMAINS", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_ENUM_DOMAINS_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_nt_verifier,
-	  { "Nt Verifier", "samr.samr_ChangePasswordUser3.nt_verifier", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info13,
-	  { "Info13", "samr.samr_UserInfo.info13", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_fields_present,
-	  { "Fields Present", "samr.samr_UserInfo21.fields_present", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_primary_gid,
-	  { "Primary Gid", "samr.samr_UserInfo21.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfo_all,
-	  { "All", "samr.samr_GroupInfo.all", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect5_system_name,
-	  { "System Name", "samr.samr_Connect5.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo3_buf_size,
-	  { "Buf Size", "samr.samr_QueryDisplayInfo3.buf_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_old_lm_crypted,
-	  { "Old Lm Crypted", "samr.samr_ChangePasswordUser.old_lm_crypted", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_DOMTRUST,
-	  { "Acb Domtrust", "samr.samr_AcctFlags.ACB_DOMTRUST", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_DOMTRUST_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_samr_samr_PasswordProperties_DOMAIN_REFUSE_PASSWORD_CHANGE,
-	  { "Domain Refuse Password Change", "samr.samr_PasswordProperties.DOMAIN_REFUSE_PASSWORD_CHANGE", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_REFUSE_PASSWORD_CHANGE_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo_max_entries,
-	  { "Max Entries", "samr.samr_QueryDisplayInfo.max_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_last_password_change,
-	  { "Last Password Change", "samr.samr_UserInfo3.last_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq2_hash,
-	  { "Hash", "samr.samr_ValidatePasswordReq2.hash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_account_name,
-	  { "Account Name", "samr.samr_UserInfo5.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetDomPwInfo_info,
-	  { "Info", "samr.samr_GetDomPwInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangeReject_unknown1,
-	  { "Unknown1", "samr.samr_ChangeReject.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_PROFILE_PATH,
-	  { "Samr Field Profile Path", "samr.samr_FieldsPresent.SAMR_FIELD_PROFILE_PATH", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_PROFILE_PATH_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info16,
-	  { "Info16", "samr.samr_UserInfo.info16", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_logon_script,
-	  { "Logon Script", "samr.samr_UserInfo21.logon_script", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_sec_desc_buf_len,
-	  { "Sec Desc Buf Len", "samr.sec_desc_buf_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupNames_names,
-	  { "Names", "samr.samr_LookupNames.names", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info14,
-	  { "Info14", "samr.samr_UserInfo.info14", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetDsrmPassword_name,
-	  { "Name", "samr.samr_SetDsrmPassword.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryGeneral_acct_flags,
-	  { "Acct Flags", "samr.samr_DispEntryGeneral.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_PW_EXPIRED,
-	  { "Acb Pw Expired", "samr.samr_AcctFlags.ACB_PW_EXPIRED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_PW_EXPIRED_tfs), ( 0x00020000 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1,
-	  { "Samr Domain Access Lookup Info 1", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_last_logoff,
-	  { "Last Logoff", "samr.samr_UserInfo3.last_logoff", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryUserInfo2_info,
-	  { "Info", "samr.samr_QueryUserInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordRepCtr_status,
-	  { "Status", "samr.samr_ValidatePasswordRepCtr.status", FT_UINT1632, BASE_DEC, VALS(samr_samr_ValidationStatus_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo1_max_password_age,
-	  { "Max Password Age", "samr.samr_DomInfo1.max_password_age", FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryGeneral_full_name,
-	  { "Full Name", "samr.samr_DispEntryGeneral.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetDisplayEnumerationIndex_name,
-	  { "Name", "samr.samr_GetDisplayEnumerationIndex.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo13_sequence_num,
-	  { "Sequence Num", "samr.samr_DomInfo13.sequence_num", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo2_returned_size,
-	  { "Returned Size", "samr.samr_QueryDisplayInfo2.returned_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo6_full_name,
-	  { "Full Name", "samr.samr_UserInfo6.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser2_lm_change,
-	  { "Lm Change", "samr.samr_ChangePasswordUser2.lm_change", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LogonHours_bits,
-	  { "Bits", "samr.samr_LogonHours.bits", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_lm_change,
-	  { "Lm Change", "samr.samr_ChangePasswordUser3.lm_change", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupNames_num_names,
-	  { "Num Names", "samr.samr_LookupNames.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_logon_hours,
-	  { "Logon Hours", "samr.samr_UserInfo21.logon_hours", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_lsa_Strings_count,
-	  { "Count", "samr.lsa_Strings.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo11_logon_script,
-	  { "Logon Script", "samr.samr_UserInfo11.logon_script", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_LOOKUP_DOMAIN,
-	  { "Samr Access Lookup Domain", "samr.samr_ConnectAccessMask.SAMR_ACCESS_LOOKUP_DOMAIN", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_LOOKUP_DOMAIN_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_samr_samr_SetMemberAttributesOfGroup_unknown1,
-	  { "Unknown1", "samr.samr_SetMemberAttributesOfGroup.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_lsa_Strings_names,
-	  { "Names", "samr.lsa_Strings.names", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_bad_password_count,
-	  { "Bad Password Count", "samr.samr_UserInfo21.bad_password_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Samr Access Enum Domains", "samr.samr_ConnectAccessMask.SAMR_ACCESS_ENUM_DOMAINS", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_ENUM_DOMAINS_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_account_name,
+		{ "Account Name", "samr.samr_UserInfo3.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasInfoAll_description,
+		{ "Description", "samr.samr_AliasInfoAll.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_EnumDomains_num_entries,
-	  { "Num Entries", "samr.samr_EnumDomains.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Num Entries", "samr.samr_EnumDomains.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2,
-	  { "Samr Domain Access Lookup Info 2", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LOGON_HOURS,
-	  { "Samr Field Logon Hours", "samr.samr_FieldsPresent.SAMR_FIELD_LOGON_HOURS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LOGON_HOURS_tfs), ( 0x00002000 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_last_password_change,
-	  { "Last Password Change", "samr.samr_UserInfo5.last_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_TEMPDUP,
-	  { "Acb Tempdup", "samr.samr_AcctFlags.ACB_TEMPDUP", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_TEMPDUP_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_new_lm_crypted,
-	  { "New Lm Crypted", "samr.samr_ChangePasswordUser.new_lm_crypted", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_primary_gid,
-	  { "Primary Gid", "samr.samr_UserInfo3.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info3,
-	  { "Info3", "samr.samr_UserInfo.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info23,
-	  { "Info23", "samr.samr_UserInfo.info23", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY,
-	  { "Samr Validate Field Password History", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_PASSWORD_HISTORY", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info17,
-	  { "Info17", "samr.samr_UserInfo.info17", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_home_directory,
-	  { "Home Directory", "samr.samr_UserInfo5.home_directory", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetDsrmPassword_hash,
-	  { "Hash", "samr.samr_SetDsrmPassword.hash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_FORCE_PWD_CHANGE,
-	  { "Samr Field Force Pwd Change", "samr.samr_FieldsPresent.SAMR_FIELD_FORCE_PWD_CHANGE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_FORCE_PWD_CHANGE_tfs), ( 0x00020000 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_private,
-	  { "Private", "samr.samr_UserInfo21.private", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo2_info,
-	  { "Info", "samr.samr_QueryDisplayInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_LOCKOUT_TIME,
-	  { "Samr Validate Field Lockout Time", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_LOCKOUT_TIME", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_LOCKOUT_TIME_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_QueryAliasInfo_info,
-	  { "Info", "samr.samr_QueryAliasInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_LOCKOUT_ADMINS,
-	  { "Domain Password Lockout Admins", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_LOCKOUT_ADMINS", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_LOCKOUT_ADMINS_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_OWF_PWD,
-	  { "Samr Field Owf Pwd", "samr.samr_FieldsPresent.SAMR_FIELD_OWF_PWD", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_OWF_PWD_tfs), ( 0x20000000 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info1,
-	  { "Info1", "samr.samr_DomainInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetSecurity_sdbuf,
-	  { "Sdbuf", "samr.samr_SetSecurity.sdbuf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_dominfo,
-	  { "Dominfo", "samr.samr_ChangePasswordUser3.dominfo", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_CreateUser2_account_name,
-	  { "Account Name", "samr.samr_CreateUser2.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_connect_access_mask,
-	  { "Access Mask", "samr.connect.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_CreateDomainGroup_name,
-	  { "Name", "samr.samr_CreateDomainGroup.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryGeneral_account_name,
-	  { "Account Name", "samr.samr_DispEntryGeneral.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordRepCtr_info,
-	  { "Info", "samr.samr_ValidatePasswordRepCtr.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser2_nt_verifier,
-	  { "Nt Verifier", "samr.samr_ChangePasswordUser2.nt_verifier", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AddGroupMember_flags,
-	  { "Flags", "samr.samr_AddGroupMember.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info1,
-	  { "Info1", "samr.samr_UserInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_home_directory,
-	  { "Home Directory", "samr.samr_UserInfo3.home_directory", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryGroupInfo_level,
-	  { "Level", "samr.samr_QueryGroupInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_GroupInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser2_account,
-	  { "Account", "samr.samr_ChangePasswordUser2.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_TRUSTED_FOR_DELEGATION,
-	  { "Acb Trusted For Delegation", "samr.samr_AcctFlags.ACB_TRUSTED_FOR_DELEGATION", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_TRUSTED_FOR_DELEGATION_tfs), ( 0x00002000 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo1_password_properties,
-	  { "Password Properties", "samr.samr_DomInfo1.password_properties", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_lm_password,
-	  { "Lm Password", "samr.samr_ChangePasswordUser3.lm_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfo_info1,
-	  { "Info1", "samr.samr_DispInfo.info1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect_system_name,
-	  { "System Name", "samr.samr_Connect.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo8_sequence_num,
-	  { "Sequence Num", "samr.samr_DomInfo8.sequence_num", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo1_account_name,
-	  { "Account Name", "samr.samr_UserInfo1.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_RID,
-	  { "Samr Field Rid", "samr.samr_FieldsPresent.SAMR_FIELD_RID", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_RID_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_BAD_PWD_COUNT,
-	  { "Samr Field Bad Pwd Count", "samr.samr_FieldsPresent.SAMR_FIELD_BAD_PWD_COUNT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_BAD_PWD_COUNT_tfs), ( 0x00004000 ), NULL, HFILL }},
-	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_NO_ANON_CHANGE,
-	  { "Domain Password No Anon Change", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_NO_ANON_CHANGE", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_NO_ANON_CHANGE_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo24_password,
-	  { "Password", "samr.samr_UserInfo24.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo12_lockout_threshold,
-	  { "Lockout Threshold", "samr.samr_DomInfo12.lockout_threshold", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Samr Domain Access Lookup Info 2", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_ConnectInfo1_client_version,
+		{ "Client Version", "samr.samr_ConnectInfo1.client_version", FT_UINT32, BASE_DEC, VALS(samr_samr_ConnectVersion_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_acct_flags,
+		{ "Acct Flags", "samr.samr_UserInfo3.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomains_buf_size,
+		{ "Buf Size", "samr.samr_EnumDomains.buf_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_DomGeneralInformation2_lockout_window,
-	  { "Lockout Window", "samr.samr_DomGeneralInformation2.lockout_window", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOCALE,
-	  { "Samr User Access Get Locale", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_LOCALE", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOCALE_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_alias_handle,
-	  { "Alias Handle", "samr.alias_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfoGeneral_count,
-	  { "Count", "samr.samr_DispInfoGeneral.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_profile_path,
-	  { "Profile Path", "samr.samr_UserInfo3.profile_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_HOMDIRREQ,
-	  { "Acb Homdirreq", "samr.samr_AcctFlags.ACB_HOMDIRREQ", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_HOMDIRREQ_tfs), ( 0x00000002 ), NULL, HFILL }},
+		{ "Lockout Window", "samr.samr_DomGeneralInformation2.lockout_window", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_new_lm_crypted,
+		{ "New Lm Crypted", "samr.samr_ChangePasswordUser.new_lm_crypted", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo11_logon_script,
+		{ "Logon Script", "samr.samr_UserInfo11.logon_script", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Connect4_client_version,
+		{ "Client Version", "samr.samr_Connect4.client_version", FT_UINT32, BASE_DEC, VALS(samr_samr_ConnectVersion_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAttrs_SE_GROUP_ENABLED_BY_DEFAULT,
+		{ "Se Group Enabled By Default", "samr.samr_GroupAttrs.SE_GROUP_ENABLED_BY_DEFAULT", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_ENABLED_BY_DEFAULT_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_DispInfo_info2,
+		{ "Info2", "samr.samr_DispInfo.info2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_LOGON,
+		{ "Samr Field Last Logon", "samr.samr_FieldsPresent.SAMR_FIELD_LAST_LOGON", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LAST_LOGON_tfs), ( 0x00000800 ), NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo2_level,
+		{ "Level", "samr.samr_QueryDisplayInfo2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainDisplayInformation_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_workstations,
+		{ "Workstations", "samr.samr_UserInfo3.workstations", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo1_primary_gid,
+		{ "Primary Gid", "samr.samr_UserInfo1.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_COMMENT,
+		{ "Samr Field Comment", "samr.samr_FieldsPresent.SAMR_FIELD_COMMENT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_COMMENT_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_account_name,
+		{ "Account Name", "samr.samr_UserInfo5.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_password3,
+		{ "Password3", "samr.samr_ChangePasswordUser3.password3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_home_directory,
+		{ "Home Directory", "samr.samr_UserInfo21.home_directory", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_SET_INFO,
+		{ "Samr Group Access Set Info", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_SET_INFO", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_SET_INFO_tfs), ( 0x00000002 ), NULL, HFILL }},
 	{ &hf_samr_samr_Ids_count,
-	  { "Count", "samr.samr_Ids.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_reject,
-	  { "Reject", "samr.samr_ChangePasswordUser3.reject", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAttrs_SE_GROUP_MANDATORY,
-	  { "Se Group Mandatory", "samr.samr_GroupAttrs.SE_GROUP_MANDATORY", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_MANDATORY_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_GetGroupsForUser_rids,
-	  { "Rids", "samr.samr_GetGroupsForUser.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo23_info,
-	  { "Info", "samr.samr_UserInfo23.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo18_password_expired,
-	  { "Password Expired", "samr.samr_UserInfo18.password_expired", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo25_info,
-	  { "Info", "samr.samr_UserInfo25.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_OpenDomain_sid,
-	  { "Sid", "samr.samr_OpenDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetAliasMembership_sids,
-	  { "Sids", "samr.samr_GetAliasMembership.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_COMPLEX,
-	  { "Domain Password Complex", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_COMPLEX", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_COMPLEX_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_HOME_DRIVE,
-	  { "Samr Field Home Drive", "samr.samr_FieldsPresent.SAMR_FIELD_HOME_DRIVE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_HOME_DRIVE_tfs), ( 0x00000080 ), NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryFullGroup_account_name,
-	  { "Account Name", "samr.samr_DispEntryFullGroup.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_NT_PASSWORD_PRESENT,
-	  { "Samr Field Nt Password Present", "samr.samr_FieldsPresent.SAMR_FIELD_NT_PASSWORD_PRESENT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_NT_PASSWORD_PRESENT_tfs), ( 0x01000000 ), NULL, HFILL }},
-	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_COUNT,
-	  { "Samr Validate Field Bad Password Count", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_BAD_PASSWORD_COUNT", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_COUNT_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_AddAliasMember_sid,
-	  { "Sid", "samr.samr_AddAliasMember.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_PASSWORD,
-	  { "Samr User Access Set Password", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_SET_PASSWORD", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_SET_PASSWORD_tfs), ( 0x00000080 ), NULL, HFILL }},
-	{ &hf_samr_samr_GetBootKeyInformation_unknown,
-	  { "Unknown", "samr.samr_GetBootKeyInformation.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect2_system_name,
-	  { "System Name", "samr.samr_Connect2.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Count", "samr.samr_Ids.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_ADD_MEMBER,
+		{ "Samr Alias Access Add Member", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_ADD_MEMBER", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_ADD_MEMBER_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo1_full_name,
+		{ "Full Name", "samr.samr_UserInfo1.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_DomInfo1_password_history_length,
-	  { "Password History Length", "samr.samr_DomInfo1.password_history_length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo25_password,
-	  { "Password", "samr.samr_UserInfo25.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordInfo_fields_present,
-	  { "Fields Present", "samr.samr_ValidatePasswordInfo.fields_present", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq_req3,
-	  { "Req3", "samr.samr_ValidatePasswordReq.req3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo7_account_name,
-	  { "Account Name", "samr.samr_UserInfo7.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo9_primary_gid,
-	  { "Primary Gid", "samr.samr_UserInfo9.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info3,
-	  { "Info3", "samr.samr_DomainInfo.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_logon_hours,
-	  { "Logon Hours", "samr.samr_UserInfo3.logon_hours", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_acct_expiry,
-	  { "Acct Expiry", "samr.samr_UserInfo21.acct_expiry", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_new_nt_crypted,
-	  { "New Nt Crypted", "samr.samr_ChangePasswordUser.new_nt_crypted", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info6,
-	  { "Info6", "samr.samr_DomainInfo.info6", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_nt_present,
-	  { "Nt Present", "samr.samr_ChangePasswordUser.nt_present", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq_req2,
-	  { "Req2", "samr.samr_ValidatePasswordReq.req2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetDomainInfo_level,
-	  { "Level", "samr.samr_SetDomainInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainInfoClass_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_lm_password,
-	  { "Lm Password", "samr.samr_UserInfo21.lm_password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfo_description,
-	  { "Description", "samr.samr_GroupInfo.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryFull_idx,
-	  { "Idx", "samr.samr_DispEntryFull.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomains_resume_handle,
-	  { "Resume Handle", "samr.samr_EnumDomains.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_num_users,
-	  { "Num Users", "samr.samr_DomGeneralInformation.num_users", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_HOME_DIRECTORY,
-	  { "Samr Field Home Directory", "samr.samr_FieldsPresent.SAMR_FIELD_HOME_DIRECTORY", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_HOME_DIRECTORY_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo3_level,
-	  { "Level", "samr.samr_QueryDisplayInfo3.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainDisplayInformation_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAttrs_SE_GROUP_ENABLED,
-	  { "Se Group Enabled", "samr.samr_GroupAttrs.SE_GROUP_ENABLED", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_ENABLED_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_SVRTRUST,
-	  { "Acb Svrtrust", "samr.samr_AcctFlags.ACB_SVRTRUST", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_SVRTRUST_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_samr_samr_SetMemberAttributesOfGroup_unknown2,
-	  { "Unknown2", "samr.samr_SetMemberAttributesOfGroup.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo1_comment,
-	  { "Comment", "samr.samr_UserInfo1.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_USE_DES_KEY_ONLY,
-	  { "Acb Use Des Key Only", "samr.samr_AcctFlags.ACB_USE_DES_KEY_ONLY", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_USE_DES_KEY_ONLY_tfs), ( 0x00008000 ), NULL, HFILL }},
-	{ &hf_samr_samr_RemoveMultipleMembersFromAlias_sids,
-	  { "Sids", "samr.samr_RemoveMultipleMembersFromAlias.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info7,
-	  { "Info7", "samr.samr_DomainInfo.info7", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation2_lockout_duration,
-	  { "Lockout Duration", "samr.samr_DomGeneralInformation2.lockout_duration", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_REMOVE_MEMBER,
-	  { "Samr Alias Access Remove Member", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_REMOVE_MEMBER", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_REMOVE_MEMBER_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_ADD_MEMBER,
-	  { "Samr Group Access Add Member", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_ADD_MEMBER", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_ADD_MEMBER_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_NUM_LOGONS,
-	  { "Samr Field Num Logons", "samr.samr_FieldsPresent.SAMR_FIELD_NUM_LOGONS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_NUM_LOGONS_tfs), ( 0x00008000 ), NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq2_info,
-	  { "Info", "samr.samr_ValidatePasswordReq2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomains_buf_size,
-	  { "Buf Size", "samr.samr_EnumDomains.buf_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation2_lockout_threshold,
-	  { "Lockout Threshold", "samr.samr_DomGeneralInformation2.lockout_threshold", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainGroups_sam,
-	  { "Sam", "samr.samr_EnumDomainGroups.sam", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_PASSWORD,
-	  { "Samr User Access Change Password", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_CHANGE_PASSWORD", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_PASSWORD_tfs), ( 0x00000040 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_unknown4,
-	  { "Unknown4", "samr.samr_UserInfo21.unknown4", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_PWNOEXP,
-	  { "Acb Pwnoexp", "samr.samr_AcctFlags.ACB_PWNOEXP", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_PWNOEXP_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_samr_samr_CreateDomAlias_alias_name,
-	  { "Alias Name", "samr.samr_CreateDomAlias.alias_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_2,
-	  { "Samr Domain Access Set Info 2", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_SET_INFO_2", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_2_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info25,
-	  { "Info25", "samr.samr_UserInfo.info25", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAttrs_SE_GROUP_ENABLED_BY_DEFAULT,
-	  { "Se Group Enabled By Default", "samr.samr_GroupAttrs.SE_GROUP_ENABLED_BY_DEFAULT", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_ENABLED_BY_DEFAULT_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_samr_Connect3_system_name,
-	  { "System Name", "samr.samr_Connect3.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo3_force_logoff_time,
-	  { "Force Logoff Time", "samr.samr_DomInfo3.force_logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_TIME,
-	  { "Samr Validate Field Bad Password Time", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_BAD_PASSWORD_TIME", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_TIME_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo13_modified_count_at_last_promotion,
-	  { "Modified Count At Last Promotion", "samr.samr_DomInfo13.modified_count_at_last_promotion", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_RidTypeArray_types,
-	  { "Types", "samr.samr_RidTypeArray.types", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo2_max_entries,
-	  { "Max Entries", "samr.samr_QueryDisplayInfo2.max_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_force_logoff_time,
-	  { "Force Logoff Time", "samr.samr_DomGeneralInformation.force_logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfoFull_entries,
-	  { "Entries", "samr.samr_DispInfoFull.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
-	  { "Samr Domain Access Lookup Alias", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS_tfs), ( 0x00000080 ), NULL, HFILL }},
-	{ &hf_samr_samr_ChangeReject_reason,
-	  { "Reason", "samr.samr_ChangeReject.reason", FT_UINT32, BASE_DEC, VALS(samr_samr_RejectReason_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq3_pwd_must_change_at_next_logon,
-	  { "Pwd Must Change At Next Logon", "samr.samr_ValidatePasswordReq3.pwd_must_change_at_next_logon", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Password History Length", "samr.samr_DomInfo1.password_history_length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAttrs_SE_GROUP_MANDATORY,
+		{ "Se Group Mandatory", "samr.samr_GroupAttrs.SE_GROUP_MANDATORY", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_MANDATORY_tfs), ( 0x00000001 ), NULL, HFILL }},
 	{ &hf_samr_samr_ChangePasswordUser_nt_cross,
-	  { "Nt Cross", "samr.samr_ChangePasswordUser.nt_cross", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_cross1_present,
-	  { "Cross1 Present", "samr.samr_ChangePasswordUser.cross1_present", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Nt Cross", "samr.samr_ChangePasswordUser.nt_cross", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Password_hash,
+		{ "Hash", "samr.samr_Password.hash", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info16,
+		{ "Info16", "samr.samr_UserInfo.info16", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_last_logon,
+		{ "Last Logon", "samr.samr_UserInfo21.last_logon", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_UserInfo8_full_name,
-	  { "Full Name", "samr.samr_UserInfo8.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfo_info2,
-	  { "Info2", "samr.samr_DispInfo.info2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAttrs_SE_GROUP_LOGON_ID,
-	  { "Se Group Logon Id", "samr.samr_GroupAttrs.SE_GROUP_LOGON_ID", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_LOGON_ID_tfs), ( 0xC0000000 ), NULL, HFILL }},
-	{ &hf_samr_samr_SetBootKeyInformation_unknown2,
-	  { "Unknown2", "samr.samr_SetBootKeyInformation.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation2_general,
-	  { "General", "samr.samr_DomGeneralInformation2.general", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainAliases_sam,
-	  { "Sam", "samr.samr_EnumDomainAliases.sam", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_sequence_num,
-	  { "Sequence Num", "samr.samr_DomGeneralInformation.sequence_num", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_account_name,
-	  { "Account Name", "samr.samr_UserInfo21.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_NO_AUTH_DATA_REQD,
-	  { "Acb No Auth Data Reqd", "samr.samr_AcctFlags.ACB_NO_AUTH_DATA_REQD", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_NO_AUTH_DATA_REQD_tfs), ( 0x00080000 ), NULL, HFILL }},
-	{ &hf_samr_samr_Connect5_info_in,
-	  { "Info In", "samr.samr_Connect5.info_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect5_level_in,
-	  { "Level In", "samr.samr_Connect5.level_in", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo13_description,
-	  { "Description", "samr.samr_UserInfo13.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo18_nt_pwd_active,
-	  { "Nt Pwd Active", "samr.samr_UserInfo18.nt_pwd_active", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info2,
-	  { "Info2", "samr.samr_UserInfo.info2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_LOGOFF,
-	  { "Samr Field Last Logoff", "samr.samr_FieldsPresent.SAMR_FIELD_LAST_LOGOFF", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LAST_LOGOFF_tfs), ( 0x00001000 ), NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainAliases_resume_handle,
-	  { "Resume Handle", "samr.samr_EnumDomainAliases.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetBootKeyInformation_unknown3,
-	  { "Unknown3", "samr.samr_SetBootKeyInformation.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfoAscii_entries,
-	  { "Entries", "samr.samr_DispInfoAscii.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_CreateUser2_access_granted,
-	  { "Access Granted", "samr.samr_CreateUser2.access_granted", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfoAll_num_members,
-	  { "Num Members", "samr.samr_GroupInfoAll.num_members", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo12_profile_path,
-	  { "Profile Path", "samr.samr_UserInfo12.profile_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_MNS,
-	  { "Acb Mns", "samr.samr_AcctFlags.ACB_MNS", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_MNS_tfs), ( 0x00000020 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo1_description,
-	  { "Description", "samr.samr_UserInfo1.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_nt_password,
-	  { "Nt Password", "samr.samr_UserInfo21.nt_password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Full Name", "samr.samr_UserInfo8.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_cross1_present,
+		{ "Cross1 Present", "samr.samr_ChangePasswordUser.cross1_present", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetDisplayEnumerationIndex2_name,
+		{ "Name", "samr.samr_GetDisplayEnumerationIndex2.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo13_modified_count_at_last_promotion,
+		{ "Modified Count At Last Promotion", "samr.samr_DomInfo13.modified_count_at_last_promotion", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser2_lm_password,
+		{ "Lm Password", "samr.samr_ChangePasswordUser2.lm_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_OemChangePasswordUser2_password,
+		{ "Password", "samr.samr_OemChangePasswordUser2.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo2_buf_size,
+		{ "Buf Size", "samr.samr_QueryDisplayInfo2.buf_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq_req2,
+		{ "Req2", "samr.samr_ValidatePasswordReq.req2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_RidTypeArray_types,
+		{ "Types", "samr.samr_RidTypeArray.types", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo3_info,
+		{ "Info", "samr.samr_QueryDisplayInfo3.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_UserInfo_info8,
-	  { "Info8", "samr.samr_UserInfo.info8", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info20,
-	  { "Info20", "samr.samr_UserInfo.info20", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Info8", "samr.samr_UserInfo.info8", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryAliasInfo_level,
+		{ "Level", "samr.samr_QueryAliasInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_AliasInfoEnum_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_password_expired,
+		{ "Password Expired", "samr.samr_UserInfo21.password_expired", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info9,
+		{ "Info9", "samr.samr_DomainInfo.info9", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_bad_password_count,
+		{ "Bad Password Count", "samr.samr_UserInfo3.bad_password_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_old_nt_crypted,
+		{ "Old Nt Crypted", "samr.samr_ChangePasswordUser.old_nt_crypted", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryGeneral_full_name,
+		{ "Full Name", "samr.samr_DispEntryGeneral.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_UserInfo21_buffer,
-	  { "Buffer", "samr.samr_UserInfo21.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_status,
-	  { "NT Error", "samr.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
+		{ "Buffer", "samr.samr_UserInfo21.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ConnectInfo1_unknown2,
+		{ "Unknown2", "samr.samr_ConnectInfo1.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_LookupDomain_sid,
+		{ "Sid", "samr.samr_LookupDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_CREATE_DOMAIN,
+		{ "Samr Access Create Domain", "samr.samr_ConnectAccessMask.SAMR_ACCESS_CREATE_DOMAIN", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_CREATE_DOMAIN_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_DeleteAliasMember_sid,
+		{ "Sid", "samr.samr_DeleteAliasMember.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetUserInfo2_level,
+		{ "Level", "samr.samr_SetUserInfo2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_UserInfoLevel_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_SamArray_count,
+		{ "Count", "samr.samr_SamArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryGeneral_idx,
+		{ "Idx", "samr.samr_DispEntryGeneral.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordRep_ctr2,
