[quoted text, click to view]

Try it like this

<MarshalAs(UnmanagedType.I1)> _
Dim AuditingMode As Boolean
Dim EventAuditingOptions As IntPtr
Dim MaxiumumAuditEventCount As Int32
End Structure

You have to dynamically allocate and fill the options array using the
Marshal class.


[quoted text, click to view]

Change the type of the policyAuditEventsInfo parameter to ByRef
POLICY_AUDIT_EVENTS_INFO.


Mattias

--
Mattias Sjögren [C# MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com

Simon,

Would you be so kind as to post your working code. I currently have gone
down the same path and seem to be stuck with a ERROR_INVALID_FUNCTION error.
You help would be greatly appreciated. Thank you for your time.

Here is the working declaration:

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Auto, Pack:=4)> _
Private Structure _POLICY_AUDIT_EVENTS_INFO
<MarshalAs(UnmanagedType.I1)> _
Dim AuditingMode As Boolean
Dim EventAuditingOptions As IntPtr 'Each element corresponds to
_POLICY_AUDIT_EVENT_TYPE and value is POLICY_AUDIT_EVENT_*
Dim MaxiumumAuditEventCount As Int32
End Structure

Private Declare Function LsaSetInformationPolicy Lib "ADVAPI32.dll" _
(ByVal PolicyHandle As IntPtr, _
ByVal policyInfoClass As Int32, _
ByRef policyAuditEventsInfo As _POLICY_AUDIT_EVENTS_INFO) As UInt32

I also included the working function to actually set the object access as
required. It took me about 2 days to get working properly but it was worth it.

Public Shared Function SetAuditObjectAccessSuccess() As Boolean

Dim Win32Error As Win32Exception

'Create an empty system name file to force changing of local
security policies.
Dim systemName As LSA_UNICODE_STRING = New LSA_UNICODE_STRING
systemName.Length = 0

'Initialize a pointer for the policy handle
Dim policyHandle As IntPtr = IntPtr.Zero

'These attributes are not used by policy, but LsaOpenPolicy wants
them to exists
Dim ObjectAttributes As LSA_OBJECT_ATTRIBUTES = New
LSA_OBJECT_ATTRIBUTES
ObjectAttributes.Length = 0
ObjectAttributes.RootDirectory = IntPtr.Zero
ObjectAttributes.Attributes = 0
ObjectAttributes.SecurityDescriptor = IntPtr.Zero
ObjectAttributes.SecurityQualityOfService = IntPtr.Zero

'Get a policy handle

Dim resultPolicy As UInt32 = LsaOpenPolicy(systemName,
ObjectAttributes, LSA_AccessPolicy.POLICY_SET_AUDIT_REQUIREMENTS,
policyHandle)

If Not resultPolicy.ToString = "0" Then
'If it's not an error then display the windows error message
Dim winError As Integer =
Convert.ToInt32(LsaNtStatusToWinError(resultPolicy))
Win32Error = New Win32Exception(winError)
MessageBox.Show(Intl.GetMessageText("quantec_fileranger_1040",
Win32Error.Message, Win32Error.NativeErrorCode.ToString),
Intl.GetMessageText("quantec_fileranger_1041"), MessageBoxButtons.OK,
MessageBoxIcon.Exclamation) 'The user does not have permission to modify the
policies specified. If this machine is a domain controller or is controlled
by Group Security Policies, refer to documentation on how to activate the
Object Access auditing.\n\nError: %1 (%2)
Return False 'Convert.ToInt32(winError)
End If

'Create required audit event info variable
Dim paei As New _POLICY_AUDIT_EVENTS_INFO
paei.AuditingMode = True
paei.MaxiumumAuditEventCount = SIZE_OF_POLICY_AUDIT_EVENT_TYPE

'Create an array for Audit Policy items and change the object access
policy to success
Dim eventAuditingOptionsPtr As IntPtr = Marshal.AllocHGlobal(4 *
SIZE_OF_POLICY_AUDIT_EVENT_TYPE)
For i As Integer = 0 To SIZE_OF_POLICY_AUDIT_EVENT_TYPE - 1
Select Case i
Case _POLICY_AUDIT_EVENT_TYPE.AuditCategoryObjectAccess
'If it's the policy we wan to change add SUCCESS
Marshal.WriteInt32(eventAuditingOptionsPtr,
_POLICY_AUDIT_EVENT_TYPE.AuditCategoryObjectAccess * 4,
POLICY_AUDIT_EVENT_SUCCESS)
Case Else
'If it's any other policy then remain unchanged
Marshal.WriteInt32(eventAuditingOptionsPtr, i * 4,
POLICY_AUDIT_EVENT_UNCHANGED)
End Select
Next
paei.EventAuditingOptions = eventAuditingOptionsPtr

'Attempt to set the policy details as required
resultPolicy = LsaSetInformationPolicy(policyHandle,
_POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation, paei) 'paei)

'Removed memory allocated by Marshal
Marshal.FreeHGlobal(eventAuditingOptionsPtr)

'Check to see if the set info policy was successful
If Not resultPolicy.ToString = "0" Then
'If it's not an error then display the windows error message
Dim winError As Integer =
Convert.ToInt32(LsaNtStatusToWinError(resultPolicy))
Win32Error = New Win32Exception(winError)
MessageBox.Show(Intl.GetMessageText("quantec_fileranger_1042",
Win32Error.Message, Win32Error.NativeErrorCode.ToString),
Intl.GetMessageText("quantec_fileranger_1041"), MessageBoxButtons.OK,
MessageBoxIcon.Exclamation) 'Unable to update the Object Access Auditing
option required. If this machine is a domain controller or is controlled by
Group Security Policies, refer to documentation on how to activate the Object
Access auditing.\n\nError: %1 (%2)
Return False 'Convert.ToInt32(winError)
End If

LsaClose(policyHandle) 'Remove the policy as it is no longer needed

Return True 'ERROR_SUCCESS 'Successful completion

End Function





[quoted text, click to view]