PrivilegedServiceAuditAlarm
The PrivilegedServiceAuditAlarm
function generates audit messages when an attempt is made to perform privileged
system service operations. Alarms are not supported in the current version of
Windows NT.
BOOL PrivilegedServiceAuditAlarm(
|
LPCTSTR SubsystemName, |
// address of
string for subsystem name |
|
LPCTSTR ServiceName, |
// address of
string for service name |
|
HANDLE ClientToken, |
// handle of access
token |
|
PPRIVILEGE_SET Privileges, |
// address of
privileges |
|
BOOL AccessGranted |
// flag for granted
access rights |
|
); |
|
Parameters
SubsystemName
Points to a
null-terminated string specifying the name of the subsystem calling the
function, such as DEBUG or WIN32 .
ServiceName
Points to a
null-terminated string specifying the name of the privileged subsystem service.
For example, RESET RUNTIME LOCAL SECURITY POLICY might be specified by a
local security authority service used to update the local security policy
database.
ClientToken
Identifies an
access token representing the client that requested the operation. This handle
must have been obtained by opening the token of a thread impersonating the
client. The token must be open for TOKEN_QUERY access.
Privileges
Points to a PRIVILEGE_SET structure containing the
privileges required to perform the operation. The information in this structure
is supplied by a call to the PrivilegeCheck function.
AccessGranted
Specifies a
flag indicating whether access was granted or denied in a previous call to an
access-checking function, such as PrivilegeCheck. If access is granted, this
flag is TRUE. If access is denied, it is FALSE.
Return Values
If the
function succeeds, the return value is nonzero.
If the
function fails, the return value is zero. To get extended error information,
call GetLastError.
Remarks
The PrivilegedServiceAuditAlarm
function requires the calling process to have SE_AUDIT_NAME privilege. The test
for this privilege is always performed against the primary token of the calling
process. This allows the calling process to impersonate a client during the
call.
See Also