Setting Permissions on a Group of Properties

Permissions can also be applied to a group of properties. A property group is identified by the GUID in the rightsGUID property of a controlAccessRight object. This GUID is set in the attributeSecurityGUID property of the attributeSchema object of each property in the group.

To set permissions that apply to a group of properties in an object:

• Set the AccessMask to ADS_RIGHT_DS_READ_PROP and/or ADS_RIGHT_DS_WRITE_PROP.

  Do not set the ADS_RIGHT_DS_CONTROL_ACCESS flag, which is used to specify an extended right only.

• Set AceType to ADS_ACETYPE_ACCESS_ALLOWED_OBJECT or ADS_ACETYPE_ACCESS_DENIED_OBJECT.
• Set ObjectType to the GUID of the property group. This is the rightsGUID property of the controlAccessRights object that identifies the property group. This GUID is also set as the attributeSecurityGUID in the attributeSchema object of each property in the group.
• Set Flags to ADS_FLAG_OBJECT_TYPE_PRESENT.

For a discussion of the steps for creating an ACE, see Setting Access Rights on an Object.

For additional C++ and Visual Basic sample code for setting an ACE for a property set, see:

• Example Code for Setting an ACE on a Directory Object