安全描述符定义语言（SDDL）在安全描述符字符串的DACL和SACL组件中使用ACE字符串。 如“安全描述符字符串格式”示例所示，安全描述符字符串中的每个ACE都用括号括起来。 ACE的字段按以下顺序排列，并用分号（;）分隔
语法：ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid;(resource_attribute)
范围：
ace_type：ACE的类型
一个字符串，指示ACE_HEADER结构的AceType成员的值。 ACE类型字符串可以是Sddl.h中定义的以下字符串之一。
| ACE 类型字符串 | Sddl.h中的常量 | Ace类型的值 |
|---|---|---|
| "A" | SDDL_ACCESS_ALLOWED | ACCESS_ALLOWED_ACE_TYPE |
| "D" | SDDL_ACCESS_DENIED | ACCESS_DENIED_ACE_TYPE |
| "OA" | SDDL_OBJECT_ACCESS_ALLOWED | ACCESS_ALLOWED_OBJECT_ACE_TYPE |
| "OD" | SDDL_OBJECT_ACCESS_DENIED | ACCESS_DENIED_OBJECT_ACE_TYPE |
| "AU" | SDDL_AUDIT | SYSTEM_AUDIT_ACE_TYPE |
| "AL" | SDDL_ALARM | SYSTEM_ALARM_ACE_TYPE |
| "OU" | SDDL_OBJECT_AUDIT | SYSTEM_AUDIT_OBJECT_ACE_TYPE |
| "OL" | SDDL_OBJECT_ALARM | SYSTEM_ALARM_OBJECT_ACE_TYPE |
| "ML" | SDDL_MANDATORY_LABEL | SYSTEM_MANDATORY_LABEL_ACE_TYPE |
| "XA" | SDDL_CALLBACK_ACCESS_ALLOWED | ACCESS_ALLOWED_CALLBACK_ACE_TYPEWindows Vista and Windows Server 2003: Not available. |
| "XD" | SDDL_CALLBACK_ACCESS_DENIED | ACCESS_DENIED_CALLBACK_ACE_TYPEWindows Vista and Windows Server 2003: Not available. |
| "RA" | SDDL_RESOURCE_ATTRIBUTE | SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPEWindows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista and Windows Server 2003: Not available. |
| "SP" | SDDL_SCOPED_POLICY_ID | SYSTEM_SCOPED_POLICY_ID_ACE_TYPEWindows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista and Windows Server 2003: Not available. |
| "XU" | SDDL_CALLBACK_AUDIT | SYSTEM_AUDIT_CALLBACK_ACE_TYPEWindows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista and Windows Server 2003: Not available. |
| "ZA" | SDDL_CALLBACK_OBJECT_ACCESS_ALLOWED | ACCESS_ALLOWED_CALLBACK_ACE_TYPEWindows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista and Windows Server 2003: Not available. |
ace_flags标志位
一个字符串，指示ACE_HEADER结构的AceFlags成员的值。 ACE标志字符串可以是Sddl.h中定义的以下字符串的串联。
| ACE 标志字符串 | Sddl.h中的常量 | Ace标志值 |
|---|---|---|
| "CI" | SDDL_CONTAINER_INHERIT | CONTAINER_INHERIT_ACE |
| "OI" | SDDL_OBJECT_INHERIT | OBJECT_INHERIT_ACE |
| "NP" | SDDL_NO_PROPAGATE | NO_PROPAGATE_INHERIT_ACE |
| "IO" | SDDL_INHERIT_ONLY | INHERIT_ONLY_ACE |
| "ID" | SDDL_INHERITED | INHERITED_ACE |
| "SA" | SDDL_AUDIT_SUCCESS | SUCCESSFUL_ACCESS_ACE_FLAG |
| "FA" | SDDL_AUDIT_FAILURE | FAILED_ACCESS_ACE_FLAG |
一个字符串，指示ACE_HEADER结构的AceFlags成员的值。 ACE标志字符串可以是Sddl.h中定义的以下字符串的串联。
rights：权限
一个字符串，指示由ACE控制的访问权限。该字符串可以是访问权限的十六进制字符串表示形式，例如“ 0x7800003F”，也可以是以下字符串的串联形式。
通用访问权限
| 访问权限字符串 | Sddl.h中的常量 | 访问权限值 |
|---|---|---|
| "GA" | SDDL_GENERIC_ALL | GENERIC_ALL |
| "GR" | SDDL_GENERIC_READ | GENERIC_READ |
| "GW" | SDDL_GENERIC_WRITE | GENERIC_WRITE |
| "GX" | SDDL_GENERIC_EXECUTE | GENERIC_EXECUTE |
标准访问权限
| 访问权限字符串 | Sddl.h中的常量 | 访问权限值 |
|---|---|---|
| "RC" | SDDL_READ_CONTROL | READ_CONTROL |
| "SD" | SDDL_STANDARD_DELETE | DELETE |
| "WD" | SDDL_WRITE_DAC | WRITE_DAC |
| "WO" | SDDL_WRITE_OWNER | WRITE_OWNER |
目录服务对象访问权限
| 访问权限字符串 | Sddl.h中的常量 | 访问权限值 |
|---|---|---|
