{"id":106640,"date":"2022-05-10T07:00:00","date_gmt":"2022-05-10T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=106640"},"modified":"2022-05-10T07:29:34","modified_gmt":"2022-05-10T14:29:34","slug":"20220510-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20220510-00\/?p=106640","title":{"rendered":"A brief summary of the various versions of the Security Descriptor Definition Language (SDDL)"},"content":{"rendered":"

The Security Descriptor Definition Language (SDDL) was introduced in Windows 2000 to provide a textual representation for security descriptors. Prior to its introduction, security descriptors were typically represented as hex bytes, which was not particularly readable or editable.<\/p>\n

Although the only defined revision number is 1, there have actually been quite a few revisions to the Security Descriptor Definition Language, which makes you wonder what that version number was for. The fact that the version number hasn’t changed when the language changed means that if you call Convert\u00adSecurity\u00adDescriptor\u00adTo\u00adString\u00adSecurity\u00adDescriptor<\/code>, you will get a string security descriptor that works on the version of Windows that generated it, but it may not work on older versions of Windows, because the older versions may not support some of the newer features.<\/p>\n

Oops.<\/p>\n

Okay, so here’s a history of the Security Descriptor Definition Language, in table form.<\/p>\n

SDDL Component Tags<\/b><\/p>\n\n\n\n\n\n\n\n
Code<\/th>\nMeaning
\nSymbol<\/th>\n		Introduced<\/th>\n<\/tr>\n
O<\/td>\nOwner
\nSDDL_OWNER<\/code>
\nOWNER_SECURITY_INFORMATION<\/code><\/td>\n		Windows 2000<\/td>\n<\/tr>\n
G<\/td>\nGroup
\nSDDL_GROUP<\/code>
\nGROUP_SECURITY_INFORMATION<\/code><\/td>\n<\/tr>\n
D<\/td>\nDACL
\nSDDL_DACL<\/code>
\nDACL_SECURITY_INFORMATION<\/code><\/td>\n<\/tr>\n
S<\/td>\nSACL
\nSDDL_SACL<\/code>
\nSACL_SECURITY_INFORMATION<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SDDL Security Descriptor Controls<\/b><\/p>\n\n\n\n\n\n\n\n
Code<\/th>\nMeaning<\/th>\nIntroduced<\/th>\n<\/tr>\n
P<\/td>\nProtected
\nSDDL_PROTECTED<\/code>
\nSE_DACL_PROTECTED<\/code>
\nSE_SACL_PROTECTED<\/code><\/td>\n		Windows 2000<\/td>\n<\/tr>\n
AR<\/td>\nAuto inherit request
\nSDDL_AUTO_INHERIT_REQ<\/code>
\nSE_DACL_AUTO_INHERIT_REQ<\/code>
\nSE_SACL_AUTO_INHERIT_REQ<\/code><\/td>\n<\/tr>\n
AI<\/td>\nAuto inherited
\nSDDL_AUTO_INHERITED<\/code>
\nSE_DACL_AUTO_INHERITED<\/code>
\nSE_SACL_AUTO_INHERITED<\/code><\/td>\n<\/tr>\n
NO_ACCESS_CONTROL<\/td>\nNull ACL
\nSDDL_NULL_ACL<\/code><\/td>\n		Windows 7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SDDL ACE Types<\/b><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Code<\/th>\nMeaning<\/th>\nIntroduced<\/th>\n<\/tr>\n
A<\/td>\nAccess allowed
\nSDDL_ACCESS_ALLOWED<\/code>
\nACCESS_ALLOWED_ACE_TYPE<\/code><\/td>\n		Windows 2000<\/td>\n<\/tr>\n
D<\/td>\nAccess denied
\nSDDL_ACCESS_DENIED<\/code>
\nACCESS_DENIED_ACE_TYPE<\/code><\/td>\n<\/tr>\n
OA<\/td>\nObject access allowed
\nSDDL_OBJECT_ACCESS_ALLOWED<\/code>
\nACCESS_ALLOWED_OBJECT_ACE_TYPE<\/code><\/td>\n<\/tr>\n
OD<\/td>\nObject access denied
\nSDDL_OBJECT_ACCESS_DENIED<\/code>
\nACCESS_DENIED_OBJECT_ACE_TYPE<\/code><\/td>\n<\/tr>\n
AU<\/td>\nAudit
\nSDDL_AUDIT<\/code>
\nSYSTEM_AUDIT_ACE_TYPE<\/code><\/td>\n<\/tr>\n
AL<\/td>\nAlarm
\nSDDL_ALARM<\/code>
\nSYSTEM_ALARM_ACE_TYPE<\/code><\/td>\n<\/tr>\n
OU<\/td>\nObject audit
\nSDDL_OBJECT_AUDIT<\/code>
\nSYSTEM_AUDIT_OBJECT_ACE_TYPE<\/code><\/td>\n<\/tr>\n
OL<\/td>\nObject alarm
\nSDDL_OBJECT_ALARM<\/code>
\nSYSTEM_ALARM_OBJECT_ACE_TYPE<\/code><\/td>\n<\/tr>\n
ML<\/td>\nIntegrity label
\nSDDL_MANDATORY_LABEL<\/code>
\nSYSTEM_MANDATORY_LABEL_ACE_TYPE<\/code><\/td>\n		Windows Vista<\/td>\n<\/tr>\n
XA<\/td>\nCallback access allowed
\nSDDL_CALLBACK_ACCESS_ALLOWED<\/code>
\nACCESS_ALLOWED_CALLBACK_ACE_TYPE<\/code><\/td>\n		Windows 7<\/td>\n<\/tr>\n
XD<\/td>\nCallback access denied
\nSDDL_CALLBACK_ACCESS_DENIED<\/code>
\nACCESS_DENIED_CALLBACK_ACE_TYPE<\/code><\/td>\n<\/tr>\n
RA<\/td>\nResource attribute
\nSDDL_RESOURCE_ATTRIBUTE<\/code>
\nSYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE<\/code><\/td>\n		Windows 8<\/td>\n<\/tr>\n
SP<\/td>\nScoped policy
\nSDDL_SCOPED_POLICY_ID<\/code>
\nSYSTEM_SCOPED_POLICY_ID_ACE_TYPE<\/code><\/td>\n<\/tr>\n
XU<\/td>\nCallback audit
\nSDDL_CALLBACK_AUDIT<\/code>
\nSYSTEM_AUDIT_CALLBACK_ACE_TYPE<\/code><\/td>\n<\/tr>\n
ZA<\/td>\nCallback object access allowed
\nSDDL_CALLBACK_OBJECT_ACCESS_ALLOWED<\/code>
\nACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE<\/code><\/td>\n<\/tr>\n
TL<\/td>\nProcess trust label
\nSDDL_PROCESS_TRUST_LABEL<\/code>
\nSYSTEM_PROCESS_TRUST_LABEL_ACE_TYPE<\/code><\/td>\n		Windows 8.1<\/td>\n<\/tr>\n
FL<\/td>\nAccess filter
\nSDDL_ACCESS_FILTER<\/code>
\nSYSTEM_ACCESS_FILTER_ACE_TYPE<\/code><\/td>\n		Windows 10
\nVersion 1703<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SDDL Resource attribute ACE data types<\/b><\/p>\n\n\n\n\n\n\n\n\n\n
Code<\/th>\nMeaning<\/th>\nIntroduced<\/th>\n<\/tr>\n
TI<\/td>\nSigned integer
\nSDDL_INT<\/code>
\nCLAIM_SECURITY_ATTRIBUTE_TYPE_INT64<\/code><\/td>\n		Windows 8<\/td>\n<\/tr>\n
TU<\/td>\nUnsigned integer
\nSDDL_UINT<\/code>
\nCLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64<\/code><\/td>\n<\/tr>\n
TS<\/td>\nWide string
\nSDDL_WSTRING<\/code>
\nCLAIM_SECURITY_ATTRIBUTE_TYPE_STRING<\/code><\/td>\n<\/tr>\n
TD<\/td>\nSID
\nSDDL_SID<\/code>
\nCLAIM_SECURITY_ATTRIBUTE_TYPE_SID<\/code><\/td>\n<\/tr>\n
TX<\/td>\nOctet string
\nSDDL_BLOB<\/code>
\nCLAIM_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING<\/code><\/td>\n<\/tr>\n
TB<\/td>\nBoolean
\nSDDL_BOOLEAN<\/code>
\nCLAIM_SECURITY_ATTRIBUTE_TYPE_BOOLEAN<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SDDL ACE flags<\/b><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Code<\/th>\nMeaning<\/th>\nIntroduced<\/th>\n<\/tr>\n
CI<\/td>\nContainer inherit
\nSDDL_CONTAINER_INHERIT<\/code>
\nCONTAINER_INHERIT_ACE<\/code><\/td>\n		Windows 2000<\/td>\n<\/tr>\n
OI<\/td>\nObject inherit
\nSDDL_OBJECT_INHERIT<\/code>
\nOBJECT_INHERIT_ACE<\/code><\/td>\n<\/tr>\n
NP<\/td>\nInherit no propagate
\nSDDL_NO_PROPAGATE<\/code>
\nNO_PROPAGATE_INHERIT_ACE<\/code><\/td>\n<\/tr>\n
IO<\/td>\nInherit only
\nSDDL_INHERIT_ONLY<\/code>
\nINHERIT_ONLY_ACE<\/code><\/td>\n<\/tr>\n
ID<\/td>\nInherited
\nSDDL_INHERITED<\/code>
\nINHERITED_ACE<\/code><\/td>\n<\/tr>\n
SA<\/td>\nAudit success
\nSDDL_AUDIT_SUCCESS<\/code>
\nSUCCESSFUL_ACCESS_ACE_FLAG<\/code><\/td>\n<\/tr>\n
FA<\/td>\nAudit failure
\nSDDL_AUDIT_FAILURE<\/code>
\nFAILED_ACCESS_ACE_FLAG<\/code><\/td>\n<\/tr>\n
TP<\/td>\nTrust protected filter
\nSDDL_TRUST_PROTECTED_FILTER<\/code>
\nTRUST_PROTECTED_FILTER_ACE_FLAG<\/code><\/td>\n		Windows 10
\nVersion 1703<\/td>\n<\/tr>\n
CR<\/td>\nCritical
\nSDDL_CRITICAL<\/code>
\nCRITICAL_ACE_FLAG<\/code><\/td>\n		Windows 10
\nVersion 1809<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SDDL access rights<\/b><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Code<\/th>\nMeaning<\/th>\nApplies to<\/th>\nIntroduced<\/th>\n<\/tr>\n
RP<\/td>\nACTRL_DS_READ_PROP<\/code>
\nSDDL_READ_PROPERTY<\/code><\/td>\n		Directory
\nservices<\/td>\n		Windows 2000<\/td>\n<\/tr>\n
WP<\/td>\nACTRL_DS_WRITE_PROP<\/code>
\nSDDL_WRITE_PROPERTY<\/code><\/td>\n<\/tr>\n
CC<\/td>\nACTRL_DS_CREATE_CHILD<\/code>
\nSDDL_CREATE_CHILD<\/code><\/td>\n<\/tr>\n
DC<\/td>\nACTRL_DS_DELETE_CHILD<\/code>
\nSDDL_DELETE_CHILD<\/code><\/td>\n<\/tr>\n
LC<\/td>\nACTRL_DS_LIST<\/code>
