title: A reliable way to determine if ntfs permissions were inherited
body: <p>I have a somewhat obscure question here.</p>
  
  <p>What I need: To determine if the permissions (or, strictly speaking, a specific ACE of a DACL)  of a file/folder was inherited.</p>
  
  <p>How I tried to solve this: using winapi bindings for python (win32security module, to be precise). Here is the stripped down version, that does just that, - it simply takes a path to a file as an argument and prints out ACEs one by one, indicating which flags are set.</p>
  
  <pre><code>#!/usr/bin/env python
  from win32security import *
  import sys
  
  def decode_flags(flags):
      _flags = {
          SE_DACL_PROTECTED:"SE_DACL_PROTECTED",
          SE_DACL_AUTO_INHERITED:"SE_DACL_AUTO_INHERITED",
          OBJECT_INHERIT_ACE:"OBJECT_INHERIT_ACE",
          CONTAINER_INHERIT_ACE:"CONTAINER_INHERIT_ACE",
          INHERIT_ONLY_ACE:"INHERIT_ONLY_ACE",
          NO_INHERITANCE:"NO_INHERITANCE",
          NO_PROPAGATE_INHERIT_ACE:"NO_PROPAGATE_INHERIT_ACE",
          INHERITED_ACE:"INHERITED_ACE"
      }
      for key in _flags.keys():
          if (flags &amp; key):
              print '\t','\t',_flags[key],"is set!"
  
  
  def main(argv):
      target = argv[0]
      print target
  
      security_descriptor = GetFileSecurity(target,DACL_SECURITY_INFORMATION)
  
      dacl = security_descriptor.GetSecurityDescriptorDacl()
  
      for ace_index in range(dacl.GetAceCount()):
          (ace_type,ace_flags),access_mask,sid = dacl.GetAce(ace_index)
          name,domain,account_type = LookupAccountSid(None,sid)
          print '\t',domain+'\\'+name,hex(ace_flags)
          decode_flags(ace_flags)
  
  
  if __name__ == '__main__':
      main(sys.argv[1:])
  </code></pre>
  
  <p>Simple enough - get a security descriptor, get a DACL from it then iterate through the ACEs in the DACL. The really important bit here is INHERITED_ACE access flag. It should be set when the ACE is inherited and not set explicitly. </p>
  
  <p>When you create a folder/file, its ACL gets populated with ACEs according to the ACEs of the parent object (folder), that are set to propagate to children. However, unless you do any change to the access list, the INHERITED_ACE flag will NOT be set! But the inherited permissions are there and they DO work. </p>
  
  <p>If you do any slight change (say, add an entry to the access list, apply changes and delete it), the flag magically appears (the behaviour does not change in any way, though, it worked before and it works afterwards)! What I want is to find the source of this behaviour of the INHERITED_ACE flag and, maybe find another <em>reliable</em> way to determine if the ACE was inherited or not.</p>
  
  <p>How to reproduce:</p>
  
  <ol>
  <li>Create an object (file or folder)</li>
  <li>Check permissions in windows explorer, see that they have been propagated from the parent object (using, say, security tab of file properties dialog of windows explorer).</li>
  <li>Check the flags using, for example, the script I was using (INHERITED_ACE will NOT be set on any ACEs).</li>
  <li>Change permissions of an object (apply changes), change them back even.</li>
  <li>Check the flags (INHERITED_ACE <em>will</em> be there)</li>
  <li>..shake your head in disbelief (I know I did)</li>
  </ol>
  
  <p>Sorry for a somewhat lengthy post, hope this makes at least a little sense.</p>