Edit

Setting Rights to Specific Types of Objects

  • Article

The following procedure shows how to set an ACE that can be inherited only by a specific class of objects.

To set an ACE that can be inherited only by a specific class of objects

  1. Set the IADsAccessControlEntry.AceType property to ADS_ACETYPE_ACCESS_ALLOWED_OBJECT or ADS_ACETYPE_ACCESS_DENIED_OBJECT.
  2. Set the IADsAccessControlEntry.AceFlags property to include the ADS_ACEFLAG_INHERIT_ACE flag.
  3. Set the IADsAccessControlEntry.InheritedObjectType property to the schemaIDGUID of the object class that can inherit the ACE.
  4. Set the IADsAccessControlEntry.Flags property to ADS_FLAG_INHERITED OBJECT_TYPE_PRESENT.

Important

Set ADS_ACEFLAG_INHERIT_ACE to cause the ACE to be inherited. In addition, you must set ADS_ACEFLAG_INHERIT_ONLY_ACE if the object type this ACE applies to does not match the object type of the container where the ACE is specified. If this is not done, the ACE will also become effective on the container and can grant unintended rights.

 

For more information and code examples that can be used to set this type of ACE, see Example Code for Setting an ACE on a Directory Object.