\nSDDL_LIST_CHILDREN<\/code><\/td>\n<\/tr>\n
SW<\/td>\nACTRL_DS_SELF<\/code>
\nSDDL_SELF_WRITE<\/code><\/td>\n<\/tr>\n
LO<\/td>\nACTRL_DS_LIST_OBJECT<\/code>
\nSDDL_LIST_OBJECT<\/code><\/td>\n<\/tr>\n
DT<\/td>\nACTRL_DS_DELETE_TREE<\/code>
\nSDDL_DELETE_TREE<\/code><\/td>\n<\/tr>\n
CR<\/td>\nACTRL_DS_CONTROL_ACCESS<\/code>
\nSDDL_CONTROL_ACCESS<\/code><\/td>\n<\/tr>\n
RC<\/td>\nREAD_CONTROL<\/code>
\nSDDL_READ_CONTROL<\/code><\/td>\n		Anything<\/td>\n<\/tr>\n
WD<\/td>\nWRITE_DAC<\/code>
\nSDDL_WRITE_DAC<\/code><\/td>\n<\/tr>\n
WO<\/td>\nWRITE_OWNER<\/code>
\nSDDL_WRITE_OWNER<\/code><\/td>\n<\/tr>\n
SD<\/td>\nDELETE<\/code>
\nSDDL_STANDARD_DELETE<\/code><\/td>\n<\/tr>\n
GA<\/td>\nGENERIC_ALL<\/code>
\nSDDL_GENERIC_ALL<\/code><\/td>\n<\/tr>\n
GR<\/td>\nGENERIC_READ<\/code>
\nSDDL_GENERIC_READ<\/code><\/td>\n<\/tr>\n
GW<\/td>\nGENERIC_WRITE<\/code>
\nSDDL_GENERIC_WRITE<\/code><\/td>\n<\/tr>\n
GX<\/td>\nGENERIC_EXECUTE<\/code>
\nSDDL_GENERIC_EXECUTE<\/code><\/td>\n<\/tr>\n
FA<\/td>\nFILE_ALL_ACCESS<\/code>
\nSDDL_FILE_ALL<\/code><\/td>\n		Files and
\nfolders<\/td>\n<\/tr>\n
FR<\/td>\nFILE_GENERIC_READ<\/code>
\nSDDL_FILE_READ<\/code><\/td>\n<\/tr>\n
FW<\/td>\nFILE_GENERIC_WRITE<\/code>
\nSDDL_FILE_WRITE<\/code><\/td>\n<\/tr>\n
FX<\/td>\nFILE_GENERIC_EXECUTE<\/code>
\nSDDL_FILE_EXECUTE<\/code><\/td>\n<\/tr>\n
KA<\/td>\nKEY_ALL_ACCESS<\/code>
\nSDDL_KEY_ALL<\/code><\/td>\n		Registry
\nkeys<\/td>\n<\/tr>\n
KR<\/td>\nKEY_READ<\/code>
\nSDDL_KEY_READ<\/code><\/td>\n<\/tr>\n
KW<\/td>\nKEY_WRITE<\/code>
\nSDDL_KEY_WRITE<\/code><\/td>\n<\/tr>\n
KX<\/td>\nKEY_EXECUTE<\/code>
\nSDDL_KEY_EXECUTE<\/code><\/td>\n<\/tr>\n
NW<\/td>\nSYSTEM_MANDATORY_LABEL_NO_WRITE_UP<\/code>
\nSDDL_NO_WRITE_UP<\/code><\/td>\n		Mandatory
\nlabel ACE<\/td>\n		Windows 7<\/td>\n<\/tr>\n
NR<\/td>\nSYSTEM_MANDATORY_LABEL_NO_READ_UP<\/code>
\nSDDL_NO_READ_UP<\/code><\/td>\n<\/tr>\n
NX<\/td>\nSYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP<\/code>
\nSDDL_NO_EXECUTE_UP<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SDDL users and groups<\/b><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Tag<\/th>\nMeaning<\/th>\nIntroduced<\/th>\n<\/tr>\n
DA<\/td>\nDomain admins
\nSDDL_DOMAIN_ADMINISTRATORS<\/code>
\nDOMAIN_GROUP_RID_ADMINS<\/code><\/td>\n		Windows 2000<\/td>\n<\/tr>\n
DG<\/td>\nDomain guests
\nSDDL_DOMAIN_GUESTS<\/code>
\nDOMAIN_GROUP_RID_GUESTS<\/code><\/td>\n<\/tr>\n
DU<\/td>\nDomain users
\nSDDL_DOMAIN_USERS<\/code>
\nDOMAIN_GROUP_RID_USERS<\/code><\/td>\n<\/tr>\n
ED<\/td>\nEnterprise domain controllers
