SetNamedSecurityInfo执行将重新启动系统

SetNamedSecurityInfo execution restarts system

本文关键字:系统 重新启动 执行 SetNamedSecurityInfo      更新时间:2023-10-16

我正在尝试更改文件夹的审核设置。当我在不同的机器上测试代码时,我发现SetNamedSecurityInfo调用会重新启动系统。这种情况发生在一些机器上。弹出窗口显示"Windows遇到安全问题,将在一分钟内重新启动"。我不知道原因。任何帮助都将不胜感激!

HANDLE hProcess = GetCurrentProcess();
HANDLE hToken;
DWORD val;
BOOL result;
result = OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES, &hToken);
if (result == 0)
{
    printf("nBreak After open process");   
    return 0;
}
else{
    printf("ncontinue after open process");
}
// Used for reading SACL's
result = SetPrivilege(hToken, SE_SECURITY_NAME, TRUE);
if (result == 0)
{
    printf("nBreak After setprivilege");   
    return 0;
}
else{
    printf("ncontinue after open process");
}
CloseHandle(hToken);
retval = GetNamedSecurityInfo(file, SE_FILE_OBJECT, SACL_SECURITY_INFORMATION, &owner, NULL, NULL, &sacl, &psd);
if(retval != 0)
{
     wcout << "GetNamedSecurityInfo failed with error: " << retval << endl;
     return -1;
}
printf("nBuilt trust successfully before");
BuildTrusteeWithSid(ptrust,psd);
printf("nBuilt trust successfully");

printf("ntrying to modify ...");
EXPLICIT_ACCESS ea;
PACL pNewSACL = NULL;
ACCESS_MODE AccessMode =  SET_AUDIT_SUCCESS; //SET_AUDIT_SUCCESS, SET_AUDIT_FAILURE
DWORD dwAccessRights = 0X410D0060;
DWORD dwInheritance = CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE;
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
ea.grfAccessPermissions = dwAccessRights;
ea.grfAccessMode = SET_AUDIT_SUCCESS;
ea.grfInheritance = dwInheritance;
ea.Trustee = *(ptrust); 

DWORD dwRes = SetEntriesInAcl(1, &ea, sacl, &pNewSACL);
if(dwRes != ERROR_SUCCESS)
{
    printf("SetEntriesInAcl() error %un", dwRes);
}
else
{
    printf("SetEntriesInAcl() is OKn");
}
dwRes = SetNamedSecurityInfo(file, SE_FILE_OBJECT, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, pNewSACL);
if(dwRes != ERROR_SUCCESS)
{
    printf("SetNamedSecurityInfo() error %un", dwRes);
}
else
    printf("SetNamedSecurityInfo() is OKnn");

LocalFree(psd);

如果系统无法记录安全审核,则有一个全局策略条目控制关闭。

请参阅:"计算机配置\Windows设置\本地策略\安全选项"审核:如果无法记录安全审核,则立即关闭系统"

这可能与结合使用

"计算机配置\Windows设置\本地策略\安全选项"审核:审核全局系统对象的访问"