Audit usage of device special files

view story

http://serverfault.com – Windows natively supports auditing of access to file objects, which has been described already on SF, for example: how to audit which process accesses a file? The audit log then contains information about the process and user login context which accessed the file. Is it possible to also audit access to devices, such as serial ports, which have file-like objects (accessed through CreateFile)? If so, are there any tools for configuring SACLs on devices (might have to run every boot), or would I be looking at custom code to do so? (HowTos)