


ACE 6: A CCDCLCSWRPWPDTLOCRSDRCWDWO Trusted installer.ACE 5: A CCLCSWRPLOCRRC Service logon user.ACE 4: A CCLCSWRPLOCRRC Interactive user.ACE 3: A CCLCSWRPLOCRRC Built-in administrators.ACE 1: A CCLCSWRPLOCRRC Built-in users.

You can get the name associated with an SID by running: >wmic useraccount where sid='S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736' get nameĮach ACE contains a list of permissions that the user is being allowed or denied.

Looking first at who they apply to, a random blog article decode some of them ( archive.is): An Access Control List is made up of a number of Access Control Entries (ACE): The D: means this is a discretionary access control list. This is quite the ugly blob, and it's completely undocumented by Microsoft, but we'll have a stab at decoding it.
