感谢 Trevor Scroggins 提供代码 。<br>SEDAPI.H :<br>/**********************************************************************/<br>/** Microsoft LAN Manager **/<br>/** Copyright(c) Microsoft Corp., 1990-1993 **/<br>/**********************************************************************/<br><br>/*<br> SEDAPI.h<br><br> This File contains the prototypes and descriptions for the interface to<br> the generic security editor dialogs for NT objects.<br><br> FILE HISTORY:<br> Johnl 02-Aug-1991 Created<br> Johnl 27-Dec-1991 Updated to reflect reality<br> JohnL 25-Feb-1992 Nuked NewObjValidMask (new obj use generic/stan.<br> only, Added GENERIC_MAPPING param.<br> Johnl 15-Jan-1993 Added CantRead flags, cleaned up comments<br><br>*/<br><br>#ifndef _SEDAPI_H_<br>#define _SEDAPI_H_<br><br>#ifdef __cplusplus<br>extern "C" {<br>#endif<br><br>//<br>// The following are status codes indicating the state of the permissions on<br>// the resource we are setting permissions for.<br>//<br>#define SED_STATUS_MODIFIED (1)<br>#define SED_STATUS_NOT_MODIFIED (2)<br>#define SED_STATUS_NOT_ALL_MODIFIED (3)<br>#define SED_STATUS_FAILED_TO_MODIFY (4)<br><br>//<br>// Current Security editor revision level.<br>//<br>#define SED_REVISION (1)<br><br>#define SED_REVISION1 (1)<br><br>//<br>// The following structure is for user help in the various dialogs. Each<br>// use of the security editor (whether for files/directories, Registry, Printer<br>// stuff etc.) will have its own set of permission names/capabilities, thus<br>// each will require its own help file. This structure allows the client<br>// of the security editor to specify which help files and which help<br>// contexts should be used for each dialog.<br>//<br>typedef struct _SED_HELP_INFO<br>{<br> //<br> // The name of the ".hlp" file to be passed to the help engine APIs.<br> //<br> LPWSTR pszHelpFileName ;<br><br> //<br> // An array of help contexts corresponding to each dialog.<br> // Use the HC_ manifiests defined below to fill this array. The<br> // manifests correspond to the following dialogs:<br> //<br> // HC_MAIN_DLG - First dialog brought up by the ACL editor<br> // HC_SPECIAL_ACCESS_DLG - Container/object special access dialog<br> // HC_NEW_ITEM_SPECIAL_ACCESS_DLG - New item special access dialog<br> // (not needed for containers that do not support new item<br> // permissions).<br> // HC_ADD_USER_DLG - The "Add" dialog (brought up when the "Add..."<br> // button is pressed).<br> // HC_ADD_USER_MEMBERS_LG_DLG - The Local Group members dialog (brought<br> // up from the "Members" button in the "Add" dialog)<br> // HC_ADD_USER_MEMBERS_GG_DLG - The Global Group members dialog (brought<br> // up from the "Members" button in the "Add" dialog).<br> //<br> ULONG aulHelpContext[7] ;<br>} SED_HELP_INFO, *PSED_HELP_INFO ;<br><br>#define HC_MAIN_DLG 0<br>#define HC_SPECIAL_ACCESS_DLG 1<br>#define HC_NEW_ITEM_SPECIAL_ACCESS_DLG 2<br>#define HC_ADD_USER_DLG 3<br>#define HC_ADD_USER_MEMBERS_LG_DLG 4 // Members Local Group Dialog<br>#define HC_ADD_USER_MEMBERS_GG_DLG 5 // Members Global Group Dialog<br>#define HC_ADD_USER_SEARCH_DLG 6 // Search Dialog<br><br>//<br>// This data type defines information related to a single class of object.<br>// For example, a FILE object, or PRINT_QUEUE object would have a structure<br>// like this defined.<br>//<br><br>typedef struct _SED_OBJECT_TYPE_DESCRIPTOR<br>{<br> //<br> // The current revision level being used by the client. This is for<br> // support in case structure definitions change. It should contain<br> // the current revision supported.<br> //<br> UCHAR Revision ;<br><br> //<br> // Defines whether the object is a container or not.<br> // TRUE indicates the object may contain other objects. Means the<br> // user can Tree apply the permissions if desired.<br> //<br> BOOLEAN IsContainer;<br><br> //<br> // Defines whether "New Object" permissions can be assigned (i.e.,<br> // a "New Object" is an object that will be created in the future).