3.1.4.1 Default Access

Information about the default access control (expressed in the default security descriptor) on user, group, alias, domain, and server objects is specified in [MS-ADTS] section 3.1.1.2. This is significant because this server MUST use the security descriptor from the [MS-ADTS] data model to determine whether the client has access to perform the requested operation. If, for example, a client opens a domain object with SamrOpenDomain (section 3.1.5.1.5) requesting DOMAIN_READ_PASSWORD_PROPERTIES, SamrOpenDomain uses the [MS-ADTS] data model security descriptor to determine whether the client has access to read password-related properties. For more information related to this example, see the message processing section of SamrOpenDomain.

Show: