LockerHelp
Feature

Access Control Entries Explained: How ACEs Secure Resources in Windows and Beyond

If you have ever asked what is an access control entry, the short answer is simple: an ACE is one rule inside an ACL. In Windows, that rule ties a specific…

By Nora Castellan ·

If you have ever asked what is an access control entry, the short answer is simple: an ACE is one rule inside an ACL. In Windows, that rule ties a specific trustee—identified by a security identifier, or SID—to a set of rights, along with instructions about whether access should be allowed, denied, or audited. Microsoft defines an ACE as an element in an ACL, notes that an ACL can contain zero or more ACEs, and describes the core ACE fields as the SID, access mask, type flag, and inheritance flags. Access Control Entries - Win32 apps | Microsoft Learn Access Control Entry - Windows drivers | Microsoft Learn

This is a Windows-first explainer, because that is where the term is most concretely defined in the cited Microsoft documentation. References to Active Directory, networking ACLs, and Unix-like systems are included for comparison and context, not to suggest that every platform uses the exact same ACE structure or evaluation model. Access Control Entries - Win32 apps | Microsoft Learn Access-control list - Wikipedia What Is an Access Control Entry? ACE Deep Dive 2026

What Is an Access Control Entry?

An Access Control Entry (ACE) is a single entry inside an Access Control List (ACL). That entry says which trustee the rule applies to and what should happen when that trustee attempts a given operation on an object. In Windows terms, an ACE can control access or monitor it, which is why ACEs are used both for permission enforcement and for auditing. Access Control Entries - Win32 apps | Microsoft Learn

The distinction between ACE and ACL matters. An ACL is the list attached to a securable object; an ACE is one rule inside that list. Microsoft describes an ACE as an element of an ACL, while Windows-oriented explainers describe the ACE as the smallest permission unit within the larger list. Access Control Entries - Win32 apps | Microsoft Learn What is Access Control Entry (ACE)? - Hexnode Blogs

A few details make that definition more useful:

In plain language, an ACE expresses a very specific security statement such as:

  • this SID is allowed read access,
  • this SID is denied delete access,
  • or this SID’s attempt should be audited.

That is why ACEs are the real working parts of ACL-based security. The ACL is the list; the ACE is the rule that actually says what happens. Access Control Entries - Win32 apps | Microsoft Learn What Is an Access Control Entry? ACE Deep Dive 2026

Core Components of an ACE

Microsoft says all ACE types contain four core pieces of access-control information: a security identifier (SID), an access mask, a type flag, and inheritance bit flags. Those four fields explain who the rule applies to, what rights it covers, how the system should interpret it, and whether it should flow to child objects. Access Control Entries - Win32 apps | Microsoft Learn Access Control Entry - Windows drivers | Microsoft Learn

Component What it does Why it matters
SID Identifies the trustee the ACE applies to Windows evaluates the underlying security identity, not just a display name
Access mask Specifies the rights controlled by the ACE Defines which actions are being allowed, denied, or audited
Type flag Tells Windows how to interpret the ACE Distinguishes allow, deny, and audit behavior
Inheritance flags Controls whether the ACE propagates to child objects Determines whether permissions stay local or flow down a hierarchy

1. Security Identifier (SID)

The SID identifies the trustee associated with the ACE. In Windows, that trustee is usually a user, group, or logon session. The visible account name in a GUI is helpful for administrators, but the operating system evaluates the SID underneath it. Access Control Entries - Win32 apps | Microsoft Learn Access Control Entry - Windows drivers | Microsoft Learn

This is one reason ACEs remain stable even when names change: the security decision is tied to the security principal’s identifier, not to a friendly label. Windows driver documentation describes an ACE specifically as access rights associated with a particular SID. Access Control Entry - Windows drivers | Microsoft Learn

2. Access mask

The access mask specifies the rights covered by the ACE. Microsoft describes it as the field that defines the access rights controlled by the entry. Depending on the object type, those rights may surface as familiar permissions such as read, write, execute, modify, or full control. Access Control Entries - Win32 apps | Microsoft Learn

NTFS makes this easy to recognize because Windows exposes common file and folder permissions such as Read, Write, Read & Execute, Modify, and Full Control, each of which maps to more granular permission bits. NTFS Permissions : An Overview NTFS File and Folder Permissions in Windows for CompTIA A+ Certification – ITU Online IT Training

3. Type flag

The type flag tells Windows what kind of ACE it is dealing with. At the practical level, this answers the question: is the entry supposed to allow, deny, or audit the specified access? Microsoft’s lower-level documentation names ACE types such as ACCESS_ALLOWED_ACE_TYPE, ACCESS_DENIED_ACE_TYPE, and SYSTEM_AUDIT_ACE_TYPE. Access Control Entries - Win32 apps | Microsoft Learn Access Control Entry - Windows drivers | Microsoft Learn

