An ACCESS_MASK is a 32-bit set of flags that are used to encode the user rights to an object. An access mask is used both for encoding the rights to an object assigned to a principal and for encoding the desired access when opening an object. The lower 16 bits are used for object-specific user rights. A file object would encode, for example, Read Access, Write Access, and so forth. A registry key object would encode Create Subkey, Read Value, etc.The upper 16 bits are user rights that are common to all objects, or are generic rights that can be mapped to object-specific user rights by the object itself.
