4/10/2009 10.1 Minor Clarified the meaning of the technical content. 5/22/2009 11.0 Major Updated and revised the technical content. 7/2/2009 11.1 Minor Clarified the meaning of the technical content. 8/14/2009 11.2 Minor Clarified the meaning of the technical content. 9/25/2009 12.0 Major Updated and revised the technical content. 11/6/2009 12.1 Minor Clarified the meaning of the technical content. 12/18/2009 12.2 Minor Clarified the meaning of the technical content. 1/29/2010 13.0 Updated and revised the technical content. 3/12/2010 13.1 Minor Clarified the meaning of the technical content. 4/23/2010 13.2 Clarified the meaning of the technical content. 6/4/2010 14.0 Major Updated and revised
the technical content. 7/16/2010 15.0 Major Updated and revised the technical content. 8/27/2010 16.0 Major Updated and revised the technical content. 10/8/2010 17.0 Updated and revised the technical content. 11/19/2010 18.0 Major Updated and revised the technical content. 1/7/2011 19.0 Major Updated and revised the technical content. 2/11/2011 20.0 Major Updated and revised the technical content. 3/25/2011 21.0 Major Updated and revised the technical content. 5/6/2011 21.1 Minor Clarified the meaning of the technical content. 6/17/2011 22.0 Major Updated and revised the technical content. 9/23/2011 22.0 None No changes to the meaning, language,
SV_TYPE_NOVELL 0x00000080 A Novell server. SV_TYPE_DOMAIN_MEMBER 0x00000100 A LAN Manager 2.x domain member. SV_TYPE_PRINTQ_SERVER 0x00000200 A server sharing print queue. SV_TYPE_DIALIN_SERVER 0x00000400 A server running a dial-in service. SV_TYPE_XENIX_SERVER 0x00000800 A Xenix server. SV_TYPE_NT 0x00001000 Windows Server 2003, Windows XP, Windows 2000, or Windows NT operating system. SV_TYPE_WFW 0x00002000 A server running Windows for Workgroups. SV_TYPE_SERVER_MFPN 0x00004000 Microsoft File and for NetWare. SV_TYPE_SERVER_NT 0x00008000 Windows Server 2003, Windows 2000 Server operating system, or a server that is not a domain controller. SV_TYPE_POTENTIAL_BROWSER 0x00010000 A server that can run the browser service. SV_TYPE_BACKUP_BROWSER 0x00020000 A server running a browser service as backup. SV_TYPE_MASTER_BROWSER 0x00040000 A server running the master browser service. SV_TYPE_DOMAIN_MASTER 0x00080000 A server running the domain master browser. SV_TYPE_WINDOWS 0x00400000 Windows Millennium Edition operating system, Microsoft Windows 98 operating system, or Windows 95. SV_TYPE_TERMINALSERVER 0x02000000 Terminal Server. SV_TYPE_CLUSTER_VS_NT 0x04000000 Cluster virtual servers available in the domain. SV_TYPE_LOCAL_LIST_ONLY 0x40000000 Servers maintained by the browser. SV_TYPE_DOMAIN_ENUM 0x80000000 Primary domain. SV_TYPE_ALL All servers.
ACE An access control (ACE) is used to encode the user rights afforded to a principal, either a user or group. This is generally done by combining an and the of the principal. There are some variations to accommodate other groupings, which are specified in the following sections. ACE_HEADER The ACE_HEADER structure defines the type and size of an access control entry (ACE). 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 AceType AceFlags AceSize AceType (1 byte): An unsigned 8-bit integer that specifies the ACE types. This field MUST be one of the following values. Value Meaning ACCESS_ALLOWED_ACE_TYPE 0x00 Access-allowed ACE that uses the structure. ACCESS_DENIED_ACE_TYPE 0x01 Access-denied ACE that uses the structure. SYSTEM_AUDIT_ACE_TYPE 0x02 ACE that uses the structure. SYSTEM_ALARM_ACE_TYPE 0x03 Reserved for future use. ACCESS_ALLOWED_COMPOUND_ACE_TYPE 0x04 Reserved for future use. ACCESS_ALLOWED_OBJECT_ACE_TYPE 0x05 Object-specific access-allowed ACE that uses the structure.<37> ACCESS_DENIED_OBJECT_ACE_TYPE 0x06 Object-specific access-denied ACE that uses the structure.<38> SYSTEM_AUDIT_OBJECT_ACE_TYPE 0x07 Object-specific system-audit ACE that uses the structure.<39> SYSTEM_ALARM_OBJECT_ACE_TYPE 0x08 Reserved for future use. ACCESS_ALLOWED_CALLBACK_ACE_TYPE 0x09 Access-allowed callback ACE that uses the structure.<40> ACCESS_DENIED_CALLBACK_ACE_TYPE 0x0A Access-denied callback ACE that uses the structure.<41> ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE 0x0B Object-specific access-allowed callback ACE that uses the structure.<42> ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE Object-specific access-denied callback ACE that uses the structure.<43>
