>We are using an API which require a username pointer as one of its parameters. The function is BuildExplicitAccessWithName.
>
>The conversion of the username to a pointer is done using an OCX. The function works well as long as we are sitting on the NT server itself. However, as oppose to other API functions we have, we can't pass the server name as one of the parameter which would have give us the possibility to execute that function from a workstation. One of the Microsoft article mentions something about putting the domain in the username as well.
>
>I tried several possibilities with the domain name or the computer server name with the user or the group. We use the BuildExplicitAccessWithName in one of the needed functions in order to adjust trustees on a directory or a file.
>
>Any idea of what is the correct syntax to pass the domain or the computer server name with the user or group?

This is what I found after our last discussion on this subject: "DomainName\UserName". If there are no defined domains, it should work with "ComputerName\UserName". This worked for me and I have no idea why it didn't worked for you. I suspect a bug in BuildExplicitAccessWithName.

In my opinion, BuildExplicitAccessWithName is a new API function that was released in a hurry, it was not tested enough and it is at least untrusty. The fact that it doesn't return any error code and it doesn't set the last error is another weird thing. I tested some error cases and it was impossible to test the error. But, obviously, the error "got to surface" when calling other API functions after BuildExplicitAccessWithName. This is obviously a bug.

Related to this function is SetEntriesInACL. SetEntriesInACL has also a bug (it doesn't copy correctly the ACL) and unless some very specific cases, it can't be used at all.

These two buggy functions make the new ACL management functions (and method released by MS) UNUSEABLE.

Vlad