On windows 2008 file server, I have huge folder, where some of subfolders do not inherit ACL from the parent object. I would like to add single permissions entry (full control for local administrators group) to the whole folder, and to propagate this entry even to folders which does not inherit ACLs from above. All existing permissions entries should be kept as it is. By default, if I just add single permission entry at the root folder, subfolders which does not inherit ACLs won't inherit new entry. If I turn on "Replace all child object permissions with inheritable permissions from this object", this will reset all existing ACL entries on folders which does not inherit ACLs. Is there any method available to solve my problem ?
It's not possible in GUI, but should be with
icacls, see Command-Line Reference.
There, you can see how
Grants specified user access rights. Permissions replace previously granted explicit permissions.
:r, permissions are added to any previously granted explicit permissions.
/t makes the command recursively, combination of these should do the trick.
So I'd suggest something like
icacls "X:\PATH\TO\FOLDER\" /grant DOMAIN\group:(f) /t but please see the documentation whether it matches your goal (and as always try it first on a test directory).
You could use SetACL if you're not comfortable with PowerShell (as BigHomie and HopelessN00b have suggested).
You should read the full documentation and test your command on a dummy location, but the syntax you'd use would be something like:
setacl -on <PATH> -ot file -actn ace -ace "n:Administrators;p:full;i:so,sc;m:grant;w:dacl" -rec cont_obj -ignoreerr