Extended Rights

Platform SDK: Active Directory, ADSI, and Directory Services

Extended Rights

All Active Directory™ objects support a standard set of access rights defined in the ADS_RIGHTS_ENUM enumeration. You can use these access rights in the ACEs of an object's security descriptor to control access to the object, that is, to control who can perform standard operations, such as creating and deleting child objects, or reading and writing the properties of an object. However, for some objects classes you may want to control access in a way not supported by the standard access rights. So Active Directory provides a way to extend the standard access control mechanism.

Extended rights are used in two ways.

For special operations not covered by the standard set of access rights. For example, the user class can be granted a Send As right that can be used by Exchange, Outlook, or any other mail program, to determine whether a particular user can have another user send mail on their behalf.
For defining property sets, to enable controlling access to a subset of an object's properties. Using the standard access rights, a single ACE can grant or deny access to all of an object's properties or to a single property. Extended rights provide a way for a single ACE to control access to a set of properties. For example, the user class supports the Personal-Information property set that includes properties such as street address and telephone number.

Each extended right is represented by a controlAccessRight object in the Extended-Rights container of the Configuration partition. Because the Configuration container is replicated across the entire forest, extended rights are propagated across all domains in a forest. There are a number of predefined extended rights, and of course, you can define your own.

For C++ and Visual Basic® sample code that sets an ACE to control read/write access to a property set, see Example Code for Setting an ACE on a Directory Object.

For information on using extended rights to control access to special operations, see the following topics.