<div class="content" name="SECURITY_DESCRIPTOR" uuid="7d4dac05-9cef-4563-a058-f108abecce1d"><p>The SECURITY_DESCRIPTOR structure defines the security
attributes of an object. These attributes specify who owns the object; who can
access the object and what they can do with it; what level of audit logging can
be applied to the object; and what kind of restrictions apply to the use of the
security descriptor.</p><p>Security descriptors appear in one of two forms, absolute or
self-relative.</p><p>A security descriptor is said to be in absolute format if it
stores all of its security information via pointer fields, as specified in the
RPC representation in section <a href="f1e18167-3ddf-48ad-a3d4-b7e832f96b95" data-linktype="relative-path">2.4.6.1</a>.</p><p>A security descriptor is said to be in self-relative format
if it stores all of its security information in a contiguous block of memory
and expresses all of its pointer fields as offsets from its beginning. The
order of appearance of pointer target fields is not required to be in any
particular order; the location of  the OwnerSid, GroupSid, Sacl, and/or Dacl is
only based on OffsetOwner, OffsetGroup, OffsetSacl, and/or OffsetDacl pointers
found in the fixed portion of the relative security descriptor.<a id="Appendix_A_Target_72"></a><a aria-label="Product behavior note 72" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_72" data-linktype="relative-path">&lt;72&gt;</a></p><p>The self-relative form of the security descriptor is
required if one wants to transmit the SECURITY_DESCRIPTOR structure as an
opaque data structure for transmission in communication protocols over a wire,
or for storage on secondary media; the absolute form cannot be transmitted
because it contains pointers to objects that are generally not accessible to
the recipient.</p><p>When a self-relative security descriptor is transmitted over
a wire, it is sent in <a href="a66edeb1-52a0-4d64-a93b-2f5c833d7d92#gt_079478cb-f4c5-4ce5-b72b-2144da5d2ce7" data-linktype="relative-path">little-endian</a>
format and requires no padding.</p><table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="8">Revision</td>
  <td colspan="8">Sbz1</td>
  <td colspan="16">Control</td>
 </tr>
 <tr>
  <td colspan="32">OffsetOwner</td>
 </tr>
 <tr>
  <td colspan="32">OffsetGroup</td>
 </tr>
 <tr>
  <td colspan="32">OffsetSacl</td>
 </tr>
 <tr>
  <td colspan="32">OffsetDacl</td>
 </tr>
 <tr>
  <td colspan="32">OwnerSid (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">GroupSid (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Sacl (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Dacl (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
</tbody></table><p><b>Revision (1 byte): </b>An unsigned 8-bit value
that specifies the revision of the SECURITY_DESCRIPTOR structure. This field
MUST be set to one.</p><p><b>Sbz1 (1 byte): </b>An unsigned 8-bit value with no
meaning unless the <b>Control</b> RM bit is set to 0x1. If the RM bit is set to
0x1, <b>Sbz1</b> is interpreted as the <a href="a66edeb1-52a0-4d64-a93b-2f5c833d7d92#gt_a7d0361f-8608-454d-9a52-67d4d181ae09" data-linktype="relative-path">resource manager</a> control
bits that contain specific information<a id="Appendix_A_Target_73"></a><a aria-label="Product behavior note 73" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_73" data-linktype="relative-path">&lt;73&gt;</a> for the
specific resource manager that is accessing the structure. The permissible
values and meanings of these bits are determined by the implementation of the
resource manager.</p><p><b>Control (2 bytes): </b>An unsigned 16-bit field
that specifies control access bit flags. The Self Relative (SR) bit MUST be set
when the security descriptor is in self-relative format.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p><br/>
   0</p>
   </th>
   <th>
   <p><br/>
   1</p>
   </th>
   <th>
   <p><br/>
   2</p>
   </th>
   <th>
   <p><br/>
   3</p>
   </th>
   <th>
   <p><br/>
   4</p>
   </th>
   <th>
   <p><br/>
   5</p>
   </th>
   <th>
   <p><br/>
   6</p>
   </th>
   <th>
   <p><br/>
   7</p>
   </th>
   <th>
   <p><br/>
   8</p>
   </th>
   <th>
   <p><br/>
   9</p>
   </th>
   <th>
   <p>1<br/>
   0</p>
   </th>
   <th>
   <p><br/>
   1</p>
   </th>
   <th>
   <p><br/>
   2</p>
   </th>
   <th>
   <p><br/>
   3</p>
   </th>
   <th>
   <p><br/>
   4</p>
   </th>
   <th>
   <p><br/>
   5</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>S R</td>
  <td>R M</td>
  <td>P S</td>
  <td>P D</td>
  <td>S I</td>
  <td>D I</td>
  <td>S C</td>
  <td>D C</td>
  <td>S S</td>
  <td>D T</td>
  <td>S D</td>
  <td>S P</td>
  <td>D D</td>
  <td>D P</td>
  <td>G D</td>
  <td>O D</td>
 </tr></tbody></table>
</dd>
<dd>
<p>Where the bits are defined as:</p>
</dd>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Description</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>SR Self-Relative</td>
  <td>Set when the security descriptor is in self-relative format. Cleared when the security descriptor is in absolute format.</td>
 </tr><tr>
  <td>RM RM Control Valid</td>
