Setting Permissions to a Specific Property

Permissions can be set to apply to a specific property of an object.

To set permissions that apply to a specific property of an object:

• Set the AccessMask to ADS_RIGHT_DS_READ_PROP and/or ADS_RIGHT_DS_WRITE_PROP.
• Set AceType to ADS_ACETYPE_ACCESS_ALLOWED_OBJECT or ADS_ACETYPE_ACCESS_DENIED_OBJECT.
• Set ObjectType to the schemaIDGUID of the property. This is the schemaIDGUID of the attributeSchema object that defines the property in the schema. The GUID must be specified as a string of the form produced by the StringFromGUID2 function in the COM library.

  For the schemaIDGUID of a predefined attribute, see the Active Directory Schema Reference in the Active Directory Reference. For sample code to retrieve a schemaIDGUID programmatically, see Reading attributeSchema and classSchema Objects.

• Set Flags to ADS_FLAG_OBJECT_TYPE_PRESENT.

For a discussion of the steps for creating an ACE, see Setting Access Rights on an Object.

For sample C++ and Visual Basic code for setting a property-specific ACE, see:

• Example Code for Setting an ACE on a Directory Object