\nSDDL_ENTERPRISE_DOMAIN_CONTROLLERS<\/code>
\nSECURITY_SERVER_LOGON_RID<\/code><\/td>\n<\/tr>\n
DD<\/td>\nDomain domain controllers
\nSDDL_DOMAIN_DOMAIN_CONTROLLERS<\/code>
\nDOMAIN_GROUP_RID_CONTROLLERS<\/code><\/td>\n<\/tr>\n
DC<\/td>\nDomain computers
\nSDDL_DOMAIN_COMPUTERS<\/code>
\nDOMAIN_GROUP_RID_COMPUTERS<\/code><\/td>\n<\/tr>\n
BA<\/td>\nLocal administrators
\nSDDL_BUILTIN_ADMINISTRATORS<\/code>
\nDOMAIN_ALIAS_RID_ADMINS<\/code><\/td>\n<\/tr>\n
BG<\/td>\nLocal guests
\nSDDL_BUILTIN_GUESTS<\/code>
\nDOMAIN_ALIAS_RID_GUESTS<\/code><\/td>\n<\/tr>\n
BU<\/td>\nLocal users
\nSDDL_BUILTIN_USERS<\/code>
\nDOMAIN_ALIAS_RID_USERS<\/code><\/td>\n<\/tr>\n
LA<\/td>\nLocal administrator account
\nSDDL_LOCAL_ADMIN<\/code>
\nDOMAIN_USER_RID_ADMIN<\/code><\/td>\n<\/tr>\n
LG<\/td>\nLocal guest account
\nSDDL_LOCAL_GUEST<\/code>
\nDOMAIN_USER_RID_GUEST<\/code><\/td>\n<\/tr>\n
AO<\/td>\nAccount operators
\nSDDL_ACCOUNT_OPERATORS<\/code>
\nDOMAIN_ALIAS_RID_ACCOUNT_OPS<\/code><\/td>\n<\/tr>\n
BO<\/td>\nBackup operators
\nSDDL_BACKUP_OPERATORS<\/code>
\nDOMAIN_ALIAS_RID_BACKUP_OPS<\/code><\/td>\n<\/tr>\n
PO<\/td>\nPrinter operators
\nSDDL_PRINTER_OPERATORS<\/code>
\nDOMAIN_ALIAS_RID_PRINT_OPS<\/code><\/td>\n<\/tr>\n
SO<\/td>\nServer operators
\nSDDL_SERVER_OPERATORS<\/code>
\nDOMAIN_ALIAS_RID_SYSTEM_OPS<\/code><\/td>\n<\/tr>\n
AU<\/td>\nAuthenticated users
\nSDDL_AUTHENTICATED_USERS<\/code>
\nSECURITY_AUTHENTICATED_USER_RID<\/code><\/td>\n<\/tr>\n
PS<\/td>\nPersonal self
\nSDDL_PERSONAL_SELF<\/code>
\nSECURITY_PRINCIPAL_SELF_RID<\/code><\/td>\n<\/tr>\n
CO<\/td>\nCreator owner
\nSDDL_CREATOR_OWNER<\/code>
\nSECURITY_CREATOR_OWNER_RID<\/code><\/td>\n<\/tr>\n
CG<\/td>\nCreator group
\nSDDL_CREATOR_GROUP<\/code>
\nSECURITY_CREATOR_GROUP_RID<\/code><\/td>\n<\/tr>\n
SY<\/td>\nLocal system
\nSDDL_LOCAL_SYSTEM<\/code>
\nSECURITY_LOCAL_SYSTEM_RID<\/code><\/td>\n<\/tr>\n
PU<\/td>\nPower users
\nSDDL_POWER_USERS<\/code>
\nDOMAIN_ALIAS_RID_POWER_USERS<\/code><\/td>\n<\/tr>\n
WD<\/td>\nEveryone (World)
\nSDDL_EVERYONE<\/code>
\nSECURITY_WORLD_RID<\/code><\/td>\n<\/tr>\n
RE<\/td>\nReplicator
\nSDDL_REPLICATOR<\/code>
\nDOMAIN_ALIAS_RID_REPLICATOR<\/code><\/td>\n<\/tr>\n
IU<\/td>\nInteractive logon user
\nSDDL_INTERACTIVE<\/code>
\nSECURITY_INTERACTIVE_RID<\/code><\/td>\n<\/tr>\n
NU<\/td>\nNework logon user
\nSDDL_NETWORK<\/code>
\nSECURITY_NETWORK_RID<\/code><\/td>\n<\/tr>\n
SU<\/td>\nService logon user
\nSDDL_SERVICE<\/code>
\nSECURITY_SERVICE_RID<\/code><\/td>\n<\/tr>\n
RC<\/td>\nRestricted code
