fix: show unknown parent in InheritedFrom, and only for inherited entries

When Windows cannot name the folder of an inherited entry, such as for an item that was deleted after its descriptor was read or for a folder above it that the user cannot read, the module fills InheritedFrom with a fallback text. The callers removed the last character of every source, which belongs to the trailing backslash of a real folder, so the fallback read 'unknown paren'. The fallback also named an unknown parent for explicit entries, which have no source. Remove only a trailing backslash, and name an unknown parent for inherited entries only.

The regression tests fail without the fix in all four configurations for access entries and in both elevated configurations for audit entries. The cmdlet pages name the text, and the help file is generated again.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

CHANGELOG.md

@@ -118,7 +118,11 @@ The format is based on
   after they took ownership of an item that the user owned already and left a
   DACL without the right to set an owner, they failed to set the same owner
   back
-
+- Fix `InheritedFrom` of `Get-NTFSAccess` and `Get-NTFSAudit` for an entry
+  whose folder Windows cannot name, such as for an item that was deleted
+  after it was read or a folder above it that the user cannot read: the text
+  read `unknown paren`, and the explicit entries showed it as well. An
+  inherited entry now shows `unknown parent`, and an explicit entry no source
 - Fix `Get-Help`, which showed only the syntax: ship the help file
   `en-US\NTFSSecurity.dll-Help.xml` generated from the cmdlet documentation,
   including the links that `Get-Help -Online` opens, instead of the outdated

Docs/Cmdlets/Get-NTFSAccess.md

@@ -33,7 +33,7 @@ In the `Path` parameter set the cmdlet reads the item from disk; relative paths
 
 By default both explicit and inherited entries are returned. `-ExcludeInherited` limits the result to the entries defined on the item itself, `-ExcludeExplicit` limits it to the entries the item inherits from its parents, and combining both returns nothing. `-Account` filters the result to a single account; an entry matches when the account resolves to the same SID.
 
-When the module setting `GetInheritedFrom` is `$true`, which is the default in the `PrivateData` section of NTFSSecurity.psd1, the `InheritedFrom` property of every inherited entry contains the path of the folder the entry originates from. The default table view shows the account, the rights, the scope of the ACE in the wording of the Windows security dialog, the access type, and the inheritance information; setting `ShowAccountSid` to `$true` adds the SID to the account column.
+When the module setting `GetInheritedFrom` is `$true`, which is the default in the `PrivateData` section of NTFSSecurity.psd1, the `InheritedFrom` property of every inherited entry contains the path of the folder the entry originates from, or `unknown parent` when Windows cannot name that folder, for example because the user cannot read a folder above the item. The default table view shows the account, the rights, the scope of the ACE in the wording of the Windows security dialog, the access type, and the inheritance information; setting `ShowAccountSid` to `$true` adds the SID to the account column.
 
 ## EXAMPLES
 
@@ -188,6 +188,8 @@ Before 5.0.0, after a path whose ACL could not be read, the cmdlet returned the
 
 Before 5.0.0-rc6, with `-ExcludeExplicit`, each inherited entry showed the `InheritedFrom` path of another entry, and for a security descriptor with audit entries, such as one that `Get-NTFSSecurityDescriptor` reads in an elevated session, the cmdlet stopped with an `ArgumentOutOfRangeException`.
 
+Before 5.0.0, when Windows could not name the folder of an inherited entry, `InheritedFrom` read `unknown paren`, and the explicit entries of the item showed it as well.
+
 For the root of a drive, such as `C:\`, or of a volume, such as `\\?\Volume{GUID}\`, the cmdlets that read and change security use the root folder of the volume, like Explorer, `icacls`, and `Get-Acl`. Before 5.0.0, they read and changed the security descriptor of the drive itself, a device object with other entries.
 
 ## RELATED LINKS

Docs/Cmdlets/Get-NTFSAudit.md

@@ -33,7 +33,7 @@ In the `Path` parameter set the cmdlet reads the security descriptor of every it
 
 By default the cmdlet returns explicit and inherited entries. Use `-ExcludeInherited` to return only the entries that are set on the item itself, and `-ExcludeExplicit` to return only the entries that the item inherits from a parent folder. `-Account` filters the result to a single account; the comparison is made on the security identifier (SID), so an account name and its SID select the same entries.
 
-The `InheritedFrom` property is filled only when the module setting `GetInheritedFrom` is `$true`, which is the default in the `PrivateData` section of `NTFSSecurity.psd1`.
+The `InheritedFrom` property is filled only when the module setting `GetInheritedFrom` is `$true`, which is the default in the `PrivateData` section of `NTFSSecurity.psd1`. It contains `unknown parent` for an inherited entry when Windows cannot name the folder that the entry comes from.
 
