The ADS_ACEFLAG_NO_PROPAGATE_INHERIT_ACE and ADS_ACEFLAG_INHERIT_ONLY_ACE flags are meaningful only if ADS_ACEFLAG_INHERIT_ACE is present. For example, if an ACE is intended to be inherited by user objects in a organizational unit, it is likely that it should not be enforced for access to the organizational unit itself. This flag is useful for setting permissions inheritable by subobjects, but do not affect accessibility of the container. If this flag is not set, then the ACE is part of the effective ACL. This flag indicates that the ACE is not part of effective ACL. This flag indicates that the ACE is part of the inherit ACL, but that no inheritance control flags are propagated to direct child objects (direct descendants) and the ACE is effective on the direct child objects. This flag indicates that the ACE is part of the inherit ACL and that child objects inherit the inheritance control flags of this ACE. Three inheritance-control flags can be set in the AceFlags property of an ACE.

The categories for where an ACE belongs are determined by the inheritance control flags set in the ACE. Inherit ACL: ACEs in this category are inherited by objects created in the container.Įach ACE in the DACL can belong to one, or more, categories.Effective ACL: ACEs in this category apply to the object.Access-control entries (ACEs) in an object access-control list (ACL) can belong to one of two categories:

Evernote desktop dissable ads