Reload Attribute Info
Compare this Object with another
Add New Attribute
Add Attribute Element to an Array
Remove Attribute
Show only Attributes that have Values
Show Friendly Object Names
Show Distinguished Name in Novell Notation
Show Hex Output for Hex Values
Show Multivalued Attributes
Set Attribute List Filter
Show Attribute Names and ValuesThis editor is used to show, edit or create Microsoft security descriptor attributes in an LDAP directory. Such attributes are used quite exclusively in Microsoft Active
Direcory environments. The editor also appears if you use the menu option Edit - Permissions for an Active Directory object:
In the top area of this dialog, you see the distinguished name and type icon for the object whose attribute your are editing. In the line beneath, the attribute name is shown.
To avoid confusion: There is a attribute syntax called String(NT-Sec-Desc) {MS}. We also call this here generally 'security descriptor', because it has nothing to do any more with Windows NT. On the other hand, the object ACL in an Active Director Environment is stored in an actual attribute which is named nTSecurityDesciptor also. This attribute has the syntax (guess what?) String(NT-Sec-Desc) {MS}.
The internal structure of an Microsoft Security Descriptor is very complex. It is described in the Microsoft Active Directory Technical Specification [MSADTS]. The value contained in String(NT-Sec-Desc) attribute represents an Microsoft Security Descriptor in binary form.
The Security Descriptor specifies the owner of an object and two different Access Control Lists: The System ACL (SACL) which controls the audit settings for this object, and the Discretionary ACL (DACL) which specify the access permissions. Therefore we have three different tabs in this attribute editor: Permission, Audit and Owner.
Even the Microsoft Dialog for the security settings of an Active Directory Object
doesn't reflect the real situation in the security descriptor data. In most cases, the dialog shows a summary or an an aggregation of the actual ACL entries in the security descriptor. LEX, in contrast, tries to show all the separate entries just as they are present in the data, so that you have an overview of the real situation. On the other hand, LEX tries to present the very complex permission flags in easy-to-handle checkboxes - they are explained below.
This tab shows all the ACEs (Access Control Entries) in the Discretionary Access Control List (DACL) of the security descriptor. This list holds the information about the security trustees of the regarding object. Each ACE is represented by one line in the permission tab:
The list of the access control entries show a summary of each entry per line. The entries can be quite complex - if you want to access and configure
the access control entries in detail, you have to double-click on an entry or use the Edit button to show the Access Control Entry editor. But you also can evaluate and access most of the permission settings right here in the list overview.
There are several columns shown in the ACEs list. You can sort the list according to the different columns by clicking on them.
Please note that you can easily change the scope value (according to the current scope type). Just click on the scope label directly in the regarding row and choose the new scope from the pulldown list:
Please be aware of the fact that
there are combinations of checkboxes which are NOT possible or not allowed to set in one single ACL line. An example: You cannot set the permission to read a certain attribute on the one hand and the permission to create a certain object class on the other hand in the sam access control entry. The reason for this is that only one scope specifier is allowed per ACE. For such cases, several different ACEs are necessary. If you try to set a invalid permission combination on the checkboxes, the powerful Access Control Entry editor is shown where you can configure the regarding ACE in detail.
Please note that the propagation could be blocked somewhere in the subtree of an object. this inheritance block can be set in this tab also: Just deactivate the Inherit permissions from parent objects option. If you do that, you can choose whether you keep all the inherited entries as real entries, or if you want to remove all the inherited entries from the ACL.
You can easily change the propagation value. Just click on the propagation label directly in the regarding row and choose the new propagation value from the pulldown list:
You can filter out the display of all permission entries of upper-level objects (such as OUs) which were inherited on the object. Under certain circumstances, a very large number of inherited permissions exist and the display the permissions may become cluttered and slow. So if you are primarily interested in the explicitly set permissions on objects, then you can use this filter. The filter is activated with a click on the button-field Hide interhited at the dialog bottom:
So do not forget that with an active filter information there is information that is not currently displayed! The button flashes red in this case:
The audit tab in the Microsoft NTSecurityDescriptor editor shows all the ACEs (Access Control Entries) in the System Access Control List (SACL) of the security descriptor. This list holds the information about the audit settings for the regarding object. Windows domain controllers can audit the access to the object according to the settings in the SACL, the audit log can be read in the local Security Log of the domain controllers. Remember that there is a global audit flag for Directory Access audit which has to be enabled first (through a GPO settings for the domain controllers).
Each ACE is represented by one line in the permission tab:
The use of the buttons and the meaning of these lines are identical to the ones which were explained before in the Permissions tab. The only difference is in the first column. The type of the access control entry defines which access has to be audited by the
system:
This tab shows the Owner of the regarding object, plus the primary group ID of the owner. Normally the user which had created an object becomes it's owner.
Attention: The owner of an object can always change the security descriptor (=> change the permissions), even if there is no explicit access control entry which specify this!
The owner is always a security Principal of the same Active Directory forest. The owner group is used very seldom by Active Directory mechanisms, it is borrowed from the concept of owner groups in the Unix/Posix world. You cannot set the owner group directly, 'cause this is always derived from the primaryGroupID attribute of the owner.
there is one special case according to object owners: If a member of the Domain Admin group is creating an object, the entire group becomes the owner (just like in Windows file system permissions).
You can change the owner with LEX if you want. The text box for the owner's name has the ability to quick-search objects when you enter names are parts of names which can be used to find them.
When the Check Names button 
is active, you just have to enter a string and LEX will automatically search for directory objects which match to this string. If more than one objects match to the search string, then an additional dialog lets you choose the object from a list.
The search for this objects is done with the same criteria as in the simple search function when you use the Directory Search dialog. If you chose the object from the list, or if you entered directly the full distinguished name of an object, then LEX realizes that the string in the text box is a real DN, it is underline to show that LEX matches this information internally. If the Check Names button is inactive, you can always try to resolve the string you entered into an objects DN by pressing F5.
If you want to see the distinguished name in the text box in a shorter, more readable form, you can activate the Show friendly object names button 
. This is the same feature which is used also in the LEX main windows object list.
When you are in the
mode where the distinguished names are displayed as short relative names, you can move your mouse over the regarding objects name: A popup text line will show you the complete distinguished name:
If you opened a security descriptor attribute with this editor dialog, you can also display and edit the underlying data in it's binary form if you want: Just press on the Raw label in the bottom left corner of the dialog. The editor is switched to an binary editor then:
The security descriptor editor is used whenever LEX has valid schema information and detects one of the following official attribute syntaxes:
1.2.840.113556.1.4.907 |
String(NT-Sec-Desc) {Microsoft} |
2.5.5.15 |
String(NT-Sec-Desc) {Microsoft} |
