How The Access Control Process Works

By Author: Shirley Green
Total Articles: 129
Comment this article

The access control process in Windows Server 2000 relies on the MCSE 2003 evaluation of the permissions set on an object and the security identifiers (SIDs) that are assigned to the security principal. Two separate data structures or collections of data are used in the evaluation process.
The data object is assigned a security descriptor, a construct that includes a Systems Access Control List (SACL) and a discretionary access control list (DACL). SACLs are used in auditing and will be discussed further in Lesson 3, "Analyzing Auditing Requirements." DACLS contain a number of Access Control Entries (ACEs). ACEs identify a permission and indicate to whom it is assigned. ACEs are assigned to objects at object creation and can be modified by a security principal with the change permissions permission. Each ACE contains a SID, a permission, and an action (either Allow or Deny).
Permissions are uniquely defined according to the type of object. For example, you can "read" a file, but you "query value" for a registry key. Although permissions for free CIW exam questions ...
... folders, and registry keys can be listed and defined in short tables, there are so many objects in the Active Directory and each one might have unique permissions that it is impossible to provide a comprehensive list of Active Directory object permissions within a document of any normal size. For explicit information on object permissions, see the "How to Design a Permission Structure for Files and Folders" and "How to Design a Permission Structure for Registry Keys" sections in this lesson and the "Guidelines for Designing the Delegation and Permission Structure for Active Directory Objects" section in Lesson 2.
An access token is created for the user or computer at logon. The access token is assigned to any process the security principal runs. Hence, when a user starts Microsoft Word, his access token is assigned to the running winword.exe process. You can see this by opening the Task Manager and adding the User Name column to the Processes tab. The access the user has to documents will depend on the permissions set on the documents and the contents of the access token. The access token contains a list of SIDs, including the SID of the security principal and the MCSE study guides free download of the groups of which the user account is a member.