okay. i get 87 as a result, which means: The parameter is incorrect.

now i tried the following:

sub query_users {
    my ( $self, $filename ) = @_;

    my $func =
      import_api( 'advapi32', 'QueryUsersOnEncryptedFile', 'PP', 'N' )
+;        
    die "Could not import API QueryUsersOnEncryptedFile: $!"
      unless defined $func;
      
    $filename = make_unicode( File::Spec->canonpath($filename) );   
    print "filename: $filename\n";

    my $encCertHashList = Win32::API::Struct->new( 'ENCRYPTION_CERTIFI
+CATE_HASH_LIST' );     
    print "retval: " . $func->Call( $filename, $encCertHashList) . "\n
+";        
    print $encCertHashList->{nCert_Hash}, "\n";
    
    $encCertHashList = Win32::API::Struct->new( 'ENCRYPTION_CERTIFICAT
+E_HASH_LIST' );     
    print "retval: " . $func->Call( $filename, \$encCertHashList) . "\
+n";
    print $encCertHashList->{nCert_Hash}, "\n";
    
    $encCertHashList = " " x 1024;
    print "retval: " . $func->Call( $filename, $encCertHashList) . "\n
+";
    print $encCertHashList, "\n";
    
    $encCertHashList = " " x 1024;
    print "retval: " . $func->Call( $filename, \$encCertHashList) . "\
+n";    
    print $encCertHashList, "\n";        
}
[download]

as a result i get

filename: C : \ e f s . p l
retval: 0
Use of uninitialized value in print at C:/Perl/site/lib/Win32/Security
+/EFS.pm line 180, <DATA> line 164.

retval: 0
Use of uninitialized value in print at C:/Perl/site/lib/Win32/Security
+/EFS.pm line 184, <DATA> line 164.

retval: 0
@¤&#9830;








retval: 0
[download]

in this case, the call works. but the structure is not really filled.
btw. the file is encrypted!