Export (0) Print
Expand All
Expand Minimize

GetAuditedPermissionsFromAcl function

The GetAuditedPermissionsFromAcl function retrieves the audited access rights for a specified trustee. The audited rights are based on the access control entries (ACEs) of a specified access control list (ACL). The audited access rights indicate the types of access attempts that cause the system to generate an audit record in the system event log. The audited rights include those that the ACL specifies for the trustee or for any groups of which the trustee is a member. In determining the audited rights, the function does not consider the security privileges held by the trustee.

Syntax


DWORD WINAPI GetAuditedPermissionsFromAcl(
  _In_   PACL pacl,
  _In_   PTRUSTEE pTrustee,
  _Out_  PACCESS_MASK pSuccessfulAuditedRights,
  _Out_  PACCESS_MASK pFailedAuditRights
);

Parameters

pacl [in]

A pointer to an ACL structure from which to get the trustee's audited access rights.

pTrustee [in]

A pointer to a TRUSTEE structure that identifies the trustee. A trustee can be a user, group, or program (such as a Windows service). You can use a name or a security identifier (SID) to identify a trustee. For information about SID structures, see SID.

pSuccessfulAuditedRights [out]

A pointer to an ACCESS_MASK structure that receives the successful audit mask for rights audited for the trustee specified by the pTrustee parameter. The system generates an audit record when the trustee successfully uses any of these access rights.

pFailedAuditRights [out]

A pointer to an ACCESS_MASK structure that receives the failed audit mask for rights audited for the trustee specified by the pTrustee parameter. The system generates an audit record when the trustee fails in an attempt to use any of these rights.

Return value

If the function succeeds, the function returns ERROR_SUCCESS.

If the function fails, it returns a nonzero error code defined in WinError.h.

Remarks

The GetAuditedPermissionsFromAcl function checks all system-audit ACEs in the ACL to determine the audited rights for the trustee. For all ACEs that specify audited rights for a group, GetAuditedPermissionsFromAcl enumerates the members of the group to determine whether the trustee is a member. The function returns an error if it cannot enumerate the members of a group.

Requirements

Minimum supported client

Windows XP [desktop apps only]

Minimum supported server

Windows Server 2003 [desktop apps only]

Header

Aclapi.h

Library

Advapi32.lib

DLL

Advapi32.dll

Unicode and ANSI names

GetAuditedPermissionsFromAclW (Unicode) and GetAuditedPermissionsFromAclA (ANSI)

See also

Access Control Overview
Basic Access Control Functions
ACCESS_MASK
ACE
ACL
GetEffectiveRightsFromAcl
SID
SYSTEM_AUDIT_ACE
TRUSTEE

 

 

Community Additions

ADD
Show:
© 2015 Microsoft