 ## EXAMPLES
 
@@ -187,6 +187,8 @@ Before 5.0.0, the cmdlet returned no entries and no error without the Security p
 
 Before 5.0.0-rc6, with `-ExcludeExplicit`, each inherited entry showed the `InheritedFrom` path of another entry.
 
+Before 5.0.0, when Windows could not name the folder of an inherited entry, `InheritedFrom` read `unknown paren`, and the explicit entries of the item showed it as well.
+
 ## RELATED LINKS
 
 [Add-NTFSAudit](Add-NTFSAudit.md)

NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml

@@ -4380,7 +4380,7 @@ PS C:\&gt; Disable-Privileges</dev:code>
       <maml:para>Reads the discretionary access control list (DACL) of a file or a folder and writes one `Security2.FileSystemAccessRule2` object for every access control entry (ACE) it contains. Each object carries the account, the rights, the access type, the inheritance and propagation flags, whether the ACE is inherited, and the path of the item it was read from.</maml:para>
       <maml:para>In the `Path` parameter set the cmdlet reads the item from disk; relative paths are resolved against the current location, and when `-Path` is omitted the current location is used. In the `SD` parameter set it reads the ACEs from a `Security2.FileSystemSecurity2` object returned by `Get-NTFSSecurityDescriptor`, which also reflects changes that have not been written back yet.</maml:para>
       <maml:para>By default both explicit and inherited entries are returned. `-ExcludeInherited` limits the result to the entries defined on the item itself, `-ExcludeExplicit` limits it to the entries the item inherits from its parents, and combining both returns nothing. `-Account` filters the result to a single account; an entry matches when the account resolves to the same SID.</maml:para>
-      <maml:para>When the module setting `GetInheritedFrom` is `$true`, which is the default in the `PrivateData` section of NTFSSecurity.psd1, the `InheritedFrom` property of every inherited entry contains the path of the folder the entry originates from. The default table view shows the account, the rights, the scope of the ACE in the wording of the Windows security dialog, the access type, and the inheritance information; setting `ShowAccountSid` to `$true` adds the SID to the account column.</maml:para>
+      <maml:para>When the module setting `GetInheritedFrom` is `$true`, which is the default in the `PrivateData` section of NTFSSecurity.psd1, the `InheritedFrom` property of every inherited entry contains the path of the folder the entry originates from, or `unknown parent` when Windows cannot name that folder, for example because the user cannot read a folder above the item. The default table view shows the account, the rights, the scope of the ACE in the wording of the Windows security dialog, the access type, and the inheritance information; setting `ShowAccountSid` to `$true` adds the SID to the account column.</maml:para>
     </maml:description>
     <command:syntax>
       <command:syntaxItem>
@@ -4589,6 +4589,7 @@ PS C:\&gt; Disable-Privileges</dev:code>
         <maml:para>Entries whose account cannot be translated into a name are returned with their SID. Use `Get-NTFSOrphanedAccess` to list only those entries.</maml:para>
         <maml:para>Before 5.0.0, after a path whose ACL could not be read, the cmdlet returned the entries of the previous item again.</maml:para>
         <maml:para>Before 5.0.0-rc6, with `-ExcludeExplicit`, each inherited entry showed the `InheritedFrom` path of another entry, and for a security descriptor with audit entries, such as one that `Get-NTFSSecurityDescriptor` reads in an elevated session, the cmdlet stopped with an `ArgumentOutOfRangeException`.</maml:para>
+        <maml:para>Before 5.0.0, when Windows could not name the folder of an inherited entry, `InheritedFrom` read `unknown paren`, and the explicit entries of the item showed it as well.</maml:para>
         <maml:para>For the root of a drive, such as `C:`, or of a volume, such as `\?\Volume{GUID}`, the cmdlets that read and change security use the root folder of the volume, like Explorer, `icacls`, and `Get-Acl`. Before 5.0.0, they read and changed the security descriptor of the drive itself, a device object with other entries.</maml:para>
       </maml:alert>
     </maml:alertSet>
@@ -4666,7 +4667,7 @@ PS C:\&gt; Disable-Privileges</dev:code>
       <maml:para>The `Get-NTFSAudit` cmdlet returns the audit entries that are stored in the system access control list (SACL) of a file or folder. Each entry is a `Security2.FileSystemAuditRule2` object that reports the audited account, the audited access rights, the audit flags (`Success`, `Failure`, or both), the inheritance and propagation flags, whether the entry is inherited, and the item it is inherited from. The access rights are the same values that `Add-NTFSAccess` and `Add-NTFSAudit` use; for what each right permits, see Concepts (../Concepts.md).</maml:para>
       <maml:para>In the `Path` parameter set the cmdlet reads the security descriptor of every item in `-Path`. Relative paths are resolved against the current location, and when you omit `-Path` the cmdlet uses the current location. The parameter accepts pipeline input by value and by property name through its `FullName` alias, so the output of `Get-ChildItem`, `Get-ChildItem2`, and `Get-Item2` binds to it. In the `SD` parameter set the cmdlet reads the audit entries from an in-memory `Security2.FileSystemSecurity2` object that `Get-NTFSSecurityDescriptor` returned instead of reading the item again.</maml:para>
       <maml:para>By default the cmdlet returns explicit and inherited entries. Use `-ExcludeInherited` to return only the entries that are set on the item itself, and `-ExcludeExplicit` to return only the entries that the item inherits from a parent folder. `-Account` filters the result to a single account; the comparison is made on the security identifier (SID), so an account name and its SID select the same entries.</maml:para>
-      <maml:para>The `InheritedFrom` property is filled only when the module setting `GetInheritedFrom` is `$true`, which is the default in the `PrivateData` section of `NTFSSecurity.psd1`.</maml:para>
+      <maml:para>The `InheritedFrom` property is filled only when the module setting `GetInheritedFrom` is `$true`, which is the default in the `PrivateData` section of `NTFSSecurity.psd1`. It contains `unknown parent` for an inherited entry when Windows cannot name the folder that the entry comes from.</maml:para>
     </maml:description>
     <command:syntax>
       <command:syntaxItem>
@@ -4873,6 +4874,7 @@ PS C:\&gt; Disable-Privileges</dev:code>
         <maml:para>If reading the audit entries is denied, the cmdlet writes a `ReadSecurityError` with the category `PermissionDenied`. It doesn't take ownership of the item, because ownership grants no access to the SACL.</maml:para>
         <maml:para>Before 5.0.0, the cmdlet returned no entries and no error without the Security privilege, and after a path whose security descriptor could not be read, it returned the entries of the previous item again. The `InheritanceEnabled` property of the entries also reported whether the access entries were inherited instead of the audit entries.</maml:para>
         <maml:para>Before 5.0.0-rc6, with `-ExcludeExplicit`, each inherited entry showed the `InheritedFrom` path of another entry.</maml:para>
+        <maml:para>Before 5.0.0, when Windows could not name the folder of an inherited entry, `InheritedFrom` read `unknown paren`, and the explicit entries of the item showed it as well.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>

