The Security Descriptor Definition Language (SDDL) defines a set of string elements for describing well-known security principals, permissions and flags in Windows security descriptors, which serve to protect securable objects in Windows operating systems.

SDDL covers the following components of Windows Security Descriptors –

Security Descriptor Flags
Access Control Entry (ACE) Flags
Security Principals
Security Permissions

1 . Security Descriptor Flags –

SDDL	Security Descriptor Flag Denoted
P	Protected
AR	Auto Inherit
AI	Auto Inherited

2 . ACE Flags –

SDDL	ACE Flag Denoted
A	Allow
D	Deny
OA	Object Allow
OD	Object Deny
CI	Container Inherit
OI	Object Inherit
IO	Inherit Only
ID	Inherited
NP	No Propogate
AU	Audit
SA	Audit Success
FA	Audit Failure
AL	Alarm
OU	Object Audit
OL	Object Alarm

Are you trying to find out who has what permissions in AD?

You can, with Gold Finger from Paramount Defenses !
Free Trial

3 . Security Principal –

SDDL	Security Principal Denoted
AN	Anonymous Logon
AU	Authenticated Users
BA	Builtin Administrators
BO	Backup Operators
BU	Builtin Users
CA	Certificate Service Administrators
CD	Certificate Services DCOM Access
CG	Creator Group
CO	Creator Owner
DA	Domain Administrators
DC	Domain Computers
DD	Domain Domain Controllers
DG	Domain Guests
DU	Domain Users
EA	Enterprise Administrators
ED	Enterprise Domain Controllers
RO	Enterprise Read-Only Domain Controllers
WD	Everyone
PA	Group Policy Administrators
BG	Guests
HI	High Integrity Level
IU	Interactively Logged-On User
LA	Local Administrators
LG	Local Guest
LS	Local Service
SY	Local System
LW	Low Integrity Level
ME	Medium Integrity Level
NO	Network Configuration Operators
NU	Network Logon User
NS	Network Service
PS	Personal Self
PU	Power Users
RU	Pre-Windows 2000 Compatible Access
PO	Print Operators
RS	RAS Servers
RD	Remote Desktop
RE	Replicator
RC	Restricted Code
SA	Schema Administrators
SU	Service Logon User
SO	Server Operators
SI	System Integrity Level

Are you trying to find out where all a user has permissions in AD?

You can, with Gold Finger from Paramount Defenses !
Free Trial

4 . Security Permissions –

SDDL	Security Principal Denoted
GA	Generic All
GR	Generic Read
GW	Generic Write
GX	Generic Execute
RC	Read Control
SD	Delete
WD	Write DACL
WO	Write Owner
RP	Read Property
WP	Write Property
CC	Create Child
DC	Delete Child
LC	List Child
SW	Self
LO	List Object
DT	Delete Tree
CR	Control Access
FA	All Access
FR	Generic Read
FW	Generic Write
FX	Generic Execute
KA	Key All Access
KR	Key Read
KW	Key Write
KX	Key Write

About	Copyright ActiveDirSec.Com 2008 – 2011. All Rights Reserved		Disclaimer
Active Directory Security	Active Directory Reports	Active Directory Reporting Tools	Cyber Security and Global Security
Active Directory Audit Tool	Active Directory Reporting Tool	Active Directory Reporting Tools	Active Directory Effective Permissions