SeAuditingFileEvents function (ntifs.h)

The SeAuditingFileEvents routine determines whether file open events are currently being audited.

Syntax

BOOLEAN SeAuditingFileEvents(
  [in] BOOLEAN              AccessGranted,
  [in] PSECURITY_DESCRIPTOR SecurityDescriptor
);

[in] AccessGranted

Set to TRUE if the access attempt was successful, FALSE otherwise.

[in] SecurityDescriptor

This parameter is ignored.

SeAuditingFileEvents returns TRUE if file open events are currently being audited, FALSE otherwise.

For more information about security and access control, see Windows security model for driver developers and the documentation on these topics in the Windows SDK.