SeAuditingFileOrGlobalEvents function (ntifs.h)

Article
02/22/2024

The SeAuditingFileOrGlobalEvents routine determines whether file or global events are currently being audited.

Syntax

BOOLEAN SeAuditingFileOrGlobalEvents(
  [in] BOOLEAN                   AccessGranted,
  [in] PSECURITY_DESCRIPTOR      SecurityDescriptor,
  [in] PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext
);

Parameters

[in] AccessGranted

Set to TRUE if the access attempt was successful, FALSE otherwise.

[in] SecurityDescriptor

Pointer to the security descriptor protecting the object being accessed.

[in] SubjectSecurityContext

Pointer to the subject's captured security context.

Return value

SeAuditingFileOrGlobalEvents returns TRUE if file or global events are currently being audited, FALSE otherwise.

Remarks

For more information about security and access control, see Windows security model for driver developers and the documentation on these topics in the Windows SDK.

Requirements

Requirement	Value
Target Platform	Universal
Header	ntifs.h (include Ntifs.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	PASSIVE_LEVEL