SDDL

SDDL, or Security Descriptor Definition Language, is a textual representation of Windows security descriptors used to describe permissions and auditing settings for objects such as files, registry keys, services, and other securable resources. It provides a compact, human-readable way to specify the components of a security descriptor.

A security descriptor describes who owns an object, which principals can access it, and how auditing and other controls apply. The main components are the owner (O:), the primary group (G:), the Discretionary Access Control List (D:), and the System Access Control List (S: or SACL). The DACL contains access-control entries (ACEs) that grant or deny rights to users or groups. The SACL defines auditing rules. Each ACE is encoded with fields that indicate the type (for example, A for allow, D for deny), any flags, the rights (such as read, write, full access), and the security identifier (SID) of the principal.

A simple example of an SDDL string is: D:(A;;FA;;;BA)(A;;FA;;;SY). This DACL allows full access to the Built-in Administrators group (BA) and to the Local System account (SY).

SDDL is primarily used within the Windows security subsystem and in Windows API routines that manipulate security descriptors. Tools and APIs can convert between SDDL strings and binary security descriptors, such as ConvertStringSecurityDescriptorToSecurityDescriptor and ConvertSecurityDescriptorToStringSecurityDescriptor. These strings are commonly used in configuration scripts, registry keys, and programmatic security management to define precise access controls in a portable, text-based form.