ADS_RIGHTS_ENUM

Flag

Description

ADS_RIGHT_DELETE

The right to delete the object.

ADS_RIGHT_READ_CONTROL

The right to read data from the security descriptor of the object, not including the data in the SACL.

ADS_RIGHT_WRITE_DAC

The right to modify the discretionary access-control list (DACL) in the object security descriptor.

ADS_RIGHT_WRITE_OWNER

The right to assume ownership of the object. The user must be an object trustee. The user cannot transfer the ownership to other users.

ADS_RIGHT_SYNCHRONIZE

The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state.

ADS_RIGHT_ACCESS_SYSTEM_SECURITY

The right to get or set the SACL in the object security descriptor.

ADS_RIGHT_GENERIC_READ

The right to read permissions on this object, read all the properties on this object, list this object name when the parent container is listed, and list the contents of this object if it is a container.

ADS_RIGHT_GENERIC_WRITE

The right to read permissions on this object, write all the properties on this object, and perform all validated writes to this object.

ADS_RIGHT_GENERIC_EXECUTE

The right to read permissions on, and list the contents of, a container object.

ADS_RIGHT_GENERIC_ALL

The right to create or delete child objects, delete a subtree, read and write properties, examine child objects and the object itself, remove the object from the directory, and read or write with an extended right.

ADS_RIGHT_DS_CREATE_CHILD

The right to create child objects of the object. The ObjectType member of an ACE can contain a GUID that identifies the type of child object whose creation is controlled. If ObjectType does not contain a GUID, the ACE controls the creation of all child object types.

ADS_RIGHT_DS_DELETE_CHILD

The right to delete child objects of the object. The ObjectType member of an ACE can contain a GUID that identifies a type of child object whose deletion is controlled. If ObjectType does not contain a GUID, the ACE controls the deletion of all child object types.

ADS_RIGHT_ACTRL_DS_LIST

The right to list child objects of this object.

ADS_RIGHT_DS_SELF

The right to perform an operation controlled by a validated write access right. The ObjectType member of an ACE can contain a GUID that identifies the validated write. If ObjectType does not contain a GUID, the ACE controls the rights to perform all valid write operations associated with the object.

ADS_RIGHT_DS_READ_PROP

The right to read properties of the object. The ObjectType member of an ACE can contain a GUID that identifies a property set or property. If ObjectType does not contain a GUID, the ACE controls the right to read all of the object properties.

ADS_RIGHT_DS_WRITE_PROP

The right to write properties of the object. The ObjectType member of an ACE can contain a GUID that identifies a property set or property. If ObjectType does not contain a GUID, the ACE controls the right to write all of the object properties.

ADS_RIGHT_DS_DELETE_TREE

The right to delete all child objects of this object, regardless of the permissions of the child objects.

ADS_RIGHT_DS_LIST_OBJECT

The right to list a particular object. If the user is not granted such a right, and the user does not have ADS_RIGHT_ACTRL_DS_LIST set on the object parent, the object is hidden from the user. This right is ignored if the third character of the dSHeuristics property is 0 or not set.

ADS_RIGHT_DS_CONTROL_ACCESS

The right to perform an operation controlled by an extended access right. The ObjectType member of an ACE can contain a GUID that identifies the extended right. If ObjectType does not contain a GUID, the ACE controls the right to perform all extended right operations associated with the object.

ADS_RIGHT_DS_RESTORE_TO

The right to restore deleted objects. The ObjectType member of an ACE can contain a GUID that identifies the type of objects whose restoring is controlled. If ObjectType does not contain a GUID, the ACE controls restoring all object types.