Data Protection and Security

V

Access Control

V.II

Unix and Windows NT Access Control Overview

Windows NT Access Control:

The access control implemented in Windows NT and other more recent versions of Windows is similar to Unix and largely based on ACLs. There are few differences though which makes access control of Windows NT fairly complex:

First of all, other than read, write and execute permissions, there are separate attributes for delete, change ownership and change permission. These attributes are not either on or off, but have multiple values: AccessDenied, AccessAllowed, or SystemAudit. These values are parsed in this order that means AccessDenied has priority over AccessAllowed. The SystemAudit entry defines which security events will be logged. An object may have any number of access control entries of each of these types.

Second, users can also have capabilities which are not tied to specific objects.

Third, users and resources can be partitioned into domains with distinct administrators so that local resources such as servers and printers could be managed locally and even individual machines might be administered by their users.

Finally, a benefit of a richer set of options is that you can arrange things to comply with least privilege principle. In practice, this is rarely done though.