+		{ "Ctr2", "samr.samr_ValidatePasswordRep.ctr2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDomainInfo2_info,
+		{ "Info", "samr.samr_QueryDomainInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_ValidatePasswordInfo_pwd_history_len,
-	  { "Pwd History Len", "samr.samr_ValidatePasswordInfo.pwd_history_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_logon_count,
-	  { "Logon Count", "samr.samr_UserInfo5.logon_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_last_password_change,
-	  { "Last Password Change", "samr.samr_UserInfo21.last_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomains_sam,
-	  { "Sam", "samr.samr_EnumDomains.sam", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq_req1,
-	  { "Req1", "samr.samr_ValidatePasswordReq.req1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_group_handle,
-	  { "Group Handle", "samr.group_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCT_FLAGS,
-	  { "Samr Field Acct Flags", "samr.samr_FieldsPresent.SAMR_FIELD_ACCT_FLAGS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_ACCT_FLAGS_tfs), ( 0x00100000 ), NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryFullGroup_acct_flags,
-	  { "Acct Flags", "samr.samr_DispEntryFullGroup.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_PRIVATE_DATA,
-	  { "Samr Field Private Data", "samr.samr_FieldsPresent.SAMR_FIELD_PRIVATE_DATA", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_PRIVATE_DATA_tfs), ( 0x04000000 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_description,
-	  { "Description", "samr.samr_UserInfo5.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_PRIMARY_GID,
-	  { "Samr Field Primary Gid", "samr.samr_FieldsPresent.SAMR_FIELD_PRIMARY_GID", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_PRIMARY_GID_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_DispInfoFullGroups_entries,
-	  { "Entries", "samr.samr_DispInfoFullGroups.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Pwd History Len", "samr.samr_ValidatePasswordInfo.pwd_history_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info3,
+		{ "Info3", "samr.samr_UserInfo.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_LOCKOUT_ADMINS,
+		{ "Domain Password Lockout Admins", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_LOCKOUT_ADMINS", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_LOCKOUT_ADMINS_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq3_info,
+		{ "Info", "samr.samr_ValidatePasswordReq3.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_status,
+		{ "NT Error", "samr.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfoFullGroups_count,
+		{ "Count", "samr.samr_DispInfoFullGroups.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LM_PASSWORD_PRESENT,
+		{ "Samr Field Lm Password Present", "samr.samr_FieldsPresent.SAMR_FIELD_LM_PASSWORD_PRESENT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LM_PASSWORD_PRESENT_tfs), ( 0x02000000 ), NULL, HFILL }},
+	{ &hf_samr_samr_Connect_system_name,
+		{ "System Name", "samr.samr_Connect.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_OemChangePasswordUser2_hash,
+		{ "Hash", "samr.samr_OemChangePasswordUser2.hash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_parameters,
+		{ "Parameters", "samr.samr_UserInfo21.parameters", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfo_all2,
+		{ "All2", "samr.samr_GroupInfo.all2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_general2,
+		{ "General2", "samr.samr_DomainInfo.general2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryFullGroup_account_name,
+		{ "Account Name", "samr.samr_DispEntryFullGroup.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryUserInfo_level,
+		{ "Level", "samr.samr_QueryUserInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_UserInfoLevel_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_DESCRIPTION,
+		{ "Samr Field Description", "samr.samr_FieldsPresent.SAMR_FIELD_DESCRIPTION", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_DESCRIPTION_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_LookupDomain_domain_name,
+		{ "Domain Name", "samr.samr_LookupDomain.domain_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info7,
+		{ "Info7", "samr.samr_DomainInfo.info7", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_profile_path,
+		{ "Profile Path", "samr.samr_UserInfo3.profile_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordRep_ctr3,
+		{ "Ctr3", "samr.samr_ValidatePasswordRep.ctr3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_NO_CLEAR_CHANGE,
-	  { "Domain Password No Clear Change", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_NO_CLEAR_CHANGE", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_NO_CLEAR_CHANGE_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordInfo_pwd_history,
-	  { "Pwd History", "samr.samr_ValidatePasswordInfo.pwd_history", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetDisplayEnumerationIndex2_name,
-	  { "Name", "samr.samr_GetDisplayEnumerationIndex2.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_OemChangePasswordUser2_password,
-	  { "Password", "samr.samr_OemChangePasswordUser2.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo_info,
-	  { "Info", "samr.samr_QueryDisplayInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info9,
-	  { "Info9", "samr.samr_UserInfo.info9", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info26,
-	  { "Info26", "samr.samr_UserInfo.info26", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser2_lm_verifier,
-	  { "Lm Verifier", "samr.samr_ChangePasswordUser2.lm_verifier", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Domain Password No Clear Change", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_NO_CLEAR_CHANGE", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_NO_CLEAR_CHANGE_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_COUNT,
+		{ "Samr Validate Field Bad Password Count", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_BAD_PASSWORD_COUNT", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_BAD_PASSWORD_COUNT_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_QueryUserInfo2_level,
+		{ "Level", "samr.samr_QueryUserInfo2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_UserInfoLevel_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_CreateDomainGroup_name,
+		{ "Name", "samr.samr_CreateDomainGroup.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainGroups_sam,
+		{ "Sam", "samr.samr_EnumDomainGroups.sam", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_CreateUser2_access_granted,
+		{ "Access Granted", "samr.samr_CreateUser2.access_granted", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetAliasInfo_level,
+		{ "Level", "samr.samr_SetAliasInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_AliasInfoEnum_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_num_users,
+		{ "Num Users", "samr.samr_DomGeneralInformation.num_users", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAttrs_SE_GROUP_RESOURCE,
+		{ "Se Group Resource", "samr.samr_GroupAttrs.SE_GROUP_RESOURCE", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_RESOURCE_tfs), ( 0x20000000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info2,
+		{ "Info2", "samr.samr_UserInfo.info2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_LOOKUP_INFO,
+		{ "Samr Alias Access Lookup Info", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_LOOKUP_INFO", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_LOOKUP_INFO_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainUsers_acct_flags,
+		{ "Acct Flags", "samr.samr_EnumDomainUsers.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_UserInfo10_home_directory,
-	  { "Home Directory", "samr.samr_UserInfo10.home_directory", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_CryptPassword_data,
-	  { "Data", "samr.samr_CryptPassword.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetGroupInfo_info,
-	  { "Info", "samr.samr_SetGroupInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo2_code_page,
-	  { "Code Page", "samr.samr_UserInfo2.code_page", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_profile_path,
-	  { "Profile Path", "samr.samr_UserInfo5.profile_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Home Directory", "samr.samr_UserInfo10.home_directory", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangeReject_reason,
+		{ "Reason", "samr.samr_ChangeReject.reason", FT_UINT32, BASE_DEC, VALS(samr_samr_RejectReason_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_LOOKUP_DOMAIN,
+		{ "Samr Access Lookup Domain", "samr.samr_ConnectAccessMask.SAMR_ACCESS_LOOKUP_DOMAIN", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_LOOKUP_DOMAIN_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_samr_samr_AddAliasMember_sid,
+		{ "Sid", "samr.samr_AddAliasMember.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_3,
+		{ "Samr Domain Access Set Info 3", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_SET_INFO_3", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_3_tfs), ( 0x00000400 ), NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo2_returned_size,
+		{ "Returned Size", "samr.samr_QueryDisplayInfo2.returned_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainUsers_num_entries,
+		{ "Num Entries", "samr.samr_EnumDomainUsers.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_connect_access_mask,
+		{ "Access Mask", "samr.connect.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainAliases_resume_handle,
+		{ "Resume Handle", "samr.samr_EnumDomainAliases.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_ENC_TXT_PWD_ALLOWED,
+		{ "Acb Enc Txt Pwd Allowed", "samr.samr_AcctFlags.ACB_ENC_TXT_PWD_ALLOWED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_ENC_TXT_PWD_ALLOWED_tfs), ( 0x00000800 ), NULL, HFILL }},
+	{ &hf_samr_samr_DispInfoAscii_entries,
+		{ "Entries", "samr.samr_DispInfoAscii.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation2_lockout_threshold,
+		{ "Lockout Threshold", "samr.samr_DomGeneralInformation2.lockout_threshold", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_DISABLED,
+		{ "Acb Disabled", "samr.samr_AcctFlags.ACB_DISABLED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_DISABLED_tfs), ( 0x00000001 ), NULL, HFILL }},
 	{ &hf_samr_samr_AliasInfoAll_name,
-	  { "Name", "samr.samr_AliasInfoAll.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetDisplayEnumerationIndex_idx,
-	  { "Idx", "samr.samr_GetDisplayEnumerationIndex.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_RidToSid_sid,
-	  { "Sid", "samr.samr_RidToSid.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo1_min_password_length,
-	  { "Min Password Length", "samr.samr_DomInfo1.min_password_length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_SET_INFO,
-	  { "Samr Alias Access Set Info", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_SET_INFO", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_SET_INFO_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_last_logoff,
-	  { "Last Logoff", "samr.samr_UserInfo5.last_logoff", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+		{ "Name", "samr.samr_AliasInfoAll.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfoAll_description,
+		{ "Description", "samr.samr_GroupInfoAll.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq2_hash,
+		{ "Hash", "samr.samr_ValidatePasswordReq2.hash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo24_password_expired,
+		{ "Password Expired", "samr.samr_UserInfo24.password_expired", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAttrs_SE_GROUP_LOGON_ID,
+		{ "Se Group Logon Id", "samr.samr_GroupAttrs.SE_GROUP_LOGON_ID", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_LOGON_ID_tfs), ( 0xC0000000 ), NULL, HFILL }},
 	{ &hf_samr_samr_UserInfo18_lm_pwd_active,
-	  { "Lm Pwd Active", "samr.samr_UserInfo18.lm_pwd_active", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainUsers_num_entries,
-	  { "Num Entries", "samr.samr_EnumDomainUsers.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect4_client_version,
-	  { "Client Version", "samr.samr_Connect4.client_version", FT_UINT32, BASE_DEC, VALS(samr_samr_ConnectVersion_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo18_lm_pwd,
-	  { "Lm Pwd", "samr.samr_UserInfo18.lm_pwd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_bad_password_count,
-	  { "Bad Password Count", "samr.samr_UserInfo5.bad_password_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_RidTypeArray_count,
-	  { "Count", "samr.samr_RidTypeArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AliasInfo_name,
-	  { "Name", "samr.samr_AliasInfo.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo18_nt_pwd,
-	  { "Nt Pwd", "samr.samr_UserInfo18.nt_pwd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOGONINFO,
-	  { "Samr User Access Get Logoninfo", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_LOGONINFO", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOGONINFO_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_connect_handle,
-	  { "Connect Handle", "samr.connect_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info9,
-	  { "Info9", "samr.samr_DomainInfo.info9", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAttrs_SE_GROUP_OWNER,
-	  { "Se Group Owner", "samr.samr_GroupAttrs.SE_GROUP_OWNER", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_OWNER_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_GetDisplayEnumerationIndex_level,
-	  { "Level", "samr.samr_GetDisplayEnumerationIndex.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect5_level_out,
-	  { "Level Out", "samr.samr_Connect5.level_out", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_comment,
-	  { "Comment", "samr.samr_UserInfo21.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispInfo_info5,
-	  { "Info5", "samr.samr_DispInfo.info5", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_REMOVE_MEMBER,
-	  { "Samr Group Access Remove Member", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_REMOVE_MEMBER", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_REMOVE_MEMBER_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_QueryDomainInfo2_info,
-	  { "Info", "samr.samr_QueryDomainInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo5_logon_script,
-	  { "Logon Script", "samr.samr_UserInfo5.logon_script", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_general,
-	  { "General", "samr.samr_DomainInfo.general", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Lm Pwd Active", "samr.samr_UserInfo18.lm_pwd_active", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordInfo_bad_pwd_count,
+		{ "Bad Pwd Count", "samr.samr_ValidatePasswordInfo.bad_pwd_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq1_password_matched,
+		{ "Password Matched", "samr.samr_ValidatePasswordReq1.password_matched", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_description,
+		{ "Description", "samr.samr_UserInfo5.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_logon_script,
+		{ "Logon Script", "samr.samr_UserInfo21.logon_script", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_full_name,
+		{ "Full Name", "samr.samr_UserInfo5.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_role,
+		{ "Role", "samr.samr_DomGeneralInformation.role", FT_UINT32, BASE_DEC, VALS(samr_samr_Role_vals), 0, NULL, HFILL }},
 	{ &hf_samr_samr_UserInfo_info11,
-	  { "Info11", "samr.samr_UserInfo.info11", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_primary,
-	  { "Primary", "samr.samr_DomGeneralInformation.primary", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_last_logon,
-	  { "Last Logon", "samr.samr_UserInfo21.last_logon", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo13_domain_create_time,
-	  { "Domain Create Time", "samr.samr_DomInfo13.domain_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo24_password_expired,
-	  { "Password Expired", "samr.samr_UserInfo24.password_expired", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_full_name,
-	  { "Full Name", "samr.samr_UserInfo3.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_DESCRIPTION,
-	  { "Samr Field Description", "samr.samr_FieldsPresent.SAMR_FIELD_DESCRIPTION", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_DESCRIPTION_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_GetAliasMembership_rids,
-	  { "Rids", "samr.samr_GetAliasMembership.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidationBlob_length,
-	  { "Length", "samr.samr_ValidationBlob.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect4_system_name,
-	  { "System Name", "samr.samr_Connect4.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_EXPIRED_FLAG,
-	  { "Samr Field Expired Flag", "samr.samr_FieldsPresent.SAMR_FIELD_EXPIRED_FLAG", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_EXPIRED_FLAG_tfs), ( 0x08000000 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomainInfo_info13,
-	  { "Info13", "samr.samr_DomainInfo.info13", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordInfo_last_password_change,
-	  { "Last Password Change", "samr.samr_ValidatePasswordInfo.last_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo8_domain_create_time,
-	  { "Domain Create Time", "samr.samr_DomInfo8.domain_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_Connect5_info_out,
-	  { "Info Out", "samr.samr_Connect5.info_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryGeneral_description,
-	  { "Description", "samr.samr_DispEntryGeneral.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo2_start_idx,
-	  { "Start Idx", "samr.samr_QueryDisplayInfo2.start_idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Info11", "samr.samr_UserInfo.info11", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_lsa_Strings_count,
+		{ "Count", "samr.lsa_Strings.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainUsers_sam,
+		{ "Sam", "samr.samr_EnumDomainUsers.sam", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_home_directory,
+		{ "Home Directory", "samr.samr_UserInfo3.home_directory", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfo_description,
+		{ "Description", "samr.samr_GroupInfo.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetBootKeyInformation_unknown1,
+		{ "Unknown1", "samr.samr_SetBootKeyInformation.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Connect3_system_name,
+		{ "System Name", "samr.samr_Connect3.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetGroupInfo_level,
+		{ "Level", "samr.samr_SetGroupInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_GroupInfoEnum_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUPS,
+		{ "Samr User Access Get Groups", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_GROUPS", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUPS_tfs), ( 0x00000100 ), NULL, HFILL }},
+	{ &hf_samr_samr_QueryGroupMember_rids,
+		{ "Rids", "samr.samr_QueryGroupMember.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info12,
+		{ "Info12", "samr.samr_UserInfo.info12", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_acct_expiry,
+		{ "Acct Expiry", "samr.samr_UserInfo5.acct_expiry", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_NUM_LOGONS,
+		{ "Samr Field Num Logons", "samr.samr_FieldsPresent.SAMR_FIELD_NUM_LOGONS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_NUM_LOGONS_tfs), ( 0x00008000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_lm_password_set,
+		{ "Lm Password Set", "samr.samr_UserInfo21.lm_password_set", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainGroups_resume_handle,
+		{ "Resume Handle", "samr.samr_EnumDomainGroups.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDomainInfo_level,
+		{ "Level", "samr.samr_QueryDomainInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainInfoClass_vals), 0, NULL, HFILL }},
 	{ &hf_samr_samr_GroupInfoAll_name,
-	  { "Name", "samr.samr_GroupInfoAll.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info24,
-	  { "Info24", "samr.samr_UserInfo.info24", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Name", "samr.samr_GroupInfoAll.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq3_pwd_must_change_at_next_logon,
+		{ "Pwd Must Change At Next Logon", "samr.samr_ValidatePasswordReq3.pwd_must_change_at_next_logon", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_cross2_present,
+		{ "Cross2 Present", "samr.samr_ChangePasswordUser.cross2_present", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_LOGOFF,
+		{ "Samr Field Last Logoff", "samr.samr_FieldsPresent.SAMR_FIELD_LAST_LOGOFF", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LAST_LOGOFF_tfs), ( 0x00001000 ), NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info8,
+		{ "Info8", "samr.samr_DomainInfo.info8", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_QueryDisplayInfo3_start_idx,
-	  { "Start Idx", "samr.samr_QueryDisplayInfo3.start_idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_LOGON,
-	  { "Samr Field Last Logon", "samr.samr_FieldsPresent.SAMR_FIELD_LAST_LOGON", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LAST_LOGON_tfs), ( 0x00000800 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_workstations,
-	  { "Workstations", "samr.samr_UserInfo3.workstations", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser_old_nt_crypted,
-	  { "Old Nt Crypted", "samr.samr_ChangePasswordUser.old_nt_crypted", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo3_returned_size,
-	  { "Returned Size", "samr.samr_QueryDisplayInfo3.returned_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_3,
-	  { "Samr Domain Access Set Info 3", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_SET_INFO_3", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_3_tfs), ( 0x00000400 ), NULL, HFILL }},
-	{ &hf_samr_samr_QueryAliasInfo_level,
-	  { "Level", "samr.samr_QueryAliasInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_AliasInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_SamArray_count,
-	  { "Count", "samr.samr_SamArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QuerySecurity_sdbuf,
-	  { "Sdbuf", "samr.samr_QuerySecurity.sdbuf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryFullGroup_description,
-	  { "Description", "samr.samr_DispEntryFullGroup.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ConnectInfo1_client_version,
-	  { "Client Version", "samr.samr_ConnectInfo1.client_version", FT_UINT32, BASE_DEC, VALS(samr_samr_ConnectVersion_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_ATTRIBUTES,
-	  { "Samr User Access Get Attributes", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_ATTRIBUTES_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_Shutdown_connect_handle,
-	  { "Connect Handle", "samr.samr_Shutdown.connect_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo10_home_drive,
-	  { "Home Drive", "samr.samr_UserInfo10.home_drive", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryUserInfo_level,
-	  { "Level", "samr.samr_QueryUserInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_UserInfoLevel_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_TRUST_AUTH_DELEGAT,
-	  { "Acb Trust Auth Delegat", "samr.samr_AcctFlags.ACB_TRUST_AUTH_DELEGAT", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_TRUST_AUTH_DELEGAT_tfs), ( 0x00040000 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomInfo7_role,
-	  { "Role", "samr.samr_DomInfo7.role", FT_UINT32, BASE_DEC, VALS(samr_samr_Role_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_domain_server_state,
-	  { "Domain Server State", "samr.samr_DomGeneralInformation.domain_server_state", FT_UINT32, BASE_DEC, VALS(samr_samr_DomainServerState_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_OemChangePasswordUser2_hash,
-	  { "Hash", "samr.samr_OemChangePasswordUser2.hash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo1_full_name,
-	  { "Full Name", "samr.samr_UserInfo1.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_AUTOLOCK,
-	  { "Acb Autolock", "samr.samr_AcctFlags.ACB_AUTOLOCK", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_AUTOLOCK_tfs), ( 0x00000400 ), NULL, HFILL }},
-	{ &hf_samr_opnum,
-	  { "Operation", "samr.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_logon_script,
-	  { "Logon Script", "samr.samr_UserInfo3.logon_script", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq3_hash,
-	  { "Hash", "samr.samr_ValidatePasswordReq3.hash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LOGON_SCRIPT,
-	  { "Samr Field Logon Script", "samr.samr_FieldsPresent.SAMR_FIELD_LOGON_SCRIPT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LOGON_SCRIPT_tfs), ( 0x00000100 ), NULL, HFILL }},
-	{ &hf_samr_samr_EnumDomainUsers_acct_flags,
-	  { "Acct Flags", "samr.samr_EnumDomainUsers.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetAliasInfo_info,
-	  { "Info", "samr.samr_SetAliasInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_domain_access_mask,
-	  { "Access Mask", "samr.domain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupRids_names,
-	  { "Names", "samr.samr_LookupRids.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_user_access_mask,
-	  { "Access Mask", "samr.user.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_unknown3,
-	  { "Unknown3", "samr.samr_DomGeneralInformation.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_FULL_NAME,
-	  { "Samr Field Full Name", "samr.samr_FieldsPresent.SAMR_FIELD_FULL_NAME", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_FULL_NAME_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_samr_DomGeneralInformation_domain_name,
-	  { "Domain Name", "samr.samr_DomGeneralInformation.domain_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SamEntry_idx,
-	  { "Idx", "samr.samr_SamEntry.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_buf_count,
-	  { "Buf Count", "samr.samr_UserInfo21.buf_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Start Idx", "samr.samr_QueryDisplayInfo3.start_idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_last_logon,
+		{ "Last Logon", "samr.samr_UserInfo5.last_logon", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo2_comment,
+		{ "Comment", "samr.samr_UserInfo2.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_PW_EXPIRED,
+		{ "Acb Pw Expired", "samr.samr_AcctFlags.ACB_PW_EXPIRED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_PW_EXPIRED_tfs), ( 0x00020000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_private,
+		{ "Private", "samr.samr_UserInfo21.private", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_WSTRUST,
+		{ "Acb Wstrust", "samr.samr_AcctFlags.ACB_WSTRUST", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_WSTRUST_tfs), ( 0x00000080 ), NULL, HFILL }},
 	{ &hf_samr_samr_ChangeReject_unknown2,
-	  { "Unknown2", "samr.samr_ChangeReject.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_full_name,
-	  { "Full Name", "samr.samr_UserInfo21.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_LENGTH,
-	  { "Samr Validate Field Password History Length", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_LENGTH", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_LENGTH_tfs), ( 0x00000010 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_allow_password_change,
-	  { "Allow Password Change", "samr.samr_UserInfo21.allow_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetUserPwInfo_info,
-	  { "Info", "samr.samr_GetUserPwInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Unknown2", "samr.samr_ChangeReject.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryAscii_idx,
+		{ "Idx", "samr.samr_DispEntryAscii.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo13_description,
+		{ "Description", "samr.samr_UserInfo13.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePassword_rep,
+		{ "Rep", "samr.samr_ValidatePassword.rep", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info21,
+		{ "Info21", "samr.samr_UserInfo.info21", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasInfo_description,
+		{ "Description", "samr.samr_AliasInfo.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY,
+		{ "Samr Validate Field Password History", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_PASSWORD_HISTORY", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_PASSWORD_HISTORY_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq2_info,
+		{ "Info", "samr.samr_ValidatePasswordReq2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_lm_cross,
+		{ "Lm Cross", "samr.samr_ChangePasswordUser.lm_cross", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetBootKeyInformation_unknown2,
+		{ "Unknown2", "samr.samr_SetBootKeyInformation.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_PASSWORD,
+		{ "Samr User Access Change Password", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_CHANGE_PASSWORD", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_PASSWORD_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidationBlob_data,
+		{ "Data", "samr.samr_ValidationBlob.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_last_password_change,
+		{ "Last Password Change", "samr.samr_UserInfo3.last_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation2_lockout_duration,
+		{ "Lockout Duration", "samr.samr_DomGeneralInformation2.lockout_duration", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info5,
+		{ "Info5", "samr.samr_DomainInfo.info5", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_lm_present,
+		{ "Lm Present", "samr.samr_ChangePasswordUser.lm_present", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_MNS,
+		{ "Acb Mns", "samr.samr_AcctFlags.ACB_MNS", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_MNS_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_server,
+		{ "Server", "samr.samr_ChangePasswordUser3.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetDisplayEnumerationIndex_level,
+		{ "Level", "samr.samr_GetDisplayEnumerationIndex.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo_total_size,
+		{ "Total Size", "samr.samr_QueryDisplayInfo.total_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_rid,
+		{ "RID", "samr.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info23,
+		{ "Info23", "samr.samr_UserInfo.info23", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info4,
+		{ "Info4", "samr.samr_UserInfo.info4", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_lm_password,
+		{ "Lm Password", "samr.samr_UserInfo21.lm_password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_OWF_PWD,
+		{ "Samr Field Owf Pwd", "samr.samr_FieldsPresent.SAMR_FIELD_OWF_PWD", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_OWF_PWD_tfs), ( 0x20000000 ), NULL, HFILL }},
+	{ &hf_samr_samr_LookupNames_types,
+		{ "Types", "samr.samr_LookupNames.types", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Connect5_level_out,
+		{ "Level Out", "samr.samr_Connect5.level_out", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info13,
+		{ "Info13", "samr.samr_DomainInfo.info13", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo3_total_size,
+		{ "Total Size", "samr.samr_QueryDisplayInfo3.total_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_reject,
+		{ "Reject", "samr.samr_ChangePasswordUser3.reject", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfoDescription_description,
+		{ "Description", "samr.samr_GroupInfoDescription.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser2_nt_password,
+		{ "Nt Password", "samr.samr_ChangePasswordUser2.nt_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_handle,
+		{ "Handle", "samr.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryUserInfo2_info,
+		{ "Info", "samr.samr_QueryUserInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_force_logoff_time,
+		{ "Force Logoff Time", "samr.samr_DomGeneralInformation.force_logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetMembersInAlias_sids,
+		{ "Sids", "samr.samr_GetMembersInAlias.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_PwInfo_password_properties,
+		{ "Password Properties", "samr.samr_PwInfo.password_properties", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordInfo_pwd_history,
+		{ "Pwd History", "samr.samr_ValidatePasswordInfo.pwd_history", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryGeneral_account_name,
+		{ "Account Name", "samr.samr_DispEntryGeneral.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_dominfo,
+		{ "Dominfo", "samr.samr_ChangePasswordUser3.dominfo", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_num_aliases,
+		{ "Num Aliases", "samr.samr_DomGeneralInformation.num_aliases", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_logon_count,
+		{ "Logon Count", "samr.samr_UserInfo5.logon_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_account_name,
+		{ "Account Name", "samr.samr_UserInfo21.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo6_account_name,
+		{ "Account Name", "samr.samr_UserInfo6.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_SetSecurity_sec_info,
-	  { "Sec Info", "samr.samr_SetSecurity.sec_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_last_logon,
-	  { "Last Logon", "samr.samr_UserInfo3.last_logon", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo3_bad_password_count,
-	  { "Bad Password Count", "samr.samr_UserInfo3.bad_password_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ChangePasswordUser3_account,
-	  { "Account", "samr.samr_ChangePasswordUser3.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Sec Info", "samr.samr_SetSecurity.sec_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfo_name,
+		{ "Name", "samr.samr_GroupInfo.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_CreateUser_account_name,
+		{ "Account Name", "samr.samr_CreateUser.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_OemChangePasswordUser2_server,
+		{ "Server", "samr.samr_OemChangePasswordUser2.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo1_password_properties,
+		{ "Password Properties", "samr.samr_DomInfo1.password_properties", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_REMOVE_MEMBER,
+		{ "Samr Group Access Remove Member", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_REMOVE_MEMBER", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_REMOVE_MEMBER_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_SamEntry_name,
+		{ "Name", "samr.samr_SamEntry.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_2,
+		{ "Samr Domain Access Set Info 2", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_SET_INFO_2", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_2_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq3_account,
+		{ "Account", "samr.samr_ValidatePasswordReq3.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_nt_password,
+		{ "Nt Password", "samr.samr_UserInfo21.nt_password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_allow_password_change,
+		{ "Allow Password Change", "samr.samr_UserInfo3.allow_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_SMARTCARD_REQUIRED,
+		{ "Acb Smartcard Required", "samr.samr_AcctFlags.ACB_SMARTCARD_REQUIRED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_SMARTCARD_REQUIRED_tfs), ( 0x00001000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo26_password,
+		{ "Password", "samr.samr_UserInfo26.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_GROUP,
-	  { "Samr Domain Access Create Group", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_CREATE_GROUP", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_GROUP_tfs), ( 0x00000020 ), NULL, HFILL }},
+		{ "Samr Domain Access Create Group", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_CREATE_GROUP", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_GROUP_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePassword_level,
+		{ "Level", "samr.samr_ValidatePassword.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_ValidatePasswordLevel_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_num_groups,
+		{ "Num Groups", "samr.samr_DomGeneralInformation.num_groups", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
+		{ "Samr Domain Access Enum Accounts", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS_tfs), ( 0x00000100 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_primary_gid,
+		{ "Primary Gid", "samr.samr_UserInfo3.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info24,
+		{ "Info24", "samr.samr_UserInfo.info24", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_SET_LOC_COM,