<br> //<br> // This field is ignored when editting Auditting information<br> //<br> BOOLEAN AllowNewObjectPerms ;<br><br> //<br> // This flag, if set to TRUE, will make the ACL editor map all specific<br> // permissions in the security descriptor to the corresponding generic<br> // permissions (using the passed generic mapping) and clear the mapped<br> // specific bits.<br> //<br> // * Note that specific bits for Generic All will always *<br> // * be mapped regardless of this flag (due to Full Control *<br> // * in the special access dialogs). *<br> //<br> // Clients who only expose the Generic and Standard permissions will<br> // generally set this flag to TRUE. If you are exposing the specific<br> // bits (note you should not expose both specific and generic except for<br> // Generic All) then this flag should be FALSE.<br> //<br> BOOLEAN MapSpecificPermsToGeneric ;<br><br> //<br> // The generic mapping for the container or object permissions.<br> //<br> // This is used for mapping the specific permissions to the generic<br> // flags.<br> //<br> PGENERIC_MAPPING GenericMapping ;<br><br> //<br> // The generic mapping for the New Object permissions.<br> //<br> // This is used for mapping the specific permissions to the generic<br> // flags for new object permissions (not used if AllowNewObjectPerms<br> // is FALSE).<br> //<br> PGENERIC_MAPPING GenericMappingNewObjects ;<br><br> //<br> // The (localized) name of the object type.<br> // For example, "File", "Print Job" or "Directory".<br> //<br> LPWSTR ObjectTypeName;<br><br> //<br> // The help information suitable for the type of object the Security<br> // Editor will be operating on.<br> //<br> PSED_HELP_INFO HelpInfo ;<br><br> //<br> // The (localized) title to display if protection/auditting can be applied<br> // to sub-objects/sub-containers. This is the Tree apply<br> // checkbox title.<br> //<br> // This string will be presented with a checkbox before it.<br> // If this box is checked, then the callback entry point<br> // will be called with the ApplyToSubContainers flag set to TRUE.<br> //<br> // This field is ignored if the IsContainer field is FALSE.<br> //<br> // As an example of how this field is used, the File Manager may<br> // specify the following string in the DIRECTORY object's<br> // descriptor:<br> //<br> // "R&eplace Permissions on Subdirectories"<br> //<br> LPWSTR ApplyToSubContainerTitle;<br><br> //<br> // The (localized) title to display if protection/auditting can be applied<br> // to sub-objects.<br> //<br> // This string will be presented with a checkbox before it.<br> // If this box is checked, then the callback entry point<br> // will be called with the ApplyTuSubObjects flag set to TRUE.<br> //<br> // This field is ignored if the IsContainer flag is FALSE or the<br> // AllowNewObjectPerms flag is FALSE.<br> //<br> // As an example of how this field is used, the File Manager may<br> // specify the following string in the DIRECTORY object's<br> // descriptor:<br> //<br> // "Replace Permissions on Existing &Files"<br> //<br> LPWSTR ApplyToObjectsTitle;<br><br> //<br> // The (localized) text is presented in a confirmation message box<br> // that is displayed to the user after the user has checked the<br> // "ApplyToSubContainer" checkbox.<br> //<br> // This field is ignored if the IsContainer field is FALSE.<br> //<br> // For directories, this text might be:<br> //<br> // "Do you want to replace the permissions on all existing<br> // files and subdirectories within %1?"<br> //<br> // %1 will be substituted by the Acl Editor with the object name<br> // field (i.e., "C:/MyDirectory")<br> //<br> LPWSTR ApplyToSubContainerConfirmation ;<br><br> //<br> // The (localized) title to display in the "Type of Access" combo<br> // that brings up the Special access dialog. This same title is<br> // used for the title of this dialog except the "..." is stripped<br> // from the end.<br> //<br> // This field is ignored if the System Acl editor was invoked.<br> //<br> // As an example of how this field is used, the File Manager may<br> // specify the following string in the DIRECTORY object's<br> // descriptor:<br> //<br> // "Special Directory Access..."