C++ 仅允许LocalAccount访问文件夹&拒绝所有人访问

如果文件夹已经存在，我必须创建文件夹或修改安全属性。我需要设置文件夹的权限，以便只有LocalAccount具有完全访问权限，而其他用户帐户不应具有对此文件夹的任何访问权限。 到目前为止，我正在尝试下面的代码，但无法实现

更新：我猜，任何现有的ACE导致问题如果文件夹存在或任何从父目录继承的ACE导致问题

DWORD dwRes;
PSID pEveryoneSID = NULL, pLocalSystemSID = NULL;
PACL pACL = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;
EXPLICIT_ACCESS ea[2];
SID_IDENTIFIER_AUTHORITY SIDAuthWorld =
    SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY SIDAuthNT = SECURITY_NT_AUTHORITY;
SECURITY_ATTRIBUTES sa;

// Create a well-known SID for the Everyone group.
if (!AllocateAndInitializeSid(&SIDAuthWorld, 1,
    SECURITY_WORLD_RID,
    0, 0, 0, 0, 0, 0, 0,
    &pEveryoneSID))
{
    LOGERROR(_T("AllocateAndInitializeSid Error %u\n"), GetLastError());
    goto Cleanup;
}

// Initialize an EXPLICIT_ACCESS structure for an ACE.
// The ACE will deny Everyone GENERIC_ALL to the folder.
ZeroMemory(&ea, 2 * sizeof(EXPLICIT_ACCESS));
ea[0].grfAccessPermissions = GENERIC_ALL;   
ea[0].grfAccessMode = DENY_ACCESS;
ea[0].grfInheritance = NO_INHERITANCE;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea[0].Trustee.ptstrName = (LPTSTR)pEveryoneSID;

// Create a SID for the LocalSystem account(A special account used by the operating system) group.
if (!AllocateAndInitializeSid(&SIDAuthNT, 1,
    SECURITY_LOCAL_SYSTEM_RID,
    0, 0, 0, 0, 0, 0, 0,
    &pLocalSystemSID))
{
    LOGERROR(_T("AllocateAndInitializeSid Error %u\n"), GetLastError());
    goto Cleanup;
}

// Initialize an EXPLICIT_ACCESS structure for an ACE.
// The ACE will allow the  LocalSystem full access to the folder
ea[1].grfAccessPermissions = GENERIC_ALL;
ea[1].grfAccessMode = GRANT_ACCESS;   // or SET_ACCESS ?
ea[1].grfInheritance = NO_INHERITANCE;
ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;     
ea[1].Trustee.TrusteeType = TRUSTEE_IS_GROUP;       //not sure what to use here for localAccount
ea[1].Trustee.ptstrName = (LPTSTR)pLocalSystemSID;

// Create a new ACL that contains the new ACEs.
dwRes = SetEntriesInAcl(2, ea, NULL, &pACL);
if (ERROR_SUCCESS != dwRes)
{
    LOGERROR(_T("SetEntriesInAcl Error %u\n"), GetLastError());
    goto Cleanup;
}

// Initialize a security descriptor.  
pSD = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR,
    SECURITY_DESCRIPTOR_MIN_LENGTH);
if (NULL == pSD)
{
    LOGERROR(_T("LocalAlloc Error %u\n"), GetLastError());
    goto Cleanup;
}

if (!InitializeSecurityDescriptor(pSD,
    SECURITY_DESCRIPTOR_REVISION))
{
    LOGERROR(_T("InitializeSecurityDescriptor Error %u\n"),
        GetLastError());
    goto Cleanup;
}

// Add the ACL to the security descriptor. 
if (!SetSecurityDescriptorDacl(pSD,
    TRUE,     // bDaclPresent flag   
    pACL,
    FALSE))   // not a default DACL 
{
    LOGERROR(_T("SetSecurityDescriptorDacl Error %u\n"),
        GetLastError());
    goto Cleanup;
}

// Initialize a security attributes structure.
sa.nLength = sizeof (SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = pSD;
sa.bInheritHandle = FALSE;

int rVal = SHCreateDirectoryExW(NULL, m_tcProxyData, &sa);

---

到底是什么不起作用？我试着给你发的帖子编码，效果很好；已创建一个文件夹，该文件夹使用单个允许系统拒绝所有人。到目前为止，普通用户可以访问该文件夹。我的意思是，这不是拒绝正常用户的访问；第二个参数应该是1，而不是2。拒绝所有人，但系统实际上不是一个有效的ACL-拒绝覆盖了允许，所以结果就是拒绝所有人。但除此之外，代码对我来说工作正常，访问被拒绝。你确定这个目录不存在吗？我的理解是，explict-allow-overrides-group-deny，这里我想每个人都是指一个组。[为了回答您的问题，目录已经存在，并且我将那些参数错误从2更正为1]ACL应该只包含允许权限；默认情况下，系统将拒绝其他所有人访问。确保使用受保护的\u DACL\u安全性\u信息标志来禁用继承的权限。