AddAccessAllowedAce function (securitybaseapi.h)

Article
02/22/2024

The AddAccessAllowedAce function adds an access-allowed access control entry (ACE) to an access control list (ACL). The access is granted to a specified security identifier (SID).

To control whether the new ACE can be inherited by child objects, use the AddAccessAllowedAceEx function.

Syntax

BOOL AddAccessAllowedAce(
  [in, out] PACL  pAcl,
  [in]      DWORD dwAceRevision,
  [in]      DWORD AccessMask,
  [in]      PSID  pSid
);

Parameters

[in, out] pAcl

A pointer to an ACL. This function adds an access-allowed ACE to the end of this ACL. The ACE is in the form of an ACCESS_ALLOWED_ACE structure.

[in] dwAceRevision

Specifies the revision level of the ACL being modified.

This value can be ACL_REVISION or ACL_REVISION_DS. Use ACL_REVISION_DS if the ACL contains object-specific ACEs.

[in] AccessMask

Specifies the mask of access rights to be granted to the specified SID.

[in] pSid

A pointer to the SID representing a user, group, or logon account being granted access.

Return value

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError. The following are possible error values.

Return code	Description
ERROR_ALLOTTED_SPACE_EXCEEDED	The new ACE does not fit into the ACL. A larger ACL buffer is required.
ERROR_INVALID_ACL	The specified ACL is not properly formed.
ERROR_INVALID_SID	The specified SID is not structurally valid.
ERROR_REVISION_MISMATCH	The specified revision is not known or is incompatible with that of the ACL.
ERROR_SUCCESS	The ACE was successfully added.

Remarks

The addition of an access-allowed ACE to an ACL is the most common form of ACL modification.

The AddAccessAllowedAce and AddAccessDeniedAce functions add a new ACE to the end of the list of ACEs for the ACL. These functions do not automatically place the new ACE in the proper canonical order. It is the caller's responsibility to ensure that the ACL is in canonical order by adding ACEs in the proper sequence.

The ACE_HEADER structure placed in the ACE by the AddAccessAllowedAce function specifies a type and size, but provides no inheritance and no ACE flags.

Examples

For an example that uses this function, see Starting an Interactive Client Process.

Requirements

Requirement	Value
Minimum supported client	Windows XP [desktop apps \| UWP apps]
Minimum supported server	Windows Server 2003 [desktop apps \| UWP apps]
Target Platform	Windows
Header	securitybaseapi.h (include Windows.h)
Library	Advapi32.lib
DLL	Advapi32.dll

Share via