<br> //<br> LPWSTR SpecialObjectAccessTitle ;<br><br> //<br> // The (localized) title to display in the "Type of Access" combo<br> // that brings up the Special new object access dialog. This same title<br> // is used for the title of this dialog except the "..." is stripped<br> // from the end.<br> //<br> // This item is required if AllowNewObjectPerms is TRUE, it is ignored<br> // if AllowNewObjectPerms is FALSE or we are editting a SACL.<br> //<br> // As an example of how this field is used, the file browser may<br> // specify the following string in the DIRECTORY object's<br> // descriptor:<br> //<br> // "Special File Access..."<br> //<br> LPWSTR SpecialNewObjectAccessTitle ;<br><br>} SED_OBJECT_TYPE_DESCRIPTOR, *PSED_OBJECT_TYPE_DESCRIPTOR;<br><br><br>//<br>// It is desirable to display access names that are<br>// meaningful in the context of the type of object whose ACL<br>// is being worked on. For example, for a PRINT_QUEUE object type,<br>// it may be desirable to display an access type named "Submit Print Jobs".<br>// The following structures are used for defining these application defined<br>// access groupings that appear in the "Type of access" combobox and the<br>// Special Access dialogs.<br>//<br><br>//<br>// The following are the different permission description types that the user<br>// will manipulate for setting permissions.<br>//<br>// SED_DESC_TYPE_RESOURCE - The SED_APPLICATION_ACCESS structure is describing<br>// an object or container permission that will be displayed in the main<br>// permissions listbox. These should be the permissions that the<br>// user will use all the time and will generally be a conglomeration<br>// of permissions (for example, "Edit" which would include Read, Write<br>// and possibly delete).<br>//<br>// SED_DESC_TYPE_CONT_AND_NEW_OBJECT - The structure is describing a container<br>// and new object permission that will be shown in the main permissions<br>// listbox. The Container permission is contained in AccessMask1 and<br>// the New Object resource is in AccessMask2. When the permission name<br>// is selected by the user, the container access permissions *and* the<br>// new object access permissions will be set to the corresponding access<br>// mask. This is useful when inherittance can be used to set the New<br>// Object Access permissions.<br>//<br>// SED_DESC_TYPE_RESOURCE_SPECIAL - The structure is describing an object<br>// or container permissions that will be displayed in the Special<br>// access dialog. These are generally generic/standard permissions (such as<br>// Read, Write, Execute, Set Permissions etc.). The permission names<br>// will appear next to checkboxes, thus they should have the "&"<br>// accelerator next to the appropriate letter.<br>//<br>// SED_DESC_TYPE_NEW_OBJECT_SPECIAL - The structure is describing a new object<br>// permission that will be shown in the Special New Object access<br>// dialog. This is used the same way the SED_DESC_TYPE_RESOURCE_SPECIAL<br>// type is used, that is, the permissions should be the primitive, per<br>// bit permissions. The permission names<br>// will appear next to checkboxes, thus they should have the "&"<br>// accelerator next to the appropriate letter.<br>//<br>// SED_DESC_TYPE_AUDIT - The structure is describing an Audit access mask.<br>// AccessMask1 contains the audit mask to be associated with the<br>// permission title string. The title string will appear next to<br>// a checkbox, thus they should have the "&" accelerator next to<br>// the appropriate letter in the title string.<br>//<br>// Note that they cannot be freely intermixed, use the following table<br>// as a guide for which ones to use where:<br>//<br>// IsContainer AllowNewObjectPerms<br>// False False RESOURCE, RESOURCE_SPECIAL<br>// True False RESOURCE, RESOURCE_SPECIAL<br>// True True RESOURCE_SPECIAL, CONT_AND_NEW_OBJECT,<br>// NEW_OBJECT_SPECIAL<br>// True False SED_DESC_TYPE_AUDIT<br>//<br>// Note that in the third case (IsContainer && AllowNewObjectPerms) you<br>// *cannot* use the RESOURCE permission description type, you must always<br>// associate the permission on the resource with new object permissions.