ACL Propagation Rules
When you create or modify access control entries (ACEs) for container objects such as folders, you can specify how to propagate the ACEs to objects within the container. For example, you might apply ACEs to all subfolders but not the files within those folders.
The rules of ACE propagation are controlled by different combinations of the InheritanceFlags enumeration and the PropagationFlags enumeration. You can pass both enumerations to constructors of the FileSystemAuditRule class or the FileSystemAccessRule class.
The following table shows all combinations of the two enumerations and describes how each combination affects the rules of propagation.
Flag combinations |
Propagation results |
|---|---|
No Flags |
Target folder. |
Target folder, child object (file), grandchild object (file). |
|
Target folder, child object (file). |
|
Child object (file), grandchild object (file). |
|
Child object (file). |
|
Target folder, child folder, grandchild folder. |
|
Target folder, child folder. |
|
Child folder, grandchild folder. |
|
Child folder. |
|
Target folder, child folder, child object (file), grandchild folder, grandchild object (file). |
|
Target folder, child folder, child object (file). |
|
Child folder, child object (file), grandchild folder, grandchild object (file). |
|
ContainerInherit, ObjectInherit, NoPropagateInherit, InheritOnly |
Child folder, child object (file). |
Note To change the access rules of only certain child files or folders, you must break your operation into several different calls.