2.4.4.10 SYSTEM_AUDIT_ACE

msdn link

The SYSTEM_AUDIT_ACE structure defines an access ACE for the system access control list (SACL) that specifies what types of access cause system-level notifications. A system-audit ACE causes an audit message to be logged when a specified trustee attempts to gain access to an object. The trustee is identified by a SID.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Header

Mask

Sid (variable)

...

Header (4 bytes): An ACE_HEADER structure that specifies the size and type of ACE. It also contains flags that control inheritance of the ACE by child objects.

Mask (4 bytes): An ACCESS_MASK structure that specifies the user rights that cause audit messages to be generated.

Sid (variable): The SID of a trustee. The length of the SID MUST be a multiple of 4. An access attempt of a kind specified by the Mask field by any trustee whose SID matches the Sid field causes the system to generate an audit message. If an application does not specify a SID for this field, audit messages are generated for the specified access rights for all trustees.