ACE entry

ACE entry (is: | is not:)
- AccessControlType is (Allow | Deny)
- IdentityReference (is | is not) domain\user literal string or domain\group literal string
- IdentityReference (like | not like) domain\user wildcard expression or domain\group wildcard expression
- IdentityReference (matches | not matches) domain\user regular expression or domain\group regular expression
- IdentityReference (exists | does not exist)
- IdentityReference is (enabled | is not enabled)
- IsInherited is (True | False)
- InheritanceFlags (is | contains | not contains) comma-separated list of inheritance flags: None, ContainerInherit, and ObjectInherit
- PropagationFlags (is | contains | not contains) comma-separated list of inheritance flags: None, InheritOnly, and NoPropagateInherit
- FileSystemRights (contains | not contains) comma-separated list of file system rights listed below

Purpose

Indicates the complete set of properties which should be set simultaneously in one or more ACEs. Each operator will check for at least one matching ACE in the relevant ACL:

Notes

This requirement may be repeated in the same section. Properties listed below may be repeated in the same requirement unless otherwise noted.

Quote values with semicolons in this requirement

In compound requirements (requirements that allow multiple command/operator/argument triads), semicolons are used as separators. To include a semicolon in the value, quote the value.

For example:
AccountName is example; IdentityReference is "semicolon;text".

Each ACE entry requirement will check for matching ACEs in the relevant ACL:
ACE entry is: requirements looks for at least one ACE matching the description given and warns if no matching ACE is found.
ACE entry is not: requirements looks for at least one matching ACE and warns if a matching ACE is found.

Property Allowed values

AccessControlType

This property may be used only once in this requirement.

Allow grants permissions
Deny denies permissions

Example configuration

[folder:\\my-unit-fileserver.ad.uillinois.edu\MyShare\]
# The result shows what you'll see if are no deny ACEs in
# the \\my-unit-fileserver.ad.uillinois.edu\MyShare\ ACL.
ACE entry is: AccessControlType is deny

Example output

Line 7: No ACE in [\\my-unit-fileserver.ad.uillinois.edu\MyShare\] ACL matches AccessControlType is deny.

IdentityReference

An AD user or AD group.

Example configuration

[folder:\\my-unit-fileserver.ad.uillinois.edu\MyShare\*]
ACE entry is not: IdentityReference is BUILTIN\Administrators

Example output

Line 5: 1 ACE in [\\jbn-windows.ad.uillinois.edu\MyShare\jbn] ACL matches IdentityReference is BUILTIN\Administrators.

FileSystemRights

A comma-separated set of permission names from either the basic permissions or the advanced permissions. The table shows the relationship between the basic and advanced permission—each basic permission consists of the following advanced permissions. For example, the basic Write permission on a directory is equivalent to the CreateFiles, CreateDirectories, WriteAttributes, WriteExtendedAttributes, ReadPermissions, and Synchronize advanced permissions.

Advanced permission combination equivalencies

Basic permission name	Advanced permissions	Martinet permission configuration keywords
Full control	Full Control, Modify, Read & execute, List folder contents, Read, Write	`FullControl`
Modify	Modify, Read & execute, List folder/read data, Read, Write	`Modify, Synchronize`
Read & Execute	Traverse, List folder/read data, Read attributes, Read extended attributes, Read permissions	`ReadAndExecute, Synchronize`
List folder contents	Traverse, List folder/read data, Read attributes, Read extended attributes, Read permissions	`ReadAndExecute, Synchronize`
Read	List folder/read data, Read attributes, Read extended attributes, Read permissions	`Read, Synchronize`
Write	Create files/write data, Write attributes, Write extended attributes	`Write, Synchronize`
These advanced permissions have no basic permission equivalents.	Traverse folder	`Traverse, Synchronize`
	List folder/read data	`ListDirectory, Synchronize`
	Read attributes	`ReadAttributes, Synchronize`
	Read extended attributes	`ReadExtendedAttributes, Synchronize`
	Create files/write data	`CreateFiles, Synchronize`
	Create folders	`CreateDirectories, Synchronize`
	Write attributes	`WriteAttributes, Synchronize`
	Write extended attributes	`WriteExtendedAttributes, Synchronize`
	Delete subfolders and files	`DeleteSubdirectoriesAndFiles, Synchronize`
	Delete	`Delete, Synchronize`
	Read permissions	`ReadPermissions, Synchronize`
	Change permissions	`ChangePermissions, Synchronize`
	Take ownership	`TakeOwnership, Synchronize`

Operators

contains lists which permissions (FileSystemRights) are among those in the relevant ACE. Use this operator to focus on interested permissions without needing to know all of the permissions in the relevant ACE.
not contains lists which permissions (FileSystemRights) are not among those in the relevant ACE. Use this operator to focus on permissions that should not be in the relevant ACE.

