We have a network share where the NTFS folder permissions indicate a particular user is being denied access and that this permission is being inherited from the parent folder. However, the parent folder has no ACE for this user.
How can this be?
Was the directory moved?
Some Microsoft engineer's brilliant idea was that inherited permissions should be retained through a move, even if the directory is no longer in the scope of the inheritance.
The ACE will then say that it's inherited from "parent," instead of displaying the exact directory where the ACE is defined.
Apparently that behavior made sense in Redmond. See this question for reference.
This can happen one of two ways, in my experience:
The there is a third way, but it's manifestation changes: the file was restored from backup and the restore didn't reset inherited rights.
I'm wondering if anyone on Win 2003 Server has tried to create the registry setting MoveSecurityAttributes as suggested in this Microsoft article? This purportedly forces the object to inherit the permissions of the destination folder parent.