Re: Inheritable/Can Propagate ?

From: ambharish (ambharish_at_discussions.microsoft.com)
Date: 01/29/05

  • Next message: ambharish: "Re: Security for Windows 2000 Server" 
    Date: Sat, 29 Jan 2005 07:53:02 -0800

    Roger
     
    Thanks for fundas !!!

    The Security guide(Securing Windows 2000 Server.pdf)that was downloaded from
    http://www.microsoft.com/downloads/details.aspx?FamilyId=9964CF42-E236-4D73-AEF4-7B4FDC0A25F6&displaylang=en

    has the following info for each registry(Registry permissions(Appendis B)
    given at page 378)

    Permissions Apply
    Configure & Propagate
    Configure & Replace
    Do Not Replace
    Inheritable/Can Propagate

    I could understand all of them but except "Inheritable/Can Propagate"
    this is what i was talking about

    I mapped "Inheritable/Can Propagate" to
    Allow inheritable permissions from parent to propagate to this object checkbox

    but felt its ambiguous
    as this(Inheritable/Can Propagate) was selected only when "Do Not Replace"
    was selected

    could u please tell me know where does this(Inheritable/Can Propagate) fit
    in DACL Editor

    any help will be greatly appreciated

    Thanks in advance

    Cheers,
    ambharish

    "Roger Abell" wrote:

    > I am not quite sure this will answer you.
    > In the NTFS DACL editor one set the inheritance properties
    > of an ACE by use of the advance edit view, where one then
    > gains access to the dropbox having selections for what the
    > highlighted ACE applies to, such as
    > This folder, subfolders, and files (i.e. this gets inherited)
    > This folder only (i.e. this is not inherited)
    > etc.
    > Some aspects of the selections in this dropbox control whether
    > the ACE is applicable only for objects (i.e. files) or for contaniners
    > (i.e. folders) or both.
    > There are also two checkboxes that impact the inheritance
    > characteristics of the ACLing. One blocks inheritance from
    > above, so that any inheritable ACE in the parental chain will
    > not inherit onto what is having its ACL edited (or any children).
    > The other box causes the ACL being edited to get applied to
    > its children, not a direct copy onto, but a "forced" inheritance
    > on down of what is inherited. This is different from just
    > applying the new ACL and letting it inherit as the case may
    > be due to the contained ACEs in that use of this checkbox
    > will also clear any points in the child structure where the
    > inheritance is blocked and will remove any explicit ACEs
    > set in the child structure.
    > In SDDL, the inheritace is represented in the OI, CI, and IO
    > strings you will see. The best way to become familiar with
    > the SDDL representation is to use the Security Templates
    > MMC snap-in to define some different ACLs and then to
    > save the template and look at it with notepad to see how the
    > different choices have been encoded. Learning by example
    > is often more direct than by trying to decode the effect of
    > what is documented in the MSDN statements of the SDDL
    > specification.
    >
    > --
    > Roger Abell
    > Microsoft MVP (Windows Security)
    > MCSE (W2k3,W2k,Nt4) MCDBA
    > "ambharish" <ambharish@discussions.microsoft.com> wrote in message
    > news:C0745901-280B-4899-BD55-53C49C2915C5@microsoft.com...
    > > I want to use Microsoft Solutions for Security (Securing Windows 2000
    > > Server.pdf) securiyt guide to harden my Domain Server
    > >
    > > I feel this is a fundooo security guide
    > >
    > > I have a small question about the recommendations for Registries given in
    > > appendix B
    > >
    > > I want to know where does "Inheritable/Can Propagate" fit ?
    > > (either in DACL editor or SDDL)
    > >
    > > Thanks in advance !!!
    > >
    > > Cheers,
    > > Shekar
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    >
    >
    >

  • Next message: ambharish: "Re: Security for Windows 2000 Server"

    Relevant Pages

    • Re: Export schema
      ... Put an inheritable ACE ... and on any newly created ones (unless they are protected from inheritance). ... > I get that the security on attributes is actually defined as a mask at ... You can't "add to" a defaultSecurityDescriptor, ...
      (microsoft.public.windows.server.active_directory)
    • Re: Inheritable/Can Propagate ?
      ... In the NTFS DACL editor one set the inheritance properties ... of an ACE by use of the advance edit view, ... In SDDL, the inheritace is represented in the OI, CI, and IO ... Microsoft MVP (Windows Security) ...
      (microsoft.public.win2000.security)
    • Re: programmatically change permissions on folder in windows?
      ... as seen in the Adv / Edit drill-in, then the new ACE ... if inheritance is blocked at some ... > programmatically change permissions on folder in windows ... > Then folder> security> Advanced> Permissions> Replace permission entries ...
      (microsoft.public.win2000.security)
    • Re: File permissons
      ... here since the mdb is marked to block inheritance. ... Microsoft MVP (Windows Security) ... > MyDocuments folder and then moves it to the C:\MyApp folder. ... >> Moving a file within a partition takes the permissions ...
      (microsoft.public.win2000.security)
    • Re: Is it possible to secure private objects with hierarchical relationship with taking hierarchy in
      ... whether changes later in the security descriptor of parent will be somehow ... > descriptor of the parent object. ... >> inherit rights and to define the hierarchy for this inheritance is the ...
      (microsoft.public.platformsdk.security)