If I have the following 3 permission values for 3 separate folders in Windows:

Decimal: 268435456 - Binary: 10000000000000000000000000000 - 29 bits

Decimal: 134217728 - Binary: 1000000000000000000000000000 - 28 bits

Decimal: 67108864 - Binary: 100000000000000000000000000 - 27 bits

How do I interpret these 3 permission values?

Here is the MSDN Access Mask Format guide:

Access Mask key

Should I be padding my generic permissions with 0's in front of the most significant bit (the left side) to make the binary word 32 bits long?

My understanding is that generic permissions are 32 bit unsigned integer values, yet I see permissions like -1610612736 all the time. Are they unsigned and simply being represented as signed?

I'm using PowerShell to create a permissions checking script and running into this issue... This stackoverflow post is relevant. Also a TechNet post I have going about this issue.

1 Answer 1


Ok self answering as I had some assistance on Technet.

Unpadded "268435456" "Generic All" 29 bits -     10000000000000000000000000000
Unpadded "536870912" "Generic Execute" 30 bits - 100000000000000000000000000000
Unpadded "1073741824" "Generic Write" 31 bits -  1000000000000000000000000000000
Unpadded "-2147483648" "Generic Read" 32 Bits -  10000000000000000000000000000000

Now padded:

Padded "268435456" "Generic All" 32 bits -     00010000000000000000000000000000
Padded "536870912" "Generic Execute" 32 bits - 00100000000000000000000000000000
Padded "1073741824" "Generic Write" 32 bits -  01000000000000000000000000000000
Padded "-2147483648" "Generic Read" 32 Bits -  10000000000000000000000000000000

Access Mask Diagram

Link to the MSDN article on access mask.

All 32 bit permissions should be padded on the left hand side (most significant bit). Once this is done it becomes clear how the bit aligns with the access masks used by Microsoft to determine permissions.

Also, it seems that the signed and unsigned representations of "Generic Read" (-2147483648) yield the exact same binary sequence. I'm really not 100% certain what bearing the sign has on this value, but perhaps it matters for other access right sequences.

  • Do you know if there is a function by Microsoft that can convert it from access mask to permissions roles?
    – E235
    Nov 14 at 7:41
  • @E235 I don't see anything obvious with a quick google search nor do I see a question here on Stack (though I only looked briefly). It's been too many years since I was trying to solve this for me to give you anything useful! If you can't find an answer then I'd make a new question here on SuperUser with links to this question and any additional information you've found in your research. Good luck!
    – Shrout1
    Nov 14 at 17:00
  • 1
    thanks, I will keep researching. I found this article that talks about it blog.cjwdev.co.uk/2011/06/28/… but he didn't make it in classic C#, he did it in VB.NET, though I can try to convert it to classic C#. If I will find something I will publish it here or as you suggested in a new question.
    – E235
    Nov 14 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.