title: A working .NET example using SetEntriesInAcl interop in action
body: <p>Does anyone has a working example of invoking SetEntriesInAcl method in .NET using P/Invoke?</p>
  
  <p>I keep getting error 87 when invoking it and just cannot get what am I doing wrong.</p>
  
  <p>Here are my definitions:</p>
  
  <pre><code>private enum FileAccessRights
  {
    FILE_READ_DATA = 0x0001,
  }
  private enum AccessMode
  {
    GRANT_ACCESS = 1,
    REVOKE_ACCESS = 4,
  }
  
  private enum InheritanceFlags
  {
    NO_INHERITANCE = 0x0,
  }
  
  private enum TrusteeForm
  {
    TRUSTEE_IS_SID = 0,
  }
  
  private enum TrusteeType
  {
    TRUSTEE_IS_USER = 1,
  }
  private struct ExplicitAccess
  {
    public FileAccessRights AccessPermissions;
    public AccessMode AccessMode;
    public InheritanceFlags Inheritance;
    public Trustee Trustee;
  }
  
  private struct Trustee
  {
    public IntPtr MultipleTrustee;
    public int MultipleTrusteeOperation;
    public TrusteeForm TrusteeForm;
    public TrusteeType TrusteeType;
    [MarshalAs(UnmanagedType.LPWStr)]
    public string Name;
  }
  [DllImport("advapi32.dll", SetLastError = true)]
  static extern int SetEntriesInAcl(int countOfExplicitEntries, ref ExplicitAccess explicitEntry, IntPtr oldAcl, out IntPtr newAcl);
  </code></pre>
  
  <p>Here is how I invoke it:</p>
  
  <pre><code>    SecurityIdentifier sid = GetSid();
      var ea = new ExplicitAccess
      {
        AccessPermissions = FileAccessRights.FILE_READ_DATA,
        AccessMode = AccessMode.GRANT_ACCESS,
        Inheritance = InheritanceFlags.NO_INHERITANCE,
        Trustee = new Trustee
        {
          TrusteeForm = TrusteeForm.TRUSTEE_IS_SID,
          TrusteeType = TrusteeType.TRUSTEE_IS_USER,
          Name = sid.Value
        }
      };
  
      IntPtr newAcl;
      int res = SetEntriesInAcl(1, ref ea, currentAcl, out newAcl);
  </code></pre>
  
  <p>I keep getting error 87 (invalid parameter) and do not know why. </p>
  
  <p>Thanks a lot in advance to all the Good Samaritans out there.</p>
  
  <p><strong>EDIT1</strong></p>
  
  <p>I will be glad to use the new managed API for changing the Acl, if someone shows me how to if I need to modify the Acl of a private key container associated with a certificate. It is unclear how to use the managed API in this scenario.</p>