<div class="content"><p align="right"><a href="https://msdn.microsoft.com/en-us/library/628ebb1d-c509-4ea0-a10f-77ef97ca4586" data-linktype="external">msdn link</a></p><p>The ACE_HEADER structure defines the type and size of an
access control entry (ACE).</p><table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="8">
  <p>AceType</p>
  </td>
  <td colspan="8">
  <p>AceFlags</p>
  </td>
  <td colspan="16">
  <p>AceSize</p>
  </td>
 </tr>
</tbody></table><p><b>AceType (1 byte): </b>An unsigned 8-bit integer
that specifies the ACE types. This field MUST be one of the following values.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>ACCESS_ALLOWED_ACE_TYPE</p>
  <p>0x00</p>
  </td>
  <td>
  <p>Access-allowed ACE that uses the <a href="72e7c7ea-bc02-4c74-a619-818a16bf6adb" data-linktype="relative-path">ACCESS_ALLOWED_ACE (section 2.4.4.2)</a>
  structure.</p>
  </td>
 </tr><tr>
  <td>
  <p>ACCESS_DENIED_ACE_TYPE</p>
  <p>0x01</p>
  </td>
  <td>
  <p>Access-denied ACE that uses the <a href="b1e1321d-5816-4513-be67-b65d8ae52fe8" data-linktype="relative-path">ACCESS_DENIED_ACE (section 2.4.4.4)</a>
  structure.</p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_AUDIT_ACE_TYPE</p>
  <p>0x02</p>
  </td>
  <td>
  <p>System-audit ACE that uses the <a href="9431fd0f-5b9a-47f0-b3f0-3015e2d0d4f9" data-linktype="relative-path">SYSTEM_AUDIT_ACE (section 2.4.4.10)</a>
  structure.</p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_ALARM_ACE_TYPE</p>
  <p>0x03</p>
  </td>
  <td>
  <p>Reserved for future use.</p>
  </td>
 </tr><tr>
  <td>
  <p>ACCESS_ALLOWED_COMPOUND_ACE_TYPE</p>
  <p>0x04</p>
  </td>
  <td>
  <p>Reserved for future use.</p>
  </td>
 </tr><tr>
  <td>
  <p>ACCESS_ALLOWED_OBJECT_ACE_TYPE</p>
  <p>0x05</p>
  </td>
  <td>
  <p>Object-specific access-allowed ACE that uses the <a href="c79a383c-2b3f-4655-abe7-dcbb7ce0cfbe" data-linktype="relative-path">ACCESS_ALLOWED_OBJECT_ACE (section 2.4.4.3)</a>
  structure.<a id="Appendix_A_Target_45"></a><a aria-label="Product behavior note 45" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_45" data-linktype="relative-path">&lt;45&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>ACCESS_DENIED_OBJECT_ACE_TYPE</p>
  <p>0x06</p>
  </td>
  <td>
  <p>Object-specific access-denied ACE that uses the <a href="8720fcf3-865c-4557-97b1-0b3489a6c270" data-linktype="relative-path">ACCESS_DENIED_OBJECT_ACE (section 2.4.4.5)</a>
  structure.<a id="Appendix_A_Target_46"></a><a aria-label="Product behavior note 46" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_46" data-linktype="relative-path">&lt;46&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_AUDIT_OBJECT_ACE_TYPE</p>
  <p>0x07</p>
  </td>
  <td>
  <p>Object-specific system-audit ACE that uses the <a href="c8da72ae-6b54-4a05-85f4-e2594936d3d5" data-linktype="relative-path">SYSTEM_AUDIT_OBJECT_ACE (section 2.4.4.11)</a>
  structure.<a id="Appendix_A_Target_47"></a><a aria-label="Product behavior note 47" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_47" data-linktype="relative-path">&lt;47&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_ALARM_OBJECT_ACE_TYPE</p>
  <p>0x08</p>
  </td>
  <td>
  <p>Reserved for future use.</p>
  </td>
 </tr><tr>
  <td>
  <p>ACCESS_ALLOWED_CALLBACK_ACE_TYPE</p>
  <p>0x09</p>
  </td>
  <td>
  <p>Access-allowed callback ACE that uses the <a href="c9579cf4-0f4a-44f1-9444-422dfb10557a" data-linktype="relative-path">ACCESS_ALLOWED_CALLBACK_ACE (section 2.4.4.6)</a>
