Access Control Lists

Access Control List(ACL) is a record of Access Control Entries(ACE). The ACE recognizes a trustee and specifies the access rights, whether they are allowed or denied, or audited for the trustee. There are 2 types of ACL: Discretionary Access Control List and System Access Control List.


Discretionary Access Control List(DACL)
This helps identify the whether the trustee is allowed or denied access to a securable object. The system will check all the ACE in the object DACL to determine granting of access when a process attempts to access a securable object. The system would grant full access to everyone if the object doesn't have DACL, as DACL does not allow any access rights.


System Access Control List(SACL)
This enables administrators to log attempts to access secure objects. The ACE in SACL can generate a record in the security log.  


* A securable object is an object that is able to have a security descriptor. All Windows object are securable object, other unnamed object like: process and thread objects, can also have security descriptor.


DACL identify the users and groups that are assigned or denied permission to access on a object, whereas SACL identify the user and groups that the administrator wants to audit whether they can access to an object.

REFERENCE : http://msdn.microsoft.com/en-us/library/windows/desktop/aa374872(v=vs.85).aspx
http://technet.microsoft.com/en-us/library/cc781716(v=ws.10).aspx
http://clintboessen.blogspot.com/2011/04/whats-difference-between-acl-ace-dacl.html