Inheritance¶
Permissions flow downhill. A folder is a parent; the files and subfolders inside are children. By default, children inherit the parent's permissions, so setting permissions on C:\Finance sets them on everything inside.
Seeing it¶
In the Security tab, inherited permissions show greyed out and can't be edited directly. Advanced shows each entry with an Inherited from column.
The usual approach¶
Set permissions on the folder and let inheritance carry them down. It's one change instead of hundreds, and new files automatically get the right permissions.
When some files need to be more open or more restricted than the folder, the fastest path is: set the restrictive permission on the parent, then override on the few files that differ.
Breaking inheritance¶
Advanced → Disable inheritance. Windows asks:
- Convert inherited permissions into explicit permissions: keeps the current settings, now editable. Usually what you want.
- Remove all inherited permissions: starts from nothing. You'll need to add Administrators and SYSTEM back or nobody can reach it.
Pushing changes down¶
If a subfolder had inheritance broken earlier and you want the parent's new permissions to apply everywhere: Advanced → tick Replace all child object permission entries with inheritable permission entries from this object → OK.
Warning
Be careful removing inherited permissions on system folders, and with Deny entries. It's easy to lock Administrators, or Windows itself, out of something. Take a snapshot first.
Example¶
C:\Finance has the right permissions, but C:\Finance\Reports shows Everyone: Full control and the entry isn't greyed out, so someone set it directly. Open Advanced on C:\Finance, tick Replace all child object permission entries, OK. The Reports folder now inherits from Finance and the Everyone entry is gone.