4

If I have the following 3 permission values for 3 separate folders in Windows:

Decimal: 268435456 - Binary: 10000000000000000000000000000 - 29 bits

Decimal: 134217728 - Binary: 1000000000000000000000000000 - 28 bits

Decimal: 67108864 - Binary: 100000000000000000000000000 - 27 bits

How do I interpret these 3 permission values?

Here is the MSDN Access Mask Format guide:

Access Mask key

Should I be padding my generic permissions with 0's in front of the most significant bit (the left side) to make the binary word 32 bits long?

My understanding is that generic permissions are 32 bit unsigned integer values, yet I see permissions like -1610612736 all the time. Are they unsigned and simply being represented as signed?

I'm using PowerShell to create a permissions checking script and running into this issue... This stackoverflow post is relevant. Also a TechNet post I have going about this issue.

Community
  • 1
Shrout1
  • 1,114

1 Answers1

2

Ok self answering as I had some assistance on Technet.

Unpadded "268435456" "Generic All" 29 bits -     10000000000000000000000000000
Unpadded "536870912" "Generic Execute" 30 bits - 100000000000000000000000000000
Unpadded "1073741824" "Generic Write" 31 bits -  1000000000000000000000000000000
Unpadded "-2147483648" "Generic Read" 32 Bits -  10000000000000000000000000000000

Now padded:

Padded "268435456" "Generic All" 32 bits -     00010000000000000000000000000000
Padded "536870912" "Generic Execute" 32 bits - 00100000000000000000000000000000
Padded "1073741824" "Generic Write" 32 bits -  01000000000000000000000000000000
Padded "-2147483648" "Generic Read" 32 Bits -  10000000000000000000000000000000

Access Mask Diagram

Link to the MSDN article on access mask.

All 32 bit permissions should be padded on the left hand side (most significant bit). Once this is done it becomes clear how the bit aligns with the access masks used by Microsoft to determine permissions.

Also, it seems that the signed and unsigned representations of "Generic Read" (-2147483648) yield the exact same binary sequence. I'm really not 100% certain what bearing the sign has on this value, but perhaps it matters for other access right sequences.

Shrout1
  • 1,114