🚀 go-pugleaf

"Remy Lebeau (TeamB)" <gambit47@yahoo.com> wrote
> Sounds like you need to read up on NT security in general before you start
> messing with it.

I have a basic understanding of allowing certain users (or groups of users)
access to securable objects according to their SID's and the objects DACL,
but some of the lower level details are confusing. The only other option was
to enumerate the ACE's and give them all write access, and ensure all
possible users were covered by at least one ACE. This second part I would
not know where to begin. The help files give setting the DACL to NULL as a
legitimate option.

> As for specifying a NULL DACL, use RegGetKeySecurity() to retreive the
> current SECURITY_DESCRIPTOR for the desired key, then call
> SetSecurityDescriptorDacl() to set the DACL to NULL, and then call
> RegSetKeySecurity() to assign the SECURITY_DESCRIPTOR back to the key.

Is there a specific benefit to doing it this way as opposed to using
SetSecurityInfo()? Isn't the end result the same?

> > I changed in 'aclapi.h'
> <snip>
>
> Do not alter header files, especially Microsoft's.

I only altered it temporarily. I just needed to be able to carry on until
I could eliminate the error.

> As previously stated, you need to use RegSetKeySecurity() instead of
> SetSecurityInfo() anyway.  In which case, aclapi.h is no longer needed for
> this situation to begin with.

I shall make the changes as recommended.

Claire.