Problem solve Get help with specific problems with your technologies, process and projects.

The Windows 2000 Security Reference Monitor

The Windows 2000 Security Reference Monitor

The Windows 2000 Security Reference Monitor
Kanajit S. Siyan

Excerpted from Windows 2000 Professional Reference, by Kanajit S. Siyan, published by New Riders.

The Security Reference Monitor (SRM) is used to implement security in the Windows 2000 system. Requests for creating or accessing an object must pass through the SRM. The SRM determines whether access to a resource is allowed. The SRM works with the user-mode security subsystem, used for authenticating user logons to the Windows 2000 system.

All Windows 2000 objects have a security descriptor, the access control list (ACL), associated with them. It consists of individual elements called access control entries (ACEs). Each ACE contains a security ID (SID) of a user of group. A SID is an internal number used with a Windows 2000 computer to describe a user and a group uniquely among Windows 2000 computers. In addition to the SID, the ACE contains a list of actions permitted or denied to a user or group.

When a user logs on to a Windows 2000 computer after successful authentication, a security access token (SAT) is created for the user. The SAT contains the SID of the user and the SIDs of all the groups to which the user belongs. The SAT then acts as a "passcard" for that user session and is used to verify all user actions.

When a logged-on user accesses an object, the SRM checks the object's security descriptor to see whether a SID listed in the SAT matches an ACE entry. If a match exists, the security permissions listed in the matching ACE apply to that user.

This was last published in October 2000

Dig Deeper on Windows Server storage management

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.