http://bugs.winehq.org/show_bug.cgi?id=16418
--- Comment #9 from Louis Lenders xerox_xerox2000@yahoo.co.uk 2008-12-11 10:19:18 --- (In reply to comment #9)
I did a bit of testing on XP and seems like ReferencedDomains[0].Entries = 1 indeed, but ReferencedDomains[0].Domains->Name.Buffer resolves to nothing.
Further Names[0].Name.Buffer resolves to "INTERACTIVE", and Names[0].Use = SidTypeWellKnownGroup;
It then continues to LsaLookupNames. From test on xp seems ReferencedDomains[0].Domains->Name.Buffer should resolve to "NT AUTHORITY", but somehow it keeps crashing with access violations when i hack that in. Maybe i'm doing something wrong.