Access control lists (ACLs) can be complex beasts, and user interfaces for editing them are incredibly tricky to implement properly. That's why I was really excited when Windows® 2000 shipped with a programmable ACL editor, shown in Figure 1. Technically this is more than an ACL editor; it also allows you to edit the owner of an object and both the discretionary and system access control lists (DACLs and SACLs, respectively). But I'll call it "ACL editor" here rather than the more technically correct "Security Descriptor Editor."
