Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a network share where the NTFS folder permissions indicate a particular user is being denied access and that this permission is being inherited from the parent folder. However, the parent folder has no ACE for this user.

How can this be?

share|improve this question
up vote 1 down vote accepted

Was the directory moved?

Some Microsoft engineer's brilliant idea was that inherited permissions should be retained through a move, even if the directory is no longer in the scope of the inheritance.

The ACE will then say that it's inherited from "parent," instead of displaying the exact directory where the ACE is defined.

Apparently that behavior made sense in Redmond. See this question for reference.

share|improve this answer
Shane, thanks - what a SNAFU! – zen Jul 16 '11 at 3:47

This can happen one of two ways, in my experience:

  1. As Shane pointed out, the file was moved from another directory on the same volume/share. Rights are not reset in this instance.
  2. Someone removed the Deny right from a higher level in the directory tree, but hit "cancel" during the (potentially very long) process of propagating that rights change to every object below that point. Files that hadn't been reached yet will show exactly what you're seeing.

The there is a third way, but it's manifestation changes: the file was restored from backup and the restore didn't reset inherited rights.

share|improve this answer
thanks for elaborating on Shane's answer – zen Jul 16 '11 at 3:48
Good point on the cancelled propagation. – Shane Madden Jul 16 '11 at 17:12

I'm wondering if anyone on Win 2003 Server has tried to create the registry setting MoveSecurityAttributes as suggested in this Microsoft article? This purportedly forces the object to inherit the permissions of the destination folder parent.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.