Mandatory Integrity Control is implemented through a new type of ACE on a security descriptor.
强制完整性控制就是通过新类型的ACE在安全描述符上实现。