Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The presence of a NULL DACL in the nTSecurityDescriptor attribute of an object grants full access to the object to any principal that requests it; normal access checks are not performed with respect to the object.
An empty DACL, on the other hand, is a properly allocated and initialized DACL containing no ACEs. An empty DACL in the nTSecurityDescriptor attribute of an object grants no access to the object. Note that even with an empty DACL, some rights are implied. For example, the current OWNER of an object is implicitly granted RIGHT_READ_CONTROL and RIGHT_WRITE_DAC access. When BlockOwnerImplicitRights is set to 1 (or 0 on Windows 11, version 26H1 operating system) and the requester is a member of neither the Domain Administrators (section 6.1.1.6.5) or Enterprise Administrators (section 6.1.1.6.10) group, the implicit grant of WRITE_DAC MUST be ignored for purposes of the authorization check.7
If the user possesses the SE_TAKE_OWNERSHIP_PRIVILEGE, then RIGHT_WRITE_OWNER access is implied.
7 Under the stated conditions, the implicit WRITE_DAC grant MUST be ignored for purposes of the authorization check on computers running the operating systems specified in [MSFT-CVE-2021-42291], each with its related MSKB article download installed.