The ObjectCloseAuditAlarm function generates an audit message in the security event log when a handle of an private object is deleted. Alarms are not supported in the current version of Windows NT.
BOOL ObjectCloseAuditAlarm(
LPCTSTR SubsystemName, // address of string for subsystem name
LPVOID HandleId, // address of handle identifier
BOOL GenerateOnClose // flag for audit generation
);
If the function succeeds, the return value is nonzero.
If the function fails, the return value is zero. To get extended error information, call GetLastError.
The ObjectCloseAuditAlarm function requires the calling application to have the SE_AUDIT_NAME privilege enabled. The test for this privilege is always performed against the primary token of the calling process, allowing the calling process to impersonate a client.
Windows NT: Requires version 3.1 or later.
Windows: Unsupported.
Windows CE: Unsupported.
Header: Declared in winbase.h.
Import Library: Use advapi32.lib.
Unicode: Implemented as Unicode and ANSI versions on Windows NT.
Client/Server Access Control Overview, Client/Server Access Control Functions, AccessCheckAndAuditAlarm, ObjectDeleteAuditAlarm, ObjectOpenAuditAlarm, ObjectPrivilegeAuditAlarm