Set GrantedAccess to AllowedAccesses and (not DeniedAccesses) IF GrantedAccess not equals 0 THEN Return success ElSE Return access_denied END IF SET GrantedAccess to 0 IF RemainingAccess to 0 THEN Return success Else Return access_denied END IF END-SUBROUTINE STATUS_CODE AccessCheck( TOKEN Token, SECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK Access Request mask, OBJECT_TYPE_LIST Object Tree, Sid PrincipalSelfSubstitute, [out] ACCESS_MASK GrantedAccess) Dim CentralAccessPolicy CentralizedAccessPolicy Dim SECURITY_DESCRIPTOR CaprSecurityDescriptor Dim SECURITY_DESCRIPTOR StagedCaprSecurityDescriptor Dim ACCESS_MASK DesiredAccess Dim ACCESS_MASK CentralAccessPolicyEffectiveAccess Dim ACCESS_MASK CentralAccessPolicyEntryEffectiveAccess Dim ACCESS_MASK CentralAccessPolicyStagedAccess Dim ACCESS_MASK CentralAccessPolicyEntryStagedAccess Dim ULONG Result Dim STATUS_CODE Status Set DACL to SecurityDescriptor Dacl field Set SACL to SecurityDescriptor Sacl field Set RemainingAccess to Access Request mask Set AllowedAccesses to 0 Set DeniedAccesses to 0 Set DesiredAccess to Access Request mask CALL EvaluateTokenAgainstDescriptor(Token, SecurityDescriptor, DesiredAccess, Object Tree, PrincipalSelfSubstitute, GrantedAccess) returning Status IF Status is access_denied THEN return Status END IF CALL GetCentralizedAccessPolicy(SACL) returning CentralizedAccessPolicy IF CentralizedAccessPolicy is not NULL THEN Set CentralAccessPolicyEffectiveAccess to GrantedAccess Set CentralAccessPolicyStagedAccess to GrantedAccess FOR each CentralAccessPolicyRule in CentralAccessPolicy.RulesList EvaluateAceCondition(Token, SACL, AppliesTo, AppliesToSize) returning Result
Set GrantedAccess to AllowedAccesses and (not DeniedAccesses) IF GrantedAccess not equals 0 THEN Return success ElSE Return access_denied END IF SET GrantedAccess to 0 IF RemainingAccess to 0 THEN Return success Else Return access_denied END IF END-SUBROUTINE STATUS_CODE AccessCheck( TOKEN Token, SECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK Access Request mask, OBJECT_TYPE_LIST Object Tree, Sid PrincipalSelfSubstitute, [out] ACCESS_MASK GrantedAccess) Dim CentralAccessPolicy CentralizedAccessPolicy Dim SECURITY_DESCRIPTOR CaprSecurityDescriptor Dim SECURITY_DESCRIPTOR StagedCaprSecurityDescriptor Dim ACCESS_MASK DesiredAccess Dim ACCESS_MASK CentralAccessPolicyEffectiveAccess Dim ACCESS_MASK CentralAccessPolicyEntryEffectiveAccess Dim ACCESS_MASK CentralAccessPolicyStagedAccess Dim ACCESS_MASK CentralAccessPolicyEntryStagedAccess Dim ULONG Result Dim STATUS_CODE Status Set DACL to SecurityDescriptor Dacl field Set SACL to SecurityDescriptor Sacl field Set RemainingAccess to Access Request mask Set AllowedAccesses to 0 Set DeniedAccesses to 0 Set DesiredAccess to Access Request mask CALL EvaluateTokenAgainstDescriptor(Token, SecurityDescriptor, DesiredAccess, Object Tree, PrincipalSelfSubstitute, GrantedAccess) returning Status IF Status is access_denied THEN return Status END IF CALL GetCentralizedAccessPolicy(SACL) returning CentralizedAccessPolicy IF CentralizedAccessPolicy is not NULL THEN Set CentralAccessPolicyEffectiveAccess to GrantedAccess Set CentralAccessPolicyStagedAccess to GrantedAccess FOR each CentralAccessPolicyRule in CentralAccessPolicy.RulesList EvaluateAceCondition(Token, SACL, AppliesTo, AppliesToSize) returning Result
%5BMS-DTYP%5D-171201.docx