UID

title

description

helpviewer_keywords

old-location

tech.root

ms.assetid

ms.date

ms.keywords

req.header

req.include-header

req.target-type

req.target-min-winverclnt

req.target-min-winversvr

req.kmdf-ver

req.umdf-ver

req.ddi-compliance

req.unicode-ansi

req.idl

req.max-support

req.namespace

req.assembly

req.type-library

req.lib

req.dll

req.irql

targetos

req.typenames

req.redist

ms.custom

f1_keywords

dev_langs

topic_type

api_type

api_location

api_name

NF:securitybaseapi.SetPrivateObjectSecurity

SetPrivateObjectSecurity function (securitybaseapi.h)

Modifies a private object's security descriptor.

SetPrivateObjectSecurity

SetPrivateObjectSecurity function [Security]

_win32_setprivateobjectsecurity

security.setprivateobjectsecurity

securitybaseapi/SetPrivateObjectSecurity

security\setprivateobjectsecurity.htm

security

726994c8-7813-4f1a-b7d7-a25e79202c33

12/05/2018

SetPrivateObjectSecurity, SetPrivateObjectSecurity function [Security], _win32_setprivateobjectsecurity, security.setprivateobjectsecurity, securitybaseapi/SetPrivateObjectSecurity

securitybaseapi.h

Windows.h

Windows

Windows XP [desktop apps only]

Windows Server 2003 [desktop apps only]

Advapi32.lib

Advapi32.dll

Windows

19H1

SetPrivateObjectSecurity

securitybaseapi/SetPrivateObjectSecurity

c++

APIRef

kbSyntax

DllExport

Advapi32.dll

API-MS-Win-DownLevel-AdvApi32-l1-1-1.dll

KernelBase.dll

API-MS-Win-Security-base-l1-1-0.dll

API-MS-Win-Security-base-l1-2-0.dll

MinKernelBase.dll

API-MS-Win-Security-Base-L1-2-1.dll

SetPrivateObjectSecurity

SetPrivateObjectSecurity function

-description

The SetPrivateObjectSecurity function modifies a private object's security descriptor.

To specify whether the protected server supports automatic inheritance of access control entries (ACEs), use the SetPrivateObjectSecurityEx function.

-parameters

-param SecurityInformation [in]

Indicates the parts of the security descriptor to set. This value can be a combination of the SECURITY_INFORMATION bit flags.

-param ModificationDescriptor [in]

A pointer to a SECURITY_DESCRIPTOR structure. The parts of this security descriptor indicated by the SecurityInformation parameter are applied to the ObjectsSecurityDescriptor security descriptor.

-param ObjectsSecurityDescriptor [in, out]

A pointer to a pointer to a SECURITY_DESCRIPTOR structure. This security descriptor must be in self-relative form. The memory for the security descriptor must be allocated from the process heap (GetProcessHeap) with the HeapAlloc function.

On input, this is the current security descriptor of the private object. The function modifies it to produce the new security descriptor. If necessary, the SetPrivateObjectSecurity function allocates additional memory to produce a larger security descriptor.

-param GenericMapping [in]

A pointer to a GENERIC_MAPPING structure that specifies the specific and standard access rights that correspond to each of the generic access rights.

-param Token [in, optional]

A handle to the access token for the client on whose behalf the private object's security is being modified. This parameter is required to ensure that the client has provided a legitimate value for a new owner security identifier (SID). The token must be open for TOKEN_QUERY access.

-returns

If the function succeeds, the function returns nonzero.

If the function fails, it returns zero. To get extended error information, call GetLastError.

-remarks

This function is intended for use by resource managers only. To implement the standard access control semantics for updating security descriptors, a resource manager should verify that the following conditions are met before calling SetPrivateObjectSecurity:

If the object's owner is being set, the calling process must have either WRITE_OWNER permission or be the object's owner.
If the object's discretionary access control list (DACL) is being set, the calling process must have either WRITE_DAC permission or be the object's owner.
If the object's system access control list (SACL) is being set, the SE_SECURITY_NAME privilege must be enabled for the calling process.

If the preceding conditions are not met, a call to this function does not fail; however, standard access policy is not enforced.

The process calling this function should not be impersonating a client because clients do not typically have appropriate privileges required for underlying token operations.