For both XP and 7? Have you confirmed which version you're receiving between the two? EVENT_TRACE.EVENT_TRACE_HEADER.wVersion?

Also, when you say " Sid is located at offset endBuffer(20) in 64 bit and endBuffer(8) in 32 bit."

Is this *after* accounting for the different structures? I.e. none of the 12 byte difference is explained the 8 bytes difference between UniqueProcessKey and DirectoryTableBase? Because it would at least make some sense if that's not true... then one of the possibilities I mentioned... there's both a TOKEN_USER with PSID, immediately followed by a SID-- that would explain it, because with the PSID, you'd have 3 pointers... UniqueProcessKey+DirectTableBase+PSID.