Executive Summary:
The Windows DAC model and its "ownership is power" concept can threaten security and compliance for organizations that must ensure the continuous availability of company data. But in the classic DAC model, there's no way to block users from deleting objects they’ve created. Now a feature in Vista and Server 2008 can help you regain control of ownership. It's a security principal called Owner Rights (SID S-1-3-4). You can use this SID and other methods such as command-line tools, to control ownership and better manage your Windows resources. |
In Windows, ownership is power—a user who creates an object automatically becomes its owner and can set permissions at his or her discretion. This authorization model, known as discretionary access control (DAC), means an object owner can control access to a file, folder, registry key, or Active Directory (AD) object, affecting the availability of that data as well as your organization's efforts to comply with regulatory requirements. . . .
