I having issues understanding exactly what the SetAccessRuleProtection property does in PowerShell.
If we take a look at Microsoft's documentation here.
Sets or removes protection of the access rules associated with this ObjectSecurity object. Protected access rules cannot be modified by parent objects through inheritance.
isProtected
Type: System.Boolean
true to protect the access rules associated with this ObjectSecurity object from inheritance; false to allow inheritance.
preserveInheritance
Type: System.Boolean
true to preserve inherited access rules; false to remove inherited access rules. This parameter is ignored if isProtected is false.
OK, it sort of explains itself but it doesn't always work. Take some simple code like this:
$fpath = "\\server\grandfather\parent"
New-Item -ItemType directory -Path $fpath
$acl = Get-Acl $fpath
$acl.SetAccessRuleProtection($False,$True)
Set-Acl $fpath $acl | Out-Null
According to the documentation, this would mean that "\\server\grandfather\parent" inherits EVERYTHING from its parent which would be "grandfather" in this case because the "isProtected" parameter is set to false which allows inheritance. Furthermore, Since preserveInheritance is set to true, it KEEPS the inheritance rules it got from "grandfather".
Lets go down some more the code:
$fpath = "\\server\grandfather\parent"
New-Item -ItemType directory -Path $fpath
$acl = Get-Acl $fpath
$acl.SetAccessRuleProtection($False,$True)
Set-Acl $fpath $acl | Out-Null
$spath = "\\server\grandfather\parent\son"
New-Item -ItemType directory -Path $spath
$acl = Get-Acl $spath
$acl.SetAccessRuleProtection($True,$False)
Set-Acl $spath $acl | Out-Null
In this case, "\\server\grandfather\parent\son" inherits NOTHING because it is protected from inheritance. In case it does (which would be impossible but), it REMOVES all its inherited properties. This would make the folder basically inaccessible except the by owner.
Is this correct? Could you give some more examples with this using
$acl.SetAccessRuleProtection($True,$True)
$acl.SetAccessRuleProtection($False,$False)
$acl.SetAccessRuleProtection($True,$False)
$acl.SetAccessRuleProtection($False,$True)