Home > Security Model > Active Directory Security Permissions

Active Directory Security Permissions

Active Directory Security Permissions

Active Directory Security Permissions are directory services access rights that control the access that security principals have on Active Directory objects.

Note - Every Active Directory object is a securable object, and an access right is a bit flag that corresponds to a particular set of operations that a thread can perform on a securable object.

There are 13 different types of Active Directory Security Permissions -

  1. Read Control (RC) - The right to read data from the security descriptor of an Active Directory object (, excluding the data in the SACL.)
  2. List Child (LC) - The right to list child objects of an Active Directory object.
  3. List Object (LO) - The right to list a particular Active Directory object. If a user is not granted this right, and does not have the List Child permission on the parent object, the object is hidden from the user.
  4. Read Property (RP) - The right to read properties of an Active Directory object. The ObjectType member of the ACE can specify a GUID that identifies the property or property set that can be read.
  5. Write Property (WP) - The right to write properties of an Active Directory object. The ObjectType member of the ACE can specify a GUID that identifies the property or property set that can be written.
  6. Create Child (CC) - The right to create child objects of an Active Directory object. The ObjectType member of the ACE can specify a GUID that identifies the type of the child object whose creaton is controlled.
  7. Delete Child (DC) - The right to delete child objects of an Active Directory object. The ObjectType member of the ACE can specify a GUID that identifies the type of the child object whose deletion is controlled.
  8. Standard Delete (SD) - The right to delete an Active Directory object.
  9. Delete Tree (DT) - The right to delete all child objects of an Active Directory object, regardless of the permissions on the child objects.
  10. Modify Permissions (WD) - The right to modify the discretionary access control list (ACL) in the security descriptor of an Active Directory object.
  11. Modify Owner (WO) - The right to assume ownership of an Active Directory object.
  12. Validated Write (SW) - The right to perform an operation controlled by a validated write access right. The ObjectType member of the ACE can specify a GUID that identifies the specific validated write.
  13. Control Access Right (CR) - The right to perform an operation controlled by an extended access right. The ObjectType member of the ACE can specify a GUID that identifies the specific extended right.

Note - The List Object security permission only comes into play when Active Directory is in List Object Mode (, controlled by setting the third characeter of the dsHeuristics property to "1" on CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=...)


Each access control entry (ACE) in an Active Directory object's access control list (ACL) specifies the identity of a security principal and the Active Directory security permissions that they are either Allowed or Denied on the object.


An ACE has the following fields -

  1. Trustee - The Security Identifier (SID) of the security principal to which the ACE applies.
  2. Access Mask - The set of access rights (from amongst those that are listed above that are) controlled by the ACE.
  3. Type - A flag that indicates the type of the ACE - ACCESS_ALLOWED_ACE_TYPE [ Allow ], ACCESS_ALLOWED_OBJECT_ACE_TYPE [ Allow ], ACCESS_DENIED_ACE_TYPE [ Deny ], ACCESS_DENIED_OBJECT_ACE_TYPE [ Deny ]
  4. Inheritance Flags - A set of flags that indicate whether an ACE is inherited and whether child objects can inherit the ACE - CONTAINER_INHERIT_ACE, INHERIT_ONLY_ACE, INHERITED_ACE, OBJECT_INHERIT_ACE, NO_PROPAGATE_INHERIT_ACE
  5. ObjectType - A GUID that indicates, one of a) a class of child objects (that can be created or deleted), b) a property or property-set (that can be read or written), c) an extended right, or d) a validated write (that can be performed).
  6. InheritedObjectType - A GUID that indicates the class of child objects whose ACL can inherit this ACE. Inheritance is also controlled by the Inheritance Flags in the ACE header as well as any protection against inheritance placed on child objects.


In summary, every single object in Active Directory is protected by an ACL, that is comprised of zero or more ACEs, each of which specifies one or more Active Directory Security Permissions that a specific security principal is either allowed or denied on the object, and ultimately it is the resulting set of all the security permissions specified in all the ACEs in an object's ACL, known as Active Directory Effective Permissions, that determines who actually has what access to an Active Directory object.