The GetUserObjectSecurity function retrieves security information for the specified user object.
BOOL GetUserObjectSecurity(
HANDLE hObj, // handle of user object
PSECURITY_INFORMATION pSIRequested,
// address of requested security information
PSECURITY_DESCRIPTOR pSD,
// address of security descriptor
DWORD nLength, // size of buffer for security descriptor
LPDWORD lpnLengthNeeded
// address of required size of buffer
);
If the function succeeds, the return value is nonzero.
If the function fails, the return value is zero. To get extended error information, call GetLastError.
To read the owner, group, or DACL from the user object's security descriptor, the calling process must have been granted READ_CONTROL access when the handle was opened. To get READ_CONTROL access, the caller must be the owner of the object or the object's DACL must grant the access.
To read the SACL from the security descriptor, the calling process must have been granted ACCESS_SYSTEM_SECURITY access when the handle was opened. The proper way to get this access is to enable the SE_SECURITY_NAME privilege in the caller's current token, open the handle for ACCESS_SYSTEM_SECURITY access, and then disable the privilege.
Windows NT: Requires version 3.1 or later.
Windows: Unsupported.
Windows CE: Unsupported.
Header: Declared in winuser.h.
Import Library: Use user32.lib.
Low-Level Access-Control Overview, Low-Level Access Control Functions, CreatePrivateObjectSecurity, GetKernelObjectSecurity, GetPrivateObjectSecurity, SECURITY_DESCRIPTOR, SECURITY_INFORMATION, SetUserObjectSecurity