SDDL(1)

🌸 SDDL — bestie edition 🌸

ok so this is the manual page for sddl (that's SDDL(1) in the User Commands section, for my fellow manpage girlies 💅) — the Windows Security Descriptor Library CLI Tool ✨ fr fr, it's giving security-descriptor realness and I am obsessed.

✨ NAME ✨

sddl — Windows Security Descriptor Library CLI Tool 🫶

💖 DESCRIPTION 💖

so like, this is Usage of sddl: — here's the whole vibe check on the flags, no gatekeeping, periodt 🎀

• -debug — turn on debugging output 💀 but lowkey listen: this one only does its thing if -o string is set. no -o string, no debug tea. it's giving conditional bestie behavior, ngl.
• -file — treat the input as filenames and go read their security descriptors using native Windows API calls 🦋 like, actual Windows API, not a vibe, not a guess — the real thing.
• -i string — the input format, bestie 📥 you get two options: 'binary' (which is base64 encoded ✨) or 'string'. and the default? "binary". yep, "binary" is the default, no cap.
• -o string — the output format, aka how it comes back out 🎁 your choices are 'binary' (again, base64 encoded) or 'string'. and this one defaults to "string". so input defaults to binary, output defaults to string — it's giving opposites attract 💜

🌈 quick recap if your brain is buffering: -debug needs -o string to even function, -file hits the native Windows API for security descriptors, -i decides how input is read ('binary' = base64 encoded, or 'string'), and -o decides how output is written ('binary' = base64 encoded, or 'string'). defaults are "binary" for -i and "string" for -o. slay 💅

that's the whole page, bestie — no more, no less, we keep it 💯 accurate up in here. this iconic lil writeup is from sddl, dated February 2026, and it lives in SDDL(1) 🩷 tysm for reading, mwah 💋