ObjectCloseAuditAlarm
The ObjectCloseAuditAlarm
function generates audit messages when a handle of an object is deleted. Alarms
are not supported in the current version of Windows NT.
BOOL ObjectCloseAuditAlarm(
|
LPCTSTR SubsystemName, |
// address of
string for subsystem name |
|
LPVOID HandleId, |
// address of
handle identifier |
|
BOOL GenerateOnClose |
// flag for audit
generation |
|
); |
|
Parameters
SubsystemName
Points to a
null-terminated string specifying the name of the subsystem calling the
function, for example, DEBUG or WIN32 .
HandleId
Specifies a
unique 32-bit value representing the client s handle of the object. This should
be the same value that was passed to the AccessCheckAndAuditAlarm or ObjectOpenAuditAlarm
function.
GenerateOnClose
Specifies a
flag set by a call to the AccessCheckAndAuditAlarm or ObjectOpenAuditAlarm
function when the object handle is created.
Return Values
If the
function succeeds, the return value is nonzero.
If the
function fails, the return value is zero. To get extended error information,
call GetLastError.
Remarks
The ObjectCloseAuditAlarm
function requires the calling application to have the SE_AUDIT_NAME privilege.
The test for this privilege is always performed against the primary token of
the calling process, allowing the calling process to impersonate a client.
See Also