ACL in Active Directory: ACE types and control rights

Deep Dive into ACL in Active Directory: ACE Types, ACCESS_MASK, and Control Access Rights

Active Directory uses 22 ACE types, grouped into 4 categories for access management. The first type includes ACCESS_ALLOWED_ACE_TYPE, ACCESS_DENIED_ACE_TYPE, SYSTEM_AUDIT_ACE_TYPE, SYSTEM_MANDATORY_LABEL_ACE_TYPE, and SYSTEM_SCOPED_POLICY_ID_ACE_TYPE. These ACEs operate on ACCESS_MASK and the subject's SID, applying basic permissions and denials.

The second type—ACCESS_ALLOWED_OBJECT_ACE_TYPE and ACCESS_DENIED_OBJECT_ACE_TYPE—expands capabilities. It supports ACCESS_MASK, GUIDs for extended rights, and inheritance to child objects. This type dominates in AD due to its flexibility.

The third type (ACCESS_ALLOWED_CALLBACK_ACE_TYPE, ACCESS_DENIED_CALLBACK_ACE_TYPE, SYSTEM_AUDIT_CALLBACK_ACE_TYPE, SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE) adds conditional expressions to ACCESS_MASK and SID. Logical rules evaluate the access token—for example, restricting access based on device claims.

The fourth type combines object ACEs with conditional expressions: ACCESS_ALLOWED_CALLBACK_OBJECT_ACE, ACCESS_DENIED_CALLBACK_OBJECT_ACE, SYSTEM_AUDIT_CALLBACK_OBJECT_ACE, SYSTEM_AUDIT_OBJECT_ACE_TYPE. However, conditional expressions are ignored by verification mechanisms here.

Absence of GENERIC Rights in Security Descriptors

ACCESS_MASK is a 32-bit field where individual bits define rights. Standard mappings include GENERIC_READ, GENERIC_WRITE, and GENERIC_ALL, but these bits are prohibited in security descriptors. Setting them leads to unpredictable results and they are ignored by the authorization algorithm.

GENERIC bits matter during access checks via AccessCheckByTypeResultListAndAuditAlarmByHandle with GenericMapping. This parameter maps GENERIC rights to object-specific rights. AD defines its own mappings separately, which differ from those for the file system or services.

When creating an ACE, GENERIC bits are blocked. In practice, GENERIC_ALL is just a combination of object-specific bits based on AD's standard mapping.

ACCESS_MASK Flags and Control Access Rights

Key flags:

• RIGHT_DS_CREATE_CHILD / RIGHT_DS_DELETE_CHILD: objectGUID is the schemaID of the child type (e.g., computer in OU=Computers). Without a GUID—applies to all types.
• RIGHT_DS_LIST_CONTENTS: reading children; objectGUID ignored.
• RIGHT_DS_WRITE_PROPERTY_EXTENDED: objectGUID for validated writes, but checked by attribute name.
• RIGHT_DS_READ_PROPERTY / RIGHT_DS_WRITE_PROPERTY: objectGUID is a property set or schemaID. Without GUID—all properties.
• RIGHT_DS_DELETE_TREE: deleting object trees.
• RIGHT_DS_LIST_OBJECT: object visibility in List Object mode (dSHeuristics).
• RIGHT_DS_CONTROL_ACCESS: objectGUID for extended rights. Without GUID—all.

Control Access Rights: Extended Rights, Validated Writes, Property Sets

Control access rights fall into three categories:

• Extended Rights—rights to perform actions (e.g., domain synchronization).
• Validated Writes—modifying specific attributes with validation checks.
• Property Sets—access to groups of attributes for more compact ACLs.

AllExtendedRights on a computer object doesn't grant write access to msDS-AllowedToActOnBehalfOfOtherIdentity (RBCD). This is a validated write from the User-Account-Restrictions property set (GUID=4c164200-20c0-11d0-a768-00aa006e0529). It requires separate WRITE_PROPERTY or property set rights.

ACE Inheritance in the AD Hierarchy

ACEs with flags like OBJECT_INHERIT_ACE, CONTAINER_INHERIT_ACE, NO_PROPAGATE_INHERIT_ACE, INHERIT_ONLY_ACE, and INHERITED_ACE propagate to children. Simple types inherit to any containers. Object ACEs (with GUID) are restricted by InheritedObjectType.

Key Takeaways

• 22 ACE types grouped into 4 categories: basic, object, callback, and object callback.
• GENERIC-* bits aren't stored in the SD; they're only used for mapping during checks.
• Control access rights include extended rights (actions), validated writes (attributes), and property sets (groups).
• RBCD requires validated write rights, not covered by AllExtendedRights.
• ACE inheritance is managed by flags and InheritedObjectType for precise control.

— Editorial Team