RsopFileAccessCheck function

The RSoPFileAccessCheck function determines whether a file's security descriptor grants a specified set of file access rights to the client identified by an RSOPTOKEN.


  LPWSTR     pszFileName,
  PRSOPTOKEN pRsopToken,
  DWORD      dwDesiredAccessMask,
  LPDWORD    pdwGrantedAccessMask,
  LPBOOL     pbAccessStatus



Pointer to the name of the relevant file. The file must already exist.


Pointer to a valid RSOPTOKEN representing the client attempting to gain access to the file.


Specifies an access mask that indicates the access rights to check. This mask can contain a combination of generic, standard, and specific access rights. For more information, see Access Rights and Access Masks.


Pointer to an access mask that receives the granted access rights.

If the function succeeds, the pbAccessStatus parameter is set to TRUE, and the mask is updated to contain the standard and specific rights granted. If pbAccessStatus is set to FALSE, this parameter is set to zero. If the function fails, the mask is not modified.


Pointer to a variable that receives the results of the access check.

If the function succeeds, and the requested set of access rights are granted, this parameter is set to TRUE. Otherwise, this parameter is set to FALSE. If the function fails, the status is not modified.

Return Value

If the function succeeds, the return value is S_OK. Otherwise, the function returns one of the COM error codes defined in the Platform SDK header file WinError.h.


The RSoPFileAccessCheck function indicates, in the pbAccessStatus parameter, whether access is granted or denied to the client identified by the RSOPTOKEN. If access is granted, the requested access mask becomes the object's granted access mask.


Windows version Windows Vista Windows Server 2008
Target Platform Windows
Header userenv.h
Library Userenv.lib
DLL Userenv.dll

See Also

Group Policy Functions

Group Policy Overview