Re: Inheritable/Can Propagate ?

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 01/28/05 

Date: Fri, 28 Jan 2005 08:13:39 -0700

I am not quite sure this will answer you.
In the NTFS DACL editor one set the inheritance properties
of an ACE by use of the advance edit view, where one then
gains access to the dropbox having selections for what the
highlighted ACE applies to, such as
This folder, subfolders, and files (i.e. this gets inherited)
This folder only (i.e. this is not inherited)
etc.
Some aspects of the selections in this dropbox control whether
the ACE is applicable only for objects (i.e. files) or for contaniners
(i.e. folders) or both.
There are also two checkboxes that impact the inheritance
characteristics of the ACLing. One blocks inheritance from
above, so that any inheritable ACE in the parental chain will
not inherit onto what is having its ACL edited (or any children).
The other box causes the ACL being edited to get applied to
its children, not a direct copy onto, but a "forced" inheritance
on down of what is inherited. This is different from just
applying the new ACL and letting it inherit as the case may
be due to the contained ACEs in that use of this checkbox
will also clear any points in the child structure where the
inheritance is blocked and will remove any explicit ACEs
set in the child structure.
In SDDL, the inheritace is represented in the OI, CI, and IO
strings you will see. The best way to become familiar with
the SDDL representation is to use the Security Templates
MMC snap-in to define some different ACLs and then to
save the template and look at it with notepad to see how the
different choices have been encoded. Learning by example
is often more direct than by trying to decode the effect of
what is documented in the MSDN statements of the SDDL
specification. 

-- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"ambharish" <ambharish@discussions.microsoft.com> wrote in message
news:C0745901-280B-4899-BD55-53C49C2915C5@microsoft.com...
> I want to use Microsoft Solutions for Security (Securing Windows 2000
> Server.pdf) securiyt guide to harden my Domain Server
>
> I feel this is a fundooo security guide
>
> I have a small question about the recommendations for Registries given in
> appendix B
>
> I want to know where does "Inheritable/Can Propagate" fit ?
> (either in DACL editor or SDDL)
>
> Thanks in advance !!!
>
> Cheers,
> Shekar
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

Relevant Pages

  • Re: Export schema
    ... Put an inheritable ACE ... and on any newly created ones (unless they are protected from inheritance). ... > I get that the security on attributes is actually defined as a mask at ... You can't "add to" a defaultSecurityDescriptor, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Inheritable/Can Propagate ?
    ... The Security guidethat was downloaded from ... I could understand all of them but except "Inheritable/Can Propagate" ... > In the NTFS DACL editor one set the inheritance properties ... > of an ACE by use of the advance edit view, ...
    (microsoft.public.win2000.security)
  • Re: programmatically change permissions on folder in windows?
    ... as seen in the Adv / Edit drill-in, then the new ACE ... if inheritance is blocked at some ... > programmatically change permissions on folder in windows ... > Then folder> security> Advanced> Permissions> Replace permission entries ...
    (microsoft.public.win2000.security)
  • Verifying if ntfs files/folders rights are inherited or not...
    ... folders where inheritance have been removed or altered with explicit ntfs ... I don't know how to manipulate the ace flags to know if the ... For child objects that are containers, ... ' Retrieve the content of Win32_SecurityDescriptor DACL property. ...
    (microsoft.public.scripting.vbscript)
  • [PATCH 002 of 9] knfsd: nfsd4: relax checking of ACL inheritance bits
    ... The rfc allows us to be more permissive about the ACL inheritance bits we ... "If the server supports a single "inherit ACE" flag that applies to ... Let's take the latter option--the ACL is a complex attribute that could be ...
    (Linux-Kernel)