Geoff Chappell, Software Analyst
The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the EVNTPROV.H header at
and draws from it the following type definitions:
A header named EVNTPROV.H is among the headers in the publicly available Windows Driver Kit (WDK) for Windows 10. It is there in the “shared” subdirectory with many other headers that are intended for use in both kernel-mode and user-mode programming.