Is there a tool to generate SDDL (Security Descriptor Definition Language) strings?

Question

Is there a tool to generate SDDL (Security Descriptor Definition Language) strings? I'd like to create them through Windows' Security property sheet or something similar.

Answer 1

One way is to set the ACL on a file (using the standard property sheet -- i.e. right click and choose Properties, then go to the Security tab), then use CACLS filename /S to display the resulting ACL in the SDDL format.

Answer 2

For those who want to get the SDDL string for registry keys permissions you can use PowerShell:

Get-Acl -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | Format-List