<div class="content"><p align="right"><a href="https://msdn.microsoft.com/en-us/library/bd6b6fd8-4bef-427e-9a43-b9b46457e934" data-linktype="external">msdn link</a></p><p>The SYSTEM_AUDIT_CALLBACK_ACE structure defines an ACE for
the SACL that specifies what types of access cause system-level notifications.
A system-audit ACE causes an audit message to be logged when a specified
trustee attempts to gain access to an object. The trustee is identified by a <a href="78eb9013-1c3a-4970-ad1f-2b1dad588a25" data-linktype="relative-path">SID</a>.</p><table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="32">
  <p>Header</p>
  </td>
 </tr>
 <tr>
  <td colspan="32">
  <p>Mask</p>
  </td>
 </tr>
 <tr>
  <td colspan="32">
  <p>Sid
  (variable)</p>
  </td>
 </tr>
 <tr>
  <td colspan="32">
  <p>...</p>
  </td>
 </tr>
 <tr>
  <td colspan="32">
  <p>ApplicationData
  (variable)</p>
  </td>
 </tr>
 <tr>
  <td colspan="32">
  <p>...</p>
  </td>
 </tr>
</tbody></table><p><b>Header (4 bytes): </b>An <a href="628ebb1d-c509-4ea0-a10f-77ef97ca4586" data-linktype="relative-path">ACE_HEADER</a> structure that
specifies the size and type of ACE. It also contains flags that control
inheritance of the ACE by child objects.</p><p><b>Mask (4 bytes): </b>An <a href="7a53f60e-e730-4dfe-bbe9-b21b62eb790b" data-linktype="relative-path">ACCESS_MASK</a> structure that
specifies the user rights that cause audit messages to be generated.</p><p><b>Sid (variable): </b>The SID of a trustee. The
length of the SID MUST be a multiple of 4. An access attempt of a kind
specified by the <b>Mask</b> field by any trustee whose SID matches the <b>Sid</b>
field causes the system to generate an audit message. If an application does
not specify a SID for this field, audit messages are generated for the
specified access rights for all trustees.</p><p><b>ApplicationData (variable): </b>Optional
application data. The size of the application data is determined by the <b>AceSize</b>
field of the ACE_HEADER.</p></div>