SOLVED: What is the ACCESS_SYSTEM_SECURITY NTFS right seen in Get-ACL with a value of 16777216 (&H1000000)?

When you run the Get-Acl command you may sometimes find that the values are presented as a number rather than a resolved enum value such as "Modify".

We recently had the issue where we were seeing the value 16777216.

This resolves to ACCESS_SYSTEM_SECURITY - but what is this permission and why isn't this being resolved?

Even stranger when you view the NTFS permissions nothing is selected in the user interface.

It turns out that the ACCESS_SYSTEM_SECURITY permission isn't really an NTFS security right at all as described here.
https://learn.microsoft.com/windows/win32/secauthz/sacl-access-right

This right is an additional assertion that must be provided when you access the system access control list (SACL) of a security description - the SACL is the way Microsoft refers to the auditing rules within the operating system. 

It's a slightly strange naming convention but according to Dave Plummer likely to make sure it was in line with the naming of the DACL but also clearly separate - auditing being a key security requirement for government and enterprise customers during Windows NT's inception. 

... also Microsoft's marketing department wasn't as big to come up with nice names for things.

This may seem strange - you can view the NTFS Permissions without ACCESS_SYSTEM_SECURITY but you can't view auditing rules. 

You can see this yourself by running PowerShell as a normal user and running Get-Acl and you'll see the command works, however if you run Get-Acl with the -Audit parameter to see the auditing rules you see the following error even if you have full permissions to the folder or file.

Get-Acl : The process does not possess the 'SeSecurityPrivilege' privilege which is required for this operation.

The same is seen in the user interface - the permissions tab is visible but the auditing tab has a UAC prompt.

Why is this additional permission required? Because if a user who has full permissions to their own folder could change auditing rules they would be able to revoke the Administrators' ability to audit their actions within that part of the filesystem and could potentially hide malicious activity.

So if ACCESS_SYSTEM_SECURITY is not an actual NTFS right why is it seen as 16777216 (&H1000000) in Get-Acl?

ACCESS_SYSTEM_SECURITY (16777216) is not an actual NTFS right so is only seen in Get-Acl within the auditing rules (not the access rules).

It is shown in the auditing rules so that it's possible to audit when someone is using this right and therefore able to modify the audit rules for a folder or file.

Why is the value not shown and nothing shown within the user interface (as seen above)? I suspect that this is because this is not a real NTFS permission therefore it would have to either be missing from the NTFS permissions section or greyed out. Secondly "Access System Security" is a confusing bit of terminology and would have to be displayed it as "Audit access to audit rules". I suspect Microsoft thought it was all too much of a muddle and decided to hide it but leave it as a flag you could set using a script or API.

In summary ACCESS_SYSTEM_SECURITY (16777216) can be set as a hidden flag in an auditing rule for a file or folder to audit when someone clicks "Continue" on the auditing tab to view the auditing rules.

 We document this audit rule permission with XIA Configuration Server -while you're here why not check out our 
IT documentation tool?