SET-ACL文件夹权限没有正确应用我的PowerShell脚本

我有两个脚本：第一个创build一个新的根文件夹，第二个创build一个新的子文件夹。

它大部分工作正常，但是当inheritance的权限被下拉到子文件夹时，权限不会显示在“安全”选项卡上。 但是，如果我检查高级权限显示正确…

这似乎是导致问题，因为inheritance的权限似乎没有正确应用到文件夹。

我究竟做错了什么？ 用图像来澄清：

这是我的两个脚本：

根/父文件夹创build：

# Create initial ACE # Create the initial Object # Set domain - This could also be changed to prompt for domain if we decide it is needed # Define local Administrators group by Well Known SID # Set additional ACEs for the new AD File Share Groups # Set ACLs on the new folder function New-Ace { [CmdletBinding()] Param( [Parameter(Mandatory=$true, Position=0)] [Security.Principal.NTAccount]$Account, [Parameter(Mandatory=$false, Position=1)] [Security.AccessControl.FileSystemRights]$Permissions = 'ReadAndExecute', [Parameter(Mandatory=$false, Position=2)] [Security.AccessControl.InheritanceFlags]$InheritanceFlags = 'ContainerInherit,ObjectInherit', [Parameter(Mandatory=$false, Position=3)] [Security.AccessControl.PropagationFlags]$PropagationFlags = 'NoPropagateInherit', [Parameter(Mandatory=$false, Position=4)] [Security.AccessControl.AccessControlType]$Type = 'Allow' ) New-Object Security.AccessControl.FileSystemAccessRule( $Account, $Permissions, $InheritanceFlags, $PropagationFlags, $Type ) } $domain = 'ESG.INTL' $administrators = ([wmi]"Win32_Sid.Sid='S-1-5-32-544'").AccountName $ADDomainUsers = "$domain\Domain Users" $acl = Get-Acl $path $administrators, "$domain\Domain Admins" | ForEach-Object { $acl.AddAccessRule((New-Ace $_ 'FullControl')) } $acl.AddAccessRule((New-Ace $ADNameRW 'Modify')) $acl.AddAccessRule((New-Ace $ADNameRO 'ReadAndExecute')) $acl.AddAccessRule((New-Ace $ADDomainUsers 'ReadAndExecute')) $acl.SetAccessRuleProtection($true, $false) Set-Acl $path $acl 

子文件夹创build：

  # Create initial ACE # Create the initial Object # Set domain - This could also be changed to prompt for domain if we decide it is needed # Define local Administrators group by Well Known SID # Set additional ACEs for the new AD File Share Groups # Set ACLs on the new folder function New-Ace { [CmdletBinding()] Param( [Parameter(Mandatory=$true, Position=0)] [Security.Principal.NTAccount]$Account, [Parameter(Mandatory=$false, Position=1)] [Security.AccessControl.FileSystemRights]$Permissions = 'ReadAndExecute', [Parameter(Mandatory=$false, Position=2)] [Security.AccessControl.InheritanceFlags]$InheritanceFlags = 'ContainerInherit,ObjectInherit', [Parameter(Mandatory=$false, Position=3)] [Security.AccessControl.PropagationFlags]$PropagationFlags = 'NoPropagateInherit', [Parameter(Mandatory=$false, Position=4)] [Security.AccessControl.AccessControlType]$Type = 'Allow' ) New-Object Security.AccessControl.FileSystemAccessRule( $Account, $Permissions, $InheritanceFlags, $PropagationFlags, $Type ) } $acl = Get-Acl $path $acl.AddAccessRule((New-Ace $ADNameRW 'Modify')) $acl.AddAccessRule((New-Ace $ADNameRO 'ReadAndExecute')) Set-Acl $path $acl 

  [Security.AccessControl.PropagationFlags]$PropagationFlags = 'None',