How the Access Control Process Works
The access control process in Windows Server 2000 relies on the MCSE 2003 evaluation of the permissions set on an object and the security identifiers (SIDs) that are assigned to the security principal. Two separate data structures or collections of data are used in the evaluation process.
The data object is assigned a security descriptor, a construct that includes a Systems Access Control List (SACL) and a discretionary access control list (DACL). SACLs are used in auditing and will be discussed further in Lesson 3, “Analyzing Auditing Requirements.” DACLS contain a number of Access Control Entries (ACEs). ACEs identify a permission and indicate to whom it is assigned. ACEs are assigned to objects at object creation and can be modified by a security principal with the change permissions permission. Each ACE contains a SID, a permission, and an action (either Allow or Deny).
Permissions are uniquely defined according to the type of object. For example, you can “read” a file, but you “query value” for a registry key. Although permissions for free CIW exam questions, folders, and registry keys can be listed and defined in short tables, there are so many objects in the Active Directory and each one might have unique permissions that it is impossible to provide a comprehensive list of Active Directory object permissions within a document of any normal size. For explicit information on object permissions, see the “How to Design a Permission Structure for Files and Folders” and “How to Design a Permission Structure for Registry Keys” sections in this lesson and the “Guidelines for Designing the Delegation and Permission Structure for Active Directory Objects” section in Lesson 2.
An access token is created for the user or computer at logon. The access token is assigned to any process the security principal runs. Hence, when a user starts Microsoft Word, his access token is assigned to the running winword.exe process. You can see this by opening the Task Manager and adding the User Name column to the Processes tab.
Processing your request, Please wait....
