SeCaptureSubjectContext function (wdm.h)

Article
02/25/2022

The SeCaptureSubjectContext routine captures the security context of the calling thread for access validation and auditing.

Syntax

void SeCaptureSubjectContext(
  [out] PSECURITY_SUBJECT_CONTEXT SubjectContext
);

Parameters

[out] SubjectContext

Pointer to a caller-allocated SECURITY_SUBJECT_CONTEXT structure.

Return value

None

Remarks

The SeCaptureSubjectContext routine returns a pointer to a SECURITY_SUBJECT_CONTEXT structure, which contains references to access tokens. The contents of that structure can change. The SeLockSubjectContext routine locks the primary access token and any impersonation tokens associated with the structure.

When using routines that query token information, such as SeQueryAuthenticationIdToken, SeQuerySubjectContextToken, SeQueryInformationToken, and SePrivilegeCheck, more than once in the same security context, lock the subject context with SeLockSubjectContext to obtain consistent results.

File systems must call SeCaptureSubjectContext before performing access validation or generating audit messages. This is necessary to provide a consistent security context to routines such as SeQueryAuthenticationIdToken, SeQuerySubjectContextToken, and SePrivilegeCheck. After these operations have been performed, the captured context should be released as soon as possible by calling SeReleaseSubjectContext.

For more information about security and access control, see the documentation on these topics in the Microsoft Windows SDK.

Requirements

Requirement	Value
Target Platform	Universal
Header	wdm.h (include Ntifs.h, Wdm.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	PASSIVE_LEVEL