<br>//<br>#define SED_DESC_TYPE_RESOURCE (1)<br>#define SED_DESC_TYPE_RESOURCE_SPECIAL (2)<br><br>#define SED_DESC_TYPE_CONT_AND_NEW_OBJECT (3)<br>#define SED_DESC_TYPE_NEW_OBJECT_SPECIAL (4)<br><br>#define SED_DESC_TYPE_AUDIT (5)<br><br><br>//<br>// To describe the permissions to the ACL Editor, build an array consisting<br>// of SED_APPLICATION_ACCESS structures. The use of each field is as follows:<br>//<br>// Type - Contains one of the SED_DESC_TYPE_* manifests, determines what the<br>// rest of the fields in this structure mean. Specifically, if Type<br>// equals:<br>//<br>// AccessMask1 AccessMask2 PermissionTitle<br>// ============================================<br>//SED_DESC_TYPE_RESOURCE Perm Not Used Name of this Perm<br>//SED_DESC_TYPE_RESOURCE_SPECIAL Special Perm Not Used Name of this Perm<br>//SED_DESC_TYPE_CONT_AND_NEW_OBJECT Perm Special Perm Name of this Perm<br>//SED_DESC_TYPE_NEW_OBJECT_SPECIAL Special Perm Not Used Name of this Perm<br>//SED_DESC_TYPE_AUDIT Audit Mask Not Used Name of this Audit mask<br>//<br>// AccessMask1 - Access mask to be associated with the PermissionTitle string,<br>// see the table under Type for what this field contains.<br>//<br>// AccessMask2 - Either used for Special permissions or ignored.<br>//<br>// PermissionTitle - Title string this permission set is being associated with.<br>typedef struct _SED_APPLICATION_ACCESS<br>{<br> UINT Type ;<br> ACCESS_MASK AccessMask1 ;<br> ACCESS_MASK AccessMask2 ;<br> LPWSTR PermissionTitle ;<br><br>} SED_APPLICATION_ACCESS, *PSED_APPLICATION_ACCESS;<br><br>//<br>// This can be used for AccessMask2 when dealing with containers that support<br>// new object permissions and you need a SED_DESC_TYPE_CONT_AND_NEW_OBJECT<br>// that doesn't have a new object permission.<br>//<br>#define ACCESS_MASK_NEW_OBJ_NOT_SPECIFIED (0xffffffff)<br><br><br>typedef struct _SED_APPLICATION_ACCESSES<br>{<br> //<br> // The count field indicates how many application defined access groupings<br> // are defined by this data structure. The AccessGroup[] array then<br> // contains that number of elements.<br> //<br><br> ULONG Count;<br> PSED_APPLICATION_ACCESS AccessGroup ;<br><br> //<br> // The default permission that should be selected in in the<br> // "Type of Access" combobox of the "Add" dialog. Should be one of<br> // the SED_DESC_TYPE_RESOURCE permissions (i.e., what is shown in the<br> // main dialog).<br> //<br> // The default permission for "Files" & "Directories" for example might<br> // be:<br> //<br> // "Read"<br> //<br><br> LPWSTR DefaultPermName ;<br><br>} SED_APPLICATION_ACCESSES, *PSED_APPLICATION_ACCESSES ;<br><br>/*++<br><br>Routine Description:<br><br> This routine is provided by a caller of the graphical ACL editor.<br><br> It is called by the ACL editor to apply security/auditting info to<br> target object(s) when requested by the user.<br><br> All error notification should be performed in this call. To dismiss<br> the ACL Editor, return 0, otherwise return a non-zero error code.<br><br>Parameters:<br><br> hwndParent - Parent window handle to use for message boxes or subsequent<br> dialogs.<br><br> hInstance - Instance handle suitable for retrieving resources from the<br> applications .exe or .dll.<br><br> CallbackContext - This is the value passed as the CallbackContext argument<br> to the SedDiscretionaryAclEditor() or SedSystemAclEditor api when<br> the graphical editor was invoked.<br><br> SecDesc - This parameter points to a security descriptor<br> that should be applied to this object/container and optionally<br> sub-containers if the user selects the apply to tree option.<br><br> SecDescNewObjects - This parameter is used only when operating on a<br> resource that is a container and supports new objects (for<br> example, directories). If the user chooses the apply to tree option,<br> then this security descriptor will have all of the "New Object"<br> permission ACEs contained in the primary container and the inherit<br> bits will be set appropriately.