SetNamedSecurityInfo无效问题-删除注册表项的Users用户的权限(整个Users删除掉)

[hzy694358]

BOOL SetRegRights()  
{  
	TCHAR SamName[260]={0};
	_stprintf(SamName,_T("MACHINE\\SOFTWARE\\Wow6432Node\\ODBC\\ODBC.INI\\SAM")); 
	LPVOID					pUserID = NULL;							//系统SYSTEM					//admin	
	LPTSTR					pUserDomain = NULL;		
	DWORD					cbUserDomain = 0,cbUserID = 0;	
	SID_NAME_USE			eUseUser;
	BOOL					bDaclPresent = TRUE;
	BOOL					bDaclDefaulted = FALSE;
	PACL					pAcl = NULL;

	ACL_SIZE_INFORMATION	AclInfo;
	PACL pOldDacl=NULL;  
	PACL pNewDacl=NULL;  
	DWORD dRet;  
	EXPLICIT_ACCESS eia;  
	PSECURITY_DESCRIPTOR pSID=NULL;  
	dRet = GetNamedSecurityInfo(SamName,SE_REGISTRY_KEY,DACL_SECURITY_INFORMATION,NULL,NULL,&pOldDacl,NULL,&pSID);// 获取SAM主键的DACL   
	if(dRet!=ERROR_SUCCESS)  
	{
		printf("aaaaaaaaaa");
		Sleep(10000);
		return FALSE;  
	}
	//获取用户名对应的SID
	if(!LookupAccountName(NULL, _T("Users"), pUserID, &cbUserID, pUserDomain, &cbUserDomain, &eUseUser))
	{
		//内存空间不足
		if(GetLastError() == ERROR_INSUFFICIENT_BUFFER)
		{
			pUserID = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY | HEAP_GENERATE_EXCEPTIONS, cbUserID * sizeof(TCHAR));
			pUserDomain = (LPTSTR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY | HEAP_GENERATE_EXCEPTIONS, cbUserDomain * sizeof(TCHAR));
			if(!LookupAccountName(NULL, _T("Users"), pUserID, &cbUserID, pUserDomain, &cbUserDomain, &eUseUser))
			{
				cout<<"Error:  "<<GetLastError()<<endl;
				//__leave;
			}
		}
		else
		{
			cout<<"Error1:  "<<GetLastError()<<endl;
			//__leave;
		}
	}	
	//获取DACL信息
	AclInfo.AceCount		= 0;
	AclInfo.AclBytesFree	= 0;
	AclInfo.AclBytesInUse	= sizeof(ACL);

	if (pOldDacl == NULL)	bDaclPresent = FALSE;	

	// 如果DACL不为空，则取其信息。（大多数情况下“自关联”的DACL为空）
	if (bDaclPresent) 
	{      
		if (!GetAclInformation(pOldDacl, &AclInfo, sizeof(ACL_SIZE_INFORMATION), AclSizeInformation)) 
		{
			_tprintf(TEXT("GetAclInformation() failed. Error %d\n"), GetLastError());
			//__leave;
		}
	}

	//逐条比较是否为要删除的ACE
	if(bDaclPresent && AclInfo.AceCount > 0)
	{
		cout<<"AclInfo.AceCount:  "<<AclInfo.AceCount<<endl;
		LPVOID pTempAce = NULL;
		int count = 0;
		int index = 0;
		for(index = 0; index < AclInfo.AceCount; index++)
		{
			if(GetAce(pOldDacl, index -count, &pTempAce))
			{
				//找到，将其删除
				if (EqualSid(pUserID, &(((ACCESS_ALLOWED_ACE *)pTempAce)->SidStart)))
				{
					int res = DeleteAce(pOldDacl, index -count);
					if (res == 0)
					{
						//cout<<"DeleteAce Error:  "<<GetLastError()<<endl;
					}
					else
					{
						count ++;
					}
					break;
				}
				pTempAce = NULL;
				//cout<<"sid:  "<<&(((ACCESS_ALLOWED_ACE *)pTempAce)->SidStart)<<endl;
			}
			else
			{
				cout<<"Error:  "<<GetLastError()<<endl;
			}
		}
	}
	
	// 更新SAM主键的DACL   
	dRet = SetNamedSecurityInfo(SamName,SE_REGISTRY_KEY,DACL_SECURITY_INFORMATION,NULL,NULL,pOldDacl,NULL);  
	if(dRet!=ERROR_SUCCESS)  
	{
		printf("bbbbbbbbbbb");
		Sleep(10000);
		return FALSE;  
	}


	//释放DACL和SID  
	if(pNewDacl)
		LocalFree(pNewDacl);  
	if(pSID)
		LocalFree(pSID);  

	printf("successs");
	Sleep(10000);
	return TRUE;  
}  

想删除注册表SAM项的Users用户，接口都返回了成功，实际却不生效，哪里有问题？？

[hzy694358]

原来循环遍历的时候，找到删除了，不能立即break ，因为一个用户可能有多个权限，必须全部删除完毕 用户才算删除

[赵4老师]

帮结帖＋蹭分

[zgl7903]

[Eleven]