SYSTEM_AUDIT_ACE

typedef struct _SYSTEM_AUDIT_ACE { /* sada */

ACE_HEADER Header;

ACCESS_MASK Mask;

DWORD SidStart;

} SYSTEM_AUDIT_ACE;

typedef SYSTEM_AUDIT_ACE *PSYSTEM_AUDIT_ACE;

The SYSTEM_AUDIT_ACE structure specifies what types of access will cause system-level audits.

Members

Header

Standard ACE_HEADER. The ACE_HEADER has the following form:

typedef struct _ACE_HEADER { /* acehdr */

BYTE AceType;

BYTE AceSize;

BYTE InheritFlags;

BYTE AceFlags;

} ACE_HEADER;

typedef ACE_HEADER *PACE_HEADER;

Mask

An ACCESS_MASK value that specifies the accesses that will cause audit messages to be generated. The SUCCESSFUL_ACCESS_ACE_FLAG and FAILED_ACCESS_ACE_FLAG flags of the header's AceFlags field indicate whether messages are to be generated for successful accesses, unsuccessful accesses, or both.

Sid

A security identifier (SID). The accesses specified by Mask are to generate an audit if they are attempted by any subject possessing an SID that matches this field. An implementation may choose to ignore this field and generate audits for all access attempts by all subjects.

See Also

ACE, ACL ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE, SYSTEM_ALARM_ACE, SYSTEM_AUDIT_ACE