126.96.36.199.1.4 Configurable State
Let C be the object in the config NC identified by the DN of "CN=Windows NT,CN=Services,CN=Configuration,<forest root DN>". C!dSHeuristics (section 188.8.131.52.4.1.2) is a Unicode string attribute, in which the 16th character, dwAdminSDExMask, can optionally be set to cause the protection operation to exclude one or more protected objects.
The valid values of dwAdminSDExMask are the characters "0"–"9" and "a"–"f". The value is interpreted as a hex digit, of which each bit represents a specific set of security principals that is to be excluded from the AdminSDHolder protection operation.
The set of security principal objects that are excluded are a member, directly or transitively, of any group in the set defined by bits set in the list below: