Section 5: ACL and ACE (Authorization Mechanics)

The Big Picture: The Guest List at the Door

Imagine a private party. At the door stands a bouncer with a guest list. Each line on the list says something like:

• "Maria — allowed in."
• "The Kitchen Staff — allowed in, but only to the kitchen."
• "Tom — not allowed."

When you arrive, the bouncer checks your wristband (your access token, Section 3) and reads the list from the top. The first line that fits you decides.

Windows does the same for files, folders, registry keys, printers and many other things. The "guest list" is called an ACL. Each line on it is an ACE.

5.1 ACL Attached to Securable Objects

What it is: A securable object is anything Windows can protect with permissions. Each one carries a security descriptor, a small package that says who owns it and who may use it.

Examples of securable objects:

A security descriptor has four parts:

┌──────────────── SECURITY DESCRIPTOR ─────────────────┐
│ Owner SID   : who owns this object                   │
│ Group SID   : a legacy field (rarely used today)     │
│ DACL        : who is ALLOWED or DENIED access        │
│ SACL        : which accesses must be AUDITED (logged)│
└──────────────────────────────────────────────────────┘

The two lists:

The owner always keeps one special power: they can change the permissions on their object, even if the list does not say so.

Important rule: no DACL vs empty DACL.

Inheritance. New files in a folder normally inherit the folder's list. That is why changing permissions on a folder usually flows down to everything inside it. Inherited entries show in grey in the Security tab. (The next chapter on Windows Permissions explains the rules in more detail.)

Windows tip: Right-click a file → Properties → Security shows you the DACL in a friendly form. Advanced shows the exact ACEs, the owner, and (under Auditing) the SACL.

5.2 ACE Entries (Allow/Deny + SID + Permission)

What it is: An ACE (Access Control Entry) is one line of an ACL. It says: this person or group (SID) is allowed or denied these actions.

An ACE has four main fields:

The access mask is a number in which each bit (a 0 or 1 switch) stands for one right. Here is a friendly view:

Windows also groups them into simple basic permissions that you see in the Security tab: Read, Write, Read & execute, Modify, Full control.

A small DACL might look like this:

DACL for D:\Reports\budget.xlsx

  No Type   Trustee (SID)         Permission
 ──────────────────────────────────────────────────
  1  DENY   Interns               Write
  2  ALLOW  Finance Team          Modify
  3  ALLOW  Authenticated Users   Read

Reading it: interns cannot write, even if they are also in another group that would allow it. Finance can modify. Any signed-in user can read.

Common ACE kinds you will meet:

5.3 Access Check Algorithm

What it is: The access check is the exact procedure the kernel (the Security Reference Monitor) follows when a program asks to open an object. It compares the thread's token against the object's DACL.

The question asked: "Does this token get all the rights it asked for?"

How it works, in plain steps:

1. The program says what it wants: for example Read and Write.
2. If the DACL is null, grant access. If it is empty, refuse.
3. Walk the ACEs in order, from the top.
4. For each ACE, check: does its SID match the user SID, or any group SID, in the token? If not, skip it.
5. If it matches and is a Deny that covers a right still wanted, stop: ACCESS DENIED.
6. If it matches and is an Allow, mark those rights as granted.
7. If all requested rights are granted, stop: ACCESS GRANTED.
8. If the end of the list is reached with some right still not granted, ACCESS DENIED (nothing said "yes").

 Request: Read + Write
 Token: Harshil, groups: Finance Team, Users, Everyone

   ACE 1: DENY  Interns            ── not in token ──► skip
   ACE 2: ALLOW Finance Team Modify ── in token ──► Read + Write granted
   all rights granted ──► ACCESS GRANTED

Why order matters: deny first. Windows keeps deny ACEs before allow ACEs (the Security tab always lists them that way), so a deny wins. If you are in a group with an allow and another group with a deny for the same right, the deny wins.

 Request: Write
 Token: Harshil, groups: Interns, Finance Team

   ACE 1: DENY  Interns        Write ── in token ──► ACCESS DENIED  (stop)
   ACE 2: ALLOW Finance Team   Modify    (never reached)

Default is "no." If no ACE mentions you, you get nothing. This is the safe default: access must be granted explicitly.

Special cases the kernel checks first or separately (simple summary):

Access check is done when the object is OPENED. The program asks for the rights it needs at open time and gets a handle (a ticket number for the open object). After that, using the handle is fast: Windows does not re-run the whole check on every read. If you change the permissions while a program already has the file open, that program may keep its already-granted access until it closes it.

Windows tip: In the Effective Access tab (Properties → Security → Advanced), pick a user or group and Windows shows what that token would get. It is the same algorithm, shown as a calculator.

Summary