  structure.<a id="Appendix_A_Target_48"></a><a aria-label="Product behavior note 48" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_48" data-linktype="relative-path">&lt;48&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>ACCESS_DENIED_CALLBACK_ACE_TYPE</p>
  <p>0x0A</p>
  </td>
  <td>
  <p>Access-denied callback ACE that uses the <a href="35adad6b-fda5-4cc1-b1b5-9beda5b07d2e" data-linktype="relative-path">ACCESS_DENIED_CALLBACK_ACE (section 2.4.4.7)</a>
  structure.<a id="Appendix_A_Target_49"></a><a aria-label="Product behavior note 49" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_49" data-linktype="relative-path">&lt;49&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE</p>
  <p>0x0B</p>
  </td>
  <td>
  <p>Object-specific access-allowed callback ACE that uses
  the <a href="fe1838ea-ea34-4a5e-b40e-eb870f8322ae" data-linktype="relative-path">ACCESS_ALLOWED_CALLBACK_OBJECT_ACE (section 2.4.4.8)</a>
  structure.<a id="Appendix_A_Target_50"></a><a aria-label="Product behavior note 50" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_50" data-linktype="relative-path">&lt;50&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE</p>
  <p>0x0C</p>
  </td>
  <td>
  <p>Object-specific access-denied callback ACE that uses
  the <a href="4652f211-82d5-4b90-bd58-43bf3b0fc48d" data-linktype="relative-path">ACCESS_DENIED_CALLBACK_OBJECT_ACE (section 2.4.4.9)</a>
  structure.<a id="Appendix_A_Target_51"></a><a aria-label="Product behavior note 51" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_51" data-linktype="relative-path">&lt;51&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_AUDIT_CALLBACK_ACE_TYPE</p>
  <p>0x0D</p>
  </td>
  <td>
  <p>System-audit callback ACE that uses the <a href="bd6b6fd8-4bef-427e-9a43-b9b46457e934" data-linktype="relative-path">SYSTEM_AUDIT_CALLBACK_ACE (section 2.4.4.12)</a>
  structure.<a id="Appendix_A_Target_52"></a><a aria-label="Product behavior note 52" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_52" data-linktype="relative-path">&lt;52&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_ALARM_CALLBACK_ACE_TYPE</p>
  <p>0x0E</p>
  </td>
  <td>
  <p>Reserved for future use.</p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE</p>
  <p>0x0F</p>
  </td>
  <td>
  <p>Object-specific system-audit callback ACE that uses
  the <a href="949b02e7-f55d-4c26-969f-52a009597469" data-linktype="relative-path">SYSTEM_AUDIT_CALLBACK_OBJECT_ACE (section 2.4.4.14)</a>
  structure.</p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE</p>
  <p>0x10</p>
  </td>
  <td>
  <p>Reserved for future use.</p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_MANDATORY_LABEL_ACE_TYPE</p>
  <p>0x11</p>
  </td>
  <td>
  <p>Mandatory label ACE that uses the <a href="25fa6565-6cb0-46ab-a30a-016b32c4939a" data-linktype="relative-path">SYSTEM_MANDATORY_LABEL_ACE (section 2.4.4.13)</a>
  structure.</p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE</p>
  <p>0x12</p>
  </td>
  <td>
  <p>Resource attribute ACE that uses the <a href="352944c7-4fb6-4988-8036-0a25dcedc730" data-linktype="relative-path">SYSTEM_RESOURCE_ATTRIBUTE_ACE</a>
  (section 2.4.4.15)</p>
  </td>
 </tr><tr>
  <td>
  <p>SYSTEM_SCOPED_POLICY_ID_ACE_TYPE</p>
  <p>0x13</p>
  </td>
  <td>
  <p>A central policy ID ACE that uses the <a href="aa0c0f62-4b4c-44f0-9718-c266a6accd9f" data-linktype="relative-path">SYSTEM_SCOPED_POLICY_ID_ACE</a>