+		{ "Samr User Access Set Loc Com", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_SET_LOC_COM", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_SET_LOC_COM_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo2_unknown,
+		{ "Unknown", "samr.samr_UserInfo2.unknown", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryFull_description,
+		{ "Description", "samr.samr_DispEntryFull.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_acct_flags,
+		{ "Acct Flags", "samr.samr_UserInfo21.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info5,
+		{ "Info5", "samr.samr_UserInfo.info5", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_ValidatePasswordInfo_lockout_time,
-	  { "Lockout Time", "samr.samr_ValidatePasswordInfo.lockout_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordInfo_bad_pwd_count,
-	  { "Bad Pwd Count", "samr.samr_ValidatePasswordInfo.bad_pwd_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_ALLOW_PWD_CHANGE,
-	  { "Samr Field Allow Pwd Change", "samr.samr_FieldsPresent.SAMR_FIELD_ALLOW_PWD_CHANGE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_ALLOW_PWD_CHANGE_tfs), ( 0x00010000 ), NULL, HFILL }},
+		{ "Lockout Time", "samr.samr_ValidatePasswordInfo.lockout_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_ADD_MEMBER,
+		{ "Samr Group Access Add Member", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_ADD_MEMBER", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_ADD_MEMBER_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_1,
+		{ "Samr Domain Access Set Info 1", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_SET_INFO_1", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_1_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo25_info,
+		{ "Info", "samr.samr_UserInfo25.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetDomainInfo_info,
+		{ "Info", "samr.samr_SetDomainInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq3_password,
+		{ "Password", "samr.samr_ValidatePasswordReq3.password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QuerySecurity_sdbuf,
+		{ "Sdbuf", "samr.samr_QuerySecurity.sdbuf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo25_password,
+		{ "Password", "samr.samr_UserInfo25.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOGONINFO,
+		{ "Samr User Access Get Logoninfo", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_LOGONINFO", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOGONINFO_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomains_connect_handle,
+		{ "Connect Handle", "samr.samr_EnumDomains.connect_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_NOT_DELEGATED,
+		{ "Acb Not Delegated", "samr.samr_AcctFlags.ACB_NOT_DELEGATED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_NOT_DELEGATED_tfs), ( 0x00004000 ), NULL, HFILL }},
+	{ &hf_samr_samr_Shutdown_connect_handle,
+		{ "Connect Handle", "samr.samr_Shutdown.connect_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SamEntry_idx,
+		{ "Idx", "samr.samr_SamEntry.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_SHUTDOWN_SERVER,
+		{ "Samr Access Shutdown Server", "samr.samr_ConnectAccessMask.SAMR_ACCESS_SHUTDOWN_SERVER", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_SHUTDOWN_SERVER_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_logon_hours,
+		{ "Logon Hours", "samr.samr_UserInfo21.logon_hours", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_LookupNames_num_names,
+		{ "Num Names", "samr.samr_LookupNames.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1,
+		{ "Samr Domain Access Lookup Info 1", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_profile_path,
+		{ "Profile Path", "samr.samr_UserInfo21.profile_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetDomPwInfo_domain_name,
+		{ "Domain Name", "samr.samr_GetDomPwInfo.domain_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetBootKeyInformation_domain_handle,
+		{ "Domain Handle", "samr.samr_GetBootKeyInformation.domain_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_nt_password_set,
+		{ "Nt Password Set", "samr.samr_UserInfo21.nt_password_set", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAttrs_SE_GROUP_USE_FOR_DENY_ONLY,
+		{ "Se Group Use For Deny Only", "samr.samr_GroupAttrs.SE_GROUP_USE_FOR_DENY_ONLY", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_USE_FOR_DENY_ONLY_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_logon_count,
+		{ "Logon Count", "samr.samr_UserInfo3.logon_count", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryUserInfo_info,
+		{ "Info", "samr.samr_QueryUserInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_force_password_change,
+		{ "Force Password Change", "samr.samr_UserInfo3.force_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_description,
+		{ "Description", "samr.samr_UserInfo21.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info26,
+		{ "Info26", "samr.samr_UserInfo.info26", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_DispInfoFull_count,
-	  { "Count", "samr.samr_DispInfoFull.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq1_info,
-	  { "Info", "samr.samr_ValidatePasswordReq1.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info4,
-	  { "Info4", "samr.samr_UserInfo.info4", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_DISABLED,
-	  { "Acb Disabled", "samr.samr_AcctFlags.ACB_DISABLED", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_DISABLED_tfs), ( 0x00000001 ), NULL, HFILL }},
+		{ "Count", "samr.samr_DispInfoFull.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainAliases_max_size,
+		{ "Max Size", "samr.samr_EnumDomainAliases.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetAliasMembership_sids,
+		{ "Sids", "samr.samr_GetAliasMembership.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo18_lm_pwd,
+		{ "Lm Pwd", "samr.samr_UserInfo18.lm_pwd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info9,
+		{ "Info9", "samr.samr_UserInfo.info9", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_CryptPassword_data,
+		{ "Data", "samr.samr_CryptPassword.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo16_acct_flags,
+		{ "Acct Flags", "samr.samr_UserInfo16.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfo_info3,
+		{ "Info3", "samr.samr_DispInfo.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info18,
+		{ "Info18", "samr.samr_UserInfo.info18", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_workstations,
+		{ "Workstations", "samr.samr_UserInfo21.workstations", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryFullGroup_acct_flags,
+		{ "Acct Flags", "samr.samr_DispEntryFullGroup.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info12,
+		{ "Info12", "samr.samr_DomainInfo.info12", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_GET_MEMBERS,
+		{ "Samr Alias Access Get Members", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_GET_MEMBERS", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_GET_MEMBERS_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_LOCKOUT_TIME,
+		{ "Samr Validate Field Lockout Time", "samr.samr_ValidateFieldsPresent.SAMR_VALIDATE_FIELD_LOCKOUT_TIME", FT_BOOLEAN, 32, TFS(&samr_ValidateFieldsPresent_SAMR_VALIDATE_FIELD_LOCKOUT_TIME_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_Connect5_system_name,
+		{ "System Name", "samr.samr_Connect5.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Connect4_system_name,
+		{ "System Name", "samr.samr_Connect4.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Connect3_unknown,
+		{ "Unknown", "samr.samr_Connect3.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_group_handle,
+		{ "Group Handle", "samr.group_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_old_lm_crypted,
+		{ "Old Lm Crypted", "samr.samr_ChangePasswordUser.old_lm_crypted", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq3_hash,
+		{ "Hash", "samr.samr_ValidatePasswordReq3.hash", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomOEMInformation_oem_information,
+		{ "Oem Information", "samr.samr_DomOEMInformation.oem_information", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser2_nt_verifier,
+		{ "Nt Verifier", "samr.samr_ChangePasswordUser2.nt_verifier", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
+		{ "Samr Domain Access Open Account", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT_tfs), ( 0x00000200 ), NULL, HFILL }},
 	{ &hf_samr_samr_SetDsrmPassword_unknown,
-	  { "Unknown", "samr.samr_SetDsrmPassword.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info6,
-	  { "Info6", "samr.samr_UserInfo.info6", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AcctFlags_ACB_DONT_REQUIRE_PREAUTH,
-	  { "Acb Dont Require Preauth", "samr.samr_AcctFlags.ACB_DONT_REQUIRE_PREAUTH", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_DONT_REQUIRE_PREAUTH_tfs), ( 0x00010000 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info21,
-	  { "Info21", "samr.samr_UserInfo.info21", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupRids_types,
-	  { "Types", "samr.samr_LookupRids.types", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_group_access_mask,
-	  { "Access Mask", "samr.group.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo_info10,
-	  { "Info10", "samr.samr_UserInfo.info10", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCT_EXPIRY,
-	  { "Samr Field Acct Expiry", "samr.samr_FieldsPresent.SAMR_FIELD_ACCT_EXPIRY", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_ACCT_EXPIRY_tfs), ( 0x00080000 ), NULL, HFILL }},
+		{ "Unknown", "samr.samr_SetDsrmPassword.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomains_resume_handle,
+		{ "Resume Handle", "samr.samr_EnumDomains.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_LOOKUP_INFO,
+		{ "Samr Group Access Lookup Info", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_LOOKUP_INFO", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_LOOKUP_INFO_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_samr_sec_desc_buf_len,
+		{ "Sec Desc Buf Len", "samr.sec_desc_buf_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetUserInfo_level,
+		{ "Level", "samr.samr_SetUserInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_UserInfoLevel_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_RidWithAttribute_attributes,
+		{ "Attributes", "samr.samr_RidWithAttribute.attributes", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetSecurity_sdbuf,
+		{ "Sdbuf", "samr.samr_SetSecurity.sdbuf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_SEC_DESC,
+		{ "Samr Field Sec Desc", "samr.samr_FieldsPresent.SAMR_FIELD_SEC_DESC", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_SEC_DESC_tfs), ( 0x10000000 ), NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_COUNTRY_CODE,
+		{ "Samr Field Country Code", "samr.samr_FieldsPresent.SAMR_FIELD_COUNTRY_CODE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_COUNTRY_CODE_tfs), ( 0x00400000 ), NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo13_sequence_num,
+		{ "Sequence Num", "samr.samr_DomInfo13.sequence_num", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_NO_ANON_CHANGE,
+		{ "Domain Password No Anon Change", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_NO_ANON_CHANGE", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_NO_ANON_CHANGE_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_WORKSTATIONS,
+		{ "Samr Field Workstations", "samr.samr_FieldsPresent.SAMR_FIELD_WORKSTATIONS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_WORKSTATIONS_tfs), ( 0x00000400 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_acct_flags,
+		{ "Acct Flags", "samr.samr_UserInfo5.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_domain_access_mask,
+		{ "Access Mask", "samr.domain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangeReject_unknown1,
+		{ "Unknown1", "samr.samr_ChangeReject.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_ValidatePasswordInfo_bad_password_time,
-	  { "Bad Password Time", "samr.samr_ValidatePasswordInfo.bad_password_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SetAliasInfo_level,
-	  { "Level", "samr.samr_SetAliasInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_AliasInfoEnum_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP,
-	  { "Samr User Access Get Group Membership", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP_tfs), ( 0x00000200 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo21_force_password_change,
-	  { "Force Password Change", "samr.samr_UserInfo21.force_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_PwInfo_password_properties,
-	  { "Password Properties", "samr.samr_PwInfo.password_properties", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_CODE_PAGE,
-	  { "Samr Field Code Page", "samr.samr_FieldsPresent.SAMR_FIELD_CODE_PAGE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_CODE_PAGE_tfs), ( 0x00800000 ), NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo1_primary_gid,
-	  { "Primary Gid", "samr.samr_UserInfo1.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GroupInfoAll_description,
-	  { "Description", "samr.samr_GroupInfoAll.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_LookupRids_num_rids,
-	  { "Num Rids", "samr.samr_LookupRids.num_rids", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_AliasInfo_description,
-	  { "Description", "samr.samr_AliasInfo.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_domain_handle,
-	  { "Domain Handle", "samr.domain_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryUserInfo_info,
-	  { "Info", "samr.samr_QueryUserInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_SamEntry_name,
-	  { "Name", "samr.samr_SamEntry.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_CREATE_DOMAIN,
-	  { "Samr Access Create Domain", "samr.samr_ConnectAccessMask.SAMR_ACCESS_CREATE_DOMAIN", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_CREATE_DOMAIN_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo_total_size,
-	  { "Total Size", "samr.samr_QueryDisplayInfo.total_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Bad Password Time", "samr.samr_ValidatePasswordInfo.bad_password_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq_req3,
+		{ "Req3", "samr.samr_ValidatePasswordReq.req3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_last_logon,
+		{ "Last Logon", "samr.samr_UserInfo3.last_logon", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_primary_gid,
+		{ "Primary Gid", "samr.samr_UserInfo5.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo1_min_password_age,
+		{ "Min Password Age", "samr.samr_DomInfo1.min_password_age", FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetGroupsForUser_rids,
+		{ "Rids", "samr.samr_GetGroupsForUser.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfoFullGroups_entries,
+		{ "Entries", "samr.samr_DispInfoFullGroups.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
+		{ "Samr Domain Access Create Alias", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_CREATE_ALIAS", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_ALIAS_tfs), ( 0x00000040 ), NULL, HFILL }},
 	{ &hf_samr_samr_QueryDomainInfo2_level,
-	  { "Level", "samr.samr_QueryDomainInfo2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainInfoClass_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePassword_rep,
-	  { "Rep", "samr.samr_ValidatePassword.rep", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_1,
-	  { "Samr Domain Access Set Info 1", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_SET_INFO_1", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_SET_INFO_1_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_PWD_CHANGE,
-	  { "Samr Field Last Pwd Change", "samr.samr_FieldsPresent.SAMR_FIELD_LAST_PWD_CHANGE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LAST_PWD_CHANGE_tfs), ( 0x00040000 ), NULL, HFILL }},
-	{ &hf_samr_samr_DispEntryFull_account_name,
-	  { "Account Name", "samr.samr_DispEntryFull.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QuerySecurity_sec_info,
-	  { "Sec Info", "samr.samr_QuerySecurity.sec_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Level", "samr.samr_QueryDomainInfo2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainInfoClass_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfo_all,
+		{ "All", "samr.samr_GroupInfo.all", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_allow_password_change,
+		{ "Allow Password Change", "samr.samr_UserInfo21.allow_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser2_server,
+		{ "Server", "samr.samr_ChangePasswordUser2.server", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_PRIMARY_GID,
+		{ "Samr Field Primary Gid", "samr.samr_FieldsPresent.SAMR_FIELD_PRIMARY_GID", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_PRIMARY_GID_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo23_password,
+		{ "Password", "samr.samr_UserInfo23.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfoGeneral_count,
+		{ "Count", "samr.samr_DispInfoGeneral.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_LookupRids_types,
+		{ "Types", "samr.samr_LookupRids.types", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_RemoveMemberFromForeignDomain_sid,
+		{ "Sid", "samr.samr_RemoveMemberFromForeignDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_last_logoff,
+		{ "Last Logoff", "samr.samr_UserInfo3.last_logoff", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_QueryGroupInfo_info,
-	  { "Info", "samr.samr_QueryGroupInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_ValidatePasswordReq3_account,
-	  { "Account", "samr.samr_ValidatePasswordReq3.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_user_handle,
-	  { "User Handle", "samr.user_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_SEC_DESC,
-	  { "Samr Field Sec Desc", "samr.samr_FieldsPresent.SAMR_FIELD_SEC_DESC", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_SEC_DESC_tfs), ( 0x10000000 ), NULL, HFILL }},
-	{ &hf_samr_samr_Password_hash,
-	  { "Hash", "samr.samr_Password.hash", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_GetDomPwInfo_domain_name,
-	  { "Domain Name", "samr.samr_GetDomPwInfo.domain_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_samr_samr_QueryDisplayInfo_level,
-	  { "Level", "samr.samr_QueryDisplayInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainDisplayInformation_vals), 0, NULL, HFILL }},
-	{ &hf_samr_samr_UserInfo2_comment,
-	  { "Comment", "samr.samr_UserInfo2.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Info", "samr.samr_QueryGroupInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_comment,
+		{ "Comment", "samr.samr_UserInfo21.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info17,
+		{ "Info17", "samr.samr_UserInfo.info17", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_lm_password,
+		{ "Lm Password", "samr.samr_ChangePasswordUser3.lm_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_logon_hours,
+		{ "Logon Hours", "samr.samr_UserInfo5.logon_hours", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_unknown3,
+		{ "Unknown3", "samr.samr_DomGeneralInformation.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_BAD_PWD_COUNT,
+		{ "Samr Field Bad Pwd Count", "samr.samr_FieldsPresent.SAMR_FIELD_BAD_PWD_COUNT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_BAD_PWD_COUNT_tfs), ( 0x00004000 ), NULL, HFILL }},
+	{ &hf_samr_samr_GetUserPwInfo_info,
+		{ "Info", "samr.samr_GetUserPwInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_logon_hours,
+		{ "Logon Hours", "samr.samr_UserInfo3.logon_hours", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_ATTRIBUTES,
+		{ "Samr User Access Get Attributes", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_ATTRIBUTES_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainGroups_num_entries,
+		{ "Num Entries", "samr.samr_EnumDomainGroups.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_lsa_Strings_names,
+		{ "Names", "samr.lsa_Strings.names", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_OpenDomain_sid,
+		{ "Sid", "samr.samr_OpenDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LOGON_HOURS,
+		{ "Samr Field Logon Hours", "samr.samr_FieldsPresent.SAMR_FIELD_LOGON_HOURS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LOGON_HOURS_tfs), ( 0x00002000 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordRep_ctr1,
+		{ "Ctr1", "samr.samr_ValidatePasswordRep.ctr1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_samr_samr_UserInfo21_home_drive,
-	  { "Home Drive", "samr.samr_UserInfo21.home_drive", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Home Drive", "samr.samr_UserInfo21.home_drive", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAccessMask_SAMR_GROUP_ACCESS_GET_MEMBERS,
+		{ "Samr Group Access Get Members", "samr.samr_GroupAccessMask.SAMR_GROUP_ACCESS_GET_MEMBERS", FT_BOOLEAN, 32, TFS(&samr_GroupAccessMask_SAMR_GROUP_ACCESS_GET_MEMBERS_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_LogonHours_units_per_week,
+		{ "Units Per Week", "samr.samr_LogonHours.units_per_week", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_NT_PASSWORD_PRESENT,
+		{ "Samr Field Nt Password Present", "samr.samr_FieldsPresent.SAMR_FIELD_NT_PASSWORD_PRESENT", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_NT_PASSWORD_PRESENT_tfs), ( 0x01000000 ), NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfoAll_attributes,
+		{ "Attributes", "samr.samr_GroupInfoAll.attributes", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetUserInfo2_info,
+		{ "Info", "samr.samr_SetUserInfo2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo_returned_size,
+		{ "Returned Size", "samr.samr_QueryDisplayInfo.returned_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo18_nt_pwd,
+		{ "Nt Pwd", "samr.samr_UserInfo18.nt_pwd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq3_clear_lockout,
+		{ "Clear Lockout", "samr.samr_ValidatePasswordReq3.clear_lockout", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo12_lockout_duration,
+		{ "Lockout Duration", "samr.samr_DomInfo12.lockout_duration", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetGroupInfo_info,
+		{ "Info", "samr.samr_SetGroupInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasInfo_all,
+		{ "All", "samr.samr_AliasInfo.all", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_TEMPDUP,
+		{ "Acb Tempdup", "samr.samr_AcctFlags.ACB_TEMPDUP", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_TEMPDUP_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_ConnectAccessMask_SAMR_ACCESS_INITIALIZE_SERVER,
+		{ "Samr Access Initialize Server", "samr.samr_ConnectAccessMask.SAMR_ACCESS_INITIALIZE_SERVER", FT_BOOLEAN, 32, TFS(&samr_ConnectAccessMask_SAMR_ACCESS_INITIALIZE_SERVER_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOCALE,
+		{ "Samr User Access Get Locale", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_LOCALE", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_LOCALE_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq2_account,
+		{ "Account", "samr.samr_ValidatePasswordReq2.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_logon_script,
+		{ "Logon Script", "samr.samr_UserInfo5.logon_script", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfo_info5,
+		{ "Info5", "samr.samr_DispInfo.info5", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_PasswordProperties_DOMAIN_PASSWORD_COMPLEX,
+		{ "Domain Password Complex", "samr.samr_PasswordProperties.DOMAIN_PASSWORD_COMPLEX", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_PASSWORD_COMPLEX_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info3,
+		{ "Info3", "samr.samr_DomainInfo.info3", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo7_account_name,
+		{ "Account Name", "samr.samr_UserInfo7.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_HOME_DRIVE,
+		{ "Samr Field Home Drive", "samr.samr_FieldsPresent.SAMR_FIELD_HOME_DRIVE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_HOME_DRIVE_tfs), ( 0x00000080 ), NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_USER,
+		{ "Samr Domain Access Create User", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_CREATE_USER", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_CREATE_USER_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_CreateUser2_acct_flags,
+		{ "Acct Flags", "samr.samr_CreateUser2.acct_flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq_req1,
+		{ "Req1", "samr.samr_ValidatePasswordReq.req1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_FORCE_PWD_CHANGE,
+		{ "Samr Field Force Pwd Change", "samr.samr_FieldsPresent.SAMR_FIELD_FORCE_PWD_CHANGE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_FORCE_PWD_CHANGE_tfs), ( 0x00020000 ), NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo3_force_logoff_time,
+		{ "Force Logoff Time", "samr.samr_DomInfo3.force_logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupInfoAttributes_attributes,
+		{ "Attributes", "samr.samr_GroupInfoAttributes.attributes", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo6_full_name,
+		{ "Full Name", "samr.samr_UserInfo6.full_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_HOMDIRREQ,
+		{ "Acb Homdirreq", "samr.samr_AcctFlags.ACB_HOMDIRREQ", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_HOMDIRREQ_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCT_FLAGS,
+		{ "Samr Field Acct Flags", "samr.samr_FieldsPresent.SAMR_FIELD_ACCT_FLAGS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_ACCT_FLAGS_tfs), ( 0x00100000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo_info7,
+		{ "Info7", "samr.samr_UserInfo.info7", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_user_access_mask,
+		{ "Access Mask", "samr.user.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordReq2_password,
+		{ "Password", "samr.samr_ValidatePasswordReq2.password", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_oem,
+		{ "Oem", "samr.samr_DomainInfo.oem", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomGeneralInformation_domain_name,
+		{ "Domain Name", "samr.samr_DomGeneralInformation.domain_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP,
+		{ "Samr User Access Change Group Membership", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP_tfs), ( 0x00000400 ), NULL, HFILL }},
+	{ &hf_samr_samr_DomainInfo_info6,
+		{ "Info6", "samr.samr_DomainInfo.info6", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_EnumDomainAliases_num_entries,
+		{ "Num Entries", "samr.samr_EnumDomainAliases.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo7_role,
+		{ "Role", "samr.samr_DomInfo7.role", FT_UINT32, BASE_DEC, VALS(samr_samr_Role_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_LookupNames_rids,
+		{ "Rids", "samr.samr_LookupNames.rids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfoGeneral_entries,
+		{ "Entries", "samr.samr_DispInfoGeneral.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasInfo_name,
+		{ "Name", "samr.samr_AliasInfo.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_EXPIRED_FLAG,
+		{ "Samr Field Expired Flag", "samr.samr_FieldsPresent.SAMR_FIELD_EXPIRED_FLAG", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_EXPIRED_FLAG_tfs), ( 0x08000000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_primary_gid,
+		{ "Primary Gid", "samr.samr_UserInfo21.primary_gid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_TRUST_AUTH_DELEGAT,
+		{ "Acb Trust Auth Delegat", "samr.samr_AcctFlags.ACB_TRUST_AUTH_DELEGAT", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_TRUST_AUTH_DELEGAT_tfs), ( 0x00040000 ), NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_ACCT_EXPIRY,
+		{ "Samr Field Acct Expiry", "samr.samr_FieldsPresent.SAMR_FIELD_ACCT_EXPIRY", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_ACCT_EXPIRY_tfs), ( 0x00080000 ), NULL, HFILL }},
+	{ &hf_samr_samr_CreateDomAlias_alias_name,
+		{ "Alias Name", "samr.samr_CreateDomAlias.alias_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AliasAccessMask_SAMR_ALIAS_ACCESS_SET_INFO,
+		{ "Samr Alias Access Set Info", "samr.samr_AliasAccessMask.SAMR_ALIAS_ACCESS_SET_INFO", FT_BOOLEAN, 32, TFS(&samr_AliasAccessMask_SAMR_ALIAS_ACCESS_SET_INFO_tfs), ( 0x00000010 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo20_parameters,
+		{ "Parameters", "samr.samr_UserInfo20.parameters", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo_start_idx,
+		{ "Start Idx", "samr.samr_QueryDisplayInfo.start_idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Connect5_info_out,
+		{ "Info Out", "samr.samr_Connect5.info_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetBootKeyInformation_unknown,
+		{ "Unknown", "samr.samr_GetBootKeyInformation.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetDisplayEnumerationIndex2_level,
+		{ "Level", "samr.samr_GetDisplayEnumerationIndex2.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_DomainDisplayInformation_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetDisplayEnumerationIndex2_idx,
+		{ "Idx", "samr.samr_GetDisplayEnumerationIndex2.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo1_account_name,
+		{ "Account Name", "samr.samr_UserInfo1.account_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AcctFlags_ACB_PWNOEXP,
+		{ "Acb Pwnoexp", "samr.samr_AcctFlags.ACB_PWNOEXP", FT_BOOLEAN, 32, TFS(&samr_AcctFlags_ACB_PWNOEXP_tfs), ( 0x00000200 ), NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_HOME_DIRECTORY,
+		{ "Samr Field Home Directory", "samr.samr_FieldsPresent.SAMR_FIELD_HOME_DIRECTORY", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_HOME_DIRECTORY_tfs), ( 0x00000040 ), NULL, HFILL }},
+	{ &hf_samr_samr_OemChangePasswordUser2_account,
+		{ "Account", "samr.samr_OemChangePasswordUser2.account", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_unknown4,
+		{ "Unknown4", "samr.samr_UserInfo21.unknown4", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfoAscii_count,
+		{ "Count", "samr.samr_DispInfoAscii.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetDisplayEnumerationIndex_idx,
+		{ "Idx", "samr.samr_GetDisplayEnumerationIndex.idx", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryGroupInfo_level,
+		{ "Level", "samr.samr_QueryGroupInfo.level", FT_UINT1632, BASE_DEC, VALS(samr_samr_GroupInfoEnum_vals), 0, NULL, HFILL }},
+	{ &hf_samr_samr_LookupRids_names,
+		{ "Names", "samr.samr_LookupRids.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_FULL_NAME,
+		{ "Samr Field Full Name", "samr.samr_FieldsPresent.SAMR_FIELD_FULL_NAME", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_FULL_NAME_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo10_home_drive,
+		{ "Home Drive", "samr.samr_UserInfo10.home_drive", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo3_home_drive,
+		{ "Home Drive", "samr.samr_UserInfo3.home_drive", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo_buf_size,
+		{ "Buf Size", "samr.samr_QueryDisplayInfo.buf_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo8_domain_create_time,
+		{ "Domain Create Time", "samr.samr_DomInfo8.domain_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_SetMemberAttributesOfGroup_unknown2,
+		{ "Unknown2", "samr.samr_SetMemberAttributesOfGroup.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_AddGroupMember_flags,
+		{ "Flags", "samr.samr_AddGroupMember.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_force_password_change,
+		{ "Force Password Change", "samr.samr_UserInfo21.force_password_change", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_NAME_ETC,
+		{ "Samr User Access Get Name Etc", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_NAME_ETC", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_NAME_ETC_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordRepCtr_info,
+		{ "Info", "samr.samr_ValidatePasswordRepCtr.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GroupAttrs_SE_GROUP_OWNER,
+		{ "Se Group Owner", "samr.samr_GroupAttrs.SE_GROUP_OWNER", FT_BOOLEAN, 32, TFS(&samr_GroupAttrs_SE_GROUP_OWNER_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_RID,
+		{ "Samr Field Rid", "samr.samr_FieldsPresent.SAMR_FIELD_RID", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_RID_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo18_password_expired,
+		{ "Password Expired", "samr.samr_UserInfo18.password_expired", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo5_profile_path,
+		{ "Profile Path", "samr.samr_UserInfo5.profile_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo1_min_password_length,
+		{ "Min Password Length", "samr.samr_DomInfo1.min_password_length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_PasswordProperties_DOMAIN_REFUSE_PASSWORD_CHANGE,
+		{ "Domain Refuse Password Change", "samr.samr_PasswordProperties.DOMAIN_REFUSE_PASSWORD_CHANGE", FT_BOOLEAN, 32, TFS(&samr_PasswordProperties_DOMAIN_REFUSE_PASSWORD_CHANGE_tfs), ( 0x00000020 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo12_profile_path,
+		{ "Profile Path", "samr.samr_UserInfo12.profile_path", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser_nt_present,
+		{ "Nt Present", "samr.samr_ChangePasswordUser.nt_present", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_PARAMETERS,
+		{ "Samr Field Parameters", "samr.samr_FieldsPresent.SAMR_FIELD_PARAMETERS", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_PARAMETERS_tfs), ( 0x00200000 ), NULL, HFILL }},
+	{ &hf_samr_samr_RidWithAttributeArray_count,
+		{ "Count", "samr.samr_RidWithAttributeArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispEntryGeneral_description,
+		{ "Description", "samr.samr_DispEntryGeneral.description", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo21_acct_expiry,
+		{ "Acct Expiry", "samr.samr_UserInfo21.acct_expiry", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_FieldsPresent_SAMR_FIELD_LAST_PWD_CHANGE,
+		{ "Samr Field Last Pwd Change", "samr.samr_FieldsPresent.SAMR_FIELD_LAST_PWD_CHANGE", FT_BOOLEAN, 32, TFS(&samr_FieldsPresent_SAMR_FIELD_LAST_PWD_CHANGE_tfs), ( 0x00040000 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo24_password,
+		{ "Password", "samr.samr_UserInfo24.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_GetDomPwInfo_info,
+		{ "Info", "samr.samr_GetDomPwInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_Connect2_system_name,
+		{ "System Name", "samr.samr_Connect2.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_connect_handle,
+		{ "Connect Handle", "samr.connect_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP,
+		{ "Samr User Access Get Group Membership", "samr.samr_UserAccessMask.SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP", FT_BOOLEAN, 32, TFS(&samr_UserAccessMask_SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP_tfs), ( 0x00000200 ), NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo1_comment,
+		{ "Comment", "samr.samr_UserInfo1.comment", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_QueryDisplayInfo3_buf_size,
+		{ "Buf Size", "samr.samr_QueryDisplayInfo3.buf_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DispInfoFull_entries,
+		{ "Entries", "samr.samr_DispInfoFull.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_ValidatePasswordInfo_fields_present,
+		{ "Fields Present", "samr.samr_ValidatePasswordInfo.fields_present", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
+		{ "Samr Domain Access Lookup Alias", "samr.samr_DomainAccessMask.SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS", FT_BOOLEAN, 32, TFS(&samr_DomainAccessMask_SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS_tfs), ( 0x00000080 ), NULL, HFILL }},
+	{ &hf_samr_samr_ChangePasswordUser3_lm_verifier,
+		{ "Lm Verifier", "samr.samr_ChangePasswordUser3.lm_verifier", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo23_info,
+		{ "Info", "samr.samr_UserInfo23.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_UserInfo2_country_code,
+		{ "Country Code", "samr.samr_UserInfo2.country_code", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_samr_samr_DomInfo13_domain_create_time,
+		{ "Domain Create Time", "samr.samr_DomInfo13.domain_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-spoolss.c b/epan/dissectors/packet-dcerpc-spoolss.c
index 8cd5419057..3fff9fb5f8 100644
--- a/epan/dissectors/packet-dcerpc-spoolss.c
+++ b/epan/dissectors/packet-dcerpc-spoolss.c
@@ -560,8 +560,7 @@ dissect_SYSTEM_TIME(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	char *str;
 
