SECURITYDESCRIPTOR

A SECURITYDESCRIPTOR, commonly referred to as a security descriptor in Windows terminology, is a data structure used to describe the security attributes of a securable object. It encapsulates the information necessary for the system to enforce access control, including who owns the object, which principals have access, and what kinds of auditing or denial rules apply.

A security descriptor can exist in two formats: absolute and self-relative. In a self-relative format, all data is contained in a single contiguous buffer and pointers are represented as offsets from the start of the descriptor. In an absolute format, the descriptor uses real pointers to separate buffers. The security descriptor contains a revision level, control flags, owner and group identifiers, and optional DACL (Discretionary Access Control List) and SACL (System Access Control List) components.

Key components include the owner (the user or entity that owns the object) and the primary group, along with the DACL, which specifies which principals may access the object and with which permissions, and the SACL, which specifies auditing rules. ACEs (Access Control Entries) within the DACL/SACL define specific permissions and conditions.

Common operations involve creating, initializing, and applying security descriptors using Windows APIs, such as InitializeSecurityDescriptor, SetSecurityDescriptorDacl, and SetSecurityInfo or Get/Set named security information. Conversions between absolute and self-relative formats are performed with functions like MakeSelfRelativeSD and MakeAbsoluteSD. The security descriptor is central to how the Windows security subsystem enforces access control across objects such as files, registry keys, processes, and other securable resources.