A SID is a variable-length numeric value that consists of a SID structure revision number, a 48-bit identifier authority value, and a variable number of 32-bit subauthority or relative identifier (RID) values.
下面是一些系统内置的SID
Well-Known SIDs
SID Group Use
S-1-1-0 Everyone A group that includes all users.
S-1-2-0 Local Users who log on to terminals locally (physically) connected to the system.
S-1-3-0 Creator Owner ID A security identifier to be replaced by the security identifier of the user who created a new object. This SID is used in inheritable access-control entries (ACEs).
S-1-3-1 Creator Group ID Identifies a security identifier to be replaced by the primary-group SID of the user who created a new object. Use this SID in inheritable ACEs.
ACL（access control list）从字面的意思很好理解。一个系统通过ACL来判断用户对资源的何种程度的访问。由两种类型的ACL：DACL（Discretionary Access Control List）和SACL（System Access Control List）。DACL包括户和组的列表，以及相应的权限，允许或是拒绝，用来确定对资源的访问权限。SACL则用来确定安全资源的审核策略。ACL由零个或多个ACE（Access Control Entries）组成，一个ACE包括一个SID和该SID可访问资源的描述，比如允许和拒绝，拒绝优先于允许。
SeTcbPrivilege Act as part of the operating system Allows a process to authenticate like a user and thus gain access to the same resources as a user. Only low-level authentication services should require this privilege.
SeMachineAccountPrivilege Add computers to a domain Allows the user to add a computer to a specific domain. For the privilege to be effective, it must be assigned to the user as part of local security policy for domain controllers in the domain.
SeBackupPrivilege Back up files and directories Allows the user to circumvent file and directory permissions to back up the system. The privilege is checked only when an application attempts access through the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply.
By default, this privilege is assigned to Administrators and Backup Operators. See also Restore files and directories in this table.
SeChangeNotifyPrivilege Bypass traverse checking Allows the user to pass through folders to which the user otherwise has no access while navigating an object path in any Windows file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories.
By default, this privilege is assigned to Administrators, Backup Operators, Power Users, Users, and Everyone.
SeSystemTimePrivilege Change the system time Allows the user to set the time for the internal clock of the computer.
By default, this privilege is assigned to Administrators and Power Users.
SeCreatePagefilePrivilege Create a page filepagefile Allows the user to create and change the size of a page file.
By default, this privilege is assigned to Administrators.
SeCreateTokenPrivilege Create a token object Allows a process to create an access token by calling NtCreateToken() or other token-creating APIs.
SeCreatePermanentPrivilege Create permanent shared objects Allows a process to create a directory object in the Windows 2000 object manager.
SeDebugPrivilege Debug programs Allows the user to attach a debugger to any process.
By default, this privilege is assigned to Administrators.
SeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation Allows the user to change the Trusted for Delegation setting on a User or Computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object.
SeRemoteShutdownPrivilege Force shutdown from a remote system Allows a user to shut down a computer from a remote location on the network. See also Shut down the system in this table.
By default, this privilege is assigned to Administrators.
SeAuditPrivilege Generate security audits Allows a process to create, generate, and add entries in the security log. The security log is used to trace unauthorized system access. See also Manage auditing and security log in this table.
SeIncreaseQuotaPrivilege Increase quotas Allows a process that has Write Property access to another process to increase the processor quota that is assigned to the other process. This privilege is useful for system tuning, but it can be abused, as in a denial of service attack.
By default, this privilege is assigned to Administrators.
SeIncreaseBasePriorityPrivilege Increase scheduling priority Allows a process that has Write Property access to another process to increase the execution priority of the other process. A user with this privilege can change the scheduling priority of a process in the Task Manager dialog box.
By default, this privilege is assigned to Administrators.
SeLoadDriverPrivilege Load and unload device drivers Allows a user to install and uninstall Plug and Play device drivers. Device drivers that are not Plug and Play are not affected by this privilege and can be installed only by Administrators. Because device drivers run as trusted (highly privileged) programs, this privilege can be misused to install hostile programs and give them destructive access to resources.
By default, this privilege is assigned to Administrators.
SeLockMemoryPrivilege Lock pages in memory Allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege can significantly degrade system performance. This privilege is obsolete and is therefore never selected.
SeSecurityPrivilege Manage auditing and security log Allows a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. Object access auditing is not actually performed unless you have enabled it in Audit Policy (under Security Settings, Local Policies). A user who has this privilege can also view and clear the security log from Event Viewer.
By default, this privilege is assigned to Administrators.
