Revision Summary Date Revision History Revision Class Comments 2/14/2008 3.1.2 Editorial Changed language and formatting in the technical content. 3/14/2008 4.0 Major Updated and revised the technical content. 6/20/2008 5.0 Major Updated and revised the technical content. 7/25/2008 6.0 Major Updated and revised the technical content. 8/29/2008 7.0 Major Updated and revised the technical content. 10/24/2008 8.0 Updated and revised the technical content. 12/5/2008 9.0 Updated and revised the technical content. 1/16/2009 9.0.1 Editorial Changed language and formatting in the technical content. 2/27/2009 10.0 Major Updated and revised the technical content.
4/10/2009 10.1 Clarified the meaning of the technical content. 5/22/2009 11.0 Updated and revised the technical content. 7/2/2009 11.1 Minor Clarified the meaning of the technical content. 8/14/2009 11.2 Minor Clarified the meaning of the technical content. 9/25/2009 12.0 Major Updated and revised the technical content. 11/6/2009 12.1 Minor Clarified the meaning of the technical content. 12/18/2009 12.2 Minor Clarified the meaning of the technical content. 1/29/2010 13.0 Major Updated and revised the technical content. 3/12/2010 13.1 Clarified the meaning of the technical content. 4/23/2010 13.2 Minor Clarified the meaning of the technical content. 6/4/2010 14.0 Major Updated and revised
the technical content. 7/16/2010 15.0 Major Updated and revised the technical content. 8/27/2010 16.0 Major Updated and revised the technical content. 10/8/2010 17.0 Updated and revised the technical content. 11/19/2010 18.0 Major Updated and revised the technical content. 1/7/2011 19.0 Major Updated and revised the technical content. 2/11/2011 20.0 Major Updated and revised the technical content. 3/25/2011 21.0 Major Updated and revised the technical content. 5/6/2011 21.1 Minor Clarified the meaning of the technical content. 6/17/2011 22.0 Updated and revised the technical content. 9/23/2011 22.0 None No changes to the meaning, language,
technical content. 6/30/2015 29.0 Major Significantly changed the technical content. 10/16/2015 30.0 Major Significantly changed the technical content. 7/14/2016 31.0 Major Significantly changed the technical content. 6/1/2017 32.0 Major Significantly changed the technical content.
Windows XP 1 Windows Server 2003 2 Windows Vista 0 Windows Server 2008 0 Windows Server 2008 R2 1 sv101_version_type: The sv101_version_type specifies the SV_TYPE flags, which indicate the software services that are available (but not necessarily running) on the server. This member MUST be a combination of one or more of the following values. Constant/Value Description SV_TYPE_WORKSTATION 0x00000001 A server running the WorkStation Service. SV_TYPE_SERVER 0x00000002 A server running the Server Service. SV_TYPE_SQLSERVER 0x00000004 A server running SQL Server. SV_TYPE_DOMAIN_CTRL 0x00000008 A primary domain controller. SV_TYPE_DOMAIN_BAKCTRL 0x00000010 A backup domain controller. SV_TYPE_TIME_SOURCE 0x00000020 A server is available as a time source for network time synchronization. SV_TYPE_AFP 0x00000040 An Apple File Protocol server. SV_TYPE_NOVELL 0x00000080 A Novell server. SV_TYPE_DOMAIN_MEMBER 0x00000100 A LAN Manager 2.x domain member. SV_TYPE_PRINTQ_SERVER 0x00000200 A server sharing print queue. SV_TYPE_DIALIN_SERVER 0x00000400 A server running a dial-in service. SV_TYPE_XENIX_SERVER 0x00000800 A Xenix server. SV_TYPE_NT 0x00001000 Windows Server 2003, Windows XP, Windows 2000, or Windows NT operating system. SV_TYPE_WFW A server running Windows for Workgroups.
21: SECURITY_NT_NON_UNIQUE, indicates a domain id will follow. 1-2-3: The next three SubAuthority arrays contain 32-bit random numbers to uniquely identify the domain. RID: Indicates a unique object ID within the domain. The actual constructed SID would be S-1-5-21-1-2-3-513. The following table lists well-known SID structure values and their matching descriptions. Constant/value Description NULL S-1-0-0 No Security principal. EVERYONE S-1-1-0 A group that includes all users. LOCAL S-1-2-0 A group that includes all users who have logged on locally. CONSOLE_LOGON S-1-2-1 A that includes users who are logged on to the physical console. This SID can be used to implement security policies that grant different rights based on whether a user has been granted physical access to the console.<5> CREATOR_OWNER S-1-3-0 A placeholder in an inheritable . When the ACE is inherited, the system replaces this SID with the SID for the object's creator. CREATOR_GROUP S-1-3-1 A placeholder in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object's creator. OWNER_SERVER S-1-3-2 A placeholder in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the object's owner server.<6> GROUP_SERVER S-1-3-3 A placeholder in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the object's group server.<7> OWNER_RIGHTS S-1-3-4 A that represents the current owner of the object. When an ACE that carries this SID is applied to an object, the system ignores the implicit READ_CONTROL and WRITE_DAC permissions for the object owner.
