SUBINACL bug

Hi,

I am trying to use SUBINACL.EXE from the reskit and it seems that it
has some bugs related to inheritance of ACEs.

When I set an auditing ACE on a parent folder it doesn't propagate to
children objects even if the "inherit from the parent" option is
checked on the children object. When, I uncheck this option and recheck
again the inherited ACEs get working.


After some googling around, it seems that it is an old problem with
reordering ACEs inside SUBINACL.

Does anyone have any solution to this?

.

Relevant Pages

  • Re: Confusion over IO (Inherit Only) ACE on Vista
    ... Note that the output from icacls does not agree with the output from cacls. ... @echo off ... Earlier we discussed how default folder permissions created by FORMAT.EXE consist of two ACEs per group - one to set the explicit ACE, and one to control the inheritance of child objects. ...
    (microsoft.public.platformsdk.security)
  • Re: Root rights problems
    ... >>What you see in the Explorer Security dialog for the ACE ... >>four kinds of ACEs in a DACL is important. ... >>Due to the way inheritance is propagated on a deferred ... >>account is a member. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Root rights problems
    ... >four kinds of ACEs in a DACL is important. ... Right, I'm on top of all that, save for the quirkiness in Explorer, ... >Due to the way inheritance is propagated on a deferred ... >in the absence of a Deny to some group in which that admin ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Confusion over IO (Inherit Only) ACE on Vista
    ... Earlier we discussed how default folder permissions created by FORMAT.EXE consist of two ACEs per group - one to set the explicit ACE, and one to control the inheritance of child objects. ... but shows ACE's on child folders with the flag set. ...
    (microsoft.public.platformsdk.security)
  • Re: GetNamedSecurityInfo VS GetFileSecurity
    ... that are not aware of ACE inheritance (which was introduced in ... If you want to work with inherited ACEs you should use ... > all return the same security descriptor which doesn't have any inherited ... > older files/folders. ...
    (microsoft.public.platformsdk.security)