5.15 Windows ACL's

5.15 Windows ACL's

1. ACL's are a convenient way of associating subjects with access rights

   • In essence a Windows ACL associate an SID (used to ID a subject) with a set of permissions (access rights)
     • ACL consists of zero or more access control entries

2. DACL

   • Discretionary Access Control List
     • Defines who can access and how they can access an object
       • Purpose is to protect the object from unauthorised access
         • IF an object has no DACL access is granted because the object is assumed to be unprotected
     • Each DACL has an ACE (access control entry) to identify who can access it
       • If there are no ACE's then no one can get access, requests will be denied

3. SACL

   • System Access Control List
     • Defines which access requests should be recorded in an audit log

4. Access Control Entries (ACE)

   • 3 Types
     • Access denied
       • Permissions are denied to the principal in the SID
     • Access Allowed
       • Permissions are allowed to the principal in the SID
     • System Audit
       • An audit record is created when these permissions are requested by the principal identified in the SID
   • Contains a SID, permissions mask and inheritance mask
   • Win 2K also includes object specific ACE's
     • These can only be included in ACL's of AD objects
       • Like generic ACE they can also be access denied, allowed or audit
         • But also include some object specific types