 	if (add_subtree) {
-		item = proto_tree_add_text(tree, tvb, offset, 16, "%s", name);
-		subtree = proto_item_add_subtree(item, ett_SYSTEM_TIME);
+		subtree = proto_tree_add_subtree(tree, tvb, offset, 16, ett_SYSTEM_TIME, &item, name);
 	}
 
 	offset = dissect_ndr_uint16(
@@ -680,9 +679,7 @@ dissect_printerdata_data(tvbuff_t *tvb, int offset,
 	proto_tree *subtree;
 	guint32 size;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Data");
-
-	subtree = proto_item_add_subtree(item, ett_printerdata_data);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_printerdata_data, &item, "Data");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep, hf_printerdata_size, &size);
@@ -1535,8 +1532,7 @@ dissect_DEVMODE(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	if (di->conformant_run)
 		return offset;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Devicemode");
-	subtree = proto_item_add_subtree(item, ett_DEVMODE);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_DEVMODE, &item, "Devicemode");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep, hf_devmode_size,
@@ -1711,14 +1707,11 @@ static int
 dissect_DEVMODE_CTR(tvbuff_t *tvb, int offset, packet_info *pinfo,
 			       proto_tree *tree, dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	guint32 size;
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "Devicemode container");
-
-	subtree = proto_item_add_subtree(item, ett_DEVMODE_CTR);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_DEVMODE_CTR, NULL, "Devicemode container");
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
 				    hf_devmodectr_size, &size);
@@ -2551,17 +2544,14 @@ dissect_USER_LEVEL_CTR(tvbuff_t *tvb, int offset,
 				  packet_info *pinfo, proto_tree *tree,
 				  dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	guint32 level;
 
