title: Setting InheritanceFlags vs PropagationFlags in Powershell
body: <p>I'm trying to find the right combination of the InheritanceFlags and PropagationFlags so that my new folder will not inherit the folder's permissions before it, but will propagate the rights to the folders/files contained in the new folder... I tried swapping the two from what I have below, but that only gave the new folder the same permissions as the one above it and didn't apply my new groups... </p>
  
  <p>How do I set the flags correctly to only apply the permissions to all files/folders below this folder and not pull from the parent folder? </p>
  
  <p>I found <a href="https://docs.google.com/spreadsheets/d/1Envcj0iYmYHyB_xA4aFe8VwlpReQdP2pr3rl-HjgfcU/pub?hl=en_US&amp;hl=en_US&amp;output=html" rel="noreferrer">this table</a>, but it doesn't seem to do what I'm wanting...</p>
  
  <pre><code>function New-Ace {
    [CmdletBinding()]
    Param(
      [Parameter(Mandatory=$true, Position=0)]
      [Security.Principal.NTAccount]$Account,
      [Parameter(Mandatory=$false, Position=1)]
      [Security.AccessControl.FileSystemRights]$Permissions = 'ReadAndExecute',
      [Parameter(Mandatory=$false, Position=2)]
      [Security.AccessControl.InheritanceFlags]$InheritanceFlags = 'ContainerInherit,ObjectInherit',
      [Parameter(Mandatory=$false, Position=3)]
      [Security.AccessControl.PropagationFlags]$PropagationFlags = 'None',
      [Parameter(Mandatory=$false, Position=4)]
      [Security.AccessControl.AccessControlType]$Type = 'Allow'
    )
  
    New-Object Security.AccessControl.FileSystemAccessRule(
      $Account, $Permissions, $InheritanceFlags, $PropagationFlags, $Type
    )
  }
  
  $domain = 'TestDomain'
  
  $administrators = ([wmi]"Win32_Sid.Sid='S-1-5-32-544'").AccountName
  
  $acl = Get-Acl $path
  
  $administrators, "$domain\Domain Admins" | ForEach-Object {
    $acl.AddAccessRule((New-Ace $_ 'FullControl'))
  }
  $acl.AddAccessRule((New-Ace $ADNameRW 'Modify'))
  $acl.AddAccessRule((New-Ace $ADNameRO 'ReadAndExecute'))
  
  Set-Acl $path $acl
  </code></pre>