4. Inheritance flags

The inheritance flags decide whether the ACE applies only to the current object or also propagates to child containers or child objects. Microsoft describes them as bit flags that determine whether child containers or objects can inherit the ACE from the object to which the ACL is attached. Access Control Entries - Win32 apps | Microsoft Learn

That makes inheritance part of the rule itself, not a separate afterthought. Two ACEs may reference the same trustee and rights but behave differently because one propagates to children and the other does not. What Is an Access Control Entry? ACE Deep Dive 2026

A compact example helps. Suppose a folder should let a finance group read the folder and all child files. The ACE would need:

That is the practical value of understanding ACE anatomy: a real ACE is never just “User X has access.” It is always which identity, which rights, what verdict, and what inheritance behavior.

Types of Access Control Entries

For most Windows administrators, three ACE types matter most: access-allowed, access-denied, and system-audit. Microsoft says those three types are supported by all securable objects. Access Control Entries - Win32 apps | Microsoft Learn

Access-allowed ACE

An access-allowed ACE grants specified rights to a trustee. If a user or group should be able to read a file, write to a folder, or modify an object, the allow ACE is the rule that expresses that permission. Access Control Entries - Win32 apps | Microsoft Learn Access Control Entry - Windows drivers | Microsoft Learn

Access-denied ACE

An access-denied ACE denies specified rights to a trustee. These entries are often used when an administrator needs an exception to broader access, but they can also increase complexity because the final result depends on ordering, inheritance, and group membership. Access Control Entries - Win32 apps | Microsoft Learn What is Access Control Entry (ACE)? - Hexnode Blogs

System-audit ACE

A system-audit ACE does not grant or deny access. Instead, it tells the system to generate an audit record when a trustee attempts the specified access. These entries belong in the SACL, not the DACL. Access Control Entries - Win32 apps | Microsoft Learn Understanding Access Control Entry and Types

Object-specific ACEs

Microsoft also says there are six ACE types in total, but only three are supported by all securable objects. The other three are object-specific ACEs supported by directory service objects. That matters because object-specific ACEs are important in directory-service scenarios, but they are not a universal feature you should assume for every Windows securable object. Access Control Entries - Win32 apps | Microsoft Learn

This is one reason Active Directory permissions can feel more granular than basic file permissions: directory objects and attributes use the same broad ACL model, but the directory context allows more object-aware access rules. Access-control list - Wikipedia Understanding Access Control Entry and Types

Specialized or lower-level ACE types

Microsoft’s driver-oriented documentation also mentions additional ACE definitions, including SYSTEM_ALARM_ACE_TYPE and ACCESS_ALLOWED_COMPOUND_ACE_TYPE. The first relates to alarm behavior, and the second is associated with server impersonation scenarios. Access Control Entry - Windows drivers | Microsoft Learn

But this is where context matters. Microsoft’s Win32 access-control documentation says system-alarm object ACEs are not currently supported. So it is reasonable to know these types exist in the API landscape without treating them as standard, everyday ACEs for typical Windows administration. Access Control Entries - Win32 apps | Microsoft Learn

DACL vs SACL: Where ACEs Live and Work

An ACE does not float around on its own. It lives inside an ACL, and in Windows a security descriptor can carry two different ACLs with different jobs: the DACL and the SACL. What Is an Access Control Entry? ACE Deep Dive 2026

That distinction is foundational:

A practical example makes the split clearer. Suppose a finance folder should be readable by a finance group, but every attempt by a non-finance trustee to exercise certain access rights should be logged. The permission rule belongs in the DACL as an allow ACE. The logging rule belongs in the SACL as a system-audit ACE. Same object, same overall security descriptor, but different ACLs and different purposes. Access Control Entries - Win32 apps | Microsoft Learn Understanding Access Control Entry and Types

This is also why a casual glance at “the ACL” can be misleading. In Windows, you may be looking either at the list that determines actual access or at the list that determines what gets logged. Confusing those two leads to bad troubleshooting and bad audits. What Is an Access Control Entry? ACE Deep Dive 2026

How ACEs Are Evaluated During Access Requests

When a program attempts to open an object, Windows compares the program’s credentials with the object’s security controls. Microsoft’s driver documentation says the operating system evaluates ACEs to compute effective access, and the security reference monitor uses ACE information to determine whether the program should be allowed or denied access. Access Control Entry - Windows drivers | Microsoft Learn

Windows-oriented technical sources describe that evaluation as ordered and sequential. The system retrieves the relevant ACL, checks entries in the defined order, and computes the result from the relevant ACEs associated with the object. Avatier summarizes the Windows-oriented rule set as top-to-bottom, first-match per right, with explicit ACEs before inherited ACEs and deny before allow within those groupings. What is Access Control Entry (ACE)? - Hexnode Blogs What Is an Access Control Entry? ACE Deep Dive 2026 Access Control Entry - Windows drivers | Microsoft Learn

For administrators, four rules are especially useful.

