🚀 go-pugleaf

Hi All,


I'm trying to set a new DACL (using D5 on either 2k, XP or 2k3) on both
the Winstation and Desktop objects during Winlogon using the following
code


<code>


procedure set_winstation_dacl(hToken : cardinal);
var s      : string;
    d      : string;
    dt     : hdesk;
    mydacl : pacl;
    sd     : psecurity_descriptor
    lo_sid : string;
begin
   .
   .
   .
   .
   d := 'D:(A;NP;LCWP;;;'+s+') blah blah blah';


   dt := openwindowstation('WinSta0',fa­lse,GENERIC_ALL);


   fillchar(mydacl,sizeof(pacl),0­);
   fillchar(sd.a,sizeof(psecurity­_descriptor),0);


convertstringsecuritydescripto­rtosecuritydescriptor(pchar(d)­,SDDL_REVISION_1,sd,nil);



   if
setsecurityinfo(dt,SE_WINDOW_O­BJECT,DACL_SECURITY_INFORMATIO­N,nil,nil,sd.dacl,nil)<>ERROR_­SUCCESS

then
      showmessage('Winstation - ' + syserrormessage(getlasterror))
   else
      showmessage('Winstation ok');


   .
   .
   .
   .
end;


</code>


but essentially always come up with the error - Invalid Access To
Memory Location.  I've previously read stuff about DWORD alignment
using the SetSecurityInfo API and have {$A+} set as a directive in the
code, however, makes no difference :-(


In the above hToken is obtained using the code


logonuser('a','b','c',LOGON32_­LOGON_INTERACTIVE,LOGON32_PROV­IDER_DEFAULT,th)



and passing th (declared as cardinal) to the above procedure.  Also the
convertstringsecuritydescripto­rtosecuritydescriptor API does generate
a correct DACL as I've used it and applied the same DACL to a newly
created directory...

Can anyone assist with this please ? 


TIA 


Mark