We're adding a lot of new groups to the permissions on our companies shared drives. Some of the folder trees can contain millions of files and TBs of data. As is, changing the ACLs on these folders can anywhere from seconds to hours, depending on how many files are in the current tree.
We would like to be able to make these changes during the work day, but only if it is safe.
A few questions,
- If you change the permissions on a folder whose children inherit permissions, is consistency maintained if a file is created in the tree during the ACL change?
- Does any additional care need to be taken for open files, assuming you're never removing access, only adding new groups to the ACL?
- Does the Set-ACL Powershell commandlet behave in the same way as the Properties > Security > Advanced page?
For example, if there is a tree with 20,000 files and say that that takes ten minutes to change all the NTFS permissions... What happens if a user creates a file in a sub folder during this window? Could the permissions on this file be missing the new group we are granting access to?
Thank you for any advice or suggestions!