1. ACL order matters

An ACL is not just a pile of permission statements. Order changes meaning. If the list is in canonical order, Windows-oriented guidance says explicit entries are evaluated before inherited ones, and deny entries are placed before allow entries within the same grouping. What Is an Access Control Entry? ACE Deep Dive 2026

2. Explicit ACEs are evaluated before inherited ACEs

An ACE set directly on an object is normally evaluated before an ACE inherited from a parent. NTFS guidance echoes this by stating that explicit permissions outrank inherited permissions. What Is an Access Control Entry? ACE Deep Dive 2026 NTFS Permissions : An Overview

3. “Deny beats allow” is useful shorthand, but incomplete

The common summary is that deny overrides allow. That is often directionally right, especially when a matching deny ACE is encountered before a matching allow ACE for the same requested right. But it is not the whole story. Because explicit ACEs are evaluated before inherited ACEs, NTFS guidance notes that an explicit allow can override an inherited deny. What Is an Access Control Entry? ACE Deep Dive 2026 NTFS Permissions : An Overview

A more precise takeaway is this: a matching deny that is encountered first for the requested right will block that right, but explicit-versus-inherited order still matters.

4. Effective access can reflect multiple groups and entries

Permissions are not determined by only one group or one ACE. NTFS-oriented guidance says rights from group memberships combine, subject to ordering, deny rules, and inheritance. NTFS Permissions : An Overview NTFS File and Folder Permissions in Windows for CompTIA A+ Certification – ITU Online IT Training

That is why real troubleshooting can be harder than reading one line in a GUI. A user may receive access because of one explicit group-based allow, lose part of that access because of another ACE, inherit additional rights from a parent, and have the final outcome shaped by the order in which those entries are processed. What is Access Control Entry (ACE)? - Hexnode Blogs NTFS Permissions : An Overview

ACE Inheritance Flags Explained

Inheritance is one of the most powerful parts of the ACE model. It allows administrators to set rules on a parent object and let those rules flow to children. It is also one of the biggest sources of confusion because inheritance is controlled by specific bits on the ACE itself. Access Control Entries - Win32 apps | Microsoft Learn What Is an Access Control Entry? ACE Deep Dive 2026

Windows-oriented explanations commonly use four abbreviations:

In plain English:

  • CI means “send this to child containers.”
  • OI means “send this to child objects.”
  • IO means “children only, not this object.”
  • NP means “inherit once, then stop.”

Microsoft’s documentation supports the larger point behind those abbreviations: ACEs include bit flags that decide whether child containers or child objects can inherit the entry. Access Control Entries - Win32 apps | Microsoft Learn

A folder example shows why this matters. An administrator might want one ACE to apply only to subfolders, another to apply only to files, and a third to exist only as a template for children without taking effect on the parent itself. That is not a different security system; it is just different inheritance bits on different ACEs. What Is an Access Control Entry? ACE Deep Dive 2026

So inheritance is not simply on or off. It is expressed per ACE, and the flags you choose can produce very different results down a directory tree.

Common Use Cases: NTFS, Active Directory, and Networking

ACEs are most commonly discussed in Windows security, especially around NTFS and Active Directory. Similar ACL-based ideas also appear in other operating systems and in networking, but the implementation details are not identical. Access-control list - Wikipedia What Is an Access Control Entry? ACE Deep Dive 2026

NTFS file and folder permissions

NTFS is where many administrators first encounter ACE-driven security. Files and folders use ACLs to define who can read, write, execute, modify, or fully control an object. When you work in the Windows Security tab, you are interacting with permissions that are backed by ACEs, even if the interface hides the lower-level structure. NTFS Permissions : An Overview NTFS File and Folder Permissions in Windows for CompTIA A+ Certification – ITU Online IT Training

This is also the environment where inheritance, explicit permissions, and group membership become operationally important. NTFS guidance emphasizes that permissions can be explicit or inherited, can combine through groups, and can produce different effective results depending on ordering and denies. NTFS Permissions : An Overview

Active Directory objects and attributes

Active Directory uses the same broad ACL model for directory objects. Wikipedia notes that Active Directory adds NTFS-like ACLs to LDAP objects and attributes, and CalCom describes Active Directory as using an ACL mechanism similar to NTFS. Access-control list - Wikipedia Understanding Access Control Entry and Types

This is where Microsoft’s note about object-specific ACEs becomes important. Directory-service objects support ACE types beyond the three universal ones, which is one reason delegation in Active Directory can become very granular compared with ordinary file permissions. Access Control Entries - Win32 apps | Microsoft Learn

Networking ACLs

Networking equipment also uses the term ACL, but here the idea is broader than a Windows ACE on a file or directory object. In routers, switches, and similar devices, ACLs are rule sets for traffic filtering. CalCom describes standard ACLs as filtering mainly by source IP and extended ACLs as considering source and destination IP, protocol, and ports. Wikipedia likewise notes that networking ACLs control traffic on routers and switches. Understanding Access Control Entry and Types Access-control list - Wikipedia

That comparison is useful, but it needs a limit: a networking ACL rule is analogous to an ACE in the sense that both are entries in a rule list, yet they are not the same Windows data structure.

Beyond Windows

Wikipedia notes that entries called ACEs appear in Windows NT, OpenVMS, and Unix-like operating systems such as Linux, macOS, and Solaris. Avatier, however, explicitly distinguishes Windows ACEs from POSIX and NFSv4 variants. Access-control list - Wikipedia What Is an Access Control Entry? ACE Deep Dive 2026

That is the safest cross-platform conclusion: the idea of an ACL entry travels well, but the schema, semantics, and evaluation behavior are not guaranteed to be identical.

Challenges and Best Practices for Managing ACEs

ACEs are powerful because they are precise. That same precision is why they can become difficult to manage in real environments.

One common problem is ACL sprawl. Over time, permissions accumulate through inherited rules, one-off exceptions, nested groups, and stale identities. Avatier specifically calls out issues such as nested group sprawl, Kerberos token bloat, and orphaned SIDs. What Is an Access Control Entry? ACE Deep Dive 2026

A second problem is unintended access caused by ordering or inheritance. Hexnode warns that inconsistent ordering or inheritance can lead to unintended access if ACLs are not reviewed regularly. What is Access Control Entry (ACE)? - Hexnode Blogs

A third problem is simple operational overhead. Large ACLs are harder to read, harder to review, and harder to troubleshoot. CalCom frames ACE hardening around least privilege, role-based thinking, monitoring, and automation. What is Access Control Entry (ACE)? - Hexnode Blogs Understanding Access Control Entry and Types

For most Windows environments, a few practical habits help:

The broad lesson is straightforward: ACEs are the precise foundation of ACL-based security, but precision without review turns into complexity. If you understand ACE structure, ordering, inheritance, and placement in DACLs versus SACLs, you are far better equipped to reason about how Windows will actually enforce access.

What is the difference between an ACE and an ACL?

An ACE is one rule or entry. An ACL is the ordered collection of those entries attached to an object. Microsoft defines an ACE as an element in an ACL and says an ACL can contain zero or more ACEs. Windows-oriented explainers then make the distinction more practical: the ACE is the smallest permission unit, while the ACL is the list that holds multiple ACEs. Access Control Entries - Win32 apps | Microsoft Learn What is Access Control Entry (ACE)? - Hexnode Blogs What Is an Access Control Entry? ACE Deep Dive 2026

Does deny always override allow in ACE evaluation?

Not as a blanket rule without context. Windows-oriented guidance describes canonical ordering as explicit before inherited, with deny before allow within each grouping. That means a matching deny often wins for the rights it covers. But NTFS guidance also notes that an explicit allow can override an inherited deny because the explicit entry is evaluated first. The safer summary is: matching denies are powerful, but inheritance and ordering still matter. What Is an Access Control Entry? ACE Deep Dive 2026 NTFS Permissions : An Overview

Are ACEs only used in Windows?

No, but Windows is the clearest and most common context for the term in this article. Wikipedia notes that entries known as ACEs appear in Windows NT, OpenVMS, and Unix-like operating systems such as Linux, macOS, and Solaris. Even so, implementations differ, so you should not assume that every platform uses the same ACE structure or the same evaluation behavior. Access-control list - Wikipedia What Is an Access Control Entry? ACE Deep Dive 2026

What tools can view or modify ACEs?

In Windows, administrators commonly use the Security tab for interactive changes and tools such as icacls and PowerShell for inspection, reporting, and bulk work. Microsoft’s ACE documentation connects ACE handling to the broader task of adding, removing, or changing ACL entries on objects, and Avatier discusses GUI and scripting-based administration in practice. Access Control Entries - Win32 apps | Microsoft Learn What Is an Access Control Entry? ACE Deep Dive 2026

How do inheritance flags affect child objects?

Inheritance flags determine whether an ACE applies only to the current object, propagates to children, or both. Microsoft describes these as the bits that decide whether child containers or child objects can inherit the ACE. In common Windows shorthand, CI targets child containers, OI targets child objects, IO makes the ACE inherit-only, and NP stops propagation after the next level. Access Control Entries - Win32 apps | Microsoft Learn What Is an Access Control Entry? ACE Deep Dive 2026

Sources

Read next