Setting Permissions on Child Object Operations

Permissions (such as Create Child and Delete Child) can also be granted or denied for operations on all subobjects or subobjects that are of a specific class.

To set permissions for a specific subobject type:

• Set AceType to ADS_ACETYPE_ACCESS_ALLOWED_OBJECT or ADS_ACETYPE_ACCESS_DENIED_OBJECT.
• Set ObjectType to the GUID for object class. This is the schemaIDGUID property of the classSchema object that defines the object class. If ObjectType is NULL, the ACE applies to subobjects of any class.
• Set Flags to ADS_FLAG_OBJECT_TYPE_PRESENT.

For a discussion of the steps for creating an ACE, see Setting Access Rights on an Object.

For additional C++ and Visual Basic sample code for setting an ACE that controls child object operations, see:

• Example Code for Setting an ACE on a Directory Object