 	if (di->conformant_run)
 		return offset;
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "User level container");
-
-	subtree = proto_item_add_subtree(item, ett_USER_LEVEL_CTR);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_USER_LEVEL_CTR, NULL, "User level container");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep, hf_level, &level);
@@ -2837,9 +2827,7 @@ dissect_NOTIFY_OPTION(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	guint16 type;
 	guint32 count;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Notify Option");
-
-	subtree = proto_item_add_subtree(item, ett_NOTIFY_OPTION);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_NOTIFY_OPTION, &item, "Notify Option");
 
 	offset = dissect_ndr_uint16(tvb, offset, pinfo, subtree, di, drep,
 				    hf_notify_option_type, &type);
@@ -3440,7 +3428,6 @@ static int
 dissect_SEC_DESC_BUF(tvbuff_t *tvb, int offset, packet_info *pinfo,
 		     proto_tree *tree, dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	guint32 len;
 
@@ -3450,10 +3437,8 @@ dissect_SEC_DESC_BUF(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	   dissect_nt_cvstring() passes back a char * where it really
 	   should pass back a tvb. */
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "Security descriptor buffer");
-
-	subtree = proto_item_add_subtree(item, ett_SEC_DESC_BUF);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_SEC_DESC_BUF, NULL, "Security descriptor buffer");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep,
@@ -3491,14 +3476,11 @@ static int
 dissect_SPOOL_PRINTER_INFO(tvbuff_t *tvb, int offset, packet_info *pinfo,
 			   proto_tree *tree, dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	guint32 level;
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "Spool printer info level");
-
-	subtree = proto_item_add_subtree(item, ett_SPOOL_PRINTER_INFO_LEVEL);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_SPOOL_PRINTER_INFO_LEVEL, NULL, "Spool printer info level");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep, hf_level, &level);
@@ -3620,9 +3602,7 @@ dissect_FORM_REL(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	int item_start = offset;
 	char *name = NULL;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Form");
-
-	subtree = proto_item_add_subtree(item, ett_FORM_REL);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_FORM_REL, &item, "Form");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep, hf_form_flags, &flags);
@@ -3890,10 +3870,7 @@ SpoolssEnumPrinterData_r(tvbuff_t *tvb, int offset,
 
 	/* Parse packet */
 
-	value_item = proto_tree_add_text(tree, tvb, offset, 0, "Value");
-
-	value_subtree = proto_item_add_subtree(
-		value_item, ett_printerdata_value);
+	value_subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_printerdata_value, &value_item, "Value");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, value_subtree, di, drep,
@@ -4127,13 +4104,10 @@ static int
 dissect_FORM_1(tvbuff_t *tvb, int offset, packet_info *pinfo,
 			  proto_tree *tree, dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	guint32 flags;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Form level 1");
-
-	subtree = proto_item_add_subtree(item, ett_FORM_1);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_FORM_1, NULL, "Form level 1");
 
 	offset = dissect_ndr_str_pointer_item(
 		tvb, offset, pinfo, subtree, di, drep, NDR_POINTER_UNIQUE,
@@ -4191,13 +4165,10 @@ dissect_FORM_CTR(tvbuff_t *tvb, int offset,
 			    packet_info *pinfo, proto_tree *tree,
 			    dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	guint32 level;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Form container");
-
-	subtree = proto_item_add_subtree(item, ett_FORM_CTR);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_FORM_CTR, NULL, "Form container");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep, hf_form_level, &level);
@@ -4511,9 +4482,7 @@ dissect_spoolss_JOB_INFO_1(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	int struct_start = offset;
 	char *document_name;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Job info level 1");
-
-	subtree = proto_item_add_subtree(item, ett_JOB_INFO_1);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_JOB_INFO_1, &item, "Job info level 1");
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
 				    hf_job_id, NULL);
@@ -4584,9 +4553,7 @@ dissect_spoolss_JOB_INFO_2(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	char *document_name;
 	guint32 devmode_offset, secdesc_offset;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Job info level 2");
-
-	subtree = proto_item_add_subtree(item, ett_JOB_INFO_2);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_JOB_INFO_2, &item, "Job info level 2");
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
 				    hf_job_id, NULL);
@@ -5007,13 +4974,10 @@ static int
 dissect_spoolss_doc_info_1(tvbuff_t *tvb, int offset, packet_info *pinfo,
 			   proto_tree *tree, dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "Document info level 1");
-
-	subtree = proto_item_add_subtree(item, ett_DOC_INFO_1);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_DOC_INFO_1, NULL, "Document info level 1");
 
 	offset = dissect_ndr_str_pointer_item(
 		tvb, offset, pinfo, subtree, di, drep, NDR_POINTER_UNIQUE,
@@ -5050,14 +5014,11 @@ static int
 dissect_spoolss_doc_info(tvbuff_t *tvb, int offset, packet_info *pinfo,
 			 proto_tree *tree, dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	guint32 level;
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "Document info");
-
-	subtree = proto_item_add_subtree(item, ett_DOC_INFO);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_DOC_INFO, NULL, "Document info");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep, hf_level, &level);
@@ -5080,13 +5041,10 @@ static int
 dissect_spoolss_doc_info_ctr(tvbuff_t *tvb, int offset, packet_info *pinfo,
 			     proto_tree *tree, dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "Document info container");
-
-	subtree = proto_item_add_subtree(item, ett_DOC_INFO_CTR);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_DOC_INFO_CTR, NULL, "Document info container");
 
 	offset = dissect_ndr_uint32(
 		tvb, offset, pinfo, subtree, di, drep, hf_level, NULL);
@@ -5221,9 +5179,7 @@ SpoolssWritePrinter_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
 
 	col_append_fstr(pinfo->cinfo, COL_INFO, ", %d bytes", size);
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Buffer");
-
-	subtree = proto_item_add_subtree(item, ett_writeprinter_buffer);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_writeprinter_buffer, &item, "Buffer");
 
 	offset = dissect_ndr_uint8s(tvb, offset, pinfo, subtree, di, drep,
 				    hf_buffer_data, size, NULL);
@@ -5318,14 +5274,11 @@ dissect_DRIVER_INFO_1(tvbuff_t *tvb, int offset,
 				 packet_info *pinfo, proto_tree *tree,
 				 dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	int struct_start = offset;
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "Driver info level 1");
-
-	subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_1);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_DRIVER_INFO_1, NULL, "Driver info level 1");
 
 	offset = dissect_spoolss_relstr(
 		tvb, offset, pinfo, subtree, di, drep, hf_drivername,
@@ -5353,14 +5306,11 @@ dissect_DRIVER_INFO_2(tvbuff_t *tvb, int offset,
 	 packet_info *pinfo, proto_tree *tree,
 	 dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	int struct_start = offset;
 
-	item = proto_tree_add_text(
-			tree, tvb, offset, 0, "Driver info level 2");
-
-	subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_2);
+	subtree = proto_tree_add_subtree(
+			tree, tvb, offset, 0, ett_DRIVER_INFO_2, NULL, "Driver info level 2");
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
 			hf_driverinfo_cversion, NULL);
@@ -5399,14 +5349,11 @@ dissect_DRIVER_INFO_3(tvbuff_t *tvb, int offset,
 				 packet_info *pinfo, proto_tree *tree,
 				 dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	int struct_start = offset;
 
-	item = proto_tree_add_text(
-		tree, tvb, offset, 0, "Driver info level 3");
-
-	subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_3);
+	subtree = proto_tree_add_subtree(
+		tree, tvb, offset, 0, ett_DRIVER_INFO_3, NULL, "Driver info level 3");
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
 				    hf_driverinfo_cversion, NULL);
@@ -5462,14 +5409,11 @@ dissect_DRIVER_INFO_6(tvbuff_t *tvb, int offset,
 				 packet_info *pinfo, proto_tree *tree,
 				 dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	int struct_start = offset;
 
-	item = proto_tree_add_text(
-			tree, tvb, offset, 0, "Driver info level 6");
-
-	subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_6);
+	subtree = proto_tree_add_subtree(
+			tree, tvb, offset, 0, ett_DRIVER_INFO_6, NULL, "Driver info level 6");
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
 			hf_driverinfo_cversion, NULL);
@@ -5557,14 +5501,11 @@ dissect_DRIVER_INFO_101(tvbuff_t *tvb, int offset,
 				 packet_info *pinfo, proto_tree *tree,
 				 dcerpc_info *di, guint8 *drep)
 {
-	proto_item *item;
 	proto_tree *subtree;
 	int struct_start = offset;
 
-	item = proto_tree_add_text(
-			tree, tvb, offset, 0, "Driver info level 101");
-
-	subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_101);
+	subtree = proto_tree_add_subtree(
+			tree, tvb, offset, 0, ett_DRIVER_INFO_101, NULL, "Driver info level 101");
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
 			hf_driverinfo_cversion, NULL);
@@ -6226,9 +6167,7 @@ dissect_NOTIFY_INFO_DATA(tvbuff_t *tvb, int offset, packet_info *pinfo,
 	guint16 type, field;
 	const char *field_string;
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "%s", "");
-
-	subtree = proto_item_add_subtree(item, ett_NOTIFY_INFO_DATA);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_NOTIFY_INFO_DATA, &item, "");
 
 	offset = dissect_ndr_uint16(
 		tvb, offset, pinfo, subtree, di, drep,
@@ -6674,9 +6613,7 @@ dissect_spoolss_printer_enum_values(tvbuff_t *tvb, int offset,
 		tvb, start_offset + name_offset, pinfo, NULL, drep,
 		&name, "Name");
 
-	item = proto_tree_add_text(tree, tvb, offset, 0, "Name: ");
-
-	subtree = proto_item_add_subtree(item, ett_printer_enumdataex_value);
+	subtree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_printer_enumdataex_value, &item, "Name: ");
 
 	proto_item_append_text(item, "%s", name);
 
@@ -6802,15 +6739,12 @@ SpoolssEnumPrinterDataEx_r(tvbuff_t *tvb, int offset,
 		&num_values);
 
 	if (size) {
-		proto_item *item;
 		proto_tree *subtree;
 		int offset2 = offset;
 		guint32 i;
 
-		item = proto_tree_add_text(
-			tree, tvb, offset, 0, "Printer data");
-
-		subtree = proto_item_add_subtree(item, ett_PRINTER_DATA_CTR);
+		subtree = proto_tree_add_subtree(
+			tree, tvb, offset, 0, ett_PRINTER_DATA_CTR, NULL, "Printer data");
 
 		for (i=0; i < num_values; i++)
 			offset2 = dissect_spoolss_printer_enum_values(
diff --git a/epan/dissectors/packet-dcerpc-srvsvc.c b/epan/dissectors/packet-dcerpc-srvsvc.c
index 5dc5f185f1..ae9928f0a8 100644
--- a/epan/dissectors/packet-dcerpc-srvsvc.c
+++ b/epan/dissectors/packet-dcerpc-srvsvc.c
@@ -2467,8 +2467,7 @@ srvsvc_dissect_NetCharDevInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pi
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetCharDevInfo");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetCharDevInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetCharDevInfo, &item, "srvsvc_NetCharDevInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -2539,8 +2538,7 @@ srvsvc_dissect_NetCharDevCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pin
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetCharDevCtr");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetCharDevCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetCharDevCtr, &item, "srvsvc_NetCharDevCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -2881,8 +2879,7 @@ srvsvc_dissect_NetCharDevQInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *p
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetCharDevQInfo");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetCharDevQInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetCharDevQInfo, &item, "srvsvc_NetCharDevQInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -2953,8 +2950,7 @@ srvsvc_dissect_NetCharDevQCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pi
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetCharDevQCtr");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetCharDevQCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetCharDevQCtr, &item, "srvsvc_NetCharDevQCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -3309,8 +3305,7 @@ srvsvc_dissect_NetConnCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetConnCtr");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetConnCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetConnCtr, &item, "srvsvc_NetConnCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -3643,8 +3638,7 @@ srvsvc_dissect_NetFileInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetFileInfo");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetFileInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetFileInfo, &item, "srvsvc_NetFileInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -3715,8 +3709,7 @@ srvsvc_dissect_NetFileCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetFileCtr");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetFileCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetFileCtr, &item, "srvsvc_NetFileCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -4719,8 +4712,7 @@ srvsvc_dissect_NetSessCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetSessCtr");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetSessCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetSessCtr, &item, "srvsvc_NetSessCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -6391,8 +6383,7 @@ srvsvc_dissect_NetShareInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetShareInfo");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetShareInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetShareInfo, &item, "srvsvc_NetShareInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -6631,8 +6622,7 @@ srvsvc_dissect_NetShareCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetShareCtr");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetShareCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetShareCtr, &item, "srvsvc_NetShareCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -12123,8 +12113,7 @@ srvsvc_dissect_NetSrvInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetSrvInfo");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetSrvInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetSrvInfo, &item, "srvsvc_NetSrvInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -13629,8 +13618,7 @@ srvsvc_dissect_NetTransportCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *p
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetTransportCtr");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetTransportCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetTransportCtr, &item, "srvsvc_NetTransportCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -13868,8 +13856,7 @@ srvsvc_dissect_NetTransportInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "srvsvc_NetTransportInfo");
-		tree = proto_item_add_subtree(item, ett_srvsvc_srvsvc_NetTransportInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_srvsvc_srvsvc_NetTransportInfo, &item, "srvsvc_NetTransportInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
diff --git a/epan/dissectors/packet-dcerpc-winreg.c b/epan/dissectors/packet-dcerpc-winreg.c
index 265293e9ee..f5b9ec3571 100644
--- a/epan/dissectors/packet-dcerpc-winreg.c
+++ b/epan/dissectors/packet-dcerpc-winreg.c
@@ -43,155 +43,155 @@ static gint ett_winreg_QueryMultipleValue = -1;
 
 
 /* Header field declarations */
-static gint hf_winreg_winreg_OpenKey_access_mask = -1;
-static gint hf_winreg_winreg_String_name = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdownEx_message = -1;
 static gint hf_winreg_KeySecurityAttribute_data_size = -1;
-static gint hf_winreg_winreg_QueryInfoKey_classname = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_buffer = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_CREATE_LINK = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_buffer_size = -1;
-static gint hf_winreg_winreg_CreateKey_secdesc = -1;
-static gint hf_winreg_winreg_DeleteKeyEx_reserved = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_key_handle = -1;
-static gint hf_winreg_QueryMultipleValue_ve_valuename = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS = -1;
-static gint hf_winreg_QueryMultipleValue_ve_valueptr = -1;
-static gint hf_winreg_KeySecurityData_data = -1;
-static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES = -1;
-static gint hf_winreg_winreg_CreateKey_keyclass = -1;
-static gint hf_winreg_winreg_SetValue_type = -1;
+static gint hf_winreg_system_name = -1;
+static gint hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK = -1;
+static gint hf_winreg_winreg_SetValue_size = -1;
+static gint hf_winreg_winreg_SecBuf_sd = -1;
 static gint hf_winreg_sd_offset = -1;
-static gint hf_winreg_access_mask = -1;
-static gint hf_winreg_winreg_CreateKey_action_taken = -1;
-static gint hf_winreg_winreg_ValNameBuf_length = -1;
-static gint hf_winreg_winreg_EnumValue_name = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_key_handle = -1;
-static gint hf_winreg_winreg_SaveKey_handle = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdownEx_reason = -1;
-static gint hf_winreg_winreg_EnumValue_type = -1;
-static gint hf_winreg_winreg_CreateKey_options = -1;
-static gint hf_winreg_winreg_QueryValue_type = -1;
-static gint hf_winreg_KeySecurityAttribute_sec_data = -1;
-static gint hf_winreg_KeySecurityData_len = -1;
-static gint hf_winreg_winreg_UnLoadKey_subkey = -1;
 static gint hf_winreg_winreg_RestoreKey_filename = -1;
-static gint hf_winreg_winreg_QueryInfoKey_max_valbufsize = -1;
-static gint hf_winreg_winreg_SaveKeyEx_sec_attrib = -1;
-static gint hf_winreg_QueryMultipleValue_ve_type = -1;
-static gint hf_winreg_winreg_SecBuf_inherit = -1;
-static gint hf_winreg_winreg_DeleteKeyEx_access_mask = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdownEx_message = -1;
-static gint hf_winreg_winreg_EnumValue_length = -1;
-static gint hf_winreg_winreg_QueryInfoKey_max_classlen = -1;
+static gint hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree = -1;
+static gint hf_winreg_sd_max_size = -1;
+static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME = -1;
+static gint hf_winreg_winreg_EnumValue_type = -1;
 static gint hf_winreg_winreg_QueryValue_value_name = -1;
-static gint hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK = -1;
-static gint hf_winreg_winreg_String_name_len = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_SET_VALUE = -1;
-static gint hf_winreg_winreg_EnumValue_value = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_key_handle = -1;
+static gint hf_winreg_winreg_SaveKey_sec_attrib = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_values_out = -1;
+static gint hf_winreg_winreg_CreateKey_secdesc = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdown_do_reboot = -1;
+static gint hf_winreg_winreg_LoadKey_filename = -1;
+static gint hf_winreg_winreg_CreateKey_options = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdown_message = -1;
+static gint hf_winreg_winreg_LoadKey_keyname = -1;
+static gint hf_winreg_winreg_SaveKeyEx_handle = -1;
+static gint hf_winreg_winreg_DeleteKeyEx_reserved = -1;
+static gint hf_winreg_winreg_UnLoadKey_handle = -1;
+static gint hf_winreg_winreg_QueryInfoKey_secdescsize = -1;
+static gint hf_winreg_winreg_QueryValue_data_length = -1;
+static gint hf_winreg_KeySecurityAttribute_inherit = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_NOTIFY = -1;
+static gint hf_winreg_winreg_ReplaceKey_handle = -1;
+static gint hf_winreg_winreg_QueryInfoKey_max_valnamelen = -1;
 static gint hf_winreg_winreg_NotifyChangeKeyValue_string1 = -1;
-static gint hf_winreg_winreg_QueryInfoKey_num_values = -1;
-static gint hf_winreg_winreg_OpenHKCU_access_mask = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_needed = -1;
-static gint hf_winreg_winreg_CreateKey_name = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY = -1;
+static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY = -1;
+static gint hf_winreg_handle = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY = -1;
+static gint hf_winreg_werror = -1;
+static gint hf_winreg_winreg_QueryInfoKey_classname = -1;
 static gint hf_winreg_winreg_InitiateSystemShutdownEx_hostname = -1;
-static gint hf_winreg_winreg_GetVersion_version = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_values_in = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdown_force_apps = -1;
-static gint hf_winreg_winreg_CreateKey_new_handle = -1;
-static gint hf_winreg_winreg_SaveKeyEx_handle = -1;
-static gint hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE = -1;
-static gint hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_num_values = -1;
-static gint hf_winreg_winreg_DeleteKeyEx_handle = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_values_out = -1;
-static gint hf_winreg_winreg_StringBuf_name = -1;
+static gint hf_winreg_winreg_EnumKey_last_changed_time = -1;
+static gint hf_winreg_KeySecurityData_data = -1;
+static gint hf_winreg_winreg_OpenHKCU_access_mask = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_buffer_size = -1;
+static gint hf_winreg_winreg_QueryInfoKey_num_values = -1;
+static gint hf_winreg_winreg_String_name_len = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_CREATE_LINK = -1;
+static gint hf_winreg_winreg_AbortSystemShutdown_server = -1;
+static gint hf_winreg_winreg_SaveKey_handle = -1;
 static gint hf_winreg_winreg_OpenKey_keyname = -1;
-static gint hf_winreg_winreg_SaveKeyEx_filename = -1;
+static gint hf_winreg_KeySecurityAttribute_sec_data = -1;
+static gint hf_winreg_opnum = -1;
 static gint hf_winreg_winreg_ReplaceKey_old_file = -1;
-static gint hf_winreg_winreg_QueryInfoKey_last_changed_time = -1;
-static gint hf_winreg_winreg_EnumKey_last_changed_time = -1;
-static gint hf_winreg_winreg_LoadKey_filename = -1;
-static gint hf_winreg_winreg_SaveKey_filename = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY = -1;
-static gint hf_winreg_system_name = -1;
-static gint hf_winreg_winreg_ValNameBuf_size = -1;
-static gint hf_winreg_winreg_QueryValue_data_size = -1;
-static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET = -1;
-static gint hf_winreg_winreg_ReplaceKey_subkey = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_buffer = -1;
-static gint hf_winreg_winreg_RestoreKey_handle = -1;
+static gint hf_winreg_winreg_SetValue_type = -1;
+static gint hf_winreg_winreg_ValNameBuf_length = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdown_force_apps = -1;
+static gint hf_winreg_winreg_StringBuf_name = -1;
+static gint hf_winreg_winreg_SetValue_name = -1;
+static gint hf_winreg_winreg_DeleteKeyEx_access_mask = -1;
+static gint hf_winreg_winreg_String_name_size = -1;
+static gint hf_winreg_KeySecurityData_size = -1;
 static gint hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot = -1;
-static gint hf_winreg_winreg_QueryInfoKey_max_subkeylen = -1;
-static gint hf_winreg_winreg_EnumKey_enum_index = -1;
-static gint hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE = -1;
-static gint hf_winreg_winreg_GetKeySecurity_sec_info = -1;
+static gint hf_winreg_winreg_OpenHKPD_access_mask = -1;
+static gint hf_winreg_winreg_EnumValue_value = -1;
+static gint hf_winreg_QueryMultipleValue_ve_valuelen = -1;
 static gint hf_winreg_winreg_EnumValue_enum_index = -1;
-static gint hf_winreg_winreg_EnumKey_name = -1;
-static gint hf_winreg_winreg_SetValue_name = -1;
-static gint hf_winreg_winreg_QueryInfoKey_num_subkeys = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdownEx_force_apps = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_key_handle = -1;
+static gint hf_winreg_winreg_SaveKeyEx_sec_attrib = -1;
+static gint hf_winreg_winreg_NotifyChangeKeyValue_string2 = -1;
+static gint hf_winreg_winreg_CreateKey_name = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_needed = -1;
 static gint hf_winreg_winreg_ReplaceKey_new_file = -1;
-static gint hf_winreg_winreg_RestoreKey_flags = -1;
-static gint hf_winreg_winreg_LoadKey_keyname = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_NOTIFY = -1;
+static gint hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE = -1;
+static gint hf_winreg_winreg_QueryInfoKey_num_subkeys = -1;
+static gint hf_winreg_winreg_DeleteValue_value = -1;
+static gint hf_winreg_winreg_EnumKey_enum_index = -1;
+static gint hf_winreg_winreg_SecBuf_inherit = -1;
+static gint hf_winreg_winreg_OpenKey_options = -1;
+static gint hf_winreg_winreg_DeleteKeyEx_key = -1;
 static gint hf_winreg_winreg_QueryMultipleValues2_values_in = -1;
+static gint hf_winreg_QueryMultipleValue_ve_valuename = -1;
+static gint hf_winreg_winreg_ValNameBuf_name = -1;
+static gint hf_winreg_winreg_UnLoadKey_subkey = -1;
+static gint hf_winreg_winreg_SaveKey_filename = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_offered = -1;
+static gint hf_winreg_QueryMultipleValue_ve_type = -1;
+static gint hf_winreg_winreg_QueryInfoKey_max_subkeylen = -1;
+static gint hf_winreg_winreg_DeleteKeyEx_handle = -1;
+static gint hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK = -1;
 static gint hf_winreg_winreg_InitiateSystemShutdownEx_timeout = -1;
-static gint hf_winreg_sd = -1;
+static gint hf_winreg_winreg_CreateKey_action_taken = -1;
 static gint hf_winreg_winreg_StringBuf_size = -1;
-static gint hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE = -1;
-static gint hf_winreg_winreg_NotifyChangeKeyValue_notify_filter = -1;
-static gint hf_winreg_winreg_AbortSystemShutdown_server = -1;
-static gint hf_winreg_winreg_ReplaceKey_handle = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_buffer = -1;
+static gint hf_winreg_winreg_GetVersion_version = -1;
 static gint hf_winreg_winreg_DeleteKey_key = -1;
-static gint hf_winreg_winreg_SecBuf_sd = -1;
-static gint hf_winreg_opnum = -1;
-static gint hf_winreg_winreg_SetValue_size = -1;
-static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY = -1;
-static gint hf_winreg_QueryMultipleValue_ve_valuelen = -1;
-static gint hf_winreg_KeySecurityData_size = -1;
-static gint hf_winreg_winreg_ValNameBuf_name = -1;
-static gint hf_winreg_winreg_OpenKey_options = -1;
-static gint hf_winreg_winreg_SecBuf_length = -1;
-static gint hf_winreg_winreg_NotifyChangeKeyValue_string2 = -1;
-static gint hf_winreg_werror = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_values_out = -1;
-static gint hf_winreg_winreg_QueryValue_data = -1;
-static gint hf_winreg_winreg_OpenKey_parent_handle = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE = -1;
 static gint hf_winreg_winreg_NotifyChangeKeyValue_unknown = -1;
+static gint hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH = -1;
+static gint hf_winreg_winreg_GetKeySecurity_sec_info = -1;
+static gint hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS = -1;
+static gint hf_winreg_winreg_CreateKey_keyclass = -1;
+static gint hf_winreg_winreg_SetKeySecurity_sec_info = -1;
+static gint hf_winreg_winreg_EnumValue_name = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_num_values = -1;
 static gint hf_winreg_winreg_InitiateSystemShutdown_hostname = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_num_values = -1;
-static gint hf_winreg_KeySecurityAttribute_inherit = -1;
-static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME = -1;
-static gint hf_winreg_winreg_EnumValue_size = -1;
+static gint hf_winreg_winreg_QueryValue_data = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_buffer = -1;
+static gint hf_winreg_QueryMultipleValue_ve_valueptr = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY = -1;
+static gint hf_winreg_winreg_EnumValue_length = -1;
 static gint hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE = -1;
-static gint hf_winreg_winreg_UnLoadKey_handle = -1;
-static gint hf_winreg_winreg_String_name_size = -1;
-static gint hf_winreg_winreg_QueryValue_data_length = -1;
-static gint hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH = -1;
-static gint hf_winreg_winreg_OpenHKPD_access_mask = -1;
-static gint hf_winreg_winreg_QueryInfoKey_secdescsize = -1;
-static gint hf_winreg_handle = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdown_do_reboot = -1;
-static gint hf_winreg_winreg_EnumKey_keyclass = -1;
+static gint hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE = -1;
+static gint hf_winreg_winreg_OpenKey_access_mask = -1;
+static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_num_values = -1;
+static gint hf_winreg_winreg_RestoreKey_handle = -1;
 static gint hf_winreg_winreg_NotifyChangeKeyValue_unknown2 = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdown_timeout = -1;
-static gint hf_winreg_winreg_StringBuf_length = -1;
-static gint hf_winreg_sd_max_size = -1;
-static gint hf_winreg_winreg_QueryInfoKey_max_valnamelen = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdown_message = -1;
-static gint hf_winreg_winreg_SetKeySecurity_sec_info = -1;
-static gint hf_winreg_winreg_SetValue_data = -1;
-static gint hf_winreg_winreg_SaveKey_sec_attrib = -1;
-static gint hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_offered = -1;
+static gint hf_winreg_winreg_QueryValue_data_size = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_values_out = -1;
+static gint hf_winreg_winreg_QueryInfoKey_max_classlen = -1;
+static gint hf_winreg_winreg_CreateKey_new_handle = -1;
+static gint hf_winreg_access_mask = -1;
+static gint hf_winreg_winreg_SecBuf_length = -1;
+static gint hf_winreg_winreg_NotifyChangeKeyValue_notify_filter = -1;
 static gint hf_winreg_winreg_SaveKeyEx_flags = -1;
-static gint hf_winreg_winreg_DeleteValue_value = -1;
-static gint hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdownEx_force_apps = -1;
-static gint hf_winreg_winreg_DeleteKeyEx_key = -1;
+static gint hf_winreg_winreg_ReplaceKey_subkey = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdownEx_reason = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_values_in = -1;
+static gint hf_winreg_winreg_SetValue_data = -1;
+static gint hf_winreg_winreg_EnumValue_size = -1;
+static gint hf_winreg_winreg_SaveKeyEx_filename = -1;
+static gint hf_winreg_winreg_StringBuf_length = -1;
+static gint hf_winreg_winreg_OpenKey_parent_handle = -1;
 static gint hf_winreg_sd_actual_size = -1;
+static gint hf_winreg_winreg_EnumKey_name = -1;
+static gint hf_winreg_winreg_QueryInfoKey_max_valbufsize = -1;
+static gint hf_winreg_winreg_RestoreKey_flags = -1;
+static gint hf_winreg_winreg_EnumKey_keyclass = -1;
+static gint hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE = -1;
+static gint hf_winreg_winreg_QueryValue_type = -1;
+static gint hf_winreg_KeySecurityData_len = -1;
+static gint hf_winreg_winreg_String_name = -1;
+static gint hf_winreg_sd = -1;
+static gint hf_winreg_winreg_QueryInfoKey_last_changed_time = -1;
+static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_SET_VALUE = -1;
+static gint hf_winreg_winreg_ValNameBuf_size = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdown_timeout = -1;
 