accounts for members of those groups. SERVER_OPERATORS S-1-5-32-549 A built-in group that exists only on domain controllers. Server Operators can perform the following actions: Log on to a server interactively. Create and delete network shares. Start and stop services. Back up and restore files. Format the hard disk of a computer. Shut down the computer. PRINTER_OPERATORS S-1-5-32-550 A built-in group that exists only on domain controllers. Print Operators can manage printers and document queues. BACKUP_OPERATORS S-1-5-32-551 A built-in group. Backup Operators can back up and restore all files on a computer, regardless of the permissions that protect those files. REPLICATOR S-1-5-32-552 A built-in group that is used by the File Replication Service (FRS) on domain controllers. ALIAS_PREW2KCOMPACC S-1-5-32-554 A backward compatibility group that allows read access on all users and groups in the domain.<13> REMOTE_DESKTOP S-1-5-32-555 An alias. Members of this group are granted the right to log on remotely.<14> NETWORK_CONFIGURATION_OPS S-1-5-32-556 An alias. Members of this group can have some administrative privileges to manage configuration of networking features.<15> INCOMING_FOREST_TRUST_BUILDERS S-1-5-32-557 An alias. Members of this group can create incoming, one-way trusts to this forest.<16> PERFMON_USERS S-1-5-32-558 An alias. Members of this group have remote access to monitor this computer.<17> PERFLOG_USERS S-1-5-32-559 An Members of this group have remote access to schedule the logging of performance counters on this computer.<18>
S-1-16-8192 ML_MEDIUM_PLUS S-1-16-8448 A medium-plus integrity level. ML_HIGH S-1-16-12288 A high integrity level. ML_SYSTEM S-1-16-16384 A system integrity ML_PROTECTED_PROCESS S-1-16-20480 A protected-process integrity level. AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY S-1-18-1 A SID that the client's identity is asserted by an authentication authority based on proof of possession of client credentials.<29> <30> SERVICE_ASSERTED_IDENTITY S-1-18-2 A SID that means the client's identity is asserted by a service.<31> <32> FRESH_PUBLIC_KEY_IDENTITY S-1-18-3 A SID that means the client's identity is asserted by an authentication authority based on proof of current possession of client public key credentials.<33> KEY_TRUST_IDENTITY S-1-18-4 A SID that means the client's identity is based on proof of possession of public key credentials using the key trust object.<34> KEY_PROPERTY_MFA S-1-18-5 A SID that means the key trust object had the multifactor authentication (MFA) property.<35> KEY_PROPERTY_ATTESTATION S-1-18-6 A SID that means the key trust object had the attestation property.<36> ACCESS_MASK An ACCESS_MASK is a 32-bit set of flags that are used to encode the user rights to an object. An access mask is used both to encode the rights to an object assigned to a principal and to encode the requested access when opening an object. The bits with an X value in the table below are used for object-specific user rights. A file object would encode, for example, Read Access and Write Access. A registry key object would encode Create Subkey and Read Value, for example. Note The bits with a value of X are reserved for use by specific protocols that make use of the ACCESS_MASK data type. The nature of this usage differs according to each protocol and is implementation-specific.
"GX" Generic Execute 0x20000000 "GA" Generic All 0x10000000 standard-rights-string: A set of SDDL-supported standard user rights. String Access right Hex value "WO" Owner 0x00080000 "WD" Write DAC 0x00040000 "RC" Read Control 0x00020000 "SD" Delete 0x00010000 object-specific-rights-string: A set of object-specific rights; some common ones are shown, but the it is recommended that the reader consult a specific protocol for applicable values, if any, in that protocol. String Object type Access right Hex value "FA" File File All Access 0x001F01FF "FX" File File Execute 0x001200A0 "FW" File File Write 0x00120116 "FR" File File Read 0x00120089 "KA" Registry Key Key All Access 0x000F003F "KR" Registry Key Key Read 0x00020019 "KX" Registry Key Key Execute 0x00020019 "KW" Registry Key Key Write 0x00020006 "CR" Directory Object Control Access 0x00000100 "LO" Directory Object List Object 0x00000080 "DT" Directory Object Delete Tree 0x00000040
Index A 55 59 60 55 42 57 60 62 57 42 52 55 80 82 42 42 42 42 13 42 42 B 42 42 42 42 42 C 13 42 42 148 89 87 42 42 14 28 16 42 42 38 42 42 42 D 14 14 28 16 38 90 42 42 42 42 42 42 42 42 E 42 42 42 28 29 42 42 135 F 13 31 G 8 42 42 42 32 31 H 42 I 42 136 42 12 42 8 42 L 32 42 42 42 42 42 13 42 31 34 35 33
M 87 42 42 42 42 42 42 42 33 N 42 42 42 11 42 42 42 42 O 33 42 12 42 42 P 55 82 28 89 87 42 42 28 29 31 31 32 33 87 33 42 42 42 142 42 42 41 34 85 34 35 41 67 38 86 38 38 R 42 42 42 42 42 References 12 11 13 13 42 42 42 42 42 41 39 34 S 42 42 136 136 90 82 85 34 35 42 42 42 41 38 135 63 66 SYSTEM_AUDIT_CALLBACK_OBJECT_ACE packet ( 64, 68) 66 67 69 70 38 T 42 42 42 42 86 148 U 38 38 42 31