Because WNF is kernel-managed, access to a state name is controlled by the kernel’s security descriptor associated with that name. Many WNF names are restricted to SYSTEM or trusted processes.
if (status == 0) // STATUS_SUCCESS printf("Successfully retrieved WNF data!\n"); // Process buffer data here else printf("Failed with status: 0x%X\n", status); ntquerywnfstatedata ntdlldll better