Setting Permissions on a Group of Properties

Permissions can also be applied to a group of properties. A property set is identified by the GUID in the rightsGUID attribute of a controlAccessRight object. This GUID is set in the attributeSecurityGUID attribute of the attributeSchema object of each attribute in the group.

To set permissions that apply to a group of properties in an object, perform the following steps:

• Set the IADsAccessControlEntry.AccessMask property to ADS_RIGHT_DS_READ_PROP, ADS_RIGHT_DS_WRITE_PROP or both values combined.

  Do not set the ADS_RIGHT_DS_CONTROL_ACCESS flag in the IADsAccessControlEntry.AccessMask property. This flag is used to specify a control access right only.

• Set the IADsAccessControlEntry.AceType property to either ADS_ACETYPE_ACCESS_ALLOWED_OBJECT or ADS_ACETYPE_ACCESS_DENIED_OBJECT.
• Set the IADsAccessControlEntry.ObjectType property to the GUID of the property set. This is the rightsGUID property of the controlAccessRight object that identifies the property set. This GUID is also set as the attributeSecurityGUID in the attributeSchema object of each property in the group.
• Set the IADsAccessControlEntry.Flags property to ADS_FLAG_OBJECT_TYPE_PRESENT.

For a code example that demonstrates how to set access rights for a proeprty set, see Example Code for Setting Permissions on a Group of Properties.

For a discussion of the steps for creating an ACE, see Setting Access Rights on an Object.

For additional C++ and Visual Basic sample code for setting an ACE for a property set, see Example Code for Setting an ACE on a Directory Object.