Major Access Control Changes in Windows Server 2008 in .NET

Encoder Code 128 Code Set A in .NET Major Access Control Changes in Windows Server 2008

Windows Server 2008, and Windows Vista, introduce a few changes to access control over prior versions of Windows. A couple of these changes are quite subtle, but two will be very important to many administrators. Let us start by looking at the subtle ones.

Many objects in Windows, as you saw earlier, are now owned by the TrustedInstaller service. This means that even administrators will find plenty of objects that they cannot modify without first changing the permissions on them. As an administrator, you are never quite completely locked out, of course, but you will almost certainly at some point run into a situation where you try to modify an object and get an access denied. This should be a trigger to question whether you really should be changing this object. The purpose of these restrictions is to maintain stability.

Part I:

As you saw in Figures 3-10 and 3-11, network location SIDs are present in security tokens. Including SIDs for INTERACTIVE, NETWORK, and so on in an ACL permits an administrator to control access to a particular object based on the access method. In Windows Server 2008 and Windows Vista, two new network location SIDs were added: DIALUP and INTERNET. The former applies to users connecting via a dial-up connection, while the latter applies to anyone connecting over a network connection that is not considered to be the local site.

It is hard not to notice that the Documents And Settings directory that we have known since Windows 2000 is now renamed to %systemdrive%\Users, with significant portions moving into %systemdrive%\ProgramData. Microsoft did this to simplify the file system namespace. However, many legacy applications use the full paths to the old directories instead of relying on environment variables. To avoid breaking such applications, Microsoft created junction points and symlinks from the old namespace to the new one. As a migration step, all those junctions and symlinks were outfitted with a Deny ACE to prevent listing the directory. In other words, you can specify a file in the old Documents And Settings directory, but you cannot open that directory in Windows Explorer. If you try to open it you will get an access denied error. Many people have grumbled about this since Windows Vista first came out. It is worth knowing how this happened.

One of the more significant changes is that the permissions for Power Users have been all but stripped. A few remnants may still exist, but for all practical purposes, Power Users are no longer any more powerful than Standard Users. This is a transitional step toward the eventual deprecation of the Power Users group altogether. The original intent behind the Power Users group was for it to be a group that would be able to do some sensitive things, but would not be outright administrators. However, by the time all the various permissions were added to make the group meaningful, they were a hairsbreadth from being administrators. In reality, making a user a Power User was tantamount to making her an administrator. Because it provided no value and was potentially misleading, Microsoft embarked on disabling the group. UAC now fills the purpose that Power Users failed to fill.

The final change is perhaps the most interesting. Prior versions of Windows have always had the Creator/Owner SID. Creator/Owner is typically used in inheritable ACEs to grant permission to whoever creates a child object. It is replaced at create time with the SID for the actual creator. In Windows Vista and Windows Server 2008 there is a new, related SID: OWNER_RIGHT. While Creator/Owner is replaced at object create time, OWNER_RIGHT is not. OWNER_RIGHT was created because there is now a change in permissions for owners.

3: