将事件日志写入安全通道C ++

Question

我目前正在尝试将事件写入安全日志。我使用具有“ SeAuditPrivilege”特权的帐户。当我尝试使用以下代码时，除安全日志中未写入任何内容外，其他所有程序都运行良好。

任何想法或经验吗？

#include <stdio.h>
#include <iostream>
#include <string>
#include <strsafe.h>
#include <windows.h>
#include <Authz.h>
#include "report_security_event.h"

BOOL SetPrivilege(
    HANDLE hToken,          // access token handle
    LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
    BOOL bEnablePrivilege   // to enable or disable privilege
    )
{
    TOKEN_PRIVILEGES tp;
    LUID luid;

    if ( !LookupPrivilegeValue(
            NULL,            // lookup privilege on local system
            lpszPrivilege,   // privilege to lookup
            &luid ) )        // receives LUID of privilege
    {
        printf("LookupPrivilegeValue error: %u\n", GetLastError() );
        return FALSE;
    }

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    if (bEnablePrivilege)
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        tp.Privileges[0].Attributes = 0;

    // Enable the privilege or disable all privileges.

    if ( !AdjustTokenPrivileges(
        hToken,
        FALSE,
        &tp,
        sizeof(TOKEN_PRIVILEGES),
        (PTOKEN_PRIVILEGES) NULL,
        (PDWORD) NULL) )
    {
        printf("AdjustTokenPrivileges error: %u\n", GetLastError() );
        return FALSE;
    }

    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

    {
        printf("The token does not have the specified privilege. \n");
        return FALSE;
    }

    return TRUE;
}

int print_error(wchar_t* f) {
    wchar_t buf[256];
    DWORD dwError;
    dwError = GetLastError();


    FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL, dwError, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
        buf, (sizeof(buf) / sizeof(wchar_t)), NULL);
    wprintf(
    L"%s (%d): %s",
    f,
    dwError,
    &buf);
    return dwError;
}

int main(int argc, const char *argv[])
{
    // Declare and initialize variables.

    BOOL bResult = TRUE;
    DWORD event_id = 4624;
    AUTHZ_SECURITY_EVENT_PROVIDER_HANDLE hEventProvider = NULL;
    PAUDIT_PARAMS p;
    std::string Source_Name = "Test security audit";
    std::wstring ws;
    std::string pbuf = "What is your purpose ?";
    std::wstring ws_buf;
    int return_code = 0;
    int i =0;
    // Register the audit provider.
    HANDLE token;
    HANDLE hevent_source;
    ws.assign( Source_Name.begin(), Source_Name.end() );
    ws_buf.assign( pbuf.begin(), pbuf.end() );

    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))
        return FALSE;

    SetPrivilege(token, "SeAuditPrivilege", true);

    AUTHZ_SOURCE_SCHEMA_REGISTRATION ar;
    memset(&ar, 0, sizeof(ar));
    ar.dwFlags = AUTHZ_ALLOW_MULTIPLE_SOURCE_INSTANCES;
    ar.szEventSourceName = &ws[0];
    ar.szEventMessageFile = &ws_buf[0];
    ar.szEventSourceXmlSchemaFile = NULL;
    ar.szEventAccessStringsFile = &ws_buf[0];
    ar.szExecutableImagePath = NULL;

    AuthzInstallSecurityEventSource(0, &ar);
    print_error(L"AuthzInstallSecurityEventSource");

    // RegisterEventSource(NULL, Source_Name.c_str());

    bResult = AuthzRegisterSecurityEventSource(0, ws.c_str(), &hEventProvider);

    print_error(L"AuthzRegisterSecurityEventSource");
    if (!bResult)
    {
        print_error(L"AuthzRegisterSecurityEventSource");
        return_code = -1;
    }
    if (hEventProvider)
    {


        // Generate the audit.
        while (i < 10) {
            bResult = AuthzReportSecurityEvent(
                    APF_AuditSuccess,
                    hEventProvider,
                    event_id,
                    NULL,
                    3,
                    APT_String, L"Jay Hamlin",
                    APT_String, L"March 21, 1960",
                    APT_Ulong,  45);

            print_error(L"AuthzReportSecurityEvent");
            if (!bResult)
            {
                return_code = -2;
                break;
            }

            i++;
        }

        AuthzUnregisterSecurityEventSource(0, &hEventProvider);
        print_error(L"AuthzUnregisterSecurityEventSource");
        AuthzUninstallSecurityEventSource(0, &ws[0]);
        print_error(L"AuthzUninstallSecurityEventSource");
    }
    std::cout << "Exit  : " << return_code << std::endl;
    exit(return_code);
}

我尝试使用文档（https://msdn.microsoft.com/en-us/library/windows/desktop/aa376317(v=vs.85).aspx）中的方法AuthzInstallSecurityEventSource，AuthzRegisterSecurityEventSource，AuthzReportSecurityEvent，但没有成功。