SetSecurityDescriptor method of the StdRegProv class

The SetSecurityDescriptor method updates the security descriptor of the specified key with a new security descriptor that is defined by an instance of a __SecurityDescriptor class.

Syntax

uint32 SetSecurityDescriptor(
  [in] uint32               hDefKey = HKEY_LOCAL_MACHINE,
  [in] string               sSubKeyName,
  [in] __SecurityDescriptor Descriptor
);

Parameters

hDefKey [in]

A registry tree, also known as a hive, that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE.

The following trees are defined in WinReg.h.

HKEY_CLASSES_ROOT (2147483648)

HKEY_CURRENT_USER (2147483649)

HKEY_LOCAL_MACHINE (2147483650)

HKEY_USERS (2147483651)

HKEY_CURRENT_CONFIG (2147483653)

Return value

In C++, the method returns a uint32 value that is 0 (zero) if successful. If the function fails, the return value is a nonzero error code that is defined in WinError.h. In C++, use the FormatMessage function with the FORMAT_MESSAGE_FROM_SYSTEM flag to get a generic description of the error. You can also look up return values under the WMI Error Constants.

In scripting or Visual Basic, the method returns an integer value that is 0 (zero) if successful. If the function fails, the return value is a nonzero error code that you can look up in WbemErrorEnum.

Remarks

The Win32_SecurityDescriptor instance represents a SECURITY_DESCRIPTOR_CONTROL data type and contains a discretionary access control list (DACL) and a system access control list (SACL). For more information, see Access Control Lists.

If the SeSecurityPrivilege is not granted or enabled when getting a security descriptor, then only the DACL is returned in the returned security descriptor. For more information, see Privilege Constants and Executing Privileged Operations.

You can update both the DACL and the SACL in the Win32_SecurityDescriptor instance when calling this method, but you also can update only the DACL or only the SACL.

The following values in SECURITY_DESCRIPTOR_CONTROL determine whether the DACL or the SACL or both are updated.

• SE_DACL_PRESENT

  Indicates that the DACL should be updated. If this is not set then WMI preserves the original value of the DACL.

• SE_SACL_PRESENT

  Indicates that the SACL should be updated. If this is not set then WMI preserves the original value of the SACL. To update the SACL, the account must have the SeSecurityPrivilege privilege enabled. For scripting, the privilege name is SeSecurityPrivilege. For more information, see Privilege Constants.

If the Group trustee and the Owner trustee properties are not NULL, then they are updated. Otherwise, WMI preserves the original values. For more information, see WMI Security Descriptor Objects.

When a new SACL is NULL in a call this method, then the security descriptor SACL on the target securable object is left unchanged.

Requirements

See also

StdRegProv

Modifying the System Registry

WMI Tasks: Registry