  (section 2.4.4.16)</p>
  </td>
 </tr></tbody></table>
</dd>
<dd>
<p>The term &#34;callback&#34; in this context does
not relate to RPC call backs. <a id="Appendix_A_Target_53"></a><a aria-label="Product behavior note 53" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_53" data-linktype="relative-path">&lt;53&gt;</a></p>
</dd></dl><p><b>AceFlags (1 byte): </b>An unsigned 8-bit integer
that specifies a set of ACE type-specific control flags. This field can be a
combination of the following values.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>CONTAINER_INHERIT_ACE</p>
  <p>0x02</p>
  </td>
  <td>
  <p>Child objects that are containers, such as directories,
  inherit the ACE as an effective ACE. The inherited ACE is inheritable unless
  the NO_PROPAGATE_INHERIT_ACE bit flag is also set.</p>
  </td>
 </tr><tr>
  <td>
  <p>FAILED_ACCESS_ACE_FLAG</p>
  <p>0x80</p>
  </td>
  <td>
  <p>Used with system-audit ACEs in a system access control
  list (SACL) to generate audit messages for failed access attempts.</p>
  </td>
 </tr><tr>
  <td>
  <p>INHERIT_ONLY_ACE</p>
  <p>0x08</p>
  </td>
  <td>
  <p>Indicates an inherit-only ACE, which does not control
  access to the object to which it is attached. If this flag is not set, the
  ACE is an effective ACE that controls access to the object to which it is
  attached.</p>
  <p>Both effective and inherit-only ACEs can be inherited
  depending on the state of the other inheritance flags.</p>
  </td>
 </tr><tr>
  <td>
  <p>INHERITED_ACE</p>
  <p>0x10</p>
  </td>
  <td>
  <p>Used to indicate that the ACE was inherited.<a id="Appendix_A_Target_54"></a><a aria-label="Product behavior note 54" href="11e1608c-6169-4fbc-9c33-373fc9b224f4#Appendix_A_54" data-linktype="relative-path">&lt;54&gt;</a> See section <a href="180e7c76-12de-4d1b-8dfd-44667140336b" data-linktype="relative-path">2.5.3.5</a> for processing
  rules for setting this flag.</p>
  </td>
 </tr><tr>
  <td>
  <p>NO_PROPAGATE_INHERIT_ACE</p>
  <p>0x04</p>
  </td>
  <td>
  <p>If the ACE is inherited by a child object, the system
  clears the OBJECT_INHERIT_ACE and CONTAINER_INHERIT_ACE flags in the
  inherited ACE. This prevents the ACE from being inherited by subsequent
  generations of objects.</p>
  </td>
 </tr><tr>
  <td>
  <p>OBJECT_INHERIT_ACE</p>
  <p>0x01</p>
  </td>
  <td>
  <p>Noncontainer child objects inherit the ACE as an
  effective ACE.</p>
  <p>For child objects that are containers, the ACE is
  inherited as an inherit-only ACE unless the NO_PROPAGATE_INHERIT_ACE bit flag
  is also set.</p>
  </td>
 </tr><tr>
  <td>
  <p>SUCCESSFUL_ACCESS_ACE_FLAG</p>
  <p>0x40</p>
  </td>
  <td>
  <p>Used with system-audit ACEs in a SACL to generate
  audit messages for successful access attempts.</p>
  </td>
 </tr></tbody></table>
</dd></dl><p><b>AceSize (2 bytes): </b>An unsigned 16-bit integer
that specifies the size, in bytes, of the ACE. The <b>AceSize</b> field can be
greater than the sum of the individual fields, but MUST be a multiple of 4 to
ensure alignment on a <a href="262627d8-3418-4627-9218-4ffe110850b2" data-linktype="relative-path">DWORD</a>
boundary. In cases where the <b>AceSize</b> field encompasses additional data
for the callback ACEs types, that data is implementation-specific. Otherwise,
this additional data is not interpreted and MUST be ignored.</p></div>