Win32 System Services: The Heart of Windows® 98 and Windows® 2000

13.5. Securable Objects and Access Rights

When you create an access mask in an ACE you can specify standard rights, which apply to any Windows 2000 object, and you can also pick extremely specific rights that apply to individual objects. For example, if you want to give the user "smith" the right to delete an object, then create an ACE giving "smith" the standard right DELETE. If, on the other hand, you want the user "jones" to be able to modify the state of a semaphore object, create an ACE giving "jones" the semaphore-specific right SEMAPHORE_MODIFY_STATE.

All of the different access rights are simply bit definitions that get ORed into the 32-bit access mask. The first 16 bits hold specific rights and are keyed to the object that the access ...