SeSystemEnvironmentPrivilege Modify firmware environment values Allows modification of system environment variables either by a process through an API or by a user through System Properties.
By default, this privilege is assigned to Administrators.
SeProfileSingleProcessPrivilege Profile a single process Allows a user to run Microsoft® Windows NT® and Microsoft® Windows® 2000 performance-monitoring tools to monitor the performance of nonsystem processes.
By default, this privilege is assigned to Administrators and Power Users.
SeSystemProfilePrivilege Profile system performance Allows a user to run Windows NT and Windows 2000 performance-monitoring tools to monitor the performance of system processes.
By default, this privilege is assigned to Administrators.
SeUndockPrivilege Remove computer from docking station Allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu.
By default, this privilege is assigned to Administrators, Power Users, and Users.
SeAssignPrimaryTokenPrivilege Replace a process-level token Allows a parent process to replace the access token associated with a child process.
SeRestorePrivilege Restore files and directories Allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object. See also Back up files and directories in this table.
By default, this privilege is assigned to Administrators and Backup Operators.
SeShutdownPrivilege Shut down the system Allows a user to shut down the local computer. See also Force shutdown from a remote system in this table. In Windows 2000 Professional:
By default, this privilege is assigned to Administrators, Backup Operators, Power Users, and Users. In Windows 2000 Server:
By default, this privilege is not assigned to Users, only to Administrators, Backup Operators, and Power Users.
SeSynchAgentPrivilege Synchronize directory service data Allows a process to provide directory synchronization services. This privilege is relevant only on domain controllers.
By default, this privilege is assigned to Administrators and LocalSystem accounts on domain controllers.
SeTakeOwnershipPrivilege Take ownership of files or other objects Allows a user to take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads.
By default, this privilege is assigned to Administrators.
在我的计算机上，tt是一个普通的user帐号，当给他添加上SeTakeOwnershipPrivilege后，就可以绕过原来的访问控制，比如，对system32目录下就可以添加完全控制的ACE，从而可以任意复制文件。对Document and Settings目录下也可以如法炮制，那么，给管理员下个套就是很简单的事情了。下面是实现过程
I/O completion ports are the mechanism by which an application uses a pool of threads that was created when the application was started to process asynchronous I/O requests. These threads are created for the sole purpose of processing I/O requests. Applications that process many concurrent asynchronous I/O requests can do so more quickly and efficiently by using I/O completion ports than by using creating threads at the time of the I/O request.
The CreateIoCompletionPort function associates an I/O completion port with one or more file handles. When an asynchronous I/O operation started on a file handle associated with a completion port is completed, an I/O completion packet is queued to the port. This can be used to combine the synchronization point for multiple file handles into a single object.
A thread uses the GetQueuedCompletionStatus function to wait for a completion packet to be queued to the completion port, rather than waiting directly for the asynchronous I/O to complete. Threads that block their execution on a completion port are released in last-in-first-out (LIFO) order. This means that when a completion packet is queued to the completion port, the system releases the last thread to block its execution on the port.
When a thread calls GetQueuedCompletionStatus, it is associated with the specified completion port until it exits, specifies a different completion port, or frees the completion port. A thread can be associated with at most one completion port.
The most important property of a completion port is the concurrency value. The concurrency value of a completion port is specified when the completion port is created. This value limits the number of runnable threads associated with the completion port. When the total number of runnable threads associated with the completion port reaches the concurrency value, the system blocks the execution of any subsequent threads that specify the completion port until the number of runnable threads associated with the completion port drops below the concurrency value. The most efficient scenario occurs when there are completion packets waiting in the queue, but no waits can be satisfied because the port has reached its concurrency limit. In this case, when a running thread calls GetQueuedCompletionStatus, it will immediately pick up the queued completion packet. No context switches will occur, because the running thread is continually picking up completion packets and the other threads are unable to run.
The best value to pick for the concurrency value is the number of CPUs on the machine. If your transaction required a lengthy computation, a larger concurrency value will allow more threads to run. Each transaction will take longer to complete, but more transactions will be processed at the same time. It is easy to experiment with the concurrency value to achieve the best effect for your application.
The PostQueuedCompletionStatus function allows an application to queue its own special-purpose I/O completion packets to the completion port without starting an asynchronous I/O operation. This is useful for notifying worker threads of external events.
The completion port is freed when there are no more references to it. The completion port handle and every file handle associated with the completion port reference the completion port. All the handles must be closed to free the completion port. To close the port handle, call the CloseHandle function.
