;         0,
                                 &dwSDLen ) )
  {
    //
    // 第一次调用给出的参数肯定返回这个错误，这样做的目的是
    // 为了得到原安全描述符 pOrigSd 的长度
    //
    if ( GetLastError() == ERROR_INSUFFICIENT_BUFFER )
    {
      pOrigSd = ( PSECURITY_DESCRIPTOR ) HeapAlloc( GetProcessHeap(),
                                                    HEAP_ZERO_MEMORY,
                                                    dwSDLen );
      if ( pOrigSd == NULL )
      {
        printf( "Allocate pSd memory to failed!\n" );

        bError = TRUE;
        goto Cleanup;
      }

      //
      // 再次调用才正确得到安全描述符 pOrigSd
      //
      if ( !GetKernelObjectSecurity( hToken,
                                     DACL_SECURITY_INFORMATION,
                                     pOrigSd,
                                     dwSDLen,
                                     &dwSDLen ) )
      {
        printf( "GetKernelObjectSecurity() = %d\n", GetLastError() );
   &