<br><br> ApplyToSubContainers - When TRUE, indicates that Dacl/Sacl is to be applied<br> to sub-containers of the target container as well as the target container.<br> This will only be TRUE if the target object is a container object.<br><br> ApplyToSubObjects - When TRUE, indicates the Dacl/Sacl is to be applied to<br> sub-objects of the target object.<br> The SecDescNewObjects should be used for applying the permissions<br> in this instance.<br><br> StatusReturn - This status flag indicates what condition the<br> resources permissions were left in after an error occurred.<br><br> SED_STATUS_MODIFIED - This (success) status code indicates the<br> protection has successfully been modified.<br><br> SED_STATUS_NOT_ALL_MODIFIED - This (warning) status code<br> indicates an attempt to modify the resource permissions<br> has only partially succeeded.<br><br> SED_STATUS_FAILED_TO_MODIFY - This (error) status code indicates<br> an attempt to modify the permissions has failed completely.<br><br>Return Status:<br><br> The return code is a standard Win32 error code. All errors that occur<br> must be reported inside this function. If the return code is NO_ERROR,<br> then the security editor will dismiss itself. If you do not wish the<br> security editor dismissed, return a non-zero value (the actual value is<br> ignored).<br><br>--*/<br>typedef DWORD (WINAPI *PSED_FUNC_APPLY_SEC_CALLBACK)(<br> HWND hwndParent,<br> HANDLE hInstance,<br> ULONG CallbackContext,<br> PSECURITY_DESCRIPTOR SecDesc,<br> PSECURITY_DESCRIPTOR SecDescNewObjects,<br> BOOLEAN ApplyToSubContainers,<br> BOOLEAN ApplyToSubObjects,<br> LPDWORD StatusReturn<br> ) ;<br><br>/*++<br><br>Routine Description:<br><br> This routine invokes the graphical Discretionary ACL editor DLL. The<br> graphical DACL editor may be used to modify or create:<br><br> - A default Discretionary ACL<br><br> - A Discretionary ACL for a particular type of object.<br><br> - A Discretionary ACL for a particular named instance of an<br> object.<br><br> Additionally, in the case where the ACl is that of a named object<br> instance, and that object may contain other object instances, the<br> user will be presented with the opportunity to apply the protection<br> to the entire sub-tree of objects.<br><br> If an error occurs, the user will be properly notified by the ACL<br> editor.<br><br><br>Parameters:<br><br> Owner - Handle of the owner window the security editor should use for<br> dialog creation and error messages. This will lock down the passed<br> window.<br><br> Instance - Instance handle of the application. This will be passed<br> to the security editor callback where it can be used for retrieving<br> any necessary resources such as message strings, dialog boxes etc.<br><br> Server - The server name in the form "//server" that the resource resides<br> on. This is used for adding users, groups and aliases to the<br> DACL and SACL. NULL indicates the local machine.<br><br> ObjectType - This parameter is used to specify information<br> about the type of object whose security is being edited.<br><br> ApplicationAccesses - This parameter is used to specify<br> groupings of access types when operating<br> on security for the specified object type. For example, it may be<br> useful to define an access type called "Submit Print Job" for a<br> PRINT_QUEUE class of object.<br><br> ObjectName - This optional parameter is used to pass the name of the<br> object whose security is being edited.<br><br> ApplySecurityCallbackRoutine - This parameter is used to provide the<br> address of a routine to be called to apply security to either the<br> object specified, or, in the case that the object is a container,<br> to sub-containers or sub-non-containers of that object.<br><br> CallbackContext - This value is opaque to the DACL editor. Its only<br> purpose is so that a context value may be passed back to the<br> application via the ApplySecurityCallbackRoutine when that routine<br> is invoked. This may be used by the application to re-locate<br> context related to the edit session. For example, it may be a<br> handle to the object whose security is being edited.