#ifndef _NTSEAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrivilegedServiceAuditAlarm(
    _In_ PUNICODE_STRING SubsystemName,
    _In_ PUNICODE_STRING ServiceName,
    _In_ HANDLE ClientToken,
    _In_ PPRIVILEGE_SET Privileges,
    _In_ BOOLEAN AccessGranted
    );

#endif
View code on GitHub

#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwPrivilegedServiceAuditAlarm(
    _In_ PUNICODE_STRING SubsystemName,
    _In_ PUNICODE_STRING ServiceName,
    _In_ HANDLE ClientToken,
    _In_ PPRIVILEGE_SET Privileges,
    _In_ BOOLEAN AccessGranted
    );

#endif
View code on GitHub

Function NtPrivilegedServiceAuditAlarm doesn't work on NT40-SP6. For more information see description of PrivilegedServiceAuditAlarm in Microsoft SDK.

SubsystemName

???

ServiceName

???

ClientToken

HANDLE to Token Object opened with TOKEN_QUERY access.

ClientPrivileges

Pointer to PRIVILEGE_SET structure contains valid data.

AccessGranted

???

Documented by

Tomasz Nowak

Requirements

Privilege: SE_AUDIT_PRIVILEGE

NtPrivilegedServiceAuditAlarm - NtDoc