This section explains the access control entries (ACEs) Microsoft Provisioning System implements in Active Directory to control group privileges on organizations and other objects in a hosted environment: