EN
此内容没有您的语言版本,但有英语版本。

SetLaunchSecurityDescriptor method of the Win32_DCOMApplicationSetting class

The SetLaunchSecurityDescriptor method updates the launch security descriptor of the DCOM application with a new security descriptor that is defined by an instance of a Win32_SecurityDescriptor class. This security descriptor controls who is allowed to launch the application. The account running the script or application that calls this method must have the SeSecurityPrivilege and SeRestorePrivilege privileges. For more information, see Changing Access Security on Securable Objects.

Syntax


uint32 SetLaunchSecurityDescriptor(
  [in]  Win32_SecurityDescriptor Descriptor
);

Parameters

Descriptor [in]

The security descriptor to set that controls who can start the DCOM application.

Return value

Return codeDescription
0

Successful completion.

2

The user does not have access to the requested information.

8

Unknown failure.

9

The user does not have adequate privileges to execute the method.

21

A parameter specified in the method call is not valid.

 

Remarks

The Win32_SecurityDescriptor instance represents a SECURITY_DESCRIPTOR_CONTROL data type and contains a discretionary access control list (DACL) and a system access control list (SACL). For more information, see Access Control Lists.

If the SeSecurityPrivilege is not granted or enabled when getting a security descriptor, then only the DACL is returned in the returned security descriptor. For more information, see Privilege Constants and Executing Privileged Operations.

You can update both the DACL and the SACL in the Win32_SecurityDescriptor instance when calling this method, but you also can update only the DACL or only the SACL.

The following values in SECURITY_DESCRIPTOR_CONTROL determine whether the DACL, the SACL, or both are updated.

  • SE_DACL_PRESENT

    Indicates that the DACL should be updated. If this is not set, then WMI preserves the original value of the DACL.

  • SE_SACL_PRESENT

    Indicates that the SACL should be updated. If this is not set, then WMI preserves the original value of the SACL. To update the SACL, the account must have the SeSecurityPrivilege privilege enabled. For scripting, the privilege name is SeSecurityPrivilege. For more information, see Privilege Constants.

If the Group trustee and the Owner trustee properties are not NULL, then they are updated. Otherwise, WMI preserves the original values. For more information, see WMI Security Descriptor Objects.

When a new SACL is NULL in a call to this method, then the security descriptor SACL on the target securable object is left unchanged.

Requirements

Minimum supported client

Windows Vista

Minimum supported server

Windows Server 2008

Namespace

\root\CIMV2

MOF

CIMWin32.mof

DLL

CIMWin32.dll

See also

Win32_DCOMApplicationSetting
Privilege Constants
WMI Security Descriptor Objects
Changing Access Security on Securable Objects

 

 

显示:
© 2014 Microsoft