The server security descriptor controls access to the adTempus server (it corresponds to the Server Security tab in the Security Options dialog in the Console). 

The following permissions are valid when editing ACEs for this descriptor:

Action (from SecurityActionsEnum)	Meaning
saFullControl	Grants all rights.
saConnect	Permission to connect to the adTempus server.
saUseSystemAccount	Permission to schedule jobs to run under the Local System account (see knowledge base article K00000036).
saModify	Permission to modify server options.
saAdminister	Permission to modify server security settings.