NTFS inherited permissions not correct

Today I stumbeled over an NTFS file system (Windows 2003 R2 Server) where many inherited permissions was wrong for some reason.

My root folder had a special permission set for the Users group(only list folder content, does only apply to this folder). But in many subfolders the Users group had read and write access to the folder and the contents.

So how do we fix incorrect inherited permissions without also loosing the permissions set for the subfolder?

Windows 2003 R2 comes with a tool called icacls that can modify permissions. Below is a script I created that processes the current directory. It does:

1. Saves a backup of the folder to your temp directory. (Just in case...)
2. Grants the Users group some permissions to this folder. (Remember, I only wanted inherited permissions for the Users group!) This grant also fixes all incorrect inherited permissions.
3. Removes the explicitly set permissions for the Users group.

Save the codesnippet to a .cmd file and run it from the directory you want to repair permissions on.

@echo off
for /d %%x in (*) do (
 echo Processing %%x
 icacls %%x /save %temp%\%%x.acl
 icacls %%x /grant users:r
 icacls %%x /remove users
)