The Windows 2000 Security Reference Monitor

The Windows 2000 Security Reference Monitor

The Windows 2000 Security Reference Monitor
Kanajit S. Siyan

Excerpted from Windows 2000 Professional Reference, by Kanajit S. Siyan, published by New Riders.

The Security Reference Monitor (SRM) is used to implement security in the Windows 2000 system. Requests for creating or accessing an object must pass through the SRM. The SRM determines whether access to a resource is allowed. The SRM works with the user-mode security subsystem, used for authenticating user logons to the Windows 2000 system.

All Windows 2000 objects have a security descriptor, the access control list (ACL), associated with them. It consists of individual elements called access control entries (ACEs). Each ACE contains a security ID (SID) of a user of group. A SID is an internal number used with a Windows 2000 computer to describe a user and a group uniquely among Windows 2000 computers. In addition to the SID, the ACE contains a list of actions permitted or denied to a user or group.

When a user logs on to a Windows 2000 computer after successful authentication, a security access token (SAT) is created for the user. The SAT contains the SID of the user and the SIDs of all the groups to which the user belongs. The SAT then acts as a "passcard" for that user session and is used to verify all user actions.

When a logged-on user accesses an object, the SRM checks the object's security descriptor to see whether a SID listed in the SAT matches an ACE entry. If a match exists, the security permissions listed in the matching ACE apply to that user.


This was first published in October 2000

Dig deeper on Windows Disaster Recovery and Business Continuity

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close