| "RP" | SDDL_READ_PROPERTY | ADS_RIGHT_DS_READ_PROP |
| "WP" | SDDL_WRITE_PROPERTY | ADS_RIGHT_DS_WRITE_PROP |
| "CC" | SDDL_CREATE_CHILD | ADS_RIGHT_DS_CREATE_CHILD |
| "DC" | SDDL_DELETE_CHILD | ADS_RIGHT_DS_DELETE_CHILD |
| "LC" | SDDL_LIST_CHILDREN | ADS_RIGHT_ACTRL_DS_LIST |
| "SW" | SDDL_SELF_WRITE | ADS_RIGHT_DS_SELF |
| "LO" | SDDL_LIST_OBJECT | ADS_RIGHT_DS_LIST_OBJECT |
| "DT" | SDDL_DELETE_TREE | ADS_RIGHT_DS_DELETE_TREE |
| "CR" | SDDL_CONTROL_ACCESS | ADS_RIGHT_DS_CONTROL_ACCESS |
档案存取权
| 访问权限字符串 | Sddl.h中的值 | 访问权限值 |
|---|---|---|
| "FA" | SDDL_FILE_ALL | FILE_ALL_ACCESS |
| "FR" | SDDL_FILE_READ | FILE_GENERIC_READ |
| "FW" | SDDL_FILE_WRITE | FILE_GENERIC_WRITE |
| "FX" | SDDL_FILE_EXECUTE | FILE_GENERIC_EXECUTE |
注册表项访问权限
| 访问权限字符串 | Sddl.h中的常量 | 访问权限值 |
|---|---|---|
| "KA" | SDDL_KEY_ALL | KEY_ALL_ACCESS |
| "KR" | SDDL_KEY_READ | KEY_READ |
| "KW" | SDDL_KEY_WRITE | KEY_WRITE |
| "KX" | SDDL_KEY_EXECUTE | KEY_EXECUTE |
强制性标签权利
| 访问权限字符串 | Sddl.h中的值 | 访问权限值 |
|---|---|---|
| "NR" | SDDL_NO_READ_UP | SYSTEM_MANDATORY_LABEL_NO_READ_UP |
| "NW" | SDDL_NO_WRITE_UP | SYSTEM_MANDATORY_LABEL_NO_WRITE_UP |
| "NX" | SDDL_NO_EXECUTE_UP | SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP |
object_guid
GUID的字符串表示形式，它表示特定于对象的ACE结构（例如ACCESS_ALLOWED_OBJECT_ACE）的ObjectType成员的值。 GUID字符串使用UuidToString函数返回的格式。
下表列出了一些常用的对象GUID。
| Rights and GUID | Permission |
|---|---|
| CR;ab721a53-1e2f-11d0-9819-00aa0040529b | Change password |
| CR;00299570-246d-11d0-a768-00aa006e0529 | Reset password |
inherit_object_guid
GUID的字符串表示形式，它指示特定于对象的ACE结构的InheritedObjectType成员的值。 GUID字符串使用UuidToString格式。
account_sid
标识ACE受托者的SID字符串。
resource_attribute
可选: resource_attribute仅用于资源ACE，并且是可选的。指示数据类型的字符串。资源属性ace数据类型可以是Sddl.h中定义的以下数据类型之一。
资源属性中的“＃”符号与“ 0”同义。例如，D:AI(XA;OICI;FA;;;WD;(OctetStringType==#1#2#3##)) 等同于D:AI(XA;OICI;FA;;;WD;(OctetStringType==#01020300)).
Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista and Windows Server 2003: 资源属性不可用
| ace类型字符串资源属性 | Sddl.h中的常量 | 数据类型 |
|---|---|---|
| "TI" | SDDL_INT | Signed integer |
| "TU" | SDDL_UINT | Unsigned integer |
| "TS" | SDDL_WSTRING | Wide string |
| "TD" | SDDL_SID | SID |
| "TX" | SDDL_BLOB | Octet string |
| "TB" | SDDL_BOOLEAN | Boolean |
以下示例显示了允许访问的ACE的ACE字符串。它不是特定于对象的ACE，因此在object_guid和Inherited_object_guid字段中没有任何信息。 ace_flags字段也为空，表示未设置任何ACE标志。
(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-1-0)上面显示的ACE字符串描述了以下ACE信息。
AceType: 0x00 (ACCESS_ALLOWED_ACE_TYPE)
AceFlags: 0x00
Access Mask: 0x100e003f
READ_CONTROL
WRITE_DAC
WRITE_OWNER
GENERIC_ALL
Other access rights(0x0000003f)
Ace Sid : (S-1-1-0)下面的示例显示了一个文件，该文件使用Windows的资源声明和“结构化查询语言（SQL）”将“保密性”设置为“高业务影响”。
(RA;CI;;;;S-1-1-0; ("Project",TS,0,"Windows","SQL"))
(RA;CI;;;;S-1-1-0; ("Secrecy",TU,0,3))上面显示的ACE字符串描述了以下ACE信息。
AceType: 0x12 (SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE)
AceFlags: 0x1 (SDDL_CONTAINER_INHERIT)
Access Mask: 0x0
Ace Sid : (S-1-1-0)
Resource Attributes: Project has the strings Windows and SQL, Secrecy has the unsigned int value of 3