Provider-Independent Access Mask Format

[This is preliminary documentation and subject to change.]

For Windows NT versions 5.0 and later, the Win32 API provides support for controlling access to securable objects that were created by operating systems other than Windows NT. Objects on other systems can have their own access mask format that is different from the access mask format used by securable objects. To provide security support for these objects, the Win32 API defines a provider-independent access mask format that you can use with objects and with objects on systems other than Windows NT.

For each supported operating system, Windows NT has a provider that converts the provider-independent flags to the corresponding object-specific flags. For example, a provider for Novell NetWare maps provider-independent access rights to object-specific access rights for NetWare objects. For Win32 objects, the system maps the provider-independent access rights to the corresponding access rights. For tables that show the mapping for each type of Win32 object, see Provider-Independent and Windows NT Access Rights.

The following diagram shows the provider-independent access mask format.

Some Win32 functions interpret access masks using the provider-independent access mask format; others use the Windows NT access mask format.

Use Windows NT access rights with the following functions:

• Functions for opening and creating securable objects, such as CreateFile or OpenProcess. These functions use the Windows NT access rights to specify the requested access and to specify the access masks in security descriptor ACEs.
• The functions described in the Windows NT 4.0 Access Control or Low-Level Access-Control overviews. This includes all of the low-level functions added for Windows NT version 5.0, such as AddAccessAllowedAceEx.
• The AccessCheck, AccessCheckAndAuditAlarm, AccessCheckByType, AccessCheckByTypeAndAuditAlarm, AccessCheckByTypeResultList, and AccessCheckByTypeResultListAndAuditAlarm functions.

Use provider-independent access rights with the following functions:

• GetAccessPermissionsForObject
• GetNamedSecurityInfoEx
• GetSecurityInfoEx
• SetEntriesInAccessList
• SetEntriesInAuditList
• SetNamedSecurityInfoEx
• SetSecurityInfoEx
• TrusteeAccessToObject

The following functions use both Windows NT access rights and provider-independent access rights:

• The ConvertAccessToSecurityDescriptor function takes provider-independent access rights as input and generates a security descriptor that contains Windows NT access rights.
• The ConvertSecurityDescriptorToAccessNamed and ConvertSecurityDescriptorToAccess functions take a security descriptor containing Windows NT access rights and return structures containing the corresponding provider-independent access rights.