Example configuration

[folder:\\my-unit-fileserver.ad.uillinois.edu\MyShare\foo]
ACE entry is not: FileSystemRights contains FullControl

Example output

Line 5: 3 ACEs in [\\my-unit-fileserver.ad.uillinois.edu\MyShare\foo] ACL match FileSystemRights contains FullControl:

FileSystemRights	AccessControlType	IdentityReference	IsInherited	InheritanceFlags	PropagationFlags
FullControl	Allow	UOFI\wislande	True	ContainerInherit, ObjectInherit	None
FullControl	Allow	NT AUTHORITY\SYSTEM	True	ContainerInherit, ObjectInherit	None
FullControl	Allow	BUILTIN\Administrators	True	ContainerInherit, ObjectInherit	None

IsInherited

This property may be used only once in this requirement.

True ACE is inherited
False ACE is not inherited.

Example configuration

[folder:\\my-unit-fileserver.ad.uillinois.edu\MyShare\foo]
ACE entry is not: IsInherited is True

Example output

Line 5: 3 ACEs in [\\my-unit-fileserver.ad.uillinois.edu\MyShare\foo] ACL match IsInherited is True:

FileSystemRights	AccessControlType	IdentityReference	IsInherited	InheritanceFlags	PropagationFlags
FullControl	Allow	UOFI\wislande	True	ContainerInherit, ObjectInherit	None
FullControl	Allow	NT AUTHORITY\SYSTEM	True	ContainerInherit, ObjectInherit	None
FullControl	Allow	BUILTIN\Administrators	True	ContainerInherit, ObjectInherit	None

InheritanceFlags

None ACE is not inherited by child objects.
ContainerInherit the ACE is inherited by subfolders of the folder but not by files.
ObjectInherit the ACE is inherited by files in the folder, but not by subfolders within that folder.

The following table lists the equivalent settings for specifying inheritance and/or propagation flags if you want to match the scope listed in the Windows advanced permissions panel user interface. For example, if you want the equivalent scope of the Windows advanced permissions “Subfolders and Files only” scope, then set InheritanceFlags is ContainerInherit, ObjectInherit and set PropagationFlags as directed below.

Folders only: InheritanceFlags: None
Subfolders and Files only: InheritanceFlags: ContainerInherit, ObjectInherit
This Folder, Subfolders and Files: InheritanceFlags: ContainerInherit, ObjectInherit
This folder and subfolders: InheritanceFlags: ContainerInherit
Subfolders only: InheritanceFlags: ContainerInherit
This folder and files: InheritanceFlags: ObjectInherit

Example configuration

[folder:\\my-unit-fileserver.ad.uillinois.edu\MyShare\foo]
ACE entry is: InheritanceFlags is None

Example output

Line 5: No ACE in [\\my-unit-fileserver.ad.uillinois.edu\MyShare\foo] ACL matches InheritanceFlags is None.

PropagationFlags

This property may be used only once in this requirement.

None no propagation flags are set.
InheritOnly the ACE is propagated only to child container (folder) and leaf (file) objects.
NoPropagateInherit the ACE is not propagated to child objects (either container or leaf).

The following table lists the equivalent settings for specifying inheritance and/or propagation flags if you want to match the scope listed in the Windows advanced permissions panel user interface. For example, if you want the equivalent scope of the Windows advanced permissions “Subfolders and Files only” scope, then set PropagationFlags is InheritOnly and set InheritanceFlags as directed above.

Folders only: PropagationFlags: None
Subfolders and Files only: PropagationFlags: InheritOnly
This Folder, Subfolders and Files: PropagationFlags: None or PropagationFlags: InheritOnly
This folder and subfolders:
Subfolders only: PropagationFlags: InheritOnly
This folder and files: PropagationFlags: None or PropagationFlags: InheritOnly

Examples

# No unit staff group should be granted full control.
ACE entry is not: AccessControlType is Allow; FileSystemRights contains FullControl; IdentityReference matches ^UOFI\\MyUnit .+ staff$
ACE entry is not: AccessControlType is Allow; FileSystemRights contains FullControl; IdentityReference is UOFI\MyUnit-Storage share users

# Admin users/groups should be granted full control.
ACE entry is: AccessControlType is Allow; FileSystemRights contains FullControl; IdentityReference is UOFI\MyUnit Admins
ACE entry is: AccessControlType is Allow; FileSystemRights contains FullControl; IdentityReference is NT AUTHORITY\SYSTEM
ACE entry is: AccessControlType is Allow; FileSystemRights contains FullControl; IdentityReference is BUILTIN\Administrators

# UOFI\MyUnit Deny Access (the ne'er-do-well group) must be denied all permissions.
ACE entry is: AccessControlType is Deny; FileSystemRights contains FullControl; IdentityReference is UOFI\MyUnit Deny Access