The Windows 2000 Security Reference Monitor

The Windows 2000 Security Reference Monitor
Kanajit S. Siyan

Excerpted from Windows 2000 Professional Reference, by Kanajit S. Siyan, published by New Riders.

The Security Reference Monitor (SRM) is used to implement security in the Windows 2000 system. Requests for creating or accessing an object must pass through the SRM. The SRM determines whether access to a resource is allowed. The SRM works with the user-mode security subsystem, used for authenticating user logons to the Windows 2000 system.

All Windows 2000 objects have a security descriptor, the access control list (ACL), associated with them. It consists of individual elements called access control entries (ACEs). Each ACE contains a security ID (SID) of a user of group. A SID is an internal number used with a Windows 2000 computer to describe a user and a group uniquely among Windows 2000 computers. In addition to the SID, the ACE contains a list of actions permitted or denied to a user or group.

When a user logs on to a Windows 2000 computer after successful authentication, a security access token (SAT) is created for the user. The SAT contains the SID of the user and the SIDs of all the groups to which the user belongs. The SAT then acts as a "passcard" for that user session and is used to verify all user actions.

When a logged-on user accesses an object, the SRM checks the object's security descriptor to see whether a SID listed

    Requires Free Membership to View

    Login

in the SAT matches an ACE entry. If a match exists, the security permissions listed in the matching ACE apply to that user.


This was first published in October 2000

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.

    Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

    Back to top