securitybaseapi.h header

This header is used by multiple technologies. For more information, see:

• Event Tracing
• Security and Identity

securitybaseapi.h contains the following programming interfaces:

Functions

AccessCheck Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token. (AccessCheck)
AccessCheckAndAuditAlarmW Determines whether a security descriptor grants a specified set of access rights to the client being impersonated by the calling thread.
AccessCheckByType Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token. (AccessCheckByType)
AccessCheckByTypeAndAuditAlarmW Determines whether a security descriptor grants a specified set of access rights to the client being impersonated by the calling thread. (AccessCheckByTypeAndAuditAlarmW)
AccessCheckByTypeResultList Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token. (AccessCheckByTypeResultList)
AccessCheckByTypeResultListAndAuditAlarmByHandleW The AccessCheckByTypeResultListAndAuditAlarmByHandleW (Unicode) function (securitybaseapi.h) determines whether a security descriptor grants access rights to the client that the calling thread is impersonating.
AccessCheckByTypeResultListAndAuditAlarmW Determines whether a security descriptor grants a specified set of access rights to the client being impersonated by the calling thread. (AccessCheckByTypeResultListAndAuditAlarmW)
AddAccessAllowedAce Adds an access-allowed access control entry (ACE) to an access control list (ACL). The access is granted to a specified security identifier (SID).
AddAccessAllowedAceEx Adds an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL). (AddAccessAllowedAceEx)
AddAccessAllowedObjectAce Adds an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL). (AddAccessAllowedObjectAce)
AddAccessDeniedAce Adds an access-denied access control entry (ACE) to an access control list (ACL). The access is denied to a specified security identifier (SID).
AddAccessDeniedAceEx Adds an access-denied access control entry (ACE) to the end of a discretionary access control list (DACL).
AddAccessDeniedObjectAce Adds an access-denied access control entry (ACE) to the end of a discretionary access control list (DACL). The new ACE can deny access to an object, or to a property set or property on an object.
AddAce Adds one or more access control entries (ACEs) to a specified access control list (ACL).
AddAuditAccessAce Adds a system-audit access control entry (ACE) to a system access control list (ACL). The access of a specified security identifier (SID) is audited.
AddAuditAccessAceEx Adds a system-audit access control entry (ACE) to the end of a system access control list (SACL). (AddAuditAccessAceEx)
AddAuditAccessObjectAce Adds a system-audit access control entry (ACE) to the end of a system access control list (SACL). (AddAuditAccessObjectAce)
AddMandatoryAce Adds a SYSTEM_MANDATORY_LABEL_ACE access control entry (ACE) to the specified system access control list (SACL).
AddResourceAttributeAce Adds a SYSTEM_RESOURCE_ATTRIBUTE_ACEaccess control entry (ACE) to the end of a system access control list (SACL).
AddScopedPolicyIDAce Adds a SYSTEM_SCOPED_POLICY_ID_ACEaccess control entry (ACE) to the end of a system access control list (SACL).
AdjustTokenGroups Enables or disables groups already present in the specified access token. Access to TOKEN_ADJUST_GROUPS is required to enable or disable groups in an access token.
AdjustTokenPrivileges Enables or disables privileges in the specified access token. Enabling or disabling privileges in an access token requires TOKEN_ADJUST_PRIVILEGES access.
AllocateAndInitializeSid Allocates and initializes a security identifier (SID) with up to eight subauthorities.
AllocateLocallyUniqueId Allocates a locally unique identifier (LUID).
AreAllAccessesGranted Checks whether a set of requested access rights has been granted. The access rights are represented as bit flags in an access mask.
AreAnyAccessesGranted Tests whether any of a set of requested access rights has been granted. The access rights are represented as bit flags in an access mask.
CheckTokenCapability Checks the capabilities of a given token.
CheckTokenMembership Determines whether a specified security identifier (SID) is enabled in an access token.
CheckTokenMembershipEx Determines whether the specified SID is enabled in the specified token.
ConvertToAutoInheritPrivateObjectSecurity Converts a security descriptor and its access control lists (ACLs) to a format that supports automatic propagation of inheritable access control entries (ACEs).
CopySid Copies a security identifier (SID) to a buffer.
CreatePrivateObjectSecurity Allocates and initializes a self-relative security descriptor for a new private object. A protected server calls this function when it creates a new private object.
CreatePrivateObjectSecurityEx Allocates and initializes a self-relative security descriptor for a new private object created by the resource manager calling this function. (CreatePrivateObjectSecurityEx)
CreatePrivateObjectSecurityWithMultipleInheritance Allocates and initializes a self-relative security descriptor for a new private object created by the resource manager calling this function. (CreatePrivateObjectSecurityWithMultipleInheritance)
CreateRestrictedToken Creates a new access token that is a restricted version of an existing access token. The restricted token can have disabled security identifiers (SIDs), deleted privileges, and a list of restricting SIDs.
CreateWellKnownSid Creates a SID for predefined aliases.
CveEventWrite A tracing function for publishing events when an attempted security vulnerability exploit is detected in your user-mode application.
DeleteAce Deletes an access control entry (ACE) from an access control list (ACL).
DeriveCapabilitySidsFromName This function constructs two arrays of SIDs out of a capability name. One is an array group SID with NT Authority, and the other is an array of capability SIDs with AppAuthority.
DestroyPrivateObjectSecurity Deletes a private object's security descriptor.
DuplicateToken Creates a new access token that duplicates one already in existence.
DuplicateTokenEx Creates a new access token that duplicates an existing token. This function can create either a primary token or an impersonation token.
EqualDomainSid Determines whether two SIDs are from the same domain.
EqualPrefixSid Tests two security-identifier (SID) prefix values for equality. A SID prefix is the entire SID except for the last subauthority value.
EqualSid Tests two security identifier (SID) values for equality. Two SIDs must match exactly to be considered equal.
