IADsAccessControlEntry

The IADsAccessControlEntry interface enables directory clients to access and manipulate individual access-control entries (ACEs) of the owning object. An ACE stipulates who can access the object and what type of access will be granted. It also specifies whether the access control settings can be propagated from the object to any of its children. An ACE exposes a set of properties through this interface to provide such services.

An object can have a number of ACEs, one for each client or a group of clients. ACEs are maintained in an access-control list (ACL) which implements the IADsAccessControlList interface. This means that a client needs to go through an ACL in order to access ACEs. To access the ACL, one must obtain the object's security descriptor that implements the IADsSecurityDescriptor interface. The general procedure to manage access controls over an ADSI object involves the following steps:

1. Obtain the security descriptor of the object of interest.
2. Retrieve an ACL from the security descriptor.
3. Work with ACEs in the ACL.

To make any new or modified ACEs persistent:

1. Add the ACEs to the ACL
2. Assign the ACL to the security descriptor
3. Commit the security descriptor to the directory store.

The IADsAccessControlEntry interface is a dual interface and exposes the following property methods.

Methods in Vtable Order

Requirements

  Windows NT/2000: Requires Windows 2000 (or Windows NT 4.0 with DSClient).
  Windows 95/98: Requires Windows 95 or later (with DSClient).
  Header: Declared in Iads.h.

See Also

IAccessControlList, IADsSecurityDescriptor