MSDN Security Descriptors Note

Question

I am trying to retrieve and restore an NTFS file security descriptor via Windows API - XP SP3, I am trying to figure out which functions can actually do this correctly, but I just fail.

I found this comment on MSDN: http://msdn.microsoft.com/en-us/library/aa379573%28VS.85%29.aspx

"Some SECURITY_INFORMATION members only work with the SetNamedSecurityInfo function. These members are not returned in the structure returned by other security functions, such as GetNamedSecurityInfo ..."

"Some members ..." Which members? Why?

"Other security features, such as ..." What are the features? Why?

Does anyone have any experience in extracting and restoring an NTFS file security descriptor?

Answer 1

In general, the MSDN API documentation assumes a basic level of programming knowledge and Win32.

You must understand that some security data may be inherited, for example. This means that during setup, you can tell Windows to copy it from the parent. But when you receive it, you cannot determine why it has meaning. Therefore, the inherit flag is a typical example of a flag that makes sense only in the Set context, and not in the search context. MSDN does not indicate exactly which functions belong in which context, as they assume that you can understand this.