c++ - SetNamedSecurityInfo 执行重启系统

Question

我正在尝试更改文件夹的审核设置。当我在不同的机器上测试我的代码时，我发现 SetNamedSecurityInfo 调用会重新启动系统。这发生在一些机器上。一个弹出窗口生成说“Windows遇到安全问题并将在一分钟后重新启动”。我无法找出原因。任何帮助将不胜感激!

HANDLE hProcess = GetCurrentProcess();
HANDLE hToken;
DWORD val;
BOOL result;
result = OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES, &hToken);
if (result == 0)
{
    printf("\nBreak After open process");   
    return 0;
}
else{
    printf("\ncontinue after open process");
}
// Used for reading SACL's
result = SetPrivilege(hToken, SE_SECURITY_NAME, TRUE);
if (result == 0)
{
    printf("\nBreak After setprivilege");   
    return 0;
}
else{
    printf("\ncontinue after open process");
}
CloseHandle(hToken);
retval = GetNamedSecurityInfo(file, SE_FILE_OBJECT, SACL_SECURITY_INFORMATION, &owner, NULL, NULL, &sacl, &psd);
if(retval != 0)
{
     wcout << "GetNamedSecurityInfo failed with error: " << retval << endl;
     return -1;
}
printf("\nBuilt trust successfully before");
BuildTrusteeWithSid(ptrust,psd);
printf("\nBuilt trust successfully");


printf("\ntrying to modify ...");
EXPLICIT_ACCESS ea;
PACL pNewSACL = NULL;
ACCESS_MODE AccessMode =  SET_AUDIT_SUCCESS; //SET_AUDIT_SUCCESS, SET_AUDIT_FAILURE
DWORD dwAccessRights = 0X410D0060;
DWORD dwInheritance = CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE;
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));

ea.grfAccessPermissions = dwAccessRights;
ea.grfAccessMode = SET_AUDIT_SUCCESS;
ea.grfInheritance = dwInheritance;
ea.Trustee = *(ptrust); 



DWORD dwRes = SetEntriesInAcl(1, &ea, sacl, &pNewSACL);
if(dwRes != ERROR_SUCCESS)
{
    printf("SetEntriesInAcl() error %u\n", dwRes);
}
else
{
    printf("SetEntriesInAcl() is OK\n");
}

dwRes = SetNamedSecurityInfo(file, SE_FILE_OBJECT, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, pNewSACL);
if(dwRes != ERROR_SUCCESS)
{
    printf("SetNamedSecurityInfo() error %u\n", dwRes);

}
else
    printf("SetNamedSecurityInfo() is OK\n\n");


LocalFree(psd);

Answer 1

如果系统无法记录安全审核，则有一个全局策略条目控制关闭。

参见: “计算机配置\Windows 设置\本地策略\安全选项” “审计:如果无法记录安全审计，请立即关闭系统”

这可能与以下情​​况结合发生:

“计算机配置\Windows 设置\本地策略\安全选项” "审计:审计全局系统对象的访问"