 static gint proto_dcerpc_winreg = -1;
 /* Version information */
@@ -633,8 +633,7 @@ cnf_dissect_winreg_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_t
 	old_offset = offset;
 	hf_info=proto_registrar_get_nth(hfindex);
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, 0, "%s: ", hf_info->name);
-		tree = proto_item_add_subtree(item, ett_winreg_winreg_String);
+		tree = proto_tree_add_subtree_format(parent_tree, tvb, offset, 0, ett_winreg_winreg_String, &item, "%s: ", hf_info->name);
 	}
 	
 	offset = winreg_dissect_element_String_name_len(tvb, offset, pinfo, tree, di, drep);
@@ -768,7 +767,7 @@ winreg_dissect_struct_String(tvbuff_t *tvb _U_, int offset _U_, packet_info *pin
 
 
 /* IDL: struct { */
-/* IDL: 	[unique(1)] [length_is(len)] [size_is(size)] uint8 *data; */
+/* IDL: 	[size_is(size)] [unique(1)] [length_is(len)] uint8 *data; */
 /* IDL: 	uint32 size; */
 /* IDL: 	uint32 len; */
 /* IDL: } */
@@ -994,7 +993,7 @@ winreg_dissect_enum_CreateAction(tvbuff_t *tvb _U_, int offset _U_, packet_info
 /* IDL: struct { */
 /* IDL: 	[value(strlen_m_term_null(name)*2)] uint16 length; */
 /* IDL: 	uint16 size; */
-/* IDL: 	[length_is(length/2)] [size_is(size/2)] [charset(UTF16)] [unique(1)] uint16 *name; */
+/* IDL: 	[charset(UTF16)] [length_is(length/2)] [unique(1)] [size_is(size/2)] uint16 *name; */
 /* IDL: } */
 
 static int
@@ -1074,7 +1073,7 @@ winreg_dissect_struct_StringBuf(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 /* IDL: struct { */
 /* IDL: 	[value(strlen_m_term(name)*2)] uint16 length; */
 /* IDL: 	uint16 size; */
-/* IDL: 	[unique(1)] [charset(UTF16)] [length_is(length/2)] [size_is(size/2)] uint16 *name; */
+/* IDL: 	[charset(UTF16)] [length_is(length/2)] [unique(1)] [size_is(size/2)] uint16 *name; */
 /* IDL: } */
 
 static int
@@ -1474,7 +1473,7 @@ winreg_dissect_element_OpenHKCR_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 /* IDL: WERROR winreg_OpenHKCR( */
 /* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *handle */
+/* IDL: [ref] [out] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1546,9 +1545,9 @@ winreg_dissect_element_OpenHKCU_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: WERROR winreg_OpenHKCU( */
-/* IDL: [in] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1696,7 +1695,7 @@ winreg_dissect_element_OpenHKPD_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 /* IDL: WERROR winreg_OpenHKPD( */
 /* IDL: [in] [unique(1)] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *handle */
+/* IDL: [ref] [out] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1768,7 +1767,7 @@ winreg_dissect_element_OpenHKU_handle_(tvbuff_t *tvb _U_, int offset _U_, packet
 }
 
 /* IDL: WERROR winreg_OpenHKU( */
-/* IDL: [unique(1)] [in] uint16 *system_name, */
+/* IDL: [in] [unique(1)] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
 /* IDL: [ref] [out] policy_handle *handle */
 /* IDL: ); */
@@ -1818,7 +1817,7 @@ winreg_dissect_element_CloseKey_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: WERROR winreg_CloseKey( */
-/* IDL: [in] [ref] [out] policy_handle *handle */
+/* IDL: [in] [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1951,7 +1950,7 @@ winreg_dissect_element_CreateKey_action_taken_(tvbuff_t *tvb _U_, int offset _U_
 /* IDL: [in] winreg_AccessMask access_mask, */
 /* IDL: [in] [unique(1)] winreg_SecBuf *secdesc, */
 /* IDL: [ref] [out] policy_handle *new_handle, */
-/* IDL: [unique(1)] [in] [out] winreg_CreateAction *action_taken */
+/* IDL: [unique(1)] [out] [in] winreg_CreateAction *action_taken */
 /* IDL: ); */
 
 static int
@@ -2020,7 +2019,7 @@ winreg_dissect_element_DeleteKey_key(tvbuff_t *tvb _U_, int offset _U_, packet_i
 }
 
 /* IDL: WERROR winreg_DeleteKey( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] winreg_String key */
 /* IDL: ); */
 
@@ -2074,7 +2073,7 @@ winreg_dissect_element_DeleteValue_value(tvbuff_t *tvb _U_, int offset _U_, pack
 }
 
 /* IDL: WERROR winreg_DeleteValue( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] winreg_String value */
 /* IDL: ); */
 
@@ -2176,11 +2175,11 @@ winreg_dissect_element_EnumKey_last_changed_time_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: WERROR winreg_EnumKey( */
-/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] uint32 enum_index, */
-/* IDL: [out] [in] [ref] winreg_StringBuf *name, */
-/* IDL: [out] [unique(1)] [in] winreg_StringBuf *keyclass, */
-/* IDL: [out] [unique(1)] [in] NTTIME *last_changed_time */
+/* IDL: [out] [ref] [in] winreg_StringBuf *name, */
+/* IDL: [unique(1)] [out] [in] winreg_StringBuf *keyclass, */
+/* IDL: [in] [out] [unique(1)] NTTIME *last_changed_time */
 /* IDL: ); */
 
 static int
@@ -2338,11 +2337,11 @@ winreg_dissect_element_EnumValue_length_(tvbuff_t *tvb _U_, int offset _U_, pack
 /* IDL: WERROR winreg_EnumValue( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] uint32 enum_index, */
-/* IDL: [ref] [in] [out] winreg_ValNameBuf *name, */
-/* IDL: [out] [in] [unique(1)] winreg_Type *type, */
-/* IDL: [unique(1)] [range(0,0x4000000)] [in] [out] [size_is(size?*size:0)] [length_is(length?*length:0)] uint8 *value, */
-/* IDL: [unique(1)] [in] [out] uint32 *size, */
-/* IDL: [in] [unique(1)] [out] uint32 *length */
+/* IDL: [in] [out] [ref] winreg_ValNameBuf *name, */
+/* IDL: [in] [unique(1)] [out] winreg_Type *type, */
+/* IDL: [in] [unique(1)] [size_is(size?*size:0)] [range(0,0x4000000)] [length_is(length?*length:0)] [out] uint8 *value, */
+/* IDL: [in] [unique(1)] [out] uint32 *size, */
+/* IDL: [out] [unique(1)] [in] uint32 *length */
 /* IDL: ); */
 
 static int
@@ -2481,7 +2480,7 @@ winreg_dissect_element_GetKeySecurity_sd_(tvbuff_t *tvb _U_, int offset _U_, pac
 /* IDL: WERROR winreg_GetKeySecurity( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] security_secinfo sec_info, */
-/* IDL: [ref] [in] [out] KeySecurityData *sd */
+/* IDL: [out] [ref] [in] KeySecurityData *sd */
 /* IDL: ); */
 
 static int
@@ -2565,7 +2564,7 @@ winreg_dissect_element_LoadKey_filename_(tvbuff_t *tvb _U_, int offset _U_, pack
 /* IDL: WERROR winreg_LoadKey( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [unique(1)] [in] winreg_String *keyname, */
-/* IDL: [unique(1)] [in] winreg_String *filename */
+/* IDL: [in] [unique(1)] winreg_String *filename */
 /* IDL: ); */
 
 static int
@@ -2660,7 +2659,7 @@ winreg_dissect_element_NotifyChangeKeyValue_unknown2(tvbuff_t *tvb _U_, int offs
 }
 
 /* IDL: WERROR winreg_NotifyChangeKeyValue( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] uint8 watch_subtree, */
 /* IDL: [in] winreg_NotifyChangeType notify_filter, */
 /* IDL: [in] uint32 unknown, */
@@ -2761,11 +2760,11 @@ winreg_dissect_element_OpenKey_handle_(tvbuff_t *tvb _U_, int offset _U_, packet
 }
 
 /* IDL: WERROR winreg_OpenKey( */
-/* IDL: [in] [ref] policy_handle *parent_handle, */
+/* IDL: [ref] [in] policy_handle *parent_handle, */
 /* IDL: [in] winreg_String keyname, */
 /* IDL: [in] winreg_KeyOptions options, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *handle */
+/* IDL: [ref] [out] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -2962,15 +2961,15 @@ winreg_dissect_element_QueryInfoKey_last_changed_time_(tvbuff_t *tvb _U_, int of
 
 /* IDL: WERROR winreg_QueryInfoKey( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] [out] winreg_String *classname, */
-/* IDL: [out] [ref] uint32 *num_subkeys, */
+/* IDL: [ref] [out] [in] winreg_String *classname, */
+/* IDL: [ref] [out] uint32 *num_subkeys, */
 /* IDL: [ref] [out] uint32 *max_subkeylen, */
-/* IDL: [ref] [out] uint32 *max_classlen, */
+/* IDL: [out] [ref] uint32 *max_classlen, */
 /* IDL: [ref] [out] uint32 *num_values, */
 /* IDL: [out] [ref] uint32 *max_valnamelen, */
 /* IDL: [out] [ref] uint32 *max_valbufsize, */
 /* IDL: [out] [ref] uint32 *secdescsize, */
-/* IDL: [out] [ref] NTTIME *last_changed_time */
+/* IDL: [ref] [out] NTTIME *last_changed_time */
 /* IDL: ); */
 
 static int
@@ -3133,9 +3132,9 @@ winreg_dissect_element_QueryValue_data_length_(tvbuff_t *tvb _U_, int offset _U_
 /* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [ref] [in] winreg_String *value_name, */
 /* IDL: [out] [unique(1)] [in] winreg_Type *type, */
-/* IDL: [length_is(data_length?*data_length:0)] [size_is(data_size?*data_size:0)] [out] [in] [range(0,0x4000000)] [unique(1)] uint8 *data, */
+/* IDL: [unique(1)] [size_is(data_size?*data_size:0)] [range(0,0x4000000)] [out] [length_is(data_length?*data_length:0)] [in] uint8 *data, */
 /* IDL: [out] [unique(1)] [in] uint32 *data_size, */
-/* IDL: [in] [unique(1)] [out] uint32 *data_length */
+/* IDL: [unique(1)] [out] [in] uint32 *data_length */
 /* IDL: ); */
 
 static int
@@ -3248,7 +3247,7 @@ winreg_dissect_element_ReplaceKey_old_file_(tvbuff_t *tvb _U_, int offset _U_, p
 }
 
 /* IDL: WERROR winreg_ReplaceKey( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [ref] [in] winreg_String *subkey, */
 /* IDL: [ref] [in] winreg_String *new_file, */
 /* IDL: [ref] [in] winreg_String *old_file */
@@ -3405,8 +3404,8 @@ winreg_dissect_element_SaveKey_sec_attrib_(tvbuff_t *tvb _U_, int offset _U_, pa
 }
 
 /* IDL: WERROR winreg_SaveKey( */
-/* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [ref] [in] winreg_String *filename, */
+/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [in] [ref] winreg_String *filename, */
 /* IDL: [in] [unique(1)] KeySecurityAttribute *sec_attrib */
 /* IDL: ); */
 
@@ -3480,7 +3479,7 @@ winreg_dissect_element_SetKeySecurity_sd_(tvbuff_t *tvb _U_, int offset _U_, pac
 /* IDL: WERROR winreg_SetKeySecurity( */
 /* IDL: [ref] [in] policy_handle *handle, */
 /* IDL: [in] security_secinfo sec_info, */
-/* IDL: [in] [ref] KeySecurityData *sd */
+/* IDL: [ref] [in] KeySecurityData *sd */
 /* IDL: ); */
 
 static int
@@ -3578,7 +3577,7 @@ winreg_dissect_element_SetValue_size(tvbuff_t *tvb _U_, int offset _U_, packet_i
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] winreg_String name, */
 /* IDL: [in] winreg_Type type, */
-/* IDL: [size_is(size)] [ref] [in] uint8 *data, */
+/* IDL: [ref] [size_is(size)] [in] uint8 *data, */
 /* IDL: [in] uint32 size */
 /* IDL: ); */
 
@@ -3646,7 +3645,7 @@ winreg_dissect_element_UnLoadKey_subkey_(tvbuff_t *tvb _U_, int offset _U_, pack
 }
 
 /* IDL: WERROR winreg_UnLoadKey( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [ref] [in] winreg_String *subkey */
 /* IDL: ); */
 
@@ -3732,8 +3731,8 @@ winreg_dissect_element_InitiateSystemShutdown_do_reboot(tvbuff_t *tvb _U_, int o
 }
 
 /* IDL: WERROR winreg_InitiateSystemShutdown( */
-/* IDL: [unique(1)] [in] uint16 *hostname, */
-/* IDL: [in] [unique(1)] lsa_StringLarge *message, */
+/* IDL: [in] [unique(1)] uint16 *hostname, */
+/* IDL: [unique(1)] [in] lsa_StringLarge *message, */
 /* IDL: [in] uint32 timeout, */
 /* IDL: [in] uint8 force_apps, */
 /* IDL: [in] uint8 do_reboot */
@@ -3846,7 +3845,7 @@ winreg_dissect_element_GetVersion_version_(tvbuff_t *tvb _U_, int offset _U_, pa
 }
 
 /* IDL: WERROR winreg_GetVersion( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [ref] [out] uint32 *version */
 /* IDL: ); */
 
@@ -3919,7 +3918,7 @@ winreg_dissect_element_OpenHKCC_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 /* IDL: WERROR winreg_OpenHKCC( */
 /* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [out] [ref] policy_handle *handle */
+/* IDL: [ref] [out] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -3991,7 +3990,7 @@ winreg_dissect_element_OpenHKDD_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: WERROR winreg_OpenHKDD( */
-/* IDL: [in] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
 /* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
@@ -4138,11 +4137,11 @@ winreg_dissect_element_QueryMultipleValues_buffer_size_(tvbuff_t *tvb _U_, int o
 
 /* IDL: WERROR winreg_QueryMultipleValues( */
 /* IDL: [in] [ref] policy_handle *key_handle, */
-/* IDL: [length_is(num_values)] [size_is(num_values)] [ref] [in] QueryMultipleValue *values_in, */
-/* IDL: [ref] [length_is(num_values)] [size_is(num_values)] [out] QueryMultipleValue *values_out, */
+/* IDL: [in] [length_is(num_values)] [ref] [size_is(num_values)] QueryMultipleValue *values_in, */
+/* IDL: [size_is(num_values)] [length_is(num_values)] [out] [ref] QueryMultipleValue *values_out, */
 /* IDL: [in] uint32 num_values, */
-/* IDL: [size_is(*buffer_size)] [length_is(*buffer_size)] [out] [in] [unique(1)] uint8 *buffer, */
-/* IDL: [ref] [in] [out] uint32 *buffer_size */
+/* IDL: [length_is(*buffer_size)] [out] [size_is(*buffer_size)] [unique(1)] [in] uint8 *buffer, */
+/* IDL: [in] [out] [ref] uint32 *buffer_size */
 /* IDL: ); */
 
 static int
@@ -4251,7 +4250,7 @@ winreg_dissect_element_InitiateSystemShutdownEx_reason(tvbuff_t *tvb _U_, int of
 
 /* IDL: WERROR winreg_InitiateSystemShutdownEx( */
 /* IDL: [in] [unique(1)] uint16 *hostname, */
-/* IDL: [in] [unique(1)] lsa_StringLarge *message, */
+/* IDL: [unique(1)] [in] lsa_StringLarge *message, */
 /* IDL: [in] uint32 timeout, */
 /* IDL: [in] uint8 force_apps, */
 /* IDL: [in] uint8 do_reboot, */
@@ -4348,9 +4347,9 @@ winreg_dissect_element_SaveKeyEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet
 }
 
 /* IDL: WERROR winreg_SaveKeyEx( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [ref] [in] winreg_String *filename, */
-/* IDL: [in] [unique(1)] KeySecurityAttribute *sec_attrib, */
+/* IDL: [unique(1)] [in] KeySecurityAttribute *sec_attrib, */
 /* IDL: [in] uint32 flags */
 /* IDL: ); */
 
