inheritable permissions are propagating but showing up as not inherited

-

i have folder "division restricted folders" has 11 aces applied, 6 of aces inherited (see acl = "division restricted folders"). of remaining 5 directly applied / not inherited aces, 1 of them "identityreference: parentdomain\provisioning - rf" set apply "this folder, subfolders , files". other 4 not inherited aces set "this folder only". issues when create subfolder "test" within "division restricted folders", single additional ace "identityreference: parentdomain\provisioning - rf"  that set apply "this folder, subfolders , files" applied folder "test" not inherited (see acl = "test"). seems weird because ace inherited, seems un-inherited itself? i'm confused. else note, not sure if help, if make subfolder within "test" same thing happens aces propagate down the "identityreference: parentdomain\provisioning - rf" ace shows again not inherited. 

acl = "division restricted folders"

#ps o:\joey\scripts\powershell> $resfol = get-acl -path "\\evs-04.childdomain.parentdomain.com\elc\division restricted folders" #ps o:\joey\scripts\powershell> $resfol.access   filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\all divisions - admin file access isinherited       : false inheritanceflags  : none propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\1280-admin file access isinherited       : false inheritanceflags  : none propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\1280-general file access isinherited       : false inheritanceflags  : none propagationflags  : none  filesystemrights  : fullcontrol <---------------------------- ace of interest accesscontroltype : allow identityreference : parentdomain\provisioning - rf isinherited       : false inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\1280-general file access (read only) isinherited       : false inheritanceflags  : none propagationflags  : none  filesystemrights  : fullcontrol accesscontroltype : allow identityreference : parentdomain\domain admins isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\all divisions - admin file access (list only) isinherited       : true inheritanceflags  : containerinherit propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\all divisions - admin file access (read only) isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : fullcontrol accesscontroltype : allow identityreference : parentdomain\all divisions - admin file access (full control) isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\1280-admin file access (read only) isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : fullcontrol accesscontroltype : allow identityreference : childdomain\domain admins isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none

acl = "test"

#ps o:\joey\scripts\powershell> $testfol = get-acl -path "\\evs-04.childdomain.parentdomain.com\elc\division restricted folders\test" #ps o:\joey\scripts\powershell> $testfol.access   filesystemrights  : fullcontrol <----------------------- ace of interest accesscontroltype : allow identityreference : parentdomain\provisioning - rf isinherited       : false <----------------------- should read true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : fullcontrol accesscontroltype : allow identityreference : parentdomain\domain admins isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\all divisions - admin file access (list only) isinherited       : true inheritanceflags  : containerinherit propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\all divisions - admin file access (read only) isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : fullcontrol accesscontroltype : allow identityreference : parentdomain\all divisions - admin file access (full control) isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : readandexecute, synchronize accesscontroltype : allow identityreference : parentdomain\1280-admin file access (read only) isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none  filesystemrights  : fullcontrol accesscontroltype : allow identityreference : childdomain\domain admins isinherited       : true inheritanceflags  : containerinherit, objectinherit propagationflags  : none













it seems issue share being hosted on our hitachi evs, when identical acl config on native windows file share aces propagate correctly. although ace shows not inherited on evs, inherited and continues to propagate down child items. i've tested applying additional aces on "division restricted folders" folder , they propagate down fine (even though not inherited). other looking weird, well. 



Windows Server  >  Windows PowerShell



Comments

Post a Comment

Popular posts from this blog

2008 Windows Deployment Server Properties Error

-
currently wading through setup , configuration of wds on 2008 server. have captured xp sp2 image , purposes of testing not prestaging. pxe response settings have been set "respond (known & unknown) client computers" leaving "for unknown clients, notify administrator etc" unchecked when ok properties sheet error "server properties error" "the system cannot find file specified" when attempting use command "wdsutil /approve-autoadddevices /requestid:1" in response pending devices within gui "an error occurred while trying execute command. error code: 0x6 error description: access denied" surely if not attempting add workstations domain (no prestaging) there shouldn't problem. any appreciated  answering part of own question although if can explain reason appreciated. server properties error occurs when launching windows deployment services using start>all programs>administrative tools. if access via server manager...
Read more

Can no longer user MS Update - Files required to use Microsoft Update are no longer registered

-
hi, i'm new server 2003.  installed it.  removed enhanced ie security.  proceed download , install windows server 2003 sp1, of dot net (1.1, 2.0, 3.0, 3.5, , updates), , sp2. after downloaded , installed of above, tried windows update menu option in ie.  (ie 8 windows server 2003) , sits there "done" in lower left hand corner.  never brings in window. so try www.microsoft.com -> download , trails -> update.  received error message "files required use microsoft update no longer registered or installed on computer".  click on register or reinstall files me now.  window changes , "check latest version of windows updating software .... ".   sits there (last time sat there on hour). i went on internet , found instructions: regsvr32 wuapi.dll regsvr32 wups.dll regsvr32 wuaueng.dll regsvr32 wucltui.dll regsvr32 atl.dll regsvr32 msxml3.dll did not work either.  have other suggestions?...
Read more

How do a find data in one file, search for it in another file and if not found, write a custom message to another file

-
in file if.txt, starting on 2nd line of file, data formatted follows: ah10551,a10551,cn=a10551,a10551@qts.com ah10600,a10600,cn=a10600,a10600@qts.com ah10608,a10608,cn=a10608,a10608@qts.com in file sf.txt, data formatted follows: 2011-02-16 17:26:44 sid acme\ah10551 added sid history of qts\a10551 2011-02-16 17:26:44 sid acme\ah10244 added sid history of qts\a10244 2011-02-16 17:26:45 sid acme\ah10425 added sid history of qts\a10425 please provide suggestions on how following: 1. in if.txt file, read first field first ',' , store in variable called $if1 2. in sf.txt file, search for the value stored in $if1 , if found, ignore.  if not found, write custom message in another file such as: $if1 sidhistory not migrated. these files wont large.  im trying build 'exception file' of items in if.txt file not occurring in sf.txt file. thanks in advance ideas. mtv99 many ways that... here's one... (using example data) [array]$if1=@() gc d:\if.txt...
Read more