Security2/FileSystem/FileSystemAccessRule2 Class/FileSystemAccessRule2.GetFileSystemAccessRules.cs

@@ -43,7 +43,8 @@ namespace Security2
                 var ace2 = new FileSystemAccessRule2(ace) { FullName = sd.Item.FullName, InheritanceEnabled = !sd.SecurityDescriptor.AreAccessRulesProtected };
                 if (getInheritedFrom && inheritedFrom.Count > 0)
                 {
-                    ace2.inheritedFrom = string.IsNullOrEmpty(source) ? "" : source.Substring(0, source.Length - 1);
+                    // Windows names a folder with a trailing backslash; the text for an unknown parent has none.
+                    ace2.inheritedFrom = string.IsNullOrEmpty(source) ? "" : source.TrimEnd('\\');
                 }
 
                 aceList.Add(ace2);

Security2/FileSystem/FileSystemAuditRule2 Class/FileSystemAuditRule2.GetFileSystemAuditRules.cs

@@ -43,7 +43,8 @@ namespace Security2
                 var ace2 = new FileSystemAuditRule2(ace) { FullName = sd.Item.FullName, InheritanceEnabled = !sd.SecurityDescriptor.AreAuditRulesProtected };
                 if (getInheritedFrom && inheritedFrom.Count > 0)
                 {
-                    ace2.inheritedFrom = string.IsNullOrEmpty(source) ? "" : source.Substring(0, source.Length - 1);
+                    // Windows names a folder with a trailing backslash; the text for an unknown parent has none.
+                    ace2.inheritedFrom = string.IsNullOrEmpty(source) ? "" : source.TrimEnd('\\');
                 }
 
                 aceList.Add(ace2);

Security2/Win32/Lib.cs

@@ -45,10 +45,12 @@ namespace Security2
                 }
                 catch
                 {
+                    // Windows can't name the folders, for example because the item is gone or a folder above it can't
+                    // be read. An explicit entry has no source in any case.
                     inheritedFrom = new List<string>();
                     for (int i = 0; i < aceCount; i++)
                     {
-                        inheritedFrom.Add("unknown parent");
+                        inheritedFrom.Add(acl[i].IsInherited ? "unknown parent" : string.Empty);
                     }
                 }
             }