  <td>Set to 0x1 when the Sbz1 field is to be interpreted as resource manager control bits.</td>
 </tr><tr>
  <td>PS SACL Protected</td>
  <td>Set when the SACL will be protected from inherit operations.</td>
 </tr><tr>
  <td>PD DACL Protected</td>
  <td>Set when the DACL will be protected from inherit operations.</td>
 </tr><tr>
  <td>SI SACL Auto-Inherited</td>
  <td>Set when the SACL was created through inheritance.</td>
 </tr><tr>
  <td>DI DACL Auto-Inherited</td>
  <td>Set when the DACL was created through inheritance.</td>
 </tr><tr>
  <td>SC SACL Computed Inheritance Required</td>
  <td>Set when the SACL is to be computed through inheritance. When both SC and SI are set, the resulting security descriptor sets SI; the SC setting is not preserved.</td>
 </tr><tr>
  <td>DC DACL Computed Inheritance Required</td>
  <td>Set when the DACL is to be computed through inheritance. When both DC and DI are set, the resulting security descriptor sets DI; the DC setting is not preserved.</td>
 </tr><tr>
  <td>SS Server Security</td>
  <td>Set when the caller wants the system to create a Server ACL based on the input ACL, regardless of its source (explicit or defaulting).</td>
 </tr><tr>
  <td>DT DACL Trusted</td>
  <td>Set when the ACL that is pointed to by the DACL field was provided by a trusted source and does not require any editing of compound ACEs.</td>
 </tr><tr>
  <td>SD SACL Defaulted</td>
  <td>Set when the SACL was established by default means.</td>
 </tr><tr>
  <td>SP SACL Present</td>
  <td>Set when the SACL is present on the object.</td>
 </tr><tr>
  <td>DD DACL Defaulted</td>
  <td>Set when the DACL was established by default means.</td>
 </tr><tr>
  <td>DP DACL Present</td>
  <td>Set when the DACL is present on the object.</td>
 </tr><tr>
  <td>GD Group Defaulted</td>
  <td>Set when the group was established by default means.</td>
 </tr><tr>
  <td>OD Owner Defaulted</td>
  <td>Set when the owner was established by default means.</td>
 </tr></tbody></table>
</dd></dl><p><b>OffsetOwner (4 bytes): </b>An unsigned 32-bit
integer that specifies the offset to the <a href="78eb9013-1c3a-4970-ad1f-2b1dad588a25" data-linktype="relative-path">SID</a>. This SID specifies
the owner of the object to which the security descriptor is associated. This
must be a valid offset if the OD flag is not set. If this field is set to zero,
the <b>OwnerSid</b> field MUST not be present.</p><p><b>OffsetGroup (4 bytes): </b>An unsigned 32-bit
integer that specifies the offset to the SID. This SID specifies the group of
the object to which the security descriptor is associated. This must be a valid
offset if the GD flag is not set. If this field is set to zero, the <b>GroupSid</b>
field MUST not be present.</p><p><b>OffsetSacl (4 bytes): </b>An unsigned 32-bit
integer that specifies the offset to the <a href="20233ed8-a6c6-4097-aafa-dd545ed24428" data-linktype="relative-path">ACL</a> that contains system
ACEs. Typically, the system ACL contains auditing ACEs (such as <a href="9431fd0f-5b9a-47f0-b3f0-3015e2d0d4f9" data-linktype="relative-path">SYSTEM_AUDIT_ACE</a>, <a href="bd6b6fd8-4bef-427e-9a43-b9b46457e934" data-linktype="relative-path">SYSTEM_AUDIT_CALLBACK_ACE</a>,
or <a href="949b02e7-f55d-4c26-969f-52a009597469" data-linktype="relative-path">SYSTEM_AUDIT_CALLBACK_OBJECT_ACE</a>),
and at most one Label ACE (as specified in section <a href="25fa6565-6cb0-46ab-a30a-016b32c4939a" data-linktype="relative-path">2.4.4.13</a>). This must be a
valid offset if the SP flag is set; if the SP flag is not set, this field MUST
be set to zero. If this field is set to zero, the <b>Sacl</b> field MUST not be
present.</p><p><b>OffsetDacl (4 bytes): </b>An unsigned 32-bit
integer that specifies the offset to the ACL that contains ACEs that control
access. Typically, the DACL contains ACEs that grant or deny access to
principals or groups. This must be a valid offset if the DP flag is set; if the
DP flag is not set, this field MUST be set to zero. If this field is set to
zero, the <b>Dacl</b> field MUST not be present.</p><p><b>OwnerSid (variable): </b>The SID of the owner of
the object. The length of the SID MUST be a multiple of 4. This field MUST be
present if the <b>OffsetOwner</b> field is not zero.</p><p><b>GroupSid (variable): </b>The SID of the group of
the object. The length of the SID MUST be a multiple of 4. This field MUST be
present if the <b>GroupOwner</b> field is not zero.<a id="Appendix_A_Target_74"></a><a aria-label="Product behavior note 74" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_74" data-linktype="relative-path">&lt;74&gt;</a> </p><p><b>Sacl (variable): </b>The <a href="a66edeb1-52a0-4d64-a93b-2f5c833d7d92#gt_c189801e-3752-4715-88f4-17804dad5782" data-linktype="relative-path">SACL</a> of the object. The
length of the SID MUST be a multiple of 4. This field MUST be present if the SP
flag is set.</p><p><b>Dacl (variable): </b>The <a href="a66edeb1-52a0-4d64-a93b-2f5c833d7d92#gt_d727f612-7a45-48e4-9d87-71735d62b321" data-linktype="relative-path">DACL</a> of the object. The
length of the SID MUST be a multiple of 4. This field MUST be present if the DP
flag is set. </p></div>