Forum Discussion

ServetKaplan's avatar
ServetKaplan
Copper Contributor
Feb 04, 2026

NTFS permissions are partially not working.

 


Participant A is sometimes unable to see Participant B’s files.
The issue can be resolved by clicking the option:
"Replace all child object permission entries with inheritable permission entries from this object."
However, the problem keeps reappearing.

Windows Server 2022 Datacenter (VMware 7.1), formatted as NTFS.

1 Reply

  • Hello,

    This is almost never an NTFS corruption issue. It is an inheritance and explicit ACE problem.

    When you click Replace all child object permission entries with inheritable permission entries from this object, you are forcing a one time reset of ACLs. The fact that the issue returns means something is breaking inheritance again or writing explicit permissions at child level.

    Common causes:

    1. Inheritance disabled on subfolders

    Some subfolders likely have inheritance disabled and explicit ACEs applied. When new files are created inside those folders, they inherit the restricted ACL, not the parent.

    Check on an affected folder:

    1. Right click > Security > Advanced
    2. Confirm Inheritance is Enabled

    If it shows Disabled, that folder is the divergence point.

    2. Application modifying ACLs

    If this is an application data folder, the application may be creating folders with its own security descriptor. In that case, manual resets will not persist.

    Use:

    icacls D:\Path\Folder /inheritance:e

    Then verify with:

    icacls D:\Path\Folder

    3. Mixed share and NTFS permissions

    Users may see files disappear due to share level filtering, not NTFS. Effective access is the intersection of Share and NTFS. Validate both layers.

    4. CREATOR OWNER behaviour

    If the parent folder grants Full Control to CREATOR OWNER, new files may grant access only to the creator and not to other participants. That often causes the symptom you describe.

    Inspect the parent ACL and check whether CREATOR OWNER is present with Full Control and how it is scoped.

    Root cause pattern in most cases:

    A subfolder with inheritance disabled or an application writing explicit ACLs. The Replace option fixes it temporarily by flattening permissions, but the underlying ACL model is still inconsistent.

    Start by identifying the first folder in the tree where inheritance is disabled. That is typically where the drift begins.