Translating ADPW Log Entry - labels "O:", "G:", "S:" and "D:" (4227401)

The Active Directory Processing Wizard (ADPW) log contains the following entry:

1/27/2009 5:43:16 PM 4380 To: O:S-1-5-21-3518318870-2071872557-721570734-64621G:S-1-5-21-3304375391-3020585114-3150506070-2756D:AI(A;CI;CCDCRC;;;PS)(A;CI;CCDCRC;;;S-1-5-21-3518318870-2071872557-721570734-65571)(A;CI;CCRC;;;S-1-5-21-3304375391-3020585114-3150506070-14981)  

What do the labels  "O:", "G:", "S:" and "D:" stand for?

The labels,"O:", "G:", "S:" and "D:", are labels for the components of a security descriptor. owner (O:), primary group (G:), DACL (D:), and SACL (S:).

The format is described in MSDN - Security Descriptor Definition Language - http://msdn.microsoft.com/en-us/library/aa379567(VS.85).aspx  and in particular Security Descriptor String Format - http://msdn.microsoft.com/en-us/library/aa379570(VS.85).aspx

Please see the attached document for a brief outline of the other fields in the log.