<br><br> SecurityDescriptor - This parameter points to a security descriptor<br> containing the current discretionary ACL of the object. This<br> security descriptor may, but does not have to, contain the owner<br> and group of that object as well. Note that the security descriptor's<br> DaclPresent flag may be FALSE, indicating either that the object<br> had no protection, or that the user couldn't read the protection.<br> This security descriptor will not be modified by the ACL editor.<br> This may be NULL, in which case, the user will be presented with<br> an empty permission list.<br><br> CouldntReadDacl - This boolean flag is used to indicate that the<br> user does not have read access to the target object's discretionary<br> acl. In this case, a warning<br> to the user will be presented along with the option to continue<br> or cancel.<br><br> CantWriteDacl - This boolean flag is used to indicate that the user<br> does not have write acces to the target object's discretionary<br> acl (but does have read access). This invokes the editor in a<br> read only mode that allows the user to view the security but not<br> change it.<br><br> Note that SACL access is determined by the SeSecurity privilege.<br> If you have the privilege, then you can both read *and* write the<br> SACL, if you do not have the privilege, you cannot read or write the<br> SACL.<br><br> SEDStatusReturn - This status flag indicates what condition the<br> resources permissions were left in after the ACL editor was<br> dismissed. It may be one of:<br><br> SED_STATUS_MODIFIED - This (success) status code indicates the<br> editor has been exited and protection has successfully been<br> modified.<br><br> SED_STATUS_NOT_MODIFIED - This (success) status code indicates<br> the editor has been exited without attempting to modify the<br> protection.<br><br> SED_STATUS_NOT_ALL_MODIFIED - This (warning) status code indicates<br> the user requested the protection to be modified, but an attempt<br> to do so only partially succeeded. The user has been notified<br> of this situation.<br><br> SED_STATUS_FAILED_TO_MODIFY - This (error) status code indicates<br> the user requested the protection to be modified, but an<br> attempt to do so has failed. The user has been notified of<br> this situation.<br><br> Flags - Should be zero.<br><br>Return Code:<br><br> A standard windows error return such as ERROR_NOT_ENOUGH_MEMORY. This<br> means the ACL editor was never displayed. The user will be notified<br> of the error before this procedure returns.<br><br>--*/<br><br>DWORD WINAPI<br>SedDiscretionaryAclEditor(<br> HWND Owner,<br> HANDLE Instance,<br> LPWSTR Server,<br> PSED_OBJECT_TYPE_DESCRIPTOR ObjectType,<br> PSED_APPLICATION_ACCESSES ApplicationAccesses,<br> LPWSTR ObjectName,<br> PSED_FUNC_APPLY_SEC_CALLBACK ApplySecurityCallbackRoutine,<br> ULONG CallbackContext,<br> PSECURITY_DESCRIPTOR SecurityDescriptor,<br> BOOLEAN CouldntReadDacl,<br> BOOLEAN CantWriteDacl,<br> LPDWORD SEDStatusReturn,<br> DWORD Flags<br> ) ;<br><br>//<br>// The parameters for the SACL editor are exactly the same except where<br>// noted as that of the SedDiscretionaryAclEditor.<br>//<br><br>DWORD WINAPI<br>SedSystemAclEditor(<br> HWND Owner,<br> HANDLE Instance,<br> LPWSTR Server,<br> PSED_OBJECT_TYPE_DESCRIPTOR ObjectType,<br> PSED_APPLICATION_ACCESSES ApplicationAccesses,<br> LPWSTR ObjectName,<br> PSED_FUNC_APPLY_SEC_CALLBACK ApplySecurityCallbackRoutine,<br> ULONG CallbackContext,<br> PSECURITY_DESCRIPTOR SecurityDescriptor,<br> BOOLEAN CouldntEditSacl,<br> LPDWORD SEDStatusReturn,<br> DWORD Flags<br> ) ;<br><br>/*++<br><br>Routine Description:<br><br> This routine invokes the take ownership dialog which is used<br> to view and/or set the owner of a security descriptor. The current owner<br> is displayed along with an optional button for the currently logged<br> on user to take ownership.<br><br> If an error occurs, the user will be properly notified by the API.