SeAuditingFileOrGlobalEvents function (ntifs.h)

The SeAuditingFileOrGlobalEvents routine determines whether file or global events are currently being audited.

Syntax

BOOLEAN SeAuditingFileOrGlobalEvents(
  [in] BOOLEAN                   AccessGranted,
  [in] PSECURITY_DESCRIPTOR      SecurityDescriptor,
  [in] PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext
);

Parameters

[in] AccessGranted

Set to TRUE if the access attempt was successful, FALSE otherwise.

[in] SecurityDescriptor

Pointer to the security descriptor protecting the object being accessed.

[in] SubjectSecurityContext

Pointer to the subject's captured security context.

Return value

SeAuditingFileOrGlobalEvents returns TRUE if file or global events are currently being audited, FALSE otherwise.

Remarks

For more information about security and access control, see Windows security model for driver developers and the documentation on these topics in the Windows SDK.

Requirements

See also

SECURITY_DESCRIPTOR

SECURITY_SUBJECT_CONTEXT

SeAuditingFileEvents

SeDeleteObjectAuditAlarm

SeOpenObjectAuditAlarm

SeOpenObjectForDeleteAuditAlarm