3.1.4.3.4.1 Set the Security Descriptor of a Task
To set the security descriptor of a task, the client MUST first know the path of the task. The path of the task is determined when the client creates the task or queries the server, as specified in section 3.1.4.3.6. Sometimes it is beneficial for the client to avoid adding its identity to the security descriptor. In order for the client to avoid adding its identity to the security descriptor, the client MUST set the TASK_DONT_ADD_PRINCIPAL_ACE bit in the flags parameter.
The client MUST invoke SchRpcSetSecurity with the following parameters:
The path of the existing task in the path parameter.
SCH_FLAG_TASK (and TASK_DONT_ADD_PRINCIPAL_ACE, if required) in the flags parameter.