NtDeleteObjectAuditAlarm - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers

#ifndef _NTSEAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteObjectAuditAlarm(
    _In_ PUNICODE_STRING SubsystemName,
    _In_opt_ PVOID HandleId,
    _In_ BOOLEAN GenerateOnClose
    );

#endif
View code on GitHub

#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDeleteObjectAuditAlarm(
    _In_ PUNICODE_STRING SubsystemName,
    _In_opt_ PVOID HandleId,
    _In_ BOOLEAN GenerateOnClose
    );

#endif
View code on GitHub

Function NtDeleteObjectAuditAlarm generates Security Audit Alarm, stored in Event Log. See also description of NtCloseObjectAuditAlarm.

SubsystemName

This string is passed as a parameter to event message.

ObjectHandle

HANDLE to any object.

GenerateOnClose

If set, event is generated.

Documented by

Tomasz Nowak

Requirements

Privilege: SE_AUDIT_PRIVILEGE