Tests/Access.Tests.ps1

@@ -969,6 +969,30 @@ Describe 'InheritedFrom of access entries' {
         $inherited | ForEach-Object -Process { $_.InheritedFrom | Should -BeNullOrEmpty }
     }
 
+    # Windows can't name the folders when the item is gone, for example deleted by another process after its security
+    # descriptor was read, or when a folder above it can't be read. The entries still come back. Before 5.0.0, the
+    # text lost its last character, and an explicit entry, which has no source, got it as well.
+    It 'Should name an unknown parent for an inherited entry and no source for an explicit entry when Windows cannot resolve the folders' {
+        $folder = New-TestSandboxItem -Sandbox $sandbox -Name 'InheritedFromGone' -Directory
+        $file = Join-Path -Path $folder -ChildPath 'Gone.txt'
+        Assert-TestSandboxPath -Sandbox $sandbox -Path $file
+        Set-Content -LiteralPath $file -Value 'Gone'
+        Add-NTFSAccess -Path $file -Account 'S-1-1-0' -AccessRights ReadData -ErrorAction Stop
+        $sd = Get-NTFSSecurityDescriptor -Path $file -ErrorAction Stop
+        Remove-Item -LiteralPath $file -Force
+
+        $entries = @([Security2.FileSystemAccessRule2]::GetFileSystemAccessRules($sd, $true, $true, $true))
+
+        $inherited = @($entries | Where-Object -FilterScript { $_.IsInherited })
+        $inherited | Should -Not -BeNullOrEmpty
+        foreach ($entry in $inherited) {
+            $entry.InheritedFrom | Should -BeExactly 'unknown parent'
+        }
+        $explicit = @($entries | Where-Object -FilterScript { -not $_.IsInherited })
+        $explicit | Should -HaveCount 1
+        $explicit[0].InheritedFrom | Should -BeNullOrEmpty
+    }
+
     It 'Should read a security descriptor with audit entries and name the same folders' -Skip:(-not $holdsSecurityPrivilege) {
         $file = New-TestSandboxItem -Sandbox $sandbox -Name 'InheritedFromAudit'
         Add-NTFSAccess -Path $file -Account 'S-1-1-0' -AccessRights ReadData

Tests/Audit.Tests.ps1

@@ -512,6 +512,29 @@ Describe 'InheritedFrom of audit entries' {
         $inherited[0].InheritedFrom | Should -Be $folder
     }
 
+    # Windows names the folders of audit entries only for a caller whose Security privilege is enabled, and the cmdlets
+    # enable it. A caller of the library that doesn't gets the entries without sources. Before 5.0.0, the text lost its
+    # last character, and an explicit entry, which has no source, got it as well.
+    It 'Should name an unknown parent for an inherited entry and no source for an explicit entry when the privilege is disabled' -Skip:(-not $canReadAudit) {
+        $folder = New-TestSandboxItem -Sandbox $sandbox -Name 'InheritedFromDisabled' -Directory
+        Add-NTFSAudit -Path $folder -Account 'S-1-1-0' -AccessRights ReadData -InheritanceFlags 'ContainerInherit, ObjectInherit' -PropagationFlags None
+        $file = Join-Path -Path $folder -ChildPath 'File.txt'
+        Assert-TestSandboxPath -Sandbox $sandbox -Path $file
+        Set-Content -LiteralPath $file -Value 'File'
+        Add-NTFSAudit -Path $file -Account 'S-1-5-32-546' -AccessRights Delete -InheritanceFlags None -PropagationFlags None
+        $sd = Get-NTFSSecurityDescriptor -Path $file -ErrorAction Stop
+        Disable-Privileges -ErrorAction SilentlyContinue -WarningAction SilentlyContinue
+
+        $entries = @([Security2.FileSystemAuditRule2]::GetFileSystemAuditRules($sd, $true, $true, $true))
+
+        $inherited = @($entries | Where-Object -FilterScript { $_.IsInherited })
+        $inherited | Should -HaveCount 1
+        $inherited[0].InheritedFrom | Should -BeExactly 'unknown parent'
+        $explicit = @($entries | Where-Object -FilterScript { -not $_.IsInherited })
+        $explicit | Should -HaveCount 1
+        $explicit[0].InheritedFrom | Should -BeNullOrEmpty
+    }
+
     # The module setting GetInheritedFrom turns off the lookup of the sources, which costs a call for each item.
     It 'Should leave InheritedFrom empty when the module setting GetInheritedFrom is off' -Skip:(-not $canReadAudit) {
         $folder = New-TestSandboxItem -Sandbox $sandbox -Name 'InheritedFromOff' -Directory