DACL and SACL

1. Discretionary Access Control List (DACL):

   • The DACL is a list of permissions attached to an object, such as files, folders, registry keys, or other securable objects in the Windows operating system.

   • Each entry in the DACL specifies the permissions that a particular user or group has on the object.

   • DACLs are discretionary because the owner of the object can grant or deny permissions to other users or groups at their discretion, provided they have the necessary permissions themselves.

   • Permissions in the DACL include actions like read, write, execute, delete, modify permissions, and more.

2. System Access Control List (SACL):

   • The SACL is another component of the ACL associated with securable objects in Windows.

   • Unlike the DACL, which controls access to the object, the SACL controls auditing for the object.

   • The SACL specifies which actions on the object should be audited, and it defines what types of access attempts should be logged, and by which users or groups.

   • When an access attempt matches the conditions specified in the SACL, an audit entry is generated in the security event log.

   • Auditing configured through the SACL helps administrators track access to sensitive resources, detect security breaches, and monitor user activity for compliance or security purposes.

In summary, while the DACL controls permissions for accessing and modifying objects, the SACL governs auditing and logging of access attempts to those objects. Both DACLs and SACLs are essential components of the Windows security model, providing granular control over access and visibility into system activity.