File server NTFS permission inheritance repair
Overview
Broken inheritance snowballs into “Finance cannot read Q3” tickets. Fix with planned resets, not random GUI clicking.
Discovery
icacls export or PowerShell Get-Acl inventory of top-level shares; compare to authorization matrix document.
Approach
- Create security groups aligned to roles, not user ACEs.
- Reset children inheritance only after backup / Previous Versions sanity check and change window.
- Remove CREATOR OWNER surprises on old shares.
Testing
Use effective access tab with sample users before/after; verify DFS targets both hit same ACL story.
Pitfalls
Mac and Linux clients cache ACLs—bounce sessions; robocopy /copyall mistakes duplicate stale DACLs—use templates carefully.
Governance
Quarterly access review ties to this structure—orphan groups deleted.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...