The RPC_SID structure is used by methods that write events.

 typedef struct _RPC_SID {
   unsigned char Revision;
   unsigned char SubAuthorityCount;
   RPC_SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
   [size_is(SubAuthorityCount)] unsigned long SubAuthority[*];
 } RPC_SID,
  *PRPC_SID;

Revision: This member is specified in [MS-DTYP] section 2.4.2.

SubAuthorityCount: This member is specified in [MS-DTYP] section 2.4.2.

IdentifierAuthority: This member is specified in [MS-DTYP] section 2.4.2.

SubAuthority: This member is specified in [MS-DTYP] section 2.4.2.

The fields in this structure exactly correspond to the fields in the SID structure, which defines a security identifier (SID)—a variable-length byte array that uniquely identifies a security principal—as specified in [MS-DTYP] section 2.4.2.