COM+ Unleashed

Windows Security

Windows provides security to a variety of object types: files, devices, processes, threads, semaphores, shared memory, registry keys, and more. In order to implement this security, every newly made object is created with a security descriptor. It would be very difficult to manage every object over every NT workstation, so NT simplifies security by dividing NT workstations into domains.

The combination of Owner (owning SID), list of principals (DACL), and list of principals to audit (SACL) is called a security descriptor (SD). A security descriptor completely describes the security policy in terms of object owner, access, and auditing. The security descriptor (in its self-relative form) is a memory structure that references its ...