Profile permissions ...

[Jean Francois Micouleau]

On Wed, 30 Oct 2002, Richard Sharpe wrote:

> Hi,
>
> In looking at NTUSER.DAT, it seems that the permissions associated with
> some of the SIDs are:
>
>   0x000f003f
>
> Hmmm, here is one of the entries:
>
>    0x0014 003f 000f 0101 0000 0000 0005 0012 0000
>
> Which seems to be:
>
>   ACCESS Denied, No Propogate Inherit, All Access, S-1-5-4608
>
> Does this seem reasonable?

hum the sid looks more like S-1-5-18 (this one exists i'm sure) or
S-1-5-18-0 (don't remember that one).

Are you sure the access mask is a file's access mask ? The lower bits of
an access mask is linked to the type of the object, it applies to.

files access bits != printer access bits != SAM access bits != LSA access
bits, and so on.

	J.F.