无法使用c+为windows中的对象访问（文件夹）添加审核策略（ACE）+； 我编写了C++程序，为ASSL对象访问审计添加ACE。虽然所有函数都返回成功，但当我手动检查文件夹的属性时，我看不到已设置任何策略

下面是我的代码。我已经修改了MSDN站点下面链接中给出的示例代码，将其添加到SASL而不是DACL

---

虽然所有函数都返回成功，但我看不到任何新的审核策略正在设置。可能是我把参数设置错了，在这种情况下，我希望函数会失败。请帮助解决这个问题

我认为问题在于您设置了错误的继承标志

INHERIT_ONLY

表示ACE不应应用于对象，而只能由子对象继承

但是，您没有设置

容器\u继承\u ACE

或

对象\u继承\u ACE

。因此ACE不适用于子对象

---

因为ACE既不适用于父母也不适用于孩子，所以Windows会丢弃它。

非常感谢，Harry。它解决了这个问题。是的，您是对的，ACE既没有应用于主对象，也没有应用于它包含的任何对象。

BOOL SetPrivilege(
    HANDLE hToken,          // access token handle
    LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
    BOOL bEnablePrivilege   // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;

if (!LookupPrivilegeValue(
    NULL,            // lookup privilege on local system
    lpszPrivilege,   // privilege to lookup 
    &luid))        // receives LUID of privilege
{
    printf("LookupPrivilegeValue error: %u\n", GetLastError());
    return FALSE;
}

tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
    tp.Privileges[0].Attributes = 0;

// Enable the privilege or disable all privileges.

if (!AdjustTokenPrivileges(
    hToken,
    FALSE,
    &tp,
    sizeof(TOKEN_PRIVILEGES),
    (PTOKEN_PRIVILEGES)NULL,
    (PDWORD)NULL))
{
    printf("AdjustTokenPrivileges error: %u\n", GetLastError());
    return FALSE;
}

if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

{
    printf("The token does not have the specified privilege. \n");
    return FALSE;
}

return TRUE;
}


DWORD AddAceToObjectsSecurityDescriptor(
LPTSTR pszObjName,          // name of object
SE_OBJECT_TYPE ObjectType,  // type of object
LPTSTR pszTrustee          // trustee for new ACE
)
{
DWORD dwRes = 0;
PACL pOldSACL = NULL, pNewSACL = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;
EXPLICIT_ACCESS ea;
HANDLE hToken;

if (NULL == pszObjName)
    return ERROR_INVALID_PARAMETER;

// Open a handle to the access token for the calling process.
if (!OpenProcessToken(GetCurrentProcess(),
    TOKEN_ADJUST_PRIVILEGES,
    &hToken))
{
    printf("OpenProcessToken failed: %u\n", GetLastError());
    goto Cleanup;
}

// Enable the SE_SECURITY_NAME privilege.
if (!SetPrivilege(hToken, SE_SECURITY_NAME, TRUE))
{
    printf("You must be logged on as Administrator.\n");
    goto Cleanup;
}

// Get a pointer to the existing SACL.

dwRes = GetNamedSecurityInfo(pszObjName, ObjectType,
    SACL_SECURITY_INFORMATION,
    NULL, NULL, NULL, &pOldSACL, &pSD);
if (ERROR_SUCCESS != dwRes) {
    printf("GetNamedSecurityInfo Error %u\n", dwRes);
    goto Cleanup;
}

// Initialize an EXPLICIT_ACCESS structure for the new ACE. 

ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
//ea.grfAccessPermissions = dwAccessRights;
ea.grfAccessPermissions = GENERIC_ALL;
//ea.grfAccessMode = AccessMode;
ea.grfAccessMode = SET_AUDIT_SUCCESS;
//ea.grfInheritance = dwInheritance;
ea.grfInheritance = INHERIT_ONLY;
//ea.Trustee.TrusteeForm = TrusteeForm;
ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
ea.Trustee.ptstrName = pszTrustee;
ea.Trustee.TrusteeType = TRUSTEE_IS_USER;

// Create a new ACL that merges the new ACE
// into the existing SACL.

dwRes = SetEntriesInAcl(1, &ea, pOldSACL, &pNewSACL);
if (ERROR_SUCCESS != dwRes)  {
    printf("SetEntriesInAcl Error %u\n", dwRes);
    goto Cleanup;
}

// Attach the new ACL as the object's SACL.

dwRes = SetNamedSecurityInfo(pszObjName, ObjectType,
    SACL_SECURITY_INFORMATION,
    NULL, NULL, NULL, pNewSACL);
if (ERROR_SUCCESS != dwRes)  {
    printf("SetNamedSecurityInfo Error %u\n", dwRes);
    goto Cleanup;
}

// Disable the SE_SECURITY_NAME privilege.
if (!SetPrivilege(hToken, SE_SECURITY_NAME, FALSE))
{
    printf("You must be logged on as Administrator.\n");
    goto Cleanup;
}

Cleanup:

if (pSD != NULL)
    LocalFree((HLOCAL)pSD);
if (pNewSACL != NULL)
    LocalFree((HLOCAL)pNewSACL);

return dwRes;
}

int _tmain(int argc, _TCHAR* argv[])
{
LPTSTR objstrname = L"C:\\path\\to\\folder\\Test_Folder";
LPTSTR trusteeName = L"UserName"; // I have mentioned username here
AddAceToObjectsSecurityDescriptor(objstrname, SE_FILE_OBJECT, trusteeName);
return 0;
}