@@ -4498,9 +4497,9 @@ winreg_dissect_element_OpenHKPN_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: WERROR winreg_OpenHKPN( */
-/* IDL: [in] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -4660,12 +4659,12 @@ winreg_dissect_element_QueryMultipleValues2_needed_(tvbuff_t *tvb _U_, int offse
 }
 
 /* IDL: WERROR winreg_QueryMultipleValues2( */
-/* IDL: [ref] [in] policy_handle *key_handle, */
-/* IDL: [length_is(num_values)] [size_is(num_values)] [ref] [in] QueryMultipleValue *values_in, */
-/* IDL: [length_is(num_values)] [size_is(num_values)] [out] [ref] QueryMultipleValue *values_out, */
+/* IDL: [in] [ref] policy_handle *key_handle, */
+/* IDL: [size_is(num_values)] [ref] [length_is(num_values)] [in] QueryMultipleValue *values_in, */
+/* IDL: [size_is(num_values)] [length_is(num_values)] [ref] [out] QueryMultipleValue *values_out, */
 /* IDL: [in] uint32 num_values, */
-/* IDL: [length_is(*offered)] [size_is(*offered)] [out] [in] [unique(1)] uint8 *buffer, */
-/* IDL: [in] [ref] uint32 *offered, */
+/* IDL: [in] [unique(1)] [size_is(*offered)] [out] [length_is(*offered)] uint8 *buffer, */
+/* IDL: [ref] [in] uint32 *offered, */
 /* IDL: [out] [ref] uint32 *needed */
 /* IDL: ); */
 
@@ -4873,304 +4872,304 @@ static dcerpc_sub_dissector winreg_dissectors[] = {
 void proto_register_dcerpc_winreg(void)
 {
 	static hf_register_info hf[] = {
-	{ &hf_winreg_winreg_OpenKey_access_mask,
-	  { "Access Mask", "winreg.winreg_OpenKey.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_String_name,
-	  { "Name", "winreg.winreg_String.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdownEx_message,
+		{ "Message", "winreg.winreg_InitiateSystemShutdownEx.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_KeySecurityAttribute_data_size,
-	  { "Data Size", "winreg.KeySecurityAttribute.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_classname,
-	  { "Classname", "winreg.winreg_QueryInfoKey.classname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_buffer,
-	  { "Buffer", "winreg.winreg_QueryMultipleValues2.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_CREATE_LINK,
-	  { "Key Create Link", "winreg.winreg_AccessMask.KEY_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_LINK_tfs), ( 0x00020 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_buffer_size,
-	  { "Buffer Size", "winreg.winreg_QueryMultipleValues.buffer_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_secdesc,
-	  { "Secdesc", "winreg.winreg_CreateKey.secdesc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKeyEx_reserved,
-	  { "Reserved", "winreg.winreg_DeleteKeyEx.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_key_handle,
-	  { "Key Handle", "winreg.winreg_QueryMultipleValues.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_QueryMultipleValue_ve_valuename,
-	  { "Ve Valuename", "winreg.QueryMultipleValue.ve_valuename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY,
-	  { "Key Wow64 32key", "winreg.winreg_AccessMask.KEY_WOW64_32KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_32KEY_tfs), ( 0x00200 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS,
-	  { "Key Enumerate Sub Keys", "winreg.winreg_AccessMask.KEY_ENUMERATE_SUB_KEYS", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS_tfs), ( 0x00008 ), NULL, HFILL }},
-	{ &hf_winreg_QueryMultipleValue_ve_valueptr,
-	  { "Ve Valueptr", "winreg.QueryMultipleValue.ve_valueptr", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityData_data,
-	  { "Data", "winreg.KeySecurityData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES,
-	  { "Reg Notify Change Attributes", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_keyclass,
-	  { "Keyclass", "winreg.winreg_CreateKey.keyclass", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetValue_type,
-	  { "Type", "winreg.winreg_SetValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Data Size", "winreg.KeySecurityAttribute.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_system_name,
+		{ "System Name", "winreg.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK,
+		{ "Reg Option Open Link", "winreg.winreg_KeyOptions.REG_OPTION_OPEN_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_OPEN_LINK_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_SetValue_size,
+		{ "Size", "winreg.winreg_SetValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SecBuf_sd,
+		{ "Sd", "winreg.winreg_SecBuf.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_sd_offset,
-	  { "Offset", "winreg.sd.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_access_mask,
-	  { "Access Mask", "winreg.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_action_taken,
-	  { "Action Taken", "winreg.winreg_CreateKey.action_taken", FT_UINT32, BASE_DEC, VALS(winreg_winreg_CreateAction_vals), 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_ValNameBuf_length,
-	  { "Length", "winreg.winreg_ValNameBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_name,
-	  { "Name", "winreg.winreg_EnumValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_key_handle,
-	  { "Key Handle", "winreg.winreg_QueryMultipleValues2.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKey_handle,
-	  { "Handle", "winreg.winreg_SaveKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY,
-	  { "Key Create Sub Key", "winreg.winreg_AccessMask.KEY_CREATE_SUB_KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_SUB_KEY_tfs), ( 0x00004 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdownEx_reason,
-	  { "Reason", "winreg.winreg_InitiateSystemShutdownEx.reason", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_type,
-	  { "Type", "winreg.winreg_EnumValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_options,
-	  { "Options", "winreg.winreg_CreateKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryValue_type,
-	  { "Type", "winreg.winreg_QueryValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityAttribute_sec_data,
-	  { "Sec Data", "winreg.KeySecurityAttribute.sec_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityData_len,
-	  { "Len", "winreg.KeySecurityData.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_UnLoadKey_subkey,
-	  { "Subkey", "winreg.winreg_UnLoadKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Offset", "winreg.sd.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_RestoreKey_filename,
-	  { "Filename", "winreg.winreg_RestoreKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_max_valbufsize,
-	  { "Max Valbufsize", "winreg.winreg_QueryInfoKey.max_valbufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKeyEx_sec_attrib,
-	  { "Sec Attrib", "winreg.winreg_SaveKeyEx.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_QueryMultipleValue_ve_type,
-	  { "Ve Type", "winreg.QueryMultipleValue.ve_type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SecBuf_inherit,
-	  { "Inherit", "winreg.winreg_SecBuf.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKeyEx_access_mask,
-	  { "Access Mask", "winreg.winreg_DeleteKeyEx.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdownEx_message,
-	  { "Message", "winreg.winreg_InitiateSystemShutdownEx.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_length,
-	  { "Length", "winreg.winreg_EnumValue.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_max_classlen,
-	  { "Max Classlen", "winreg.winreg_QueryInfoKey.max_classlen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Filename", "winreg.winreg_RestoreKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree,
+		{ "Watch Subtree", "winreg.winreg_NotifyChangeKeyValue.watch_subtree", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_sd_max_size,
+		{ "Max Size", "winreg.sd.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME,
+		{ "Reg Notify Change Name", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_NAME", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_type,
+		{ "Type", "winreg.winreg_EnumValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_QueryValue_value_name,
-	  { "Value Name", "winreg.winreg_QueryValue.value_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK,
-	  { "Reg Option Create Link", "winreg.winreg_KeyOptions.REG_OPTION_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_CREATE_LINK_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_String_name_len,
-	  { "Name Len", "winreg.winreg_String.name_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_SET_VALUE,
-	  { "Key Set Value", "winreg.winreg_AccessMask.KEY_SET_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_SET_VALUE_tfs), ( 0x00002 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_value,
-	  { "Value", "winreg.winreg_EnumValue.value", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Value Name", "winreg.winreg_QueryValue.value_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_key_handle,
+		{ "Key Handle", "winreg.winreg_QueryMultipleValues.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKey_sec_attrib,
+		{ "Sec Attrib", "winreg.winreg_SaveKey.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_values_out,
+		{ "Values Out", "winreg.winreg_QueryMultipleValues.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_secdesc,
+		{ "Secdesc", "winreg.winreg_CreateKey.secdesc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdown_do_reboot,
+		{ "Do Reboot", "winreg.winreg_InitiateSystemShutdown.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_LoadKey_filename,
+		{ "Filename", "winreg.winreg_LoadKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_options,
+		{ "Options", "winreg.winreg_CreateKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdown_message,
+		{ "Message", "winreg.winreg_InitiateSystemShutdown.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_LoadKey_keyname,
+		{ "Keyname", "winreg.winreg_LoadKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKeyEx_handle,
+		{ "Handle", "winreg.winreg_SaveKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKeyEx_reserved,
+		{ "Reserved", "winreg.winreg_DeleteKeyEx.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_UnLoadKey_handle,
+		{ "Handle", "winreg.winreg_UnLoadKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_secdescsize,
+		{ "Secdescsize", "winreg.winreg_QueryInfoKey.secdescsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryValue_data_length,
+		{ "Data Length", "winreg.winreg_QueryValue.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityAttribute_inherit,
+		{ "Inherit", "winreg.KeySecurityAttribute.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_NOTIFY,
+		{ "Key Notify", "winreg.winreg_AccessMask.KEY_NOTIFY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_NOTIFY_tfs), ( 0x00010 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_ReplaceKey_handle,
+		{ "Handle", "winreg.winreg_ReplaceKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_max_valnamelen,
+		{ "Max Valnamelen", "winreg.winreg_QueryInfoKey.max_valnamelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_NotifyChangeKeyValue_string1,
-	  { "String1", "winreg.winreg_NotifyChangeKeyValue.string1", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_num_values,
-	  { "Num Values", "winreg.winreg_QueryInfoKey.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenHKCU_access_mask,
-	  { "Access Mask", "winreg.winreg_OpenHKCU.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_needed,
-	  { "Needed", "winreg.winreg_QueryMultipleValues2.needed", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_name,
-	  { "Name", "winreg.winreg_CreateKey.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "String1", "winreg.winreg_NotifyChangeKeyValue.string1", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY,
+		{ "Key Wow64 64key", "winreg.winreg_AccessMask.KEY_WOW64_64KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_64KEY_tfs), ( 0x00100 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY,
+		{ "Reg Notify Change Security", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_SECURITY", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_winreg_handle,
+		{ "Handle", "winreg.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY,
+		{ "Key Create Sub Key", "winreg.winreg_AccessMask.KEY_CREATE_SUB_KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_SUB_KEY_tfs), ( 0x00004 ), NULL, HFILL }},
+	{ &hf_winreg_werror,
+		{ "Windows Error", "winreg.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_classname,
+		{ "Classname", "winreg.winreg_QueryInfoKey.classname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_InitiateSystemShutdownEx_hostname,
-	  { "Hostname", "winreg.winreg_InitiateSystemShutdownEx.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_GetVersion_version,
-	  { "Version", "winreg.winreg_GetVersion.version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_values_in,
-	  { "Values In", "winreg.winreg_QueryMultipleValues.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdown_force_apps,
-	  { "Force Apps", "winreg.winreg_InitiateSystemShutdown.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_new_handle,
-	  { "New Handle", "winreg.winreg_CreateKey.new_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKeyEx_handle,
-	  { "Handle", "winreg.winreg_SaveKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE,
-	  { "Reg Force Restore", "winreg.winreg_RestoreKeyFlags.REG_FORCE_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_FORCE_RESTORE_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree,
-	  { "Watch Subtree", "winreg.winreg_NotifyChangeKeyValue.watch_subtree", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_num_values,
-	  { "Num Values", "winreg.winreg_QueryMultipleValues2.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKeyEx_handle,
-	  { "Handle", "winreg.winreg_DeleteKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_values_out,
-	  { "Values Out", "winreg.winreg_QueryMultipleValues.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_StringBuf_name,
-	  { "Name", "winreg.winreg_StringBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Hostname", "winreg.winreg_InitiateSystemShutdownEx.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumKey_last_changed_time,
+		{ "Last Changed Time", "winreg.winreg_EnumKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityData_data,
+		{ "Data", "winreg.KeySecurityData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenHKCU_access_mask,
+		{ "Access Mask", "winreg.winreg_OpenHKCU.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_buffer_size,
+		{ "Buffer Size", "winreg.winreg_QueryMultipleValues.buffer_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_num_values,
+		{ "Num Values", "winreg.winreg_QueryInfoKey.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_String_name_len,
+		{ "Name Len", "winreg.winreg_String.name_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_CREATE_LINK,
+		{ "Key Create Link", "winreg.winreg_AccessMask.KEY_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_LINK_tfs), ( 0x00020 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_AbortSystemShutdown_server,
+		{ "Server", "winreg.winreg_AbortSystemShutdown.server", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKey_handle,
+		{ "Handle", "winreg.winreg_SaveKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_OpenKey_keyname,
-	  { "Keyname", "winreg.winreg_OpenKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKeyEx_filename,
-	  { "Filename", "winreg.winreg_SaveKeyEx.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Keyname", "winreg.winreg_OpenKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityAttribute_sec_data,
+		{ "Sec Data", "winreg.KeySecurityAttribute.sec_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_opnum,
+		{ "Operation", "winreg.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_ReplaceKey_old_file,
-	  { "Old File", "winreg.winreg_ReplaceKey.old_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_last_changed_time,
-	  { "Last Changed Time", "winreg.winreg_QueryInfoKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumKey_last_changed_time,
-	  { "Last Changed Time", "winreg.winreg_EnumKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_LoadKey_filename,
-	  { "Filename", "winreg.winreg_LoadKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKey_filename,
-	  { "Filename", "winreg.winreg_SaveKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY,
-	  { "Key Wow64 64key", "winreg.winreg_AccessMask.KEY_WOW64_64KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_64KEY_tfs), ( 0x00100 ), NULL, HFILL }},
-	{ &hf_winreg_system_name,
-	  { "System Name", "winreg.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_ValNameBuf_size,
-	  { "Size", "winreg.winreg_ValNameBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryValue_data_size,
-	  { "Data Size", "winreg.winreg_QueryValue.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET,
-	  { "Reg Notify Change Last Set", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_LAST_SET", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_ReplaceKey_subkey,
-	  { "Subkey", "winreg.winreg_ReplaceKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_buffer,
-	  { "Buffer", "winreg.winreg_QueryMultipleValues.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKey_handle,
-	  { "Handle", "winreg.winreg_RestoreKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Old File", "winreg.winreg_ReplaceKey.old_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetValue_type,
+		{ "Type", "winreg.winreg_SetValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_ValNameBuf_length,
+		{ "Length", "winreg.winreg_ValNameBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdown_force_apps,
+		{ "Force Apps", "winreg.winreg_InitiateSystemShutdown.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_StringBuf_name,
+		{ "Name", "winreg.winreg_StringBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetValue_name,
+		{ "Name", "winreg.winreg_SetValue.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKeyEx_access_mask,
+		{ "Access Mask", "winreg.winreg_DeleteKeyEx.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_String_name_size,
+		{ "Name Size", "winreg.winreg_String.name_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityData_size,
+		{ "Size", "winreg.KeySecurityData.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot,
-	  { "Do Reboot", "winreg.winreg_InitiateSystemShutdownEx.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_max_subkeylen,
-	  { "Max Subkeylen", "winreg.winreg_QueryInfoKey.max_subkeylen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumKey_enum_index,
-	  { "Enum Index", "winreg.winreg_EnumKey.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE,
-	  { "Reg Option Backup Restore", "winreg.winreg_KeyOptions.REG_OPTION_BACKUP_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE,
-	  { "Key Query Value", "winreg.winreg_AccessMask.KEY_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_QUERY_VALUE_tfs), ( 0x00001 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_GetKeySecurity_sec_info,
-	  { "Sec Info", "winreg.winreg_GetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+		{ "Do Reboot", "winreg.winreg_InitiateSystemShutdownEx.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenHKPD_access_mask,
+		{ "Access Mask", "winreg.winreg_OpenHKPD.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_value,
+		{ "Value", "winreg.winreg_EnumValue.value", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_QueryMultipleValue_ve_valuelen,
+		{ "Ve Valuelen", "winreg.QueryMultipleValue.ve_valuelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_EnumValue_enum_index,
-	  { "Enum Index", "winreg.winreg_EnumValue.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumKey_name,
-	  { "Name", "winreg.winreg_EnumKey.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetValue_name,
-	  { "Name", "winreg.winreg_SetValue.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_num_subkeys,
-	  { "Num Subkeys", "winreg.winreg_QueryInfoKey.num_subkeys", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Enum Index", "winreg.winreg_EnumValue.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdownEx_force_apps,
+		{ "Force Apps", "winreg.winreg_InitiateSystemShutdownEx.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_key_handle,
+		{ "Key Handle", "winreg.winreg_QueryMultipleValues2.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKeyEx_sec_attrib,
+		{ "Sec Attrib", "winreg.winreg_SaveKeyEx.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeKeyValue_string2,
+		{ "String2", "winreg.winreg_NotifyChangeKeyValue.string2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_name,
+		{ "Name", "winreg.winreg_CreateKey.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_needed,
+		{ "Needed", "winreg.winreg_QueryMultipleValues2.needed", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_ReplaceKey_new_file,
-	  { "New File", "winreg.winreg_ReplaceKey.new_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKey_flags,
-	  { "Flags", "winreg.winreg_RestoreKey.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_LoadKey_keyname,
-	  { "Keyname", "winreg.winreg_LoadKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_NOTIFY,
-	  { "Key Notify", "winreg.winreg_AccessMask.KEY_NOTIFY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_NOTIFY_tfs), ( 0x00010 ), NULL, HFILL }},
+		{ "New File", "winreg.winreg_ReplaceKey.new_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE,
+		{ "Reg Refresh Hive", "winreg.winreg_RestoreKeyFlags.REG_REFRESH_HIVE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_REFRESH_HIVE_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_num_subkeys,
+		{ "Num Subkeys", "winreg.winreg_QueryInfoKey.num_subkeys", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteValue_value,
+		{ "Value", "winreg.winreg_DeleteValue.value", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumKey_enum_index,
+		{ "Enum Index", "winreg.winreg_EnumKey.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SecBuf_inherit,
+		{ "Inherit", "winreg.winreg_SecBuf.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenKey_options,
+		{ "Options", "winreg.winreg_OpenKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKeyEx_key,
+		{ "Key", "winreg.winreg_DeleteKeyEx.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_QueryMultipleValues2_values_in,
-	  { "Values In", "winreg.winreg_QueryMultipleValues2.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Values In", "winreg.winreg_QueryMultipleValues2.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_QueryMultipleValue_ve_valuename,
+		{ "Ve Valuename", "winreg.QueryMultipleValue.ve_valuename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_ValNameBuf_name,
+		{ "Name", "winreg.winreg_ValNameBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_UnLoadKey_subkey,
+		{ "Subkey", "winreg.winreg_UnLoadKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKey_filename,
+		{ "Filename", "winreg.winreg_SaveKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_offered,
+		{ "Offered", "winreg.winreg_QueryMultipleValues2.offered", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_QueryMultipleValue_ve_type,
+		{ "Ve Type", "winreg.QueryMultipleValue.ve_type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_max_subkeylen,
+		{ "Max Subkeylen", "winreg.winreg_QueryInfoKey.max_subkeylen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKeyEx_handle,
+		{ "Handle", "winreg.winreg_DeleteKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK,
+		{ "Reg Option Create Link", "winreg.winreg_KeyOptions.REG_OPTION_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_CREATE_LINK_tfs), ( 0x00000002 ), NULL, HFILL }},
 	{ &hf_winreg_winreg_InitiateSystemShutdownEx_timeout,
-	  { "Timeout", "winreg.winreg_InitiateSystemShutdownEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_sd,
-	  { "KeySecurityData", "winreg.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Timeout", "winreg.winreg_InitiateSystemShutdownEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_action_taken,
+		{ "Action Taken", "winreg.winreg_CreateKey.action_taken", FT_UINT32, BASE_DEC, VALS(winreg_winreg_CreateAction_vals), 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_StringBuf_size,
-	  { "Size", "winreg.winreg_StringBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE,
-	  { "Reg Refresh Hive", "winreg.winreg_RestoreKeyFlags.REG_REFRESH_HIVE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_REFRESH_HIVE_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeKeyValue_notify_filter,
-	  { "Notify Filter", "winreg.winreg_NotifyChangeKeyValue.notify_filter", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AbortSystemShutdown_server,
-	  { "Server", "winreg.winreg_AbortSystemShutdown.server", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_ReplaceKey_handle,
-	  { "Handle", "winreg.winreg_ReplaceKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Size", "winreg.winreg_StringBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_buffer,
+		{ "Buffer", "winreg.winreg_QueryMultipleValues.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_GetVersion_version,
+		{ "Version", "winreg.winreg_GetVersion.version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_DeleteKey_key,
-	  { "Key", "winreg.winreg_DeleteKey.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SecBuf_sd,
-	  { "Sd", "winreg.winreg_SecBuf.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_opnum,
-	  { "Operation", "winreg.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetValue_size,
-	  { "Size", "winreg.winreg_SetValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY,
-	  { "Reg Notify Change Security", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_SECURITY", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_winreg_QueryMultipleValue_ve_valuelen,
-	  { "Ve Valuelen", "winreg.QueryMultipleValue.ve_valuelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityData_size,
-	  { "Size", "winreg.KeySecurityData.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_ValNameBuf_name,
-	  { "Name", "winreg.winreg_ValNameBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenKey_options,
-	  { "Options", "winreg.winreg_OpenKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SecBuf_length,
-	  { "Length", "winreg.winreg_SecBuf.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeKeyValue_string2,
-	  { "String2", "winreg.winreg_NotifyChangeKeyValue.string2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_werror,
-	  { "Windows Error", "winreg.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_values_out,
-	  { "Values Out", "winreg.winreg_QueryMultipleValues2.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryValue_data,
-	  { "Data", "winreg.winreg_QueryValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenKey_parent_handle,
-	  { "Parent Handle", "winreg.winreg_OpenKey.parent_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Key", "winreg.winreg_DeleteKey.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE,
+		{ "Key Query Value", "winreg.winreg_AccessMask.KEY_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_QUERY_VALUE_tfs), ( 0x00001 ), NULL, HFILL }},
 	{ &hf_winreg_winreg_NotifyChangeKeyValue_unknown,
-	  { "Unknown", "winreg.winreg_NotifyChangeKeyValue.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown", "winreg.winreg_NotifyChangeKeyValue.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH,
+		{ "Reg No Lazy Flush", "winreg.winreg_RestoreKeyFlags.REG_NO_LAZY_FLUSH", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_GetKeySecurity_sec_info,
+		{ "Sec Info", "winreg.winreg_GetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE,
+		{ "Reg Option Backup Restore", "winreg.winreg_KeyOptions.REG_OPTION_BACKUP_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS,
+		{ "Key Enumerate Sub Keys", "winreg.winreg_AccessMask.KEY_ENUMERATE_SUB_KEYS", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS_tfs), ( 0x00008 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_keyclass,
+		{ "Keyclass", "winreg.winreg_CreateKey.keyclass", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetKeySecurity_sec_info,
+		{ "Sec Info", "winreg.winreg_SetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_name,
+		{ "Name", "winreg.winreg_EnumValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_num_values,
+		{ "Num Values", "winreg.winreg_QueryMultipleValues2.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_InitiateSystemShutdown_hostname,
-	  { "Hostname", "winreg.winreg_InitiateSystemShutdown.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_num_values,
-	  { "Num Values", "winreg.winreg_QueryMultipleValues.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityAttribute_inherit,
-	  { "Inherit", "winreg.KeySecurityAttribute.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME,
-	  { "Reg Notify Change Name", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_NAME", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_size,
-	  { "Size", "winreg.winreg_EnumValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Hostname", "winreg.winreg_InitiateSystemShutdown.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryValue_data,
+		{ "Data", "winreg.winreg_QueryValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_buffer,
+		{ "Buffer", "winreg.winreg_QueryMultipleValues2.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_QueryMultipleValue_ve_valueptr,
+		{ "Ve Valueptr", "winreg.QueryMultipleValue.ve_valueptr", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY,
+		{ "Key Wow64 32key", "winreg.winreg_AccessMask.KEY_WOW64_32KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_32KEY_tfs), ( 0x00200 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_length,
+		{ "Length", "winreg.winreg_EnumValue.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE,
-	  { "Reg Whole Hive Volatile", "winreg.winreg_RestoreKeyFlags.REG_WHOLE_HIVE_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_UnLoadKey_handle,
-	  { "Handle", "winreg.winreg_UnLoadKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_String_name_size,
-	  { "Name Size", "winreg.winreg_String.name_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryValue_data_length,
-	  { "Data Length", "winreg.winreg_QueryValue.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH,
-	  { "Reg No Lazy Flush", "winreg.winreg_RestoreKeyFlags.REG_NO_LAZY_FLUSH", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenHKPD_access_mask,
-	  { "Access Mask", "winreg.winreg_OpenHKPD.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_secdescsize,
-	  { "Secdescsize", "winreg.winreg_QueryInfoKey.secdescsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_handle,
-	  { "Handle", "winreg.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdown_do_reboot,
-	  { "Do Reboot", "winreg.winreg_InitiateSystemShutdown.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumKey_keyclass,
-	  { "Keyclass", "winreg.winreg_EnumKey.keyclass", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Reg Whole Hive Volatile", "winreg.winreg_RestoreKeyFlags.REG_WHOLE_HIVE_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE,
+		{ "Reg Option Volatile", "winreg.winreg_KeyOptions.REG_OPTION_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenKey_access_mask,
+		{ "Access Mask", "winreg.winreg_OpenKey.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES,
+		{ "Reg Notify Change Attributes", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_num_values,
+		{ "Num Values", "winreg.winreg_QueryMultipleValues.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKey_handle,
+		{ "Handle", "winreg.winreg_RestoreKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_NotifyChangeKeyValue_unknown2,
-	  { "Unknown2", "winreg.winreg_NotifyChangeKeyValue.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdown_timeout,
-	  { "Timeout", "winreg.winreg_InitiateSystemShutdown.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_StringBuf_length,
-	  { "Length", "winreg.winreg_StringBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_sd_max_size,
-	  { "Max Size", "winreg.sd.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_max_valnamelen,
-	  { "Max Valnamelen", "winreg.winreg_QueryInfoKey.max_valnamelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdown_message,
-	  { "Message", "winreg.winreg_InitiateSystemShutdown.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetKeySecurity_sec_info,
-	  { "Sec Info", "winreg.winreg_SetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetValue_data,
-	  { "Data", "winreg.winreg_SetValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKey_sec_attrib,
-	  { "Sec Attrib", "winreg.winreg_SaveKey.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK,
-	  { "Reg Option Open Link", "winreg.winreg_KeyOptions.REG_OPTION_OPEN_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_OPEN_LINK_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_offered,
-	  { "Offered", "winreg.winreg_QueryMultipleValues2.offered", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Unknown2", "winreg.winreg_NotifyChangeKeyValue.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryValue_data_size,
+		{ "Data Size", "winreg.winreg_QueryValue.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_values_out,
+		{ "Values Out", "winreg.winreg_QueryMultipleValues2.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_max_classlen,
+		{ "Max Classlen", "winreg.winreg_QueryInfoKey.max_classlen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_new_handle,
+		{ "New Handle", "winreg.winreg_CreateKey.new_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_access_mask,
+		{ "Access Mask", "winreg.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SecBuf_length,
+		{ "Length", "winreg.winreg_SecBuf.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeKeyValue_notify_filter,
+		{ "Notify Filter", "winreg.winreg_NotifyChangeKeyValue.notify_filter", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_SaveKeyEx_flags,
-	  { "Flags", "winreg.winreg_SaveKeyEx.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteValue_value,
-	  { "Value", "winreg.winreg_DeleteValue.value", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE,
-	  { "Reg Option Volatile", "winreg.winreg_KeyOptions.REG_OPTION_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdownEx_force_apps,
-	  { "Force Apps", "winreg.winreg_InitiateSystemShutdownEx.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKeyEx_key,
-	  { "Key", "winreg.winreg_DeleteKeyEx.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+		{ "Flags", "winreg.winreg_SaveKeyEx.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_ReplaceKey_subkey,
+		{ "Subkey", "winreg.winreg_ReplaceKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdownEx_reason,
+		{ "Reason", "winreg.winreg_InitiateSystemShutdownEx.reason", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_values_in,
+		{ "Values In", "winreg.winreg_QueryMultipleValues.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetValue_data,
+		{ "Data", "winreg.winreg_SetValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_size,
+		{ "Size", "winreg.winreg_EnumValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKeyEx_filename,
+		{ "Filename", "winreg.winreg_SaveKeyEx.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_StringBuf_length,
+		{ "Length", "winreg.winreg_StringBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenKey_parent_handle,
+		{ "Parent Handle", "winreg.winreg_OpenKey.parent_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_sd_actual_size,
-	  { "Actual Size", "winreg.sd.actual_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Actual Size", "winreg.sd.actual_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumKey_name,
+		{ "Name", "winreg.winreg_EnumKey.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_max_valbufsize,
+		{ "Max Valbufsize", "winreg.winreg_QueryInfoKey.max_valbufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKey_flags,
+		{ "Flags", "winreg.winreg_RestoreKey.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumKey_keyclass,
+		{ "Keyclass", "winreg.winreg_EnumKey.keyclass", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE,
+		{ "Reg Force Restore", "winreg.winreg_RestoreKeyFlags.REG_FORCE_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_FORCE_RESTORE_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryValue_type,
+		{ "Type", "winreg.winreg_QueryValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityData_len,
+		{ "Len", "winreg.KeySecurityData.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_String_name,
+		{ "Name", "winreg.winreg_String.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_sd,
+		{ "KeySecurityData", "winreg.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_last_changed_time,
+		{ "Last Changed Time", "winreg.winreg_QueryInfoKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET,
+		{ "Reg Notify Change Last Set", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_LAST_SET", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_SET_VALUE,
+		{ "Key Set Value", "winreg.winreg_AccessMask.KEY_SET_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_SET_VALUE_tfs), ( 0x00002 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_ValNameBuf_size,
+		{ "Size", "winreg.winreg_ValNameBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdown_timeout,
+		{ "Timeout", "winreg.winreg_InitiateSystemShutdown.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc-wkssvc.c b/epan/dissectors/packet-dcerpc-wkssvc.c
index e23c0faed7..0ae6af917a 100644
--- a/epan/dissectors/packet-dcerpc-wkssvc.c
+++ b/epan/dissectors/packet-dcerpc-wkssvc.c
@@ -1142,8 +1142,7 @@ cnf_dissect_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree
 	old_offset = offset;
 	hf_info=proto_registrar_get_nth(hfindex);
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, 0, "%s: ", hf_info->name);
-		tree = proto_item_add_subtree(item, ett_wkssvc_lsa_String);
+		tree = proto_tree_add_subtree_format(parent_tree, tvb, offset, 0, ett_wkssvc_lsa_String, &item, "%s: ", hf_info->name);
 	}
 	
