SetSecurityDescriptorSacl

SetSecurityDescriptorSacl is a Windows API function that assigns or replaces the System Access Control List (SACL) in a SECURITY_DESCRIPTOR. The SACL governs auditing for a securable object, describing which accesses should be audited and under what conditions.

The function signature is BOOL SetSecurityDescriptorSacl(PSECURITY_DESCRIPTOR pSD, BOOL bSaclPresent, PACL pSacl, BOOL bSaclDefaulted). The pSD parameter points to the security descriptor to modify. The bSaclPresent flag indicates whether a SACL is present after the call. The pSacl parameter supplies the new SACL to attach, and bSaclDefaulted indicates whether the SACL is flagged as defaulted by the system. The security descriptor can be absolute or self-relative, but the caller must ensure its structure is valid before calling the function.

SetSecurityDescriptorSacl only updates the SACL within the in-memory descriptor; applying those changes to an actual object requires an additional step, such as using SetSecurityInfo or SetNamedSecurityInfo to apply the descriptor to the target object. To modify a SACL, the caller typically needs the SeSecurityPrivilege; lacking the appropriate privilege will cause the function to fail, usually with an access or privilege-related error.

Return value is nonzero (TRUE) on success and zero (FALSE) on failure. When it fails, extended error information can be obtained with GetLastError. This function is commonly used in security management scenarios where auditing behavior must be configured for objects, complements other descriptor functions like GetSecurityDescriptorSacl and SetSecurityDescriptorDacl, and ties into broader security policy management.

See also: GetSecurityDescriptorSacl, SetSecurityDescriptorDacl, GetSecurityInfo, SetSecurityInfo, SetNamedSecurityInfo.