fix: enable privileges in the inheritance cmdlets only when configured

Defect 12. Besides the base class, which enables the privileges only when
the module setting EnablePrivileges is $true and disables them again in
EndProcessing, the six inheritance cmdlets called
EnableFileSystemPrivileges in BeginProcessing unconditionally. With
EnablePrivileges = $false they enabled the privileges anyway and, because
EndProcessing disables them only when the setting is $true, left them
enabled. The extra calls are gone; the inheritance cmdlets now behave like
the other cmdlets.

Tests/Privileges.Tests.ps1: 6 tests, one per cmdlet, CI-only, because
they need a token that holds the privileges. Without the fix the Backup
privilege is enabled after each call.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

CHANGELOG.md

@@ -85,5 +85,8 @@ The format is based on
   copied a folder that contained files
 - Fix `Disable-Privileges`, which couldn't disable the privileges when the
   module setting `EnablePrivileges` was `$false`
+- Fix the inheritance cmdlets, which enabled the Backup, Restore, Take
+  Ownership, and Security privileges even when the module setting
+  `EnablePrivileges` was `$false`, and left them enabled
 
 [Unreleased]: https://github.com/raandree/NTFSSecurity/compare/4.2.6...HEAD

Docs/Cmdlets/Disable-NTFSAccessInheritance.md

@@ -168,6 +168,8 @@ Blocking access inheritance requires permission to change the DACL of the item,
 
 A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.
 
+Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.
+
 ## RELATED LINKS
 
 [Enable-NTFSAccessInheritance](Enable-NTFSAccessInheritance.md)

Docs/Cmdlets/Disable-NTFSAuditInheritance.md

@@ -170,6 +170,8 @@ If the descriptor cannot be opened because the account has no permission to the
 
 A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.
 
+Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.
+
 ## RELATED LINKS
 
 [Enable-NTFSAuditInheritance](Enable-NTFSAuditInheritance.md)

Docs/Cmdlets/Enable-NTFSAccessInheritance.md

@@ -167,6 +167,8 @@ Restoring access inheritance requires permission to change the DACL of the item,
 
 A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.
 
+Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.
+
 ## RELATED LINKS
 
 [Disable-NTFSAccessInheritance](Disable-NTFSAccessInheritance.md)

Docs/Cmdlets/Enable-NTFSAuditInheritance.md

@@ -169,6 +169,8 @@ If the descriptor cannot be opened because the account has no permission to the
 
 A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.
 
+Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.
+
 ## RELATED LINKS
 
 [Disable-NTFSAuditInheritance](Disable-NTFSAuditInheritance.md)

Docs/Cmdlets/Get-NTFSInheritance.md

@@ -136,6 +136,8 @@ If the security descriptor of an item cannot be opened because the account has n
 
 A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.
 
+Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.
+
 ## RELATED LINKS
 
 [Set-NTFSInheritance](Set-NTFSInheritance.md)

Docs/Cmdlets/Set-NTFSInheritance.md

@@ -194,6 +194,8 @@ A path that does not exist produces a non-terminating error and the cmdlet conti
 
 Before 5.0.0, omitting `-AccessInheritanceEnabled` or `-AuditInheritanceEnabled` could fail with the error "Nullable object must have a value".
 
+Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.
+
 ## RELATED LINKS
 
 [Get-NTFSInheritance](Get-NTFSInheritance.md)

Docs/Concepts.md

@@ -188,9 +188,9 @@ The access, audit, inheritance, owner, and security descriptor cmdlets enable
 these privileges automatically while they run and disable the ones they
 enabled when they finish. If a privilege cannot be enabled, the cmdlet
 continues without it. You can turn this behavior off with the
-`EnablePrivileges` module setting. The inheritance cmdlets are an exception:
-they always try to enable the privileges, and when `EnablePrivileges` is
-`$false`, they leave them enabled.
+`EnablePrivileges` module setting. Before 5.0.0, the inheritance cmdlets were
+an exception: they always tried to enable the privileges, and when
+`EnablePrivileges` was `$false`, they left them enabled.
 
 `Enable-Privileges` enables the four privileges for the current PowerShell
 process until you run `Disable-Privileges` or close the session.

