in sam_account_info_info, rpc_netlogon.h the field uint32 dw_reserved[4] contains the lockout_time field the first two are NTTIME lockout_time, but in reverse order high is low low is high :) -- Richard Renard <rrenard at idealx.com>