<br><br>Parameters:<br><br> Owner - Handle of the owner window the security editor should use for<br> dialog creation and error messages. This will lock down the passed<br> window.<br><br> Instance - Instance handle of the application. This will be passed<br> to the security editor callback where it can be used for retrieving<br> any necessary resources such as message strings, dialog boxes etc.<br><br> Server - The server name in the form "//server" that the resource resides<br> on. NULL indicates the local machine.<br><br> ObjectTypeName - NT Resource type of object the user wants to look<br> at the owner of.<br> Examples for this parameter would be "File", "Directory"<br> or "Files/Directories".<br><br> ObjectName - This parameter is used to pass the name of the<br> object whose security is being edited. This might be<br> "C:/status.doc" or some other qualified name.<br><br> CountOfObjects - The number of objects the user wants to change permissions<br> on. If this number is greater then one, then the ObjectName is<br> ignored and a message of the form "%d ObjectTypeName Selected".<br><br> ApplySecurityCallbackRoutine - This parameter is used to provide the<br> address of a routine to be called to apply the new security<br> descriptor. The flags in the PSED_FUNC_APPLY_SEC_CALLBACK<br> type are not used.<br><br> CallbackContext - This value is opaque to this API. Its only<br> purpose is so that a context value may be passed back to the<br> application via the ApplySecurityCallbackRoutine when that routine<br> is invoked. This may be used by the application to re-locate<br> context related to the edit session. For example, it may be a<br> handle to the object whose security is being edited.<br><br> SecurityDescriptor - This parameter points to a security descriptor<br> containing the current owner and group. May be NULL.<br><br> CouldntReadOwner - This boolean flag may be used to indicate that the<br> user does not have read access to the target object's owner/group<br> SID. In this case, a warning<br> to the user will be presented along with the option to continue<br> or cancel.<br><br> CantWriteOwner - The boolean flag may be used to indicate that the user<br> does not have write access to the target object's owner/group SID.<br><br> SEDStatusReturn - This status flag indicates what condition the<br> resources security descriptor were left in after the take ownership<br> dialog was dismissed. It may be one of:<br><br> SED_STATUS_MODIFIED - This (success) status code indicates the<br> dialog has been exited and the new owner has successfully been<br> modified.<br><br> SED_STATUS_NOT_MODIFIED - This (success) status code indicates<br> the dialog has been exited without attempting to modify the<br> owner.<br><br> SED_STATUS_NOT_ALL_MODIFIED - This (warning) status code indicates<br> the user requested the owner to be modified, but an attempt<br> to do so only partially succeeded. The user has been notified<br> of this situation.<br><br> SED_STATUS_FAILED_TO_MODIFY - This (error) status code indicates<br> the user requested the owner to be modified, but an<br> attempt to do so has failed. The user has been notified of<br> this situation.<br><br> Flags - Should be zero.<br>Return Code:<br><br> A standard windows error return such as ERROR_NOT_ENOUGH_MEMORY. This<br> means the dialog was never displayed. The user will be notified<br> of the error before this procedure returns.<br><br>--*/<br><br>DWORD WINAPI<br>SedTakeOwnership(<br> HWND Owner,<br> HANDLE Instance,<br> LPWSTR Server,<br> LPWSTR ObjectTypeName,<br> LPWSTR ObjectName,<br> UINT CountOfObjects,<br> PSED_FUNC_APPLY_SEC_CALLBACK ApplySecurityCallbackRoutine,<br> ULONG CallbackContext,<br> PSECURITY_DESCRIPTOR SecurityDescriptor,<br> BOOLEAN CouldntReadOwner,<br> BOOLEAN CantWriteOwner,<br> LPDWORD SEDStatusReturn,<br> PSED_HELP_INFO HelpInfo,<br> DWORD Flags<br> );<br><br><br>#ifdef __cplusplus<br>}<br>#endif<br><br>#endif //_SEDAPI_H_<br>
]<br>谢谢你。<br>你所写的我都知道，在sysinternal都有。我已经把结构换成delphi代码<br>我的问题是怎么调用那函数。有些参数不知道怎么初始，该赋什么值。。。<br>再次感谢你 （小雨哥）。
