GENERICALL

GENERICALL, commonly written as GENERIC_ALL, is a generic access right defined in Windows security. It is used in Access Control Lists (ACLs) and security descriptors to represent an intent to request or grant all possible access rights to an object, such as a file, registry key, or service.

In practice, granting GENERIC_ALL on an object gives broad control to the holder, typically including reading, writing, executing, deleting, changing permissions, and changing ownership. The exact set of rights that GENERIC_ALL yields depends on the object's specific access control entries (DACL) and the Windows access-control mapping, which translates generic rights into object-specific rights.

Notes and caveats: The translation from GENERIC_ALL to concrete rights is subject to the object’s security policy and any inherited or mandatory restrictions. On some objects, the DACL or policy may limit or override certain actions, so GENERIC_ALL is not an absolute guarantee of unlimited access in every situation. Security tools and administrators frequently encounter GENERIC_ALL when analyzing or modifying ACLs.

Security considerations: Because GENERIC_ALL can grant extensive privileges, it is a common target for misconfiguration and privilege escalation risk. Best practices encourage applying the principle of least privilege, routinely auditing ACLs, and avoiding broad GENERIC_ALL grants to untrusted or non-administrative accounts. Common tooling for inspecting and managing these rights includes icacls, PowerShell Get-Acl, and third-party security utilities.