mscorlib 2.0.0.0 4.0.0.0 System.Security.AccessControl.AccessRule

The class is one of a set of classes that the .NET Framework provides for managing Windows access control security on registry keys. For an overview of these classes, and their relationship to the underlying Windows access control structures, see .

Windows access control security can only be applied to registry keys. It cannot be applied to individual key/value pairs stored in a key.

To get a list of the rules currently applied to a registry key, use the method to get a object, and then use its method to obtain a collection of objects.

objects do not map one-to-one with access control entries in the underlying discretionary control access list (DACL). When you get the set of all access rules for a registry key, the set contains the minimum number of rules currently required to express all the access control entries.

The underlying access control entries change as you apply and remove rules. The information in rules is merged if possible, to maintain the smallest number of access control entries. Thus, when you read the current list of rules, it might not look exactly like the list of all the rules you have added.

Use objects to specify access rights to allow or deny to a user or group. A object always represents either allowed access or denied access, never both.

To apply a rule to a registry key, use the method to get the object. Modify the object by using its methods to add the rule, and then use the method to reattach the security object.

Changes you make to a object do not affect the access levels of the registry key until you call the method to assign the altered security object to the registry key.

objects are immutable. Security for a registry key is modified using the methods of the class to add or remove rules; as you do this, the underlying access control entries are modified.

Represents a set of access rights allowed or denied for a user or group. This class cannot be inherited.

- Constructor
  2.0.0.0
  4.0.0.0

  This constructor specifies default propagation and inheritance. That is, and .

  Initializes a new instance of the class, specifying the user or group the rule applies to, the access rights, and whether the specified access rights are allowed or denied.

  The user or group the rule applies to. Must be of type or a type such as that can be converted to type .
  A bitwise combination of values indicating the rights allowed or denied.
  One of the values indicating whether the rights are allowed or denied.
- Constructor
  2.0.0.0
  4.0.0.0

  This constructor specifies default propagation and inheritance. That is, and .

  This constructor is equivalent to creating an object, by passing to the constructor, and passing the newly created object to the constructor.

  Initializes a new instance of the class, specifying the name of the user or group the rule applies to, the access rights, and whether the specified access rights are allowed or denied.

  The name of the user or group the rule applies to.
  A bitwise combination of values indicating the rights allowed or denied.
  One of the values indicating whether the rights are allowed or denied.
- Constructor
  2.0.0.0
  4.0.0.0

  All registry keys are containers, so the only inheritance flag that is meaningful for registry keys is the flag. If this flag is not specified, the propagation flags are ignored, and only the immediate key is affected. If the flag is present, the rule is propagated as shown in the following table. The table assumes there is a subkey S with child subkey CS and grandchild subkey GS. That is, the path for the grandchild subkey is S\CS\GS.

  Propagation flags

  S

  CS

  GS

  X

  X

  X

  X

  X

  X

  X

  ,

  X

  The pattern for the grandchild subkey governs all subkeys contained by the grandchild subkey.

  For example, if the flag is specified for and the propagation flag is specified for , this rule does not apply to the immediate subkey, but does apply to all its immediate child subkeys and to all subkeys they contain.

  Although you can specify the flag for , there is no point in doing so. For the purposes of access control, the name/value pairs in a subkey are not separate objects. The access rights to name/value pairs are controlled by the rights of the subkey. Furthermore, since all subkeys are containers (that is, they can contain other subkeys), they are not affected by the flag. Finally, specifying the flag needlessly complicates the maintenance of rules, because it interferes with the combination of otherwise compatible rules.

  Initializes a new instance of the class, specifying the user or group the rule applies to, the access rights, the inheritance flags, the propagation flags, and whether the specified access rights are allowed or denied.

  The user or group the rule applies to. Must be of type or a type such as that can be converted to type .
  A bitwise combination of values specifying the rights allowed or denied.
  A bitwise combination of flags specifying how access rights are inherited from other objects.
  A bitwise combination of flags specifying how access rights are propagated to other objects.
  One of the values specifying whether the rights are allowed or denied.
- Constructor
  2.0.0.0
  4.0.0.0

  All registry keys are containers, so the only inheritance flag that is meaningful for registry keys is the flag. If this flag is not specified, the propagation flags are ignored, and only the immediate key is affected. If the flag is present, the rule is propagated as shown in the following table. The table assumes there is a subkey S with child subkey CS and grandchild subkey GS. That is, the path for the grandchild subkey is S\CS\GS.

  Propagation flags

  S

  CS

  GS

  X

  X

  X

  X

  X

  X

  X

  ,

  X

  The pattern for the grandchild subkey governs all subkeys contained by the grandchild subkey.

  For example, if the flag is specified for and the propagation flag is specified for , this rule does not apply to the immediate subkey, but does apply to all its immediate child subkeys and to all subkeys they contain.

  Although you can specify the flag for , there is no point in doing so. For the purposes of access control, the name/value pairs in a subkey are not separate objects. The access rights to name/value pairs are controlled by the rights of the subkey. Furthermore, since all subkeys are containers (that is, they can contain other subkeys), they are not affected by the flag. Finally, specifying the flag needlessly complicates the maintenance of rules, because it interferes with the combination of otherwise compatible rules.

  This constructor is equivalent to creating an object, by passing to the constructor, and passing the newly created object to the constructor.

  Initializes a new instance of the class, specifying the name of the user or group the rule applies to, the access rights, the inheritance flags, the propagation flags, and whether the specified access rights are allowed or denied.

  The name of the user or group the rule applies to.
  A bitwise combination of values indicating the rights allowed or denied.
  A bitwise combination of flags specifying how access rights are inherited from other objects.
  A bitwise combination of flags specifying how access rights are propagated to other objects.
  One of the values specifying whether the rights are allowed or denied.
- Property
  2.0.0.0
  4.0.0.0
  System.Security.AccessControl.RegistryRights To be added.

  objects are immutable. You can create a new access rule representing a different user, different rights, or a different , but you cannot modify an existing access rule.

  Gets the rights allowed or denied by the access rule.