访问令牌成员歧义
根据这篇有关访问令牌的文章令牌包含多条信息，包括：
- 用户帐户的安全标识符 (SID)
- 所有者 SID
我希望所有者 SID 和用户帐户 SID 相同。在什么示例场景中它们会有所不同？
更多文档解释了访问令牌的登录 SID 有时在 DACL 中使用。我想知道一种安全“模式”，其中 DACL 将被分配访问或拒绝特定登录 SID。从表面上看，这似乎是一个牵强的案例。我能想象到的唯一用途是拒绝一个登录用户了解其他用户也登录的情况。还有更多吗？
According to this article on Access Tokens, a token contains several pieces of information, including:
- The security identifier (SID) for the user's account
- An owner SID
I would expect the owner SID and user account SID to be the same. In what example scenario would they be different?
Further documentation explains that the Login SID of an access token is sometimes used in a DACL. I'd like to know a security "pattern" where a DACL would be assigned an access or deny of a particular Login SID. At face value, it seems like a far-fetched case. About the only use I could imagine, would be to deny one logged in user from having visibility about what other users are also logged in. Is there more?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
所有者 SID 表示应指定为在该属性下创建的任何对象的所有者的实体。焦点标记。人们期望所有者 SID 与登录 SID 不同的关键场景之一是 系统对象：管理员组成员创建的对象的默认所有者 配置本地安全策略选项，以便管理员组成为登录管理员创建的对象的所有者。
在 DACL 中使用登录 SID 的唯一真正“典型”情况是控制对当前登录会话下运行的进程或瞬态资源的访问。有关详细信息，请参阅 http://blogs .msdn.com/b/david_leblanc/archive/2007/07/29/logon-id-sids.aspx。
The owner SID represents the entity that should be designated as the owner of any objects created under the focal token. One of the key scenarios under which one expect the owner SID to differ from the login SID is when the System objects: Default owner for objects created by members of the Administrators group local security policy option is configured so that the Administrators group becomes the owner of objects created by a logged in administrator.
The only really "typical" cases for using a logon SID in a DACL would be when controlling access to a process or a transient resource running under the current logon session. For details, see http://blogs.msdn.com/b/david_leblanc/archive/2007/07/29/logon-id-sids.aspx.