Is there a tool to generate SDDL (Security Descriptor Definition Language) strings?

Question

Is there a tool to generate SDDL (Security Descriptor Definition Language) strings? I'd like to create them through Windows' Security property sheet or something similar.

Dryad

Answer 1

One way is to set the ACL on a file (using the standard property sheet -- i.e. right click and choose Properties, then go to the Security tab), then use CACLS filename /S to display the resulting ACL in the SDDL format.

Dryad

This is really good tip to construct SDDL if you don't want to go through the complex SDDL syntax to format it. I like it. :-) – Newscast

Will not work for custom (non in-built) user accounts. – Bessiebessy

@Bessiebessy - Would it work for AD-accounts and groups as well as built-in groups? For stable environments the identifiers of AD-entities should be known ahead of deployment? Most of the time you would permission based on groups and not user accounts? (users come and go, but groups remain stable). – Integration

Answer 2

For those who want to get the SDDL string for registry keys permissions you can use PowerShell:

Get-Acl -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | Format-List

Euphonic