Geoff Chappell, Software Analyst
The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the NTLSA.H header at
and draws from it the type definitions that are tabulated below.
Nowadays, NTLSA.H is among the headers in the Software Development Kit (SDK) for Windows 10. It is there in the “um” subdirectory with many other headers that are intended only for user-mode programming. Before the SDK for Windows 8, it is instead in the Windows Driver Kit (WDK). It dates from WIndows Vista. Much of its content has earlier history back to at least the DDK for Windows NT 3.51 but in a header named NTSECAPI.H.