EventWaitHandleAuditRule Class

Definition

Namespace:

System.Security.AccessControl

Assembly:

System.Threading.AccessControl.dll

Source:

EventWaitHandleSecurity.cs

Represents a set of access rights to be audited for a user or group. This class cannot be inherited.

public ref class EventWaitHandleAuditRule sealed : System::Security::AccessControl::AuditRule

public sealed class EventWaitHandleAuditRule : System.Security.AccessControl.AuditRule

type EventWaitHandleAuditRule = class
    inherit AuditRule

Public NotInheritable Class EventWaitHandleAuditRule
Inherits AuditRule

Inheritance

Object

AuthorizationRule

AuditRule

EventWaitHandleAuditRule

Remarks

The EventWaitHandleAuditRule class is one of a set of classes that the .NET Framework provides for managing Windows access control security on named system events. For an overview of these classes and their relationship to the underlying Windows access control structures, see EventWaitHandleSecurity.

Note

Windows access control security is meaningful only for named system events. If an EventWaitHandle object represents a local event, access control is irrelevant.

To get a list of the audit rules currently applied to a named event, use the EventWaitHandle.GetAccessControl method to get an EventWaitHandleSecurity object, and then use its GetAuditRules method to obtain a collection of EventWaitHandleAuditRule objects.

EventWaitHandleAuditRule objects do not map one-to-one with access control entries in the underlying discretionary access control list (DACL). When you get the set of all audit rules for an event, the set contains the minimum number of rules currently required to express all the access control entries.

Note

The underlying access control entries change as you apply and remove rules. The information in rules is merged if possible, to maintain the smallest number of access control entries. Thus, when you read the current list of rules, it might not look exactly like the list of all the rules you have added.

Use EventWaitHandleAuditRule objects to specify access rights to be audited for a user or group. To apply a rule to a named system event, use the EventWaitHandle.GetAccessControl method to get the EventWaitHandleSecurity object. Modify the EventWaitHandleSecurity object by using its methods to add the rule, and then use the EventWaitHandle.SetAccessControl method to reattach the security object.

Important

Changes you make to an EventWaitHandleSecurity object do not affect the access levels of the named event until you call the EventWaitHandle.SetAccessControl method to assign the altered security object to the named event.

EventWaitHandleAuditRule objects are immutable. Security for an event is modified using the methods of the EventWaitHandleSecurity class to add or remove rules; as you do this, the underlying access control entries are modified.

Constructors

EventWaitHandleAuditRule(IdentityReference, EventWaitHandleRights, AuditFlags)

Initializes a new instance of the EventWaitHandleAuditRule class, specifying the user or group to audit, the rights to audit, and whether to audit success, failure, or both.

Properties

AccessMask	Gets the access mask for this rule. (Inherited from AuthorizationRule)
AuditFlags	Gets the audit flags for this audit rule. (Inherited from AuditRule)
EventWaitHandleRights	Gets the access rights affected by the audit rule.
IdentityReference	Gets the IdentityReference to which this rule applies. (Inherited from AuthorizationRule)
InheritanceFlags	Gets the value of flags that determine how this rule is inherited by child objects. (Inherited from AuthorizationRule)
IsInherited	Gets a value indicating whether this rule is explicitly set or is inherited from a parent container object. (Inherited from AuthorizationRule)
PropagationFlags	Gets the value of the propagation flags, which determine how inheritance of this rule is propagated to child objects. This property is significant only when the value of the InheritanceFlags enumeration is not None. (Inherited from AuthorizationRule)

Methods

Equals(Object)	Determines whether the specified object is equal to the current object. (Inherited from Object)
GetHashCode()	Serves as the default hash function. (Inherited from Object)
GetType()	Gets the Type of the current instance. (Inherited from Object)
MemberwiseClone()	Creates a shallow copy of the current Object. (Inherited from Object)
ToString()	Returns a string that represents the current object. (Inherited from Object)