AceSize (2 bytes): An unsigned 16-bit integer that specifies the size, in bytes, of the ACE. The AceSize field can be greater than the sum of the individual fields, but MUST be a multiple of 4 to ensure alignment on a boundary. In cases where the AceSize field encompasses additional data for the callback ACEs types, that data is implementation-specific. Otherwise, this additional data is not interpreted and MUST be ignored. ACE_HEADER--RPC representation The RPC representation of the defines the type and size of an . The members and values are as specified in section 2.4.4.1. typedef struct _ACE_HEADER { AceType; UCHAR AceFlags; USHORT AceSize; } ACE_HEADER, *PACE_HEADER; ACCESS_ALLOWED_ACE The ACCESS_ALLOWED_ACE structure defines an ACE for the discretionary access control list (DACL) that controls access to an object. An access-allowed ACE allows access to an object for a specific trustee identified by a security identifier (SID). 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 Header Mask Sid (variable) ... Header (4 An structure that specifies the size and type of ACE. It also contains flags that control inheritance of the ACE by child objects. Mask (4 bytes): An that specifies the user rights allowed by this ACE. Sid (variable): The of a trustee. The length of the SID MUST be a multiple of 4. ACCESS_ALLOWED_OBJECT_ACE The ACCESS_ALLOWED_OBJECT_ACE structure defines an ACE that controls allowed access to an object, a property set, or property. The ACE contains a set of access rights, a GUID that identifies the type of object, and a that identifies the trustee to whom the system will grant access. The ACE also contains a GUID and a set of flags that control inheritance of the ACE by child objects. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 Header Mask
OWNER_SECURITY_INFORMATION 0x00000001 The owner identifier of the object is being referenced. GROUP_SECURITY_INFORMATION 0x00000002 The primary group identifier of the object is being referenced. DACL_SECURITY_INFORMATION 0x00000004 The DACL of the object is being referenced. SACL_SECURITY_INFORMATION 0x00000008 The SACL of the object is being referenced. LABEL_SECURITY_INFORMATION 0x00000010 The mandatory integrity label is being referenced. UNPROTECTED_SACL_SECURITY_INFORMATION 0x10000000 The SACL inherits access control entries (ACEs) from the parent object. UNPROTECTED_DACL_SECURITY_INFORMATION 0x20000000 The DACL inherits ACEs from the parent object. PROTECTED_SACL_SECURITY_INFORMATION 0x40000000 The SACL cannot inherit ACEs. PROTECTED_DACL_SECURITY_INFORMATION 0x80000000 The DACL cannot inherit ACEs. ATTRIBUTE_SECURITY_INFORMATION A (section 2.4.4.15)
Initialize InheritableACL to Empty ACL IF (IsContainerObject = TRUE) THEN FOR each ACE in ACL DO IF ACE.AceFlags does not contain NO_PROPAGATE_INHERIT_ACE THEN IF((ACE.AceFlags contains CONTAINER_INHERIT_ACE) OR (ACE.AceFlags contains OBJECT_INHERIT_ACE)) THEN Set NewACE to ACE Add INHERITED_ACE to NewACE.AceFlags Add INHERIT_ONLY_ACE to NewACE.AceFlags Append NewACE to InheritableACL ENDIF END FOR ENDIF RETURN concatenation of ExplicitACL and InheritableACL // END ComputeInheritedACLFromParent There are seven flags that can appear in an ACE. Of the seven flags, the following pertain to inheritance. CI: CONTAINER_INHERIT_ACE OI: OBJECT_INHERIT_ACE NP: NO_PROPAGATE_INHERIT_ACE IO: INHERIT_ONLY_ACE ID: INHERITED_ACE IO and ID do not play a part when it comes to making decisions about inheritance. The ID flag is added to any ACE that is inherited to indicate that it was inherited. The IO flag is used to indicate that an ACE is not effective for the child that inherits the ACE. An ACE that has the IO flag can be inherited, but the decision is based on other flags, if present. The following table summarizes the inherited ACE flags for the child container and child leaf object based on the parent ACE flags. Parent ACE flags Child container object Child leaf object No Flags, IO No Inheritance No Inheritance OI IO,OI Inherited, No OI,NP No Inheritance Inherited, No flags CI CI No Inheritance CI,NP Inherited, No flags No Inheritance CI,OI IO,CI,OI Inherited, No flags CI,OI,NP Inherited, No flags Inherited, No For the cases in which a container inherits an ACE that is both effective on the container and inheritable by its descendents, the container can inherit two ACEs. This occurs when an inheritable
Index A 55 59 60 55 42 57 60 62 57 42 52 55 80 82 42 42 42 42 13 42 42 B 42 42 42 42 42 C 13 42 42 148 89 87 42 42 14 28 16 42 42 38 42 42 42 D 14 14 28 16 38 90 42 42 42 42 42 42 42 42 E 42 42 42 28 29 42 42 135 F 13 31 G 8 42 42 42 32 31 H 42 I 42 136 42 12 42 8 42 L 32 42 42 42 42 42 13 42 31 34 35 33
M 87 42 42 42 42 42 42 42 33 N 42 42 42 11 42 42 42 42 O 33 42 12 42 42 P 55 82 28 89 87 42 42 28 29 31 31 32 33 87 33 42 42 42 142 42 42 41 34 85 34 35 41 67 38 86 38 38 R 42 42 42 42 42 References 12 11 13 13 42 42 42 42 42 41 39 34 S 42 42 136 136 90 82 85 34 35 42 42 42 41 38 135 63 66 SYSTEM_AUDIT_CALLBACK_OBJECT_ACE packet ( 64, 68) 66 67 69 70 38 T 42 42 42 42 86 148 U 38 38 42 31