Could you pls explain the "Get-Acl C:/Windows | fl" output?

Question

Could you pls explain the "Get-Acl C:/Windows | fl" output? There are some nos. what are those indicate?
PS C:\> Get-Acl C:/Windows | fl
Path : Microsoft.PowerShell.Core\FileSystem::C:\Windows
Owner : NT SERVICE\TrustedInstaller
Group : NT SERVICE\TrustedInstaller
Access : CREATOR OWNER Allow 268435456
NT AUTHORITY\SYSTEM Allow 268435456
NT AUTHORITY\SYSTEM Allow Modify, Synchronize
BUILTIN\Administrators Allow 268435456
BUILTIN\Administrators Allow Modify, Synchronize
BUILTIN\Users Allow -1610612736
BUILTIN\Users Allow ReadAndExecute, Synchronize
NT SERVICE\TrustedInstaller Allow 268435456
NT SERVICE\TrustedInstaller Allow FullControl
Audit :
Sddl : O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-185
3292631-2271478464D:PAI(A;OICIIO;GA;;;CO)(A;OICIIO;GA;;;SY)(A;;0x1301bf;;;SY)(A;OICIIO;GA;;;BA)(A;;0x1301bf;;;
BA)(A;OICIIO;GXGR;;;BU)(A;;0x1200a9;;;BU)(A;CIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271
478464)(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)
AliahMurfy

Answer 1

Those numbers are
generic access rights.
The string representation of the access rights come from the FileSystemRights enumeration. Generic rights aren't included in that enumeration, so they show up as the numeric value. You can look up the generic mappings for lots of different objects on MSDN.
The 3.0 beta of
my access control module will translate generic access rights for lots of different objects, including files and folders. Here is a screenshot showing the generic rights being translated for a registry key (HKLM:\SOFTWARE) and a folder (C:\Windows):
The helper function that does the translation is temporarily accessible in the beta version. It is called New-AdaptedAcl. You can play around with it to get a better idea of what's going on (but this command will be private before the final 3.0 version is
released). Here's a screenshot of the helper function in action (the first command does no translation, it just gives a string representation of the numeric access mask; the second command does translation, but it doesn't merge similar ACEs with each other):