RE: Using AuthzReportSecurityEvent

From: Chris Stagnaro (anonymous_at_discussions.microsoft.com)
Date: 09/28/04 

Date: Tue, 28 Sep 2004 08:41:37 -0700

Thanks, that gets me past this call.

I get a success from this call, but I still don't get
anything in the security log.

Does something need to change in the message file format?

Thanks,
Chris

>-----Original Message-----
>AuthzReportSecurityEvent takes a var arg list. Instead of
constructing the
>AUDIT_PARAMS struct, you'd have to call
AuthzReportSecurityEvent as follows:
>
> bRet = AuthzReportSecurityEvent
>(nEventType /*nEventType */,
> m_hSecHandle,
> (DWORD) nEventID,
> pSID,
> index,
> APT_String, <Your
String>,
> APT_String, <Your
String>,
> // and so forth
> );
>
>HTH
>
>
>"Chris Stagnaro" wrote:
>
>> The code has gotten pretty hacked up. Here is the
section
>> that builds the AUDIT_PARAM strucutre and calls the
>> AuthzReportSecurityEvent.
>>
>> vector<_bstr_t> vecMsgs;
>>
>> /* ... Code that parses an input string and turns
>> it into the list of strings in vecMsgs
>> left out here. ... */
>>
>> // Code that populates the AUDIT_PARAM array from
vecMsgs
>>
>> long index = 0;
>> AUDIT_PARAM list[20];
>> TCHAR listparms[10][1024];
>>
>> for (int i = 0; i < vecMsgs.size(); ++i)
>> {
>> list[index].Type = APT_String;
>> list[index].Length = sizeof(AUDIT_PARAM);
>> list[index].Flags = 0;
>> ZeroMemory(listparms[i], 1024 * sizeof(TCHAR));
>> wsprintf(listparms[i], vecMsgs[i]);
>> list[index].String = listparms[i];
>>
>> index++;
>> }
>>
>> // Making the API call
>>
>> bRet = AuthzReportSecurityEvent
>> (nEventType /*nEventType */,
>> m_hSecHandle,
>> (DWORD) nEventID,
>> pSID,
>> index,
>> list);
>> Result_Error = GetLastError();
>>
>> Thanks,
>> Chris
>>
>> >-----Original Message-----
>> >Please post your code. Especially, how you are
>> constructing the AUDIT_PARAM
>> >struct.
>> >
>> >"Chris Stagnaro" wrote:
>> >
>> >> I am trying to report Audit Events from our
application
>> into the Security Log
>> >> on Windows Server 2003 using the
>> AuthzReportSecurityEvent Security API. On
>> >> Windows 2000 we were using ReportEvent, which worked
>> because of a bug in the
>> >> API, which has subsequently been fixed.
>> >>
>> >> Currently I am making a call to
>> AuthzReportSecurityEvent with no paramaters
>> >> and it returns a success, however nothing is written
to
>> the security log.
>> >>
>> >> I've tried to also provide a list of paramaters to
this
>> call by passing an
>> >> array of AUDIT_PARAM. However in this case
>> GetLastError returns 87 (The
>> >> parameter is incorrect). I have not been able to
find
>> any example code or
>> >> any documentation that outlines any additional steps
>> that need to be taken to
>> >> actually get this method to work. All I have been
able
>> to find is the basic
>> >> SDK pages that give the syntax for each method call.
>> >>
>> >> Does anyone have an idea what else needs to be done
to
>> make this work? It
>> >> is running as a service and has the necessary audit
>> privilege set already.
>> >>
>> >> Thanks,
>> >> Chris
>> >>
>> >.
>> >
>>
>.
>

Relevant Pages

  • RE: Using AuthzReportSecurityEvent
    ... into the Security Log ... AuthzReportSecurityEvent Security API. ... AuthzReportSecurityEvent with no paramaters ...
    (microsoft.public.platformsdk.security)
  • RE: Using AuthzReportSecurityEvent
    ... you'd have to call AuthzReportSecurityEvent as follows: ... > that builds the AUDIT_PARAM strucutre and calls the ... > constructing the AUDIT_PARAM ... > into the Security Log ...
    (microsoft.public.platformsdk.security)
  • Re: Security event log messages 576/540/538
    ... This is the SBS default auditing level, and it's probably based on a ... IMO it makes the security log useless because you ... can't separate the valuable entries from the sea of entries that don't ... see what's logging Success and Failure. ...
    (microsoft.public.windows.server.sbs)
  • How do I read the Security Log
    ... Enable Auditing for Logon Events and Object Access ... This logs events in the security log informing you if IKE ... Using the Group Policy MMC snap-in, ... Enable success and failure auditing for "Audit logon ...
    (microsoft.public.win2000.security)
  • Re: unable to enable "success" option of "Audit object access" und
    ... I ran event com.exe on server side by entering "d:\cfs" into the text field ... of Event Com.exe (and select Security Log and "Success") and the result was ... path was logged in SECURITY log, no down to file level of READ, ... > Spawning Thread for: hqscfs01 ...
    (microsoft.public.windows.server.security)