SDDL syntax in secedit security templates

Friday, March 7, 2008

My summary of the SDDL syntax and security templates with regards to inheritance:

The second column in a security template entry dictates the action on existing explicit ACE's, 0 will merge, 2 will overwrite (and 1 is used during OS install).
DACL flags, P - Protected against inheriting from above, AI - Automatically propagate the ACL to child objects (assuming P not set deeper), AR - same as AR but checks if the file system supports automatic propagation of inheritable ACE's (eg. NT4)
ACE OI - Object Inherit, subordinate files will inherit the ACE - including files deeper in the tree (unless NP is set). Equivalent to 'This folder and files' in the GUI.
ACE CI - Container Inherit, subordinate containers will inherit the ACE - including directories deeper in the tree (unless NP is set). Direct children will inherit the ACE. Equivalent to 'This folder and subfolders' in the GUI.
ACE OICI - Combination of OI an CI above. Equivalent to 'This folder, subfolders, and files' in the GUI
ACE NP - Non-propagate, subordinate objects will not propagate the inherited ACE any further

For example:
SDDL:

"C:\Test\",0,"D:PAR(A;OICI;FA;;;BA)(A;OICINP;0x1200a9;;;BU)(A;OICI;FA;;;SY)"

"C:\Test\AAAA",0,"D:AR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;BU)(A;OICI;FA;;;SY)"

"C:\Test\BBBB",0,"D:PAR(A;OICI;FA;;;BA)(A;OI;0x1301bf;;;BU)(A;OICI;FA;;;SY)"

"C:\Test\CCCC",2,"D:(A;OICI;FA;;;BA)(A;CI;0x1200a9;;;BU)(A;OICI;FA;;;SY)"

Explanation:

C:\Test - Protected from above, Auto-inherit below, merge with explicit ACL, Users:R for 'This folder, subfolders, and files' and non-propagate on the ACE. This will ensure access to the root, sub-folders and files in the root for all users, except for any secured sub-folders not inherit this ACE.
C:\Test\AAAA - Allow inherit from above (not protected), auto-inherit below, merge with explicit ACL, Users:R.
C:\Test\BBBB - Protected from above, auto-inherit below, merge with explicit ACL, Users:C to subordinate files, but not containers - 'This folder and files'
C:\Test\CCCC - Allow inherit from above (not protected), do not automatically propagate deeper (no AR), overwrite explicit ACL, container inherit - 'This folder and subfolders'

Note that to apply such a security template on a remote machine, you could run (assuming the security template location):

psexec \\%server% secedit /configure /db c:\windows\temp\%random%.sdb /cfg c:\windows\security\templates\%template%.inf /log c:\windows\temp\Configure.log

References:

Win32_SecurityDescriptor Class