Section 3: ACL Inheritance

The Big Picture: Rules That Flow Downhill

Imagine a drive with 200,000 files. Setting a guest list on every single file by hand would take forever, and one mistake would leave a hole. Windows solves this with inheritance: a folder's rules flow down to everything inside it, like water running downhill.

You set the rule once on the top folder. Every file and subfolder below receives a copy automatically. If you later change the top rule, the copies change too.

Inheritance is when a file or folder gets some of its ACL entries from its parent (the folder it lives in) instead of having them written directly on it.

  D:\Projects            ← you set "Team: Modify" here
     │
     ├── Plan.docx       ← gets "Team: Modify" (inherited)
     │
     └── Design          ← gets "Team: Modify" (inherited)
          │
          └── Logo.png   ← gets "Team: Modify" (inherited)

3.1 Inherited vs Explicit Permissions

What it is: Every entry (ACE) in an ACL is one of two kinds:

How to see it in File Explorer:

1. Right-click the item → Properties → Security tab.
2. Click a name. If the tick boxes are grey, those rights are inherited.
3. Click Advanced. The Permission entries table has a column called Inherited from. It shows the parent path, or None for an explicit entry.

How to see it with icacls: Inherited entries carry the code (I):

C:\Data\Report.docx  BUILTIN\Administrators:(I)(F)
                     Everyone:(I)(R)
                     HARSHIL-PC\Harshil:(F)

Here the first two are inherited (marked (I)), and the last one is explicit.

Which controls what gets passed down? When you add a rule to a folder, the Applies to setting (Section 1) decides if it goes to subfolders, files, both, or neither. Under the hood this uses two flags:

The order Windows checks entries. When Windows reads an ACL it follows a fixed order. This is how "Deny wins" is built in:

1. Explicit Deny    (set on this item)
2. Explicit Allow   (set on this item)
3. Inherited Deny   (from the parent)
4. Inherited Allow  (from the parent)

Windows reads the list from the top and stops as soon as the answer is clear. This means an explicit entry on the item beats an inherited one:

• An explicit Deny overrides an inherited Allow.
• An explicit Allow can override an inherited Deny (because it is read first).
• Within the same group (for example two explicit entries), Deny comes before Allow.

(The Security tab and icacls keep entries in this order for you. Section 4 shows how the full result is worked out.)

What happens when the parent changes? If you add a rule to the parent, Windows copies it onto the children (this can take a while on big folders). If you remove the rule from the parent, the inherited copies disappear too. Explicit entries on the children stay untouched.

Walking down a tree (the "ACL walk"). When Windows checks D:\Projects\Design\Logo.png, it does not read the ACLs of the parent folders one by one. Each item already carries its inherited entries. So the check is one lookup in one ACL. That is why inheritance is fast, and why the copies must be updated whenever a parent changes.

3.2 Breaking Inheritance

What it is: Sometimes a subfolder needs different rules from its parent. For example, D:\Projects\Secret should be seen only by the boss, even though D:\Projects is open to the whole team. You can stop the flow from the parent. This is called breaking or disabling inheritance.

How to do it:

1. Right-click the folder → Properties → Security → Advanced.
2. Click Disable inheritance.
3. Windows asks you to choose one of two options:

Safer habit: Choose Convert first. Then delete the entries you do not want. That way you never end up with an empty list by accident.

BEFORE                         AFTER "Disable inheritance → Convert"

 Projects                       Projects
   Team: Modify  (explicit)       Team: Modify  (explicit)
     │ flows down                   ╳  no longer flows into Secret
     ▼
 Secret                         Secret
   Team: Modify  (inherited)      Team: Modify  (explicit copy)
                                  ← now you can delete "Team" here
                                    and add "Boss: Full control"

Turning it back on. In the same Advanced window, click Enable inheritance. The folder starts receiving the parent's rules again. Your explicit entries stay.

Protected DACL. In technical terms, when inheritance is off, the item's list (its DACL, the part of the ACL that holds allow/deny entries, from Chapter 24) is marked protected. A protected DACL ignores changes flowing down from the parent. Windows shows this as the tick box Include inheritable permissions from this object's parent being off.

A useful tool: "Replace all child object permission entries with inheritable permission entries from this object." This tick box, in the Advanced window, forces every child to drop its own explicit entries and take the parent's. It is powerful. It can undo careful custom work in subfolders, so use it only when you mean to reset them.

Windows tip: You can also see whether inheritance is on from PowerShell:

(Get-Acl "C:\Users\Public").AreAccessRulesProtected

False means inheritance is on. True means the list is protected (inheritance off).

Where this matters in real life:

• Program Files and Windows folders use inherited rules set by the installer and by TrustedInstaller (Section 8). Do not break inheritance there.
• Your user profile C:\Users\<you> usually has inheritance off, with explicit entries for you, SYSTEM and Administrators. This is why other normal users cannot read your files.

Summary