Reload Attribute Info
Compare this Object with another
Add New Attribute
Add Attribute Element to an Array
Remove Attribute
Show only Attributes that have Values
Show Friendly Object Names
Show Distinguished Name in Novell Notation
Show Hex Output for Hex Values
Show Multivalued Attributes
Set Attribute List Filter
Show Attribute Names and Values
This is an option for Active Directory environments only. Actually, it's nothing else than opening the nTSecurityDescriptor attribute of the currently selected object with the appropriate attribute editor.
The ntSecurityDescriptor attribute which contains the access control list (ACL) is very specific to Microsoft Active Directory environments. So, if you are not connected to an AD directory server, or you cannot access the nTSecurityDescriptor attribute, you cannot use the Edit - Permissions option.
First of all, the security attribute editor presents three different tabs for you:
If you don't see all of these dialog tabs, it might be that you have insufficient rights to access the permission or audit information. To see the DACL permissions, you need to have the Read Control (RC) right. To see the SACL audit information, you need the security policy privilege 'Manage Audit and Security Log'. If LEX detects that you do not have the permissions to access the DACL, you are asked if you want to try taking ownership for the regarding object - the owner can always access the DACL:
There are a lot of particular permission flags. In most cases, these flags can be joined together to combinations which are reasonable for daily operation in Active Directory environments. The Permissions Editor shows you directly if some of these combinations are set for the entries in the object ACL.
The abbreviations for the often used permission combinations are:
'
| F | Full permissions. |
| R | Read permissions on the properties which are listed in the 'Scope' column. If this column is empty, R means that all properties can be read, the object and children can be listed and the object permissions can be read. |
| W | Write permissions on the properties which are listed in the 'Scope' column. If this column is empty, W means that all properties can be read, and all the validated rights are granted. |
| L | List children or content of the object. |
| C | Create child permissions: All objects of the type listed in 'Scope' column can be created as children. If this column is empty, then D means that all object classes can be created as children. |
| D | Delete child permissions: All child objects of the type listed in 'Scope' column can be deleted. If this column is empty, then D means that all children can be deleted. |
| S | Special permissions: All permissions which can't be specified with a valid combination of the other often used permissions |
If you want to see the detailed view and the settings of all possible permission flags, or if you want to set a special permission, then you have to double-click on one entry. Then the Access Control Entry Editor is shown:
Detailed info about the security attribute editor are outlined in the manual topic about Attribute Editors for Microsoft Security Desciptors.