NTFSSecurity/InheritanceCmdlets/DisableAccessInheritance.cs

@@ -53,7 +53,6 @@ namespace NTFSSecurity
         protected override void BeginProcessing()
         {
             base.BeginProcessing();
-            EnableFileSystemPrivileges(true);
         }
 
         protected override void ProcessRecord()

NTFSSecurity/InheritanceCmdlets/DisableAuditInheritance.cs

@@ -54,7 +54,6 @@ namespace NTFSSecurity
         protected override void BeginProcessing()
         {
             base.BeginProcessing();
-            EnableFileSystemPrivileges(true);
         }
 
         protected override void ProcessRecord()

NTFSSecurity/InheritanceCmdlets/EnableAccessInheritance.cs

@@ -53,7 +53,6 @@ namespace NTFSSecurity
         protected override void BeginProcessing()
         {
             base.BeginProcessing();
-            EnableFileSystemPrivileges(true);
         }
 
         protected override void ProcessRecord()

NTFSSecurity/InheritanceCmdlets/EnableAuditInheritance.cs

@@ -53,7 +53,6 @@ namespace NTFSSecurity
         protected override void BeginProcessing()
         {
             base.BeginProcessing();
-            EnableFileSystemPrivileges(true);
         }
 
         protected override void ProcessRecord()

NTFSSecurity/InheritanceCmdlets/GetInheritance.cs

@@ -38,7 +38,6 @@ namespace NTFSSecurity
         protected override void BeginProcessing()
         {
             base.BeginProcessing();
-            EnableFileSystemPrivileges(true);
 
             if (paths.Count == 0)
             {

NTFSSecurity/InheritanceCmdlets/SetInheritance.cs

@@ -61,7 +61,6 @@ namespace NTFSSecurity
         protected override void BeginProcessing()
         {
             base.BeginProcessing();
-            EnableFileSystemPrivileges(true);
         }
 
         protected override void ProcessRecord()

NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml

@@ -2412,6 +2412,7 @@ PS C:\&gt; Set-NTFSSecurityDescriptor -SecurityDescriptor $sd</dev:code>
         <maml:para>When the module setting `EnablePrivileges` is `$true` (the default in the `PrivateData` section of NTFSSecurity.psd1), this cmdlet tries to enable the Backup, Restore, Take Ownership, and Security privileges while it runs and disables the privileges it enabled when it finishes. These privileges are only available in an elevated session of an account that holds them, such as a member of the local Administrators group. If a privilege cannot be enabled, the cmdlet continues without it and writes a debug message.</maml:para>
         <maml:para>Blocking access inheritance requires permission to change the DACL of the item, which the owner of an item always has. If the descriptor cannot be opened, the cmdlet takes ownership of the item, applies the change, and sets the previous owner back. That fallback only succeeds when the account can take ownership of the item and restore the original owner; otherwise the cmdlet writes an error and continues with the next item.</maml:para>
         <maml:para>A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.</maml:para>
+        <maml:para>Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -2656,6 +2657,7 @@ PS C:\&gt; Set-NTFSSecurityDescriptor -SecurityDescriptor $sd</dev:code>
         <maml:para>The audit section of a security descriptor can only be read and written with the Security privilege (`SeSecurityPrivilege`), which an account can only use in an elevated session. Without it, the cmdlet writes a non-terminating error that reports Windows error 1314, "A required privilege is not held by the client", and the audit rules of the item stay unchanged.</maml:para>
         <maml:para>If the descriptor cannot be opened because the account has no permission to the item, the cmdlet takes ownership of the item, applies the change, and sets the previous owner back. That fallback only succeeds when the account can take ownership of the item and restore the original owner; a missing Security privilege is not an access problem and is not repaired by it.</maml:para>
         <maml:para>A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.</maml:para>
+        <maml:para>Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -3025,6 +3027,7 @@ PS C:\&gt; Get-Privileges | Where-Object { $_.Privilege -in 'Backup', 'Restore',
         <maml:para>When the module setting `EnablePrivileges` is `$true` (the default in the `PrivateData` section of NTFSSecurity.psd1), this cmdlet tries to enable the Backup, Restore, Take Ownership, and Security privileges while it runs and disables the privileges it enabled when it finishes. These privileges are only available in an elevated session of an account that holds them, such as a member of the local Administrators group. If a privilege cannot be enabled, the cmdlet continues without it and writes a debug message.</maml:para>
         <maml:para>Restoring access inheritance requires permission to change the DACL of the item, which the owner of an item always has. If the descriptor cannot be opened, the cmdlet takes ownership of the item, applies the change, and sets the previous owner back. That fallback only succeeds when the account can take ownership of the item and restore the original owner; otherwise the cmdlet writes an error and continues with the next item.</maml:para>
         <maml:para>A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.</maml:para>
+        <maml:para>Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -3269,6 +3272,7 @@ PS C:\&gt; Set-NTFSSecurityDescriptor -SecurityDescriptor $sd</dev:code>
         <maml:para>The audit section of a security descriptor can only be read and written with the Security privilege (`SeSecurityPrivilege`), which an account can only use in an elevated session. Without it, the cmdlet writes a non-terminating error that reports Windows error 1314, "A required privilege is not held by the client", and the audit rules of the item stay unchanged.</maml:para>
         <maml:para>If the descriptor cannot be opened because the account has no permission to the item, the cmdlet takes ownership of the item, applies the change, and sets the previous owner back. That fallback only succeeds when the account can take ownership of the item and restore the original owner; a missing Security privilege is not an access problem and is not repaired by it.</maml:para>
         <maml:para>A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.</maml:para>
+        <maml:para>Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -5430,6 +5434,7 @@ PS C:\&gt; Get-NTFSAudit -SecurityDescriptor $sd</dev:code>
         <maml:para>Before 5.0.0, a security descriptor that was read without its audit section reported `AuditInheritanceEnabled` as `$true`.</maml:para>
         <maml:para>If the security descriptor of an item cannot be opened because the account has no permission to it, the cmdlet takes ownership of the item, reads the state, and sets the previous owner back. That fallback only succeeds when the account can take ownership of the item and restore the original owner; otherwise the cmdlet writes an error and continues with the next item.</maml:para>
         <maml:para>A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.</maml:para>
+        <maml:para>Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -9391,6 +9396,7 @@ PS C:\&gt; Set-NTFSSecurityDescriptor -SecurityDescriptor $sd</dev:code>
         <maml:para>If the descriptor cannot be opened because the account has no permission to the item, the cmdlet takes ownership of the item, applies the changes, and sets the previous owner back. That fallback only succeeds when the account can take ownership of the item and restore the original owner; otherwise the cmdlet writes an error and continues with the next item.</maml:para>
         <maml:para>A path that does not exist produces a non-terminating error and the cmdlet continues with the remaining paths.</maml:para>
         <maml:para>Before 5.0.0, omitting `-AccessInheritanceEnabled` or `-AuditInheritanceEnabled` could fail with the error "Nullable object must have a value".</maml:para>
+        <maml:para>Before 5.0.0, the cmdlet enabled the privileges even when `EnablePrivileges` was `$false`, and left them enabled.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>

Tests/Privileges.Tests.ps1

@@ -61,3 +61,28 @@ Describe 'Disable-Privileges' {
         }
     }
 }
+
+Describe 'Inheritance cmdlets' {
+    Context 'When the module setting EnablePrivileges is $false' {
+        BeforeAll {
+            $privateData['EnablePrivileges'] = $false
+            $file = New-TestSandboxItem -Sandbox $sandbox -Name 'Inheritance'
+        }
+
+        AfterAll {
+            $privateData['EnablePrivileges'] = $enablePrivileges
+        }
+
+        # Before 5.0.0, the inheritance cmdlets enabled the privileges anyway and left them enabled.
+        It '<_> should leave the privileges disabled' -Skip:(-not $holdsPrivileges) -ForEach @(
+            'Get-NTFSInheritance', 'Set-NTFSInheritance', 'Enable-NTFSAccessInheritance',
+            'Disable-NTFSAccessInheritance', 'Enable-NTFSAuditInheritance', 'Disable-NTFSAuditInheritance'
+        ) {
+            Get-BackupPrivilegeState | Should -Be 'Disabled'
+
+            & $_ -Path $file -ErrorAction SilentlyContinue | Out-Null
+
+            Get-BackupPrivilegeState | Should -Be 'Disabled'
+        }
+    }
+}