Null and Empty DACLs

What occurs when the Security Group Policy CSE encounters a null DACL

Ask the Directory Services Team — Tue, 02 Jun 2009 17:03:13 GMT

The Group Policy security client side extension can distribute security descriptors on files and registry

re: Null and Empty DACLs

MikeStephensMSFT — Tue, 02 Jun 2009 15:16:55 GMT

Hello jlupolt,

Unfortunately, the ACL editor within Windows shows the interpreted permission of the null or empty DACL. The command line utility cacls.exe does report a null DACL by displaying "No permissions are set." I have an upcoming post that includes a script that specifically looks for null DACLs within nested folders.

re: Null and Empty DACLs

HelgeKlein — Tue, 02 Jun 2009 12:30:24 GMT

Thanks for the article Mike.

If you want to detect NULL vs. empty ACLs you can use my open source tool SetACL (http://setacl.sourceforge.net/).

You might also be interested in my "primer" article on Windows permissions where I also explain the differences between NULL and empty ACLs:

http://blogs.sepago.de/helge/2009/03/12/permissions-a-primer-or-dacl-sacl-owner-sid-and-ace-explained/

re: Null and Empty DACLs

jlupolt — Mon, 01 Jun 2009 22:41:28 GMT

Thanks for this. How can a sysadmin tell the difference between an object with a null DACL and an object with an empty DACL? Would the permissions look the same if viewed in Explorer?

Ask the Directory Services Team : Null and Empty DACLs

Ask the Directory Services Team : Null and Empty DACLs — Mon, 01 Jun 2009 21:34:09 GMT

PingBack from http://www.tscmpro.com/?p=4246