As some of you know I invest waaaay too much time in NTFS permissions.
Recent findings show that I stumbled on yet another problem.
If you used my NTFSPerms UDF you're likely to to have stumbled upon the same problem settings security permissions on folders. While the udf works fine on files, folders are another issue. Especially when you want to have your new perms propagated down the food chain. Normally (my UDF does this by default) you set the aceflag to 3, which means 1 (for object inherit) + 2 (container inherit). This works fine and dandy for subfolders you create afterwards but not for the existing subfolders.

Apparantly this has to do with the Security Descriptor Control Flags.
This is a whole new ballpark. As the AdsSecurityUtility (which I use in my SharePerms and NTFSPerms) allows for pretty much everything in a SD to be edited this is the only thing seemingly it does not allow to edit, however you can read the control flags and here comes the curious part. When you create a folder and the NTFS perms are default (IE not edited and the upper folders not edited as well) this Flag will most likely be 33796 which means SE_SACL_PRESENT and SE_DACL_AUTO_INHERITED. This is basically always what you want. (unless you have different ideas about inheritance).

As soon as you apply your new ace to the folder the Control Flag changes, so it can be changed you ask ?, yes and no. It changes it for you and drops the SE_DACL_AUTO_INHERITED flag. You can not (not to my knowledge...) change the control flag back. So existing subfolders do not get your new permissions inherited, off course you could make a script that applies the new ace to each subfolder and file but this is not how it should be done imo.

Here comes the curious bit, if you CREATE a new subfolder, the new aces are inherited!!! now thats strange isn't it ?

There is a workaround to have control flags set back properly to the root folder that you wanted your ace to be added, you can set the control flags with a vbs script \:\( This is because there is a WMI object that allows you to do just that, it makes use of a Reference Variable, something KiX does not allow, KiX only support Optional Variables for UDF's.

So basically with all my ramblings aside there is a question in here \:\)
Does anyone know how to use AdsSecurityUtility to SET control flags?

As always thanks for taking the time to read my ramblings \:\)