2 Days and I found part of the solution.
As soon as you apply the security descriptor it "AdsSecurityUtility" removes the SE_DACL_AUTO_INHERIT flag. Reapplying this flag with the afore mentioned VBS solves the problem completely. I found that partly this can be done with AdsSecurityUtility. Before you apply the Security Descriptor back to the folder add SE_DACL_AUTO_INHERIT_REQ flag to it.
 Code:
$sd.Control = $sd.Control + &100

This will set everything on the folder back to how it should have been, however the problem remains that the existing subfolders don't inherit the new ace. When you set the sd.Control flags using wmi and vbs the existing subfolders do inherit the new ace....

Thanks to M$ for properly documenting AdsSecurityUtility!.... NOT!!!! :P