Windows – “This folder only” permission propagating

file-permissionspermissionswindows

On a Windows network(no active directory), I can go to a local folder and under a folder select Properties->Security(tab)->Advanced(btn)->Change Permissions…(btn)->Add…(btn)->

Select a user and in the "Permission Entry for *" window

  • Set a couple permission such as Traverse/List/Read
  • Apply to: This folder
  • False/Unchecked for "Apply these permission to objects…"

I just want to add permissions for the current folder, and let other folders inherit those permissions(rather than explicitly setting those permissions on the child objects).

However, when I click Ok or Apply, the "Setting security information on:" dialog comes up and it is enumerating all the child objects. What is it changing? Why is this operation enumerating everything? It should only be modifying the ACL of the current item!

Also "Replace all child object permissions" is set to false for the folder I am modifying.

Best Answer

This is standard behavior. It will add the permissions you set to those folders, but marks them as child permissions.

Go to a subfolder, and check its permissions, and you'll notice those permissions are greyed out (child permissions).

If you want to have the child objects not have these permissions, you'll have to edit the first child folder and correct the permissions.

Usually a network system administrator will suggest to have a subfolder with no childs created and apply the new rights to that folder, then move the files that should have these rights there. This way, any subfolder will have the same rights and you don't worry about child objects not having different access rights.

Because if you deny a user to enter this directory, and you allow that user child directories, they will not be able to get there unless they manually enter that address. Only a person who knows that directory exists and how to manually get there will have access, something not many do. (which is why security settings are set to all child folders when changed, because it usually needs to have those permissions all the way down to the last child folder.

Related Question