unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls, untSecUtils, untRightsMapping;
type
  TSec = class
  private
    pSD: PSecurityDescriptor;
    function CreateDefaultSD(out pSD: PSecurityDescriptor): boolean;
  public
    constructor Create();
end;

type
  TForm1 = class(TForm)
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

constructor TSec.Create;
begin
  if not CreateDefaultSD(pSD) then
    ShowMessage('ERROR!!!');
end;

function TSec.CreateDefaultSD(out pSD: PSecurityDescriptor): boolean;
var
  SD: TSecurityDescriptor;
  Acl: PACL;
  SzAcl: Cardinal;
  SidAdmins, SidSystem: PSID;
  H: THandle;
  LastErr: Cardinal;
//      ADMINS:      Sid: 'S-1-5-32-544'
//      LOCALSYSTEM: Sid: 'S-1-5-18'
begin
  Acl:= nil; SidAdmins:= nil; SidSystem:= nil; H:= 0;
  try
    Result:= AllocateAndInitializeSid(SECURITY_NT_AUTHORITY, 2,
      SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS,
      0, 0, 0, 0, 0, 0, SidAdmins);
    if not Result then Exit;
    Result:= AllocateAndInitializeSid(SECURITY_NT_AUTHORITY, 1,
      SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0, SidSystem);
    if not Result then Exit;
    SzAcl:= sizeof(Acl^) + GetLengthSid(SidAdmins)
      + GetLengthSid(SidSystem) + 2 * ACE_ALLOWED_SIZE;
    Acl:= Pointer(LocalAlloc(LMEM_FIXED, SzAcl));
    Result:= Acl <> nil;
    if not Result then Exit;
    Result:= InitializeAcl(Acl^, SzAcl, ACL_REVISION);
    if not Result then Exit;
    Result:= AddAccessAllowedAce(Acl^,
      ACL_REVISION, RightMapping.GenericAll, SidAdmins);
    if not Result then Exit;
    Result:= AddAccessAllowedAce(Acl^,
      ACL_REVISION, RightMapping.GenericAll, SidSystem);
    if not Result then Exit;
    Result:= InitDescriptor(SD, [isdDacl, isdOwner, isdGroup],
      Acl, nil, SidSystem, SidAdmins);
    if not Result then Exit;
    H:= GetCurrentToken(TOKEN_QUERY);
    Result:= H <> 0;
    if not Result then Exit;
    Result:= CreatePrivateObjectSecurity(nil, @SD, pSD, false, H, RightMapping);
  finally
    LastErr:= GetLastError;
    if H <> 0 then CloseHandle(H);
    if Acl <> nil then LocalFree(Cardinal(Acl));
    if SidAdmins <> nil then FreeSid(SidAdmins);
    if SidSystem <> nil then FreeSid(SidSystem);
    SetLastError(LastErr);
  end;
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  FSec: TSec;
begin
  FSec := TSec.Create;
end;

end.