Calcs, iCalcs and Chml: Integrity Control in Windows

Last week, at the Moscone Center in San Francisco, I enjoyed the privilege of both attending and speaking at the TechMentor Conference, which focuses on the systems administrator or IT manager seeking real-world, in-depth technical training.

While attending a session given by Mark Minasi, famous technology writer and speaker, I was quite impressed with a discussion on Windows Integrity Control and a cool new tool that Mark developed called Chml that is free to download from his site.

Most admins understand ACLs but Windows Integrity Control lies above those and hence is more powerful. With ACLs we are looking at a discretionary access model. With WICs we have a more mandatory access model. And this may be somewhat of a scary thought because it means there are certain items that may have a higher WIC level than your account (even as an admin, which is given a rating of 3000 or “high”) because the system level runs at a rating of 4000. This prevents you from deleting items like your OS files (which we can all appreciate is a good thing) but can leave you open to having some malicious app infiltrate your system that you cannot delete if it has a system rating level.

Now, you might try to use Cacls to see these levels on a file but you will learn that our dearly loved cmd line tool has been “deprecated” (an odd word, wouldn’t you agree). You will be instructed to use iCalcs (which Minasi jokes must mean it was developed by Apple… just a joke mind you). ICacls will show you mandatory labels that exist. If you don’t see a label, it’s because you probably created the file and the file has a mandatory rating of ‘medium’ and so that wont show up.

However, Mr. Minasi has created a tool that allows you to change the WIC level of files. It’s a free download that includes demos and such and can be found here.

So, if you are interested in learning more about the hidden secrets behind the OS, iCalcs and Chml may be right up your alley.