System and method for securing windows discretionary access control

A computer system, comprising:

• a processor;
• and
• a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising:
• determining a Windows domain model including capability assignments of principals on resources,
• wherein a respective capability assignment comprises a permission of a respective principal to a respective resource and wherein the respective principal comprises a user or a group of users;
• specifying desired effective permissions of each principal to each resource;
• generating, based on the specified desired effective permissions, access control entries for the respective principal to the respective resource;
• and
• generating, based on the specified desired effective permissions, group memberships indicating which users belong to which groups.

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:

• determining a Windows domain model including capability assignments of principals on resources,
• wherein a respective capability assignment comprises a permission of a respective principal to a respective resource and wherein the respective principal comprises a user or a group of users;
• specifying desired effective permissions of each principal to each resource;
• generating, based on the specified desired effective permissions, access control entries for the respective principal to the respective resource;
• and
• generating, based on the specified desired effective permissions, group memberships indicating which users belong to which groups.