\nSDDL_RESTRICTED_CODE<\/code>
\nSECURITY_RESTRICTED_CODE_RID<\/code><\/td>\n<\/tr>\n
SA<\/td>\nSchema administrators
\nSDDL_SCHEMA_ADMINISTRATORS<\/code>
\nDOMAIN_GROUP_RID_SCHEMA_ADMINS<\/code><\/td>\n<\/tr>\n
CA<\/td>\nCertificate server administrators
\nSDDL_CERT_SERV_ADMINISTRATORS<\/code>
\nDOMAIN_GROUP_RID_CERT_ADMINS<\/code><\/td>\n<\/tr>\n
RS<\/td>\nRAS servers group
\nSDDL_RAS_SERVERS<\/code>
\nDOMAIN_ALIAS_RID_RAS_SERVERS<\/code><\/td>\n<\/tr>\n
EA<\/td>\nEnterprise administrators
\nSDDL_ENTERPRISE_ADMINS<\/code>
\nDOMAIN_GROUP_RID_ENTERPRISE_ADMINS<\/code><\/td>\n<\/tr>\n
PA<\/td>\nGroup Policy administrators
\nSDDL_GROUP_POLICY_ADMINS<\/code>
\nDOMAIN_GROUP_RID_POLICY_ADMINS<\/code><\/td>\n<\/tr>\n
RU<\/td>\nCompatibility for pre-Windows 2000 accounts
\nSDDL_ALIAS_PREW2KCOMPACC<\/code>
\nDOMAIN_ALIAS_RID_PREW2KCOMPACCESS<\/code><\/td>\n<\/tr>\n
AN<\/td>\nAnonymous logon
\nSDDL_ANONYMOUS<\/code>
\nSECURITY_ANONYMOUS_LOGON_RID<\/code><\/td>\n		Windows XP<\/td>\n<\/tr>\n
LS<\/td>\nLocal service account
\nSDDL_LOCAL_SERVICE<\/code>
\nSECURITY_LOCAL_SERVICE_RID<\/code><\/td>\n<\/tr>\n
NS<\/td>\nNetwork service account
\nSDDL_NETWORK_SERVICE<\/code>
\nSECURITY_NETWORK_SERVICE_RID<\/code><\/td>\n<\/tr>\n
RD<\/td>\nRemote desktop users
\nSDDL_REMOTE_DESKTOP<\/code>
\nDOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS<\/code><\/td>\n<\/tr>\n
NO<\/td>\nNetwork configuration operators
\nSDDL_NETWORK_CONFIGURATION_OPS<\/code>
\nDOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS<\/code><\/td>\n<\/tr>\n
MU<\/td>\nPerformance Monitor users
\nSDDL_PERFMON_USERS<\/code>
\nDOMAIN_ALIAS_RID_MONITORING_USERS<\/code><\/td>\n<\/tr>\n
LU<\/td>\nPerformance Log users
\nSDDL_PERFLOG_USERS<\/code>
\nDOMAIN_ALIAS_RID_LOGGING_USERS<\/code><\/td>\n<\/tr>\n
WR<\/td>\nWrite Restricted code
\nSDDL_WRITE_RESTRICTED_CODE<\/code>
\nSECURITY_WRITE_RESTRICTED_CODE_RID<\/code><\/td>\n		Windows Vista<\/td>\n<\/tr>\n
IS<\/td>\nAnonymous Internet users
\nSDDL_IIS_USERS<\/code>
\nDOMAIN_ALIAS_RID_IUSERS<\/code><\/td>\n<\/tr>\n
CY<\/td>\nCrypto operators
\nSDDL_CRYPTO_OPERATORS<\/code>
\nDOMAIN_ALIAS_RID_CRYPTO_OPERATORS<\/code><\/td>\n<\/tr>\n
OW<\/td>\nOwner Rights SID
\nSDDL_OWNER_RIGHTS<\/code>
\nSECURITY_CREATOR_OWNER_RIGHTS_RID<\/code><\/td>\n<\/tr>\n
RM<\/td>\nRMS service operators
\nSDDL_RMS_SERVICE_OPERATORS<\/code>
\nDOMAIN_ALIAS_RID_RMS_SERVICE_OPERATORS<\/code><\/td>\n		Windows Vista
\nRemoved in Win7<\/td>\n<\/tr>\n
ER<\/td>\nEvent log readers
\nSDDL_EVENT_LOG_READERS<\/code>
\nDOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP<\/code><\/td>\n		Windows 7<\/td>\n<\/tr>\n
RO<\/td>\nEnterprise read-only domain controllers
\nSDDL_ENTERPRISE_RO_DCs<\/code>
\nDOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS<\/code><\/td>\n<\/tr>\n
CD<\/td>\nCan connect to certification authorities using DCOM
\nSDDL_CERTSVC_DCOM_ACCESS<\/code>
\nDOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP<\/code><\/td>\n<\/tr>\n
AC<\/td>\nAll applications running in an app package context
\nSDDL_ALL_APP_PACKAGES<\/code>
\nSECURITY_BUILTIN_PACKAGE_ANY_PACKAGE<\/code><\/td>\n		Windows 8<\/td>\n<\/tr>\n
RA<\/td>\nRDS remote access servers
\nSDDL_RDS_REMOTE_ACCESS_SERVERS<\/code>
\nDOMAIN_ALIAS_RID_RDS_REMOTE_ACCESS_SERVERS<\/code><\/td>\n<\/tr>\n
ES<\/td>\nEndpoint servers
\nSDDL_RDS_ENDPOINT_SERVERS<\/code>
\nDOMAIN_ALIAS_RID_RDS_ENDPOINT_SERVERS<\/code><\/td>\n<\/tr>\n
MS<\/td>\nManagement servers
\nSDDL_RDS_MANAGEMENT_SERVERS<\/code>
\nDOMAIN_ALIAS_RID_RDS_MANAGEMENT_SERVERS<\/code><\/td>\n<\/tr>\n
UD<\/td>\nUser-mode driver
\nSDDL_USER_MODE_DRIVERS<\/code>
\nSECURITY_USERMODEDRIVERHOST_ID_BASE_RID<\/code><\/td>\n<\/tr>\n
HA<\/td>\nHyper-V administrators
\nSDDL_HYPER_V_ADMINS<\/code>
\nDOMAIN_ALIAS_RID_HYPER_V_ADMINS<\/code><\/td>\n<\/tr>\n
CN<\/td>\nDomain controllers which may be cloned
\nSDDL_CLONEABLE_CONTROLLERS<\/code>
\nDOMAIN_GROUP_RID_CLONEABLE_CONTROLLERS<\/code><\/td>\n<\/tr>\n
AA<\/td>\nAccess control assistant operators
\nSDDL_ACCESS_CONTROL_ASSISTANCE_OPS<\/code>
\nDOMAIN_ALIAS_RID_ACCESS_CONTROL_ASSISTANCE_OPS<\/code><\/td>\n<\/tr>\n
RM<\/td>\nRemote management users
\nSDDL_REMOTE_MANAGEMENT_USERS<\/code>
\nDOMAIN_ALIAS_RID_REMOTE_MANAGEMENT_USERS<\/code><\/td>\n<\/tr>\n
AS<\/td>\nAuthentication Authority Asserted
\nSDDL_AUTHORITY_ASSERTED<\/code>
\nSECURITY_AUTHENTICATION_AUTHORITY_ASSERTED_RID<\/code><\/td>\n<\/tr>\n
SS<\/td>\nAuthentication Service Asserted
\nSDDL_SERVICE_ASSERTED<\/code>
\nSECURITY_AUTHENTICATION_SERVICE_ASSERTED_RID<\/code><\/td>\n<\/tr>\n
AP<\/td>\nProtected users<\/a>
\nSDDL_PROTECTED_USERS<\/code>
\nDOMAIN_GROUP_RID_PROTECTED_USERS<\/code><\/td>\n		Windows 8.1<\/td>\n<\/tr>\n
KA<\/td>\nDomain key credential administrators
\nSDDL_KEY_ADMINS<\/code>
\nDOMAIN_GROUP_RID_KEY_ADMINS<\/code><\/td>\n		Windows 10<\/td>\n<\/tr>\n
EK<\/td>\nEnterprise key credential administrators
\nSDDL_ENTERPRISE_KEY_ADMINS<\/code>
\nDOMAIN_GROUP_RID_ENTERPRISE_KEY_ADMINS<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

