Overview#

NT-Sec-Descs is the representation of a data structure containing the security information associated with a securable object. Security Descriptor identifies:

• an object's owner by its Security Identifier (SID).
• If Access Control is configured for the object, the Security Descriptor contains a Discretionary Access Control List (DACL) with SIDs for the security principals who are allowed or denied access.

Applications use NT-Sec-Desc to set and query an object's security status. The Security Descriptor is used to guard access to an object as well as to control which type of auditing takes place when the object is accessed. The Security Descriptor format is specified in MS-DTYP section 2.4.6; a string representation of Security Descriptors, called Security Descriptor Description Language SDDL, is specified in MS-DTYP section 2.5.1.

NT-Sec-Desc is an Octet String

NT-Sec-Desc is defined in Draft-armijo-ldap-syntax-00 as:

Object-Security-Descriptor: 1.2.840.113556.1.4.907
        Encoded as an Octet-String (OID 1.3.6.1.4.1.1466.115.121.1.40)]

More Information#

• 2.5.5.15
• ADSTYPE_NT_SECURITY_DESCRIPTOR
• Microsoft Active Directory Syntax
• Security Descriptor