What is the SYNCHRONIZE File Access Right?

Software Development
Published Aug 23, 2010 Updated Jul 13, 2019

When dealing with Windows NTFS file system permissions, one quickly encounters the SYNCHRONIZE access right, the purpose of which may not be obvious. SYNCHRONIZE belongs to the standard access rights, just like DELETE, READ_CONTROL, WRITE_DAC and WRITE_OWNER.

Here is the definition of SYNCHRONIZE from MSDN (2010):

The SYNCHRONIZE access right is defined within the standard access rights list as the right to specify a file handle in one of the wait functions.

Here is the newer definition of SYNCHRONIZE from Microsoft Docs (2019):

The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.

Access Rights CodeProject File System NTFS Permissions

Comments

Comments are powered by Giscus. Please enable JavaScript to view them, or view discussions directly on GitHub.

Related Posts

How to Map Generic Rights to Standard and Specific Rights

There are two equivalent ways trustees can be assigned a specific set of permissions on Windows: via generic rights and via a combination of standard and specific rights. Generic rights are identical for all object types. There are only four of them:

Software development

Finding (Executables in) User-Writeable Directories

Finding (Executables in) User-Writeable Directories

This article presents two different detection types for insecure filesystem permissions on Windows endpoints: scanning for directories that are user-writable, and detecting processes that are started from user-writeable directories. Directory Scan With ListUserWriteableDirectories & SetACL My ListUserWriteableDirectories script is an implementation of the first detection type: it scans the filesystem listing any permissions not known to be safe.

How to Enable Drag and Drop for an Elevated MFC Application on Windows

Finding good information on how to enable drag and drop for MFC applications is hard enough (why?). But just when you think you should have it working, you hit a very solid wall: UIPI (User Interface Privilege Isolation, a variant of UAC, User Account Control). Because of “security” reasons, UIPI disables drag and drop from medium integrity processes (Explorer) to high integrity (aka elevated) processes by filtering out most window messages, including those required for drag and drop. In essence drag and drop from Explorer to your elevated application does not work.

Software development

Taking Ownership Fails With UNC Path, Works Locally!?! Why?

Here is an interesting tidbit related to Windows security: Create a test file share, e.g. C:\temp\test, and share it with full permissions for everyone (share, not NTFS permissions) as “test” Create the following directory hierarchy below the share: C:\temp\test\1\2\3\4 Assign ownership of the four folders 1, 2, 3 and 4 to any user (but do not use your own account, just anyone else’s) Set permissions on 1, 2, 3 and 4 that only the user from the previous step has full access, nobody else, not even the SYSTEM Now try to use SetACL to change the owner of directory “4” over the network (SetACL uses backup and restore privileges so this should be no problem) by issuing the following command locally: setacl -on \localhost\test\1\2\3\4 -ot file -actn setowner -ownr n:domain\administrator SetACL will fail with access denied (full message: “ERROR: Writing SD to <\?\UNC\localhost\test\1\2\3\4> failed with: Access is denied.”) Now issue the same command, but instead of using a UNC path use the local drive letter: setacl -on c:\temp\test\1\2\3\4 -ot file -actn setowner -ownr n:domain\administrator That works! Why is this so? I have no clue.

Latest Posts

Beautiful Slide Decks from Markdown: Presenting with Slidev

Beautiful Slide Decks from Markdown: Presenting with Slidev

Would you like to get away from PowerPoint and author slide decks in Markdown? Then Slidev may be just what you’re looking for. It’s a web app for presentations. The fact that it’s geared towards developers shouldn’t put you off. After all, who isn’t a developer these days, with AI? Slidev comes with the beautiful Tahta themes and supports features like syntax highlighting and animations. Export options to PDF and PPTX allow for easy sharing. This article shows how to get started.

Sambee 1.0: Secure, Browser-Based File Management for PCs, Phones & Tablets

Sambee 1.0: Secure, Browser-Based File Management for PCs, Phones & Tablets

Sambee 1.0 is now available! This milestone marks the end of the beta and pre-release phases. What Is Sambee? Sambee turns your existing storage into a modern workspace - no migration, syncing, or cloud required.

Filebrowser to Be Archived. Migrate to a Modern Alternative: Sambee

Filebrowser to Be Archived. Migrate to a Modern Alternative: Sambee

Filebrowser is being archived. As the author writes, the codebase dates back to when he was but 15 years old. Having created such a popular file management tool is a more than impressive achievement for anyone, let alone a teenager. However, when it comes to security and reliability, Filebrowser seems to be built on a less than ideal foundation, so much so that the author states:

Home Automation, Networking & Self-Hosting

Auditing Samba File & Directory Changes With Elasticsearch

Auditing Samba File & Directory Changes With Elasticsearch

This article explains how to set up an auditing (change-tracking) system for Samba file shares that shows who created, deleted, or changed a file or directory and when. The solution is optimized for security, high performance, and low maintenance.

Home Automation, Networking & Self-Hosting