From 63b23ce365cd663a7e64701175ba67ddccc69aef Mon Sep 17 00:00:00 2001 From: Raimund Andree Date: Tue, 6 Oct 2026 11:59:23 +0000 Subject: [PATCH] docs: explain why a share root loses its inherited permissions over UNC Written through its UNC path, the DACL of a share root can't re-inherit from the parent folder on the server: Windows drops the inherited entries of a DACL in the auto-inherit format and stores the others as explicit copies. icacls and Set-Acl behave the same; a subfolder through the share and the local path keep them (#67). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant --- Docs/FAQ.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/Docs/FAQ.md b/Docs/FAQ.md index 8f31dc8..498f7d4 100644 --- a/Docs/FAQ.md +++ b/Docs/FAQ.md @@ -29,6 +29,17 @@ which Explorer adds for a path on a file share, and the account must be resolvable on the computer that runs the cmdlet. See [Get-NTFSEffectiveAccess](Cmdlets/Get-NTFSEffectiveAccess.md). +## The root of a share loses its inherited permissions over UNC + +When you change the permissions of the root folder of a share through its +UNC path, such as `\\server\share`, Windows can't reach the parent folder on +the server to inherit from. The root folder then loses its inherited +entries, or keeps them as explicit entries that no longer follow the parent +folder. `icacls` and `Set-Acl` behave the same way. Change the root folder +through its local path on the server, such as `D:\Shares\Data`, and use the +UNC path for the folders below the root. See +[#67](https://github.com/raandree/NTFSSecurity/issues/67). + ## Get-ChildItem2 -Recurse runs in a loop through junctions A junction can point to a folder above it. Use `-SkipMountPoints` and