 	offset = wkssvc_dissect_element_lsa_String_name_len(tvb, offset, pinfo, tree, di, drep);
@@ -3819,8 +3818,7 @@ wkssvc_dissect_NetWkstaInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinf
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "wkssvc_NetWkstaInfo");
-		tree = proto_item_add_subtree(item, ett_wkssvc_wkssvc_NetWkstaInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_wkssvc_wkssvc_NetWkstaInfo, &item, "wkssvc_NetWkstaInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -4316,8 +4314,7 @@ wkssvc_dissect_NetWkstaEnumUsersCtr(tvbuff_t *tvb _U_, int offset _U_, packet_in
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "wkssvc_NetWkstaEnumUsersCtr");
-		tree = proto_item_add_subtree(item, ett_wkssvc_wkssvc_NetWkstaEnumUsersCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_wkssvc_wkssvc_NetWkstaEnumUsersCtr, &item, "wkssvc_NetWkstaEnumUsersCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -4497,8 +4494,7 @@ wkssvc_dissect_NetrWkstaUserInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "wkssvc_NetrWkstaUserInfo");
-		tree = proto_item_add_subtree(item, ett_wkssvc_wkssvc_NetrWkstaUserInfo);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_wkssvc_wkssvc_NetrWkstaUserInfo, &item, "wkssvc_NetrWkstaUserInfo");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -4719,8 +4715,7 @@ wkssvc_dissect_NetWkstaTransportCtr(tvbuff_t *tvb _U_, int offset _U_, packet_in
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "wkssvc_NetWkstaTransportCtr");
-		tree = proto_item_add_subtree(item, ett_wkssvc_wkssvc_NetWkstaTransportCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_wkssvc_wkssvc_NetWkstaTransportCtr, &item, "wkssvc_NetWkstaTransportCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -5321,8 +5316,7 @@ wkssvc_dissect_NetrUseGetInfoCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "wkssvc_NetrUseGetInfoCtr");
-		tree = proto_item_add_subtree(item, ett_wkssvc_wkssvc_NetrUseGetInfoCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_wkssvc_wkssvc_NetrUseGetInfoCtr, &item, "wkssvc_NetrUseGetInfoCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
@@ -5606,8 +5600,7 @@ wkssvc_dissect_NetrUseEnumCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pi
 
 	old_offset = offset;
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, -1, "wkssvc_NetrUseEnumCtr");
-		tree = proto_item_add_subtree(item, ett_wkssvc_wkssvc_NetrUseEnumCtr);
+		tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_wkssvc_wkssvc_NetrUseEnumCtr, &item, "wkssvc_NetrUseEnumCtr");
 	}
 
 	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &level);
diff --git a/epan/dissectors/packet-dcerpc-wzcsvc.c b/epan/dissectors/packet-dcerpc-wzcsvc.c
index cf14205138..93eb84de17 100644
--- a/epan/dissectors/packet-dcerpc-wzcsvc.c
+++ b/epan/dissectors/packet-dcerpc-wzcsvc.c
@@ -413,7 +413,7 @@ void proto_register_dcerpc_wzcsvc(void)
 {
 	static hf_register_info hf[] = {
 	{ &hf_wzcsvc_opnum,
-	  { "Operation", "wzcsvc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+		{ "Operation", "wzcsvc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	};
 
 
diff --git a/epan/dissectors/packet-dcerpc.c b/epan/dissectors/packet-dcerpc.c
index 15c9fd983f..1ae895c64a 100644
--- a/epan/dissectors/packet-dcerpc.c
+++ b/epan/dissectors/packet-dcerpc.c
@@ -1964,9 +1964,8 @@ dissect_ndr_cvstring(tvbuff_t *tvb, int offset, packet_info *pinfo,
     }
 
     if (add_subtree) {
-        string_item = proto_tree_add_text(tree, tvb, offset, -1, "%s",
+        string_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_dcerpc_string, &string_item,
                                           proto_registrar_get_name(hfindex));
-        string_tree = proto_item_add_subtree(string_item, ett_dcerpc_string);
     } else {
         string_item = NULL;
         string_tree = tree;
@@ -2150,9 +2149,8 @@ dissect_ndr_vstring(tvbuff_t *tvb, int offset, packet_info *pinfo,
     }
 
     if (add_subtree) {
-        string_item = proto_tree_add_text(tree, tvb, offset, -1, "%s",
+        string_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_dcerpc_string, &string_item,
                                           proto_registrar_get_name(hfindex));
-        string_tree = proto_item_add_subtree(string_item, ett_dcerpc_string);
     } else {
         string_item = NULL;
         string_tree = tree;
@@ -2499,9 +2497,8 @@ dissect_ndr_pointer_cb(tvbuff_t *tvb, gint offset, packet_info *pinfo,
         proto_item *item;
 
         /* we must find out a nice way to do the length here */
-        item = proto_tree_add_text(tree, tvb, offset, 0,
-                                   "%s", text);
-        tr = proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+        tr = proto_tree_add_subtree(tree, tvb, offset, 0,
+                                   ett_dcerpc_pointer_data, &item, text);
 
         add_pointer_to_list(pinfo, tr, item, di, fnct, 0xffffffff,
                             hf_index, callback, callback_args);
@@ -2541,10 +2538,8 @@ dissect_ndr_pointer_cb(tvbuff_t *tvb, gint offset, packet_info *pinfo,
         }
 
         /* new pointer */
-        item = proto_tree_add_text(tree, tvb, offset-pointer_size,
-                                   pointer_size,
-                                   "%s", text);
-        tr = proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+        tr = proto_tree_add_subtree(tree, tvb, offset-pointer_size,
+                                   pointer_size, ett_dcerpc_pointer_data, &item, text);
         if (di->call_data->flags & DCERPC_IS_NDR64) {
             proto_tree_add_uint64(tr, hf_dcerpc_referent_id64, tvb,
                                 offset-pointer_size, pointer_size, id);
@@ -2575,10 +2570,9 @@ dissect_ndr_pointer_cb(tvbuff_t *tvb, gint offset, packet_info *pinfo,
         }
 
         /* new pointer */
-        item = proto_tree_add_text(tree, tvb, offset-pointer_size,
+        tr = proto_tree_add_subtree(tree, tvb, offset-pointer_size,
                                    pointer_size,
-                                   "%s", text);
-        tr = proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+                                   ett_dcerpc_pointer_data, &item, text);
         if (di->call_data->flags & DCERPC_IS_NDR64) {
             proto_tree_add_uint64(tr, hf_dcerpc_referent_id64, tvb,
                             offset-pointer_size, pointer_size, id);
@@ -2602,10 +2596,9 @@ dissect_ndr_pointer_cb(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 
         tvb_ensure_bytes_exist(tvb, offset-pointer_size, pointer_size);
         /* new pointer */
-        item = proto_tree_add_text(tree, tvb, offset-pointer_size,
+        tr = proto_tree_add_subtree(tree, tvb, offset-pointer_size,
                                  pointer_size,
-                                 "%s",text);
-        tr = proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+                                 ett_dcerpc_pointer_data,&item,text);
         if (di->call_data->flags & DCERPC_IS_NDR64) {
             proto_tree_add_uint64(tr, hf_dcerpc_referent_id64, tvb,
                             offset-pointer_size, pointer_size, id);
@@ -2637,10 +2630,9 @@ dissect_ndr_pointer_cb(tvbuff_t *tvb, gint offset, packet_info *pinfo,
         }
 
         /* new pointer */
-        item = proto_tree_add_text(tree, tvb, offset-pointer_size,
+        tr = proto_tree_add_subtree(tree, tvb, offset-pointer_size,
                                    pointer_size,
-                                   "%s",text);
-        tr = proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+                                   ett_dcerpc_pointer_data,&item,text);
         if (di->call_data->flags & DCERPC_IS_NDR64) {
             proto_tree_add_uint64(tr, hf_dcerpc_referent_id64, tvb,
                             offset-pointer_size, pointer_size, id);
@@ -2686,10 +2678,9 @@ dissect_ndr_pointer_cb(tvbuff_t *tvb, gint offset, packet_info *pinfo,
         }
 
         /* new pointer */
-        item = proto_tree_add_text(tree, tvb, offset-pointer_size,
+        tr = proto_tree_add_subtree(tree, tvb, offset-pointer_size,
                                    pointer_size,
-                                   "%s", text);
-        tr = proto_item_add_subtree(item,ett_dcerpc_pointer_data);
+                                   ett_dcerpc_pointer_data, &item, text);
         if (di->call_data->flags & DCERPC_IS_NDR64) {
             proto_tree_add_uint64(tr, hf_dcerpc_referent_id64, tvb,
                             offset-pointer_size, pointer_size, id);
@@ -3477,8 +3468,7 @@ dissect_dcerpc_cn_bind_ack(tvbuff_t *tvb, gint offset, packet_info *pinfo,
         proto_item *ctx_item = NULL;
 
         if (dcerpc_tree) {
-            ctx_item = proto_tree_add_text(dcerpc_tree, tvb, offset, 24, "Ctx Item[%u]:", i+1);
-            ctx_tree = proto_item_add_subtree(ctx_item, ett_dcerpc_cn_ctx);
+            ctx_tree = proto_tree_add_subtree_format(dcerpc_tree, tvb, offset, 24, ett_dcerpc_cn_ctx, &ctx_item, "Ctx Item[%u]:", i+1);
         }
 
         offset = dissect_dcerpc_uint16(tvb, offset, pinfo, ctx_tree,
@@ -4407,8 +4397,7 @@ dissect_dcerpc_cn_rts(tvbuff_t *tvb, gint offset, packet_info *pinfo,
                                    hf_dcerpc_cn_rts_commands_nb, &commands_nb);
 
     /* Create the RTS PDU tree - we do not yet know its name */
-    tf = proto_tree_add_text(dcerpc_tree, tvb, offset, tvb_length_remaining(tvb, offset), "RTS PDU: %u commands", commands_nb);
-    cn_rts_pdu_tree = proto_item_add_subtree(tf, ett_dcerpc_cn_rts_pdu);
+    cn_rts_pdu_tree = proto_tree_add_subtree_format(dcerpc_tree, tvb, offset, -1, ett_dcerpc_cn_rts_pdu, &tf, "RTS PDU: %u commands", commands_nb);
 
     cmd = (guint32 *)wmem_alloc(wmem_packet_scope(), sizeof (guint32) * (commands_nb + 1));
 
@@ -5114,7 +5103,6 @@ static void
 dissect_dcerpc_dg_auth(tvbuff_t *tvb, int offset, proto_tree *dcerpc_tree,
                        e_dce_dg_common_hdr_t *hdr, int *auth_level_p)
 {
-    proto_item *ti        = NULL;
     proto_tree *auth_tree = NULL;
     guint8      protection_level;
 
@@ -5138,8 +5126,7 @@ dissect_dcerpc_dg_auth(tvbuff_t *tvb, int offset, proto_tree *dcerpc_tree,
         switch (hdr->auth_proto) {
 
         case DCE_C_RPC_AUTHN_PROTOCOL_KRB5:
-            ti = proto_tree_add_text(dcerpc_tree, tvb, offset, -1, "Kerberos authentication verifier");
-            auth_tree = proto_item_add_subtree(ti, ett_dcerpc_krb5_auth_verf);
+            auth_tree = proto_tree_add_subtree(dcerpc_tree, tvb, offset, -1, ett_dcerpc_krb5_auth_verf, NULL, "Kerberos authentication verifier");
             protection_level = tvb_get_guint8(tvb, offset);
             if (auth_level_p != NULL)
                 *auth_level_p = protection_level;
diff --git a/epan/dissectors/pidl/mapi/mapi.cnf b/epan/dissectors/pidl/mapi/mapi.cnf
index fb7c24bc3c..78f2190b52 100644
--- a/epan/dissectors/pidl/mapi/mapi.cnf
+++ b/epan/dissectors/pidl/mapi/mapi.cnf
@@ -89,15 +89,13 @@ static int mapi_dissect_element_request_handles_cnf(tvbuff_t *tvb _U_, int offse
 	gint		handles_cnt = 0;
 	int		old_offset;
 	guint32		value;
-	proto_item	*it = NULL;
-	proto_tree	*tr = NULL;
+	proto_tree	*tr;
 
 	reported_len = tvb_reported_length_remaining(tvb, offset);
 
 	handles_cnt = reported_len / 4;
 
-	it = proto_tree_add_text(tree, tvb, offset, reported_len, "MAPI Handles: %d", handles_cnt);
-	tr = proto_item_add_subtree(it, ett_mapi_mapi_request);
+	tr = proto_tree_add_subtree_format(tree, tvb, offset, reported_len, ett_mapi_mapi_request, NULL, "MAPI Handles: %d", handles_cnt);
 
 	for (i = 0; i < handles_cnt; i++) {
 	    old_offset = offset;
diff --git a/epan/dissectors/pidl/winreg.cnf b/epan/dissectors/pidl/winreg.cnf
index 622597e0ab..a4d89d77d2 100644
--- a/epan/dissectors/pidl/winreg.cnf
+++ b/epan/dissectors/pidl/winreg.cnf
@@ -212,8 +212,7 @@ cnf_dissect_winreg_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_t
 	hf_info=proto_registrar_get_nth(hfindex);
 
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, 0, "%s: ", hf_info->name);
-		tree = proto_item_add_subtree(item, ett_winreg_winreg_String);
+		tree = proto_tree_add_subtree_format(parent_tree, tvb, offset, 0, ett_winreg_winreg_String, &item, "%s: ", hf_info->name);
 	}
 	
 	offset = winreg_dissect_element_String_name_len(tvb, offset, pinfo, tree, di, drep);
diff --git a/epan/dissectors/pidl/wkssvc.cnf b/epan/dissectors/pidl/wkssvc.cnf
index 556230871b..d71519de77 100644
--- a/epan/dissectors/pidl/wkssvc.cnf
+++ b/epan/dissectors/pidl/wkssvc.cnf
@@ -59,8 +59,7 @@ cnf_dissect_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree
 	hf_info=proto_registrar_get_nth(hfindex);
 
 	if (parent_tree) {
-		item = proto_tree_add_text(parent_tree, tvb, offset, 0, "%s: ", hf_info->name);
-		tree = proto_item_add_subtree(item, ett_wkssvc_lsa_String);
+		tree = proto_tree_add_subtree_format(parent_tree, tvb, offset, 0, ett_wkssvc_lsa_String, &item, "%s: ", hf_info->name);
 	}
 	
 	offset = wkssvc_dissect_element_lsa_String_name_len(tvb, offset, pinfo, tree, di, drep);