ACE entry

ACE entry ( is: | is not: )
- AccessControlType is ( AccessAllowed | AccessDenied )
- Principal ( is | is not ) domain\user literal string or domain\group literal string
- Principal ( matches | not matches ) domain\user regular expression or domain\group regular expression
- Principal ( like | not like ) domain\user wildcard expression or domain\group wildcard expression
- PrintQueueRights ( is | contains | not contains ) comma-separated list of one or more of the following: AppendData, ChangePermissions, Delete, GenericExecute, ReadExtendedAttributes, ReadPermissions, or TakeOwnership.

Purpose

Indicates the complete set of properties which should be set simultaneously in one or more ACEs.

Notes

Each ACE entry requirement will check for matching ACEs in the relevant ACL:
ACE entry is: requirements looks for at least one ACE matching the description given and warns if no matching ACE is found.
ACE entry is not: requirements looks for at least one matching ACE and warns if a matching ACE is found.

Each specified ACE (access control entry) is described on one line.

Properties may be left out if that portion of the ACE does not need to be examined (if those properties do not matter). Each keyword/value pair is separated by a semicolon.

This requirement may be repeated in the same section. These properties may not be repeated in the same requirement. Therefore one can specify multiple “ACE entry” requirements in the same section, but one may not repeat the same property (such as “AccessControlType”) in any one “ACE entry” requirement.

PrintQueueRights conversion table from Windows print permission GUI

Windows print permission	Description	Martinet configuration language
Print	Assigns the ability for users to connect to printers and to print, pause, resume, start, and cancel their own documents. (source)	AccessControlType is AccessAllowed; PrintQueueRights is ReadExtendedAttributes, ReadPermissions
Manage this printer	Assigns the ability to pause and restart the printer, change spooler settings, share a printer, adjust printer permissions, and change printer properties. (source)	AccessControlType is AccessAllowed; PrintQueueRights is AppendData, ChangePermissions, Delete, GenericExecute, ReadExtendedAttributes, ReadPermissions, TakeOwnership
Manage documents	Assigns the ability to control job settings for all documents and to pause, restart, and delete all documents. (source)	AccessControlType is AccessAllowed; PrintQueueRights is ChangePermissions, Delete, ReadPermissions, TakeOwnership
Read permissions	Assigns the ability to read permissions.	AccessControlType is AccessAllowed; PrintQueueRights is ReadPermissions
Change permissions	Assigns the ability to change permissions.	AccessControlType is AccessAllowed; PrintQueueRights is ChangePermissions
Take ownership		AccessControlType is AccessAllowed; PrintQueueRights is TakeOwnership

Examples

# Warn if uofi\wislande is granted any rights directly in the relevant ACL (as opposed to inheriting rights by being a member of an AD group or local group).
ACE entry is not: Principal is uofi\wislande; AccessControlType is AccessAllowed;

# Warn if uofi\wislande is granted not ChangePermission right in the relevant ACL.
ACE entry is: Principal is uofi\wislande; AccessControlType is AccessAllowed; PrintQueueRights contains ChangePermission;