“RM” is the only case I can find of something being removed<\/i> from SDDL.<\/p>\n

SDDL integrity labels<\/b><\/p>\n\n\n\n\n\n\n\n\n
Code<\/th>\nMeaning<\/th>\nIntroduced<\/th>\n<\/tr>\n
LW<\/td>\nLow mandatory level
\nSECURITY_MANDATORY_LOW_RID<\/code><\/td>\n		Windows Vista<\/td>\n<\/tr>\n
ME<\/td>\nMedium mandatory level
\nSECURITY_MANDATORY_MEDIUM_RID<\/code><\/td>\n<\/tr>\n
MP<\/td>\nMedium Plus mandatory level
\nSECURITY_MANDATORY_MEDIUM_PLUS_RID<\/code><\/td>\n		Windows 7<\/td>\n<\/tr>\n
HI<\/td>\nHigh mandatory level
\nSECURITY_MANDATORY_HIGH_RID<\/code><\/td>\n		Windows Vista<\/td>\n<\/tr>\n
SI<\/td>\nSystem mandatory level
\nSECURITY_MANDATORY_SYSTEM_RID<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SDDL syntax elements<\/b><\/p>\n\n\n\n\n\n\n\n\n\n\n
Syntax<\/th>\nMeaning<\/th>\nIntroduced<\/th>\n<\/tr>\n
semicolon<\/td>\nSeparates elements inside an ACE
\nSDDL_SEPERATOR<\/code><\/td>\n		Windows 2000<\/td>\n<\/tr>\n
colon<\/td>\nDelimits SD components
\nSDDL_DELIMINATOR<\/code><\/td>\n<\/tr>\n
parentheses<\/td>\nEnclose an ACE
\nSDDL_ACE_BEGIN<\/code>
\nSDDL_ACE_END<\/code><\/td>\n<\/tr>\n
parentheses<\/td>\nEnclose a conditional ACE expression
\nSDDL_ACE_COND_BEGIN<\/code>
\nSDDL_ACE_COND_END<\/code><\/td>\n		Windows 7<\/td>\n<\/tr>\n
curly braces<\/td>\nEnclose a comma-separated list of SIDs
\nSDDL_ACE_COND_COMPOSITEVALUE_BEGIN<\/code>
\nSDDL_ACE_COND_COMPOSITEVALUE_SEPERATOR<\/code>
\nSDDL_ACE_COND_COMPOSITEVALUE_END<\/code><\/td>\n<\/tr>\n
number sign<\/td>\nHexadecimal byte data
\nSDDL_ACE_COND_BLOB_PREFIX<\/code><\/td>\n<\/tr>\n
parentheses<\/td>\nEnclose a string SID in a SID list
\nSDDL_ACE_COND_SID_BEGIN<\/code>
\nSDDL_ACE_COND_SID_END<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

I like how “separator” and “delimiter” are misspelled.<\/p>\n","protected":false},"excerpt":{"rendered":"

Things come, and rarely go.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[104],"class_list":["post-106640","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-tipssupport"],"acf":[],"blog_post_summary":"

Things come, and rarely go.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/106640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=106640"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/106640\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=106640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=106640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=106640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}