In Windows, a security descriptor may be expressed either in a binary representation, or as SDDL. Use the Sddl tool to work with security descriptors in either form, or to convert between them.
Describe a Security Descriptor
With SDDL
Sddl describe 'O:BAG:DUD:P(A;CIOI;FA;;;BA)(A;CIOI;FA;;;SY)(A;NP;0x1201AD;;;BU)'
With Binary
Sddl describe 0100049014000000240000000000000040000000010200000000000520000000200200000105000000000005150000000100000001000000010000000102000002004c000300000000031800ff011f000102000000000005200000002002000000031400ff011f0001010000000000051200000000041800ad01120001020000000000052000000021020000
Convert Between Binary Descriptor and SDDL
Use Sddl describe, specifying -PrintHex or -PrintSddl.
From SDDL to Binary
Sddl describe 0100049014000000240000000000000040000000010200000000000520000000200200000105000000000005150000000100000001000000010000000102000002004c000300000000031800ff011f000102000000000005200000002002000000031400ff011f0001010000000000051200000000041800ad01120001020000000000052000000021020000 -PrintSddl
Sddl describe 'O:BAG:DUD:P(A;CIOI;FA;;;BA)(A;CIOI;FA;;;SY)(A;NP;0x1201AD;;;BU)' -PrintHex
Lookup GUID of Property or Permission
Sddl lookupguid 5F202010-79A5-11D0-9020-00C04FC2D4CF, 00299570-246d-11d0-a768-00aa006e0529
Lookup Well-Known Security Principal
From WKS to SID
Sddl lookupwks BA, BO, SY
From SID to WKS
Sddl lookupwks S-1-5-32-544, S-1-5-32-551, S-1-5-18, S-1-5-21-1718252288-3416168337-1457700507-512