> For the complete documentation index, see [llms.txt](https://kyou00.gitbook.io/xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kyou00.gitbook.io/xyz/notes/view/windows/security-descriptor-definition-language-sddl.md).

# Security Descriptor Definition Language (SDDL)

The Security Descriptor Definition Language (SDDL) is a textual format used to represent security descriptors in a human-readable form. Security descriptors are data structures used by Windows to describe the security attributes of securable objects, such as files, folders, registry keys, services, and more.

SDDL provides a standardized way to express the components of a security descriptor, including:

1. **Owner**: The security identifier (SID) of the object's owner.
2. **Group**: The SID of the object's primary group.
3. **Discretionary Access Control List (DACL)**: A list of access control entries (ACEs) that define the permissions granted or denied to specific users or groups.
4. **System Access Control List (SACL)**: A list of ACEs that specify which actions should be audited for the object.

SDDL strings are typically used in scenarios such as:

* Setting permissions on securable objects using command-line tools like `icacls` or `secedit`.
* Configuring security settings in Group Policy objects (GPOs).
* Displaying security information in event logs or other administrative tools.

Here's a basic example of an SDDL string:

```css
cssCopy codeO:BAG:BAD:(A;;0x12019f;;;BU)
```

This SDDL string represents a security descriptor with the following components:

* **Owner (O)**: SID of the owner.
* **Group (G)**: SID of the primary group.
* **DACL (D)**: `(A;;0x12019f;;;BU)` - An ACE granting generic read and generic write permissions (`0x12019f`) to the built-in Users group (`BU`).

While SDDL strings may seem cryptic at first glance, they provide a compact and standardized way to represent complex security information, making them useful for managing and configuring security settings in Windows environments.