A class container is associated with a user account, computer account, group account, OU, or a domain. Every user, computer, group, OU, and domain object has an associated property ClassStorePath, which contains the class store path for the object.
Administration of the class store occurs through the Application Managers extension to the Group Policy Editor. Class stores are created automatically as needed.
User accounts inherit the profile of its hierarchy (one or more OUs and the domain). This method of inheritance creates a list of class stores that is associated with the user account. A class store search for a user logged on under this account results in an ordered lookup in all the class stores included in the profile.
IClassAccess searches the ordered list of class containers based on the user account requesting the information. There may also be class implementations in a class store that have access control lists (ACLs) to enforce user specific views and access restrictions.