FindFirstFreeAce Retrieves a pointer to the first free byte in an access control list (ACL).
FreeSid Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function.
GetAce Obtains a pointer to an access control entry (ACE) in an access control list (ACL).
GetAclInformation Retrieves information about an access control list (ACL).
GetAppContainerAce Retrieves a value that indicates whether a package or capability SID is present.
GetCachedSigningLevel Retrieves the cached signing level.
GetFileSecurityW Obtains specified information about the security of a file or directory. The information obtained is constrained by the caller's access rights and privileges. (GetFileSecurityW)
GetKernelObjectSecurity Retrieves a copy of the security descriptor that protects a kernel object.
GetLengthSid Returns the length, in bytes, of a valid security identifier (SID).
GetPrivateObjectSecurity Retrieves information from a private object's security descriptor.
GetSecurityDescriptorControl Retrieves a security descriptor control and revision information.
GetSecurityDescriptorDacl Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor.
GetSecurityDescriptorGroup Retrieves the primary group information from a security descriptor.
GetSecurityDescriptorLength Returns the length, in bytes, of a structurally valid security descriptor. The length includes the length of all associated structures.
GetSecurityDescriptorOwner Retrieves the owner information from a security descriptor.
GetSecurityDescriptorRMControl Retrieves the resource manager control bits.
GetSecurityDescriptorSacl Retrieves a pointer to the system access control list (SACL) in a specified security descriptor.
GetSidIdentifierAuthority Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID).
GetSidLengthRequired Returns the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities.
GetSidSubAuthority Returns a pointer to a specified subauthority in a security identifier (SID). The subauthority value is a relative identifier (RID).
GetSidSubAuthorityCount Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count.
GetTokenInformation Retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information.
GetWindowsAccountDomainSid Receives a security identifier (SID) and returns a SID representing the domain of that SID.
ImpersonateAnonymousToken Enables the specified thread to impersonate the system's anonymous logon token.
ImpersonateLoggedOnUser Lets the calling thread impersonate the security context of a logged-on user. The user is represented by a token handle.
ImpersonateSelf Obtains an access token that impersonates the security context of the calling process. The token is assigned to the calling thread.
InitializeAcl Initializes a new ACL structure.
InitializeSecurityDescriptor Initializes a new security descriptor.
InitializeSid Initializes a security identifier (SID).
IsTokenRestricted Indicates whether a token contains a list of restricted security identifiers (SIDs).
IsValidAcl Validates an access control list (ACL).
IsValidSecurityDescriptor Determines whether the components of a security descriptor are valid.
IsValidSid Validates a security identifier (SID) by verifying that the revision number is within a known range, and that the number of subauthorities is less than the maximum.
IsWellKnownSid Compares a SID to a well-known SID and returns TRUE if they match.
MakeAbsoluteSD Creates a security descriptor in absolute format by using a security descriptor in self-relative format as a template.
MakeSelfRelativeSD Creates a security descriptor in self-relative format by using a security descriptor in absolute format as a template.
MapGenericMask Maps the generic access rights in an access mask to specific and standard access rights. The function applies a mapping supplied in a GENERIC_MAPPING structure.
ObjectCloseAuditAlarmW Generates an audit message in the security event log when a handle to a private object is deleted. (ObjectCloseAuditAlarmW)
ObjectDeleteAuditAlarmW The ObjectDeleteAuditAlarmW (Unicode) function (securitybaseapi.h) generates audit messages when an object is deleted.
ObjectOpenAuditAlarmW Generates audit messages when a client application attempts to gain access to an object or to create a new one. (ObjectOpenAuditAlarmW)
ObjectPrivilegeAuditAlarmW Generates an audit message in the security event log. (ObjectPrivilegeAuditAlarmW)
PrivilegeCheck Determines whether a specified set of privileges are enabled in an access token.
PrivilegedServiceAuditAlarmW Generates an audit message in the security event log. (PrivilegedServiceAuditAlarmW)
QuerySecurityAccessMask Creates an access mask that represents the access permissions necessary to query the specified object security information.
RevertToSelf Terminates the impersonation of a client application.
SetAclInformation Sets information about an access control list (ACL).
SetCachedSigningLevel Sets the cached signing level.
SetFileSecurityW The SetFileSecurityW (Unicode) function (securitybaseapi.h) sets the security of a file or directory object.
SetKernelObjectSecurity Sets the security of a kernel object.
SetPrivateObjectSecurity Modifies a private object's security descriptor.
SetPrivateObjectSecurityEx Modifies the security descriptor of a private object maintained by the resource manager calling this function.
SetSecurityAccessMask Creates an access mask that represents the access permissions necessary to set the specified object security information.
SetSecurityDescriptorControl Sets the control bits of a security descriptor. The function can set only the control bits that relate to automatic inheritance of ACEs.
SetSecurityDescriptorDacl Sets information in a discretionary access control list (DACL). If a DACL is already present in the security descriptor, the DACL is replaced.
SetSecurityDescriptorGroup Sets the primary group information of an absolute-format security descriptor, replacing any primary group information already present in the security descriptor.
SetSecurityDescriptorOwner Sets the owner information of an absolute-format security descriptor. It replaces any owner information already present in the security descriptor.
SetSecurityDescriptorRMControl Sets the resource manager control bits in the SECURITY_DESCRIPTOR structure.
SetSecurityDescriptorSacl Sets information in a system access control list (SACL). If there is already a SACL present in the security descriptor, it is replaced.
SetTokenInformation Sets various types of information for a specified access token.