Not able to add Audit policy (ACE) for object access (Folder) in windows using c++ -

i writing c++ program add ace object access audit sasl. though functions return success, when go , check properties of folder manually, not see policy has been set.

below code. have modified sample code given in msdn site @ below link add sasl instead of dacl .

https://msdn.microsoft.com/en-us/library/windows/desktop/aa379283(v=vs.85).aspx

bool setprivilege(     handle htoken,          // access token handle     lpctstr lpszprivilege,  // name of privilege enable/disable     bool benableprivilege   // enable or disable privilege ) { token_privileges tp; luid luid;  if (!lookupprivilegevalue(     null,            // lookup privilege on local system     lpszprivilege,   // privilege lookup      &luid))        // receives luid of privilege {     printf("lookupprivilegevalue error: %u\n", getlasterror());     return false; }  tp.privilegecount = 1; tp.privileges[0].luid = luid; if (benableprivilege)     tp.privileges[0].attributes = se_privilege_enabled; else     tp.privileges[0].attributes = 0;  // enable privilege or disable privileges.  if (!adjusttokenprivileges(     htoken,     false,     &tp,     sizeof(token_privileges),     (ptoken_privileges)null,     (pdword)null)) {     printf("adjusttokenprivileges error: %u\n", getlasterror());     return false; }  if (getlasterror() == error_not_all_assigned)  {     printf("the token not have specified privilege. \n");     return false; }  return true; }   dword addacetoobjectssecuritydescriptor( lptstr pszobjname,          // name of object se_object_type objecttype,  // type of object lptstr psztrustee          // trustee new ace ) { dword dwres = 0; pacl poldsacl = null, pnewsacl = null; psecurity_descriptor psd = null; explicit_access ea; handle htoken;  if (null == pszobjname)     return error_invalid_parameter;  // open handle access token calling process. if (!openprocesstoken(getcurrentprocess(),     token_adjust_privileges,     &htoken)) {     printf("openprocesstoken failed: %u\n", getlasterror());     goto cleanup; }  // enable se_security_name privilege. if (!setprivilege(htoken, se_security_name, true)) {     printf("you must logged on administrator.\n");     goto cleanup; }  // pointer existing sacl.  dwres = getnamedsecurityinfo(pszobjname, objecttype,     sacl_security_information,     null, null, null, &poldsacl, &psd); if (error_success != dwres) {     printf("getnamedsecurityinfo error %u\n", dwres);     goto cleanup; }  // initialize explicit_access structure new ace.   zeromemory(&ea, sizeof(explicit_access)); //ea.grfaccesspermissions = dwaccessrights; ea.grfaccesspermissions = generic_all; //ea.grfaccessmode = accessmode; ea.grfaccessmode = set_audit_success; //ea.grfinheritance = dwinheritance; ea.grfinheritance = inherit_only; //ea.trustee.trusteeform = trusteeform; ea.trustee.trusteeform = trustee_is_name; ea.trustee.ptstrname = psztrustee; ea.trustee.trusteetype = trustee_is_user;  // create new acl merges new ace // existing sacl.  dwres = setentriesinacl(1, &ea, poldsacl, &pnewsacl); if (error_success != dwres)  {     printf("setentriesinacl error %u\n", dwres);     goto cleanup; }  // attach new acl object's sacl.  dwres = setnamedsecurityinfo(pszobjname, objecttype,     sacl_security_information,     null, null, null, pnewsacl); if (error_success != dwres)  {     printf("setnamedsecurityinfo error %u\n", dwres);     goto cleanup; }  // disable se_security_name privilege. if (!setprivilege(htoken, se_security_name, false)) {     printf("you must logged on administrator.\n");     goto cleanup; }  cleanup:  if (psd != null)     localfree((hlocal)psd); if (pnewsacl != null)     localfree((hlocal)pnewsacl);  return dwres; }  int _tmain(int argc, _tchar* argv[]) { lptstr objstrname = l"c:\\path\\to\\folder\\test_folder"; lptstr trusteename = l"username"; // have mentioned username here addacetoobjectssecuritydescriptor(objstrname, se_file_object, trusteename); return 0; } 

though functions return success, not able see new audit policy getting set. might setting parameters wrong, case expect functions fail. please resolve issue.

i believe problem setting wrong inheritance flags.

inherit_only means ace should not apply object, inherited child objects.

however, have not set either container_inherit_ace or object_inherit_ace. ace not apply child objects.

since ace applies neither parent nor children, has no effect, windows discards it.