Security descriptors (SDs), access control lists (ACLs), and access control entries (ACEs) have been used for files and directories on NTFS filesystems for years. The same concepts apply to securing Active Directory objects as well. While the information in this chapter is focused on Active Directory, the principles of creating an SD that contains a discretionary access control list (DACL) and system access control list (SACL) can map exactly over to NTFS files and directories.
ADSI provides four main interfaces we can use:
Manipulates individual ACEs that represent access or audit permissions for specific users or groups to objects and properties in Active Directory.
Manages collections of ACEs for an object.
Manages the different sets of ACLs to an object.
Gets, sets, and retrieves security descriptors for an object.
All of the ADSI
security interfaces can be found in the MSDN Library (http://msdn.microsoft.com/library/) under
Networking and Directory Services Active
Directory, ADSI and Directory Services
SDK
Documentation
Directory Services
Active Directory Service Interfaces
Active Directory Service Interfaces Reference
ADSI Interfaces
Security
Interfaces.
|