SeAuditingFileOrGlobalEvents function (ntifs.h)
The SeAuditingFileOrGlobalEvents routine determines whether file or global events are currently being audited.
Syntax
BOOLEAN SeAuditingFileOrGlobalEvents(
[in] BOOLEAN AccessGranted,
[in] PSECURITY_DESCRIPTOR SecurityDescriptor,
[in] PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext
);
Parameters
[in] AccessGranted
Set to TRUE if the access attempt was successful, FALSE otherwise.
[in] SecurityDescriptor
Pointer to the security descriptor protecting the object being accessed.
[in] SubjectSecurityContext
Pointer to the subject's captured security context.
Return value
SeAuditingFileOrGlobalEvents returns TRUE if file or global events are currently being audited, FALSE otherwise.
Remarks
For more information about security and access control, see Windows security model for driver developers and the documentation on these topics in the Windows SDK.
Requirements
| Requirement | Value |
|---|---|
| Target Platform | Universal |
| Header | ntifs.h (include Ntifs.h) |
| Library | NtosKrnl.lib |
| DLL | NtosKrnl.exe |
| IRQL | PASSIVE_LEVEL |