Python windows service to automatically grant folder permissions creates duplicate ACEs
<p>I wrote a windows service in Python that scans a given directory for new folders. Whenever a new folder is created, the service creates 4 sub-folders and grants each one a different set of permissions. The problem is that within those subfolders, any folders created (essentially tertiary level, or sub-sub-folders)
have the following error when accessing the permissions (through right-click-> properties->security): </p>

<p><strong>"The permissions on test folder are incorrectly ordered, which may cause some entries to be ineffective"</strong> </p>

<p>To reiterate, we have folder A which is scanned. When I create folder B in folder A, folders 1,2,3,4 are created within B, with permissions provided by the script. Any folders created within (1,2,3,4) have the above error when opening up the directory permissions. Furthermore, the security entries for SYSTEM, Administrators and Authenticated Users appear twice when clicking on advanced.</p>

<p>The relevant portion of code is: </p>

<pre><code>import win32security
import ntsecuritycon

for rw_user in rw:
    sd=win32security.GetFileSecurity(in_dir+"\\"+dir_,win32security.DACL_SECURITY_INFORMATION)
    dacl=sd.GetSecurityDescriptorDacl()
    dacl.AddAccessAllowedAceEx(sec.ACL_REVISION_DS,sec.OBJECT_INHERIT_ACE|sec.CONTAINER_INHERIT_ACE,con.FILE_GENERIC_READ|con.FILE_ADD_FILE,p_dict[rw_user][0])

    sd.SetSecurityDescriptorDacl(1,dacl,0)
    win32security.SetFileSecurity(in_dir+"\\"+dir_,win32security.DACL_SECURITY_INFORMATION,sd)
</code></pre>

<p>This is based on the example found in <a href="http://stackoverflow.com/questions/12168110/setting-folder-permissions-in-windows-using-python">Setting folder permissions in Windows using Python</a></p>

<p>Any help is greatly appreciated.</p>

<p>***EDITED TO ADD:</p>

<p>This is the output of icacls.exe on the folder created by the service:</p>

<pre><code>PS C:\&gt; icacls "C:\directory monitor\main\center\test\request"
C:\directory monitor\main\center\test\request PNIM\jmtzlilmi:(OI)(CI)(R,WD)
                                                PNIM\jmtzlilmi:(OI)(CI)(W,Rc)
                                                PNIM\jmtzlilmi:(OI)(CI)(R,WD)
                                                PNIM\jmtzlilmi:(OI)(CI)(W,Rc)
                                                BUILTIN\Administrators:(I)(F)
                                                BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                                NT AUTHORITY\SYSTEM:(I)(F)
                                                NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                                BUILTIN\Users:(I)(OI)(CI)(RX)
                                                NT AUTHORITY\Authenticated Users:(I)(M)
                                                NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
</code></pre>

<p>This is the output of icacls on the directory that I created within the automatically created folder, the one that has duplicate entries:</p>

<pre><code>PS C:\&gt; icacls "C:\directory monitor\main\center\test\request\test folder"
C:\directory monitor\main\center\test\request\test folder PNIM\jmtzlilmi:(OI)(CI)(R,WD)
                                                            PNIM\jmtzlilmi:(OI)(CI)(W,Rc)
                                                            PNIM\jmtzlilmi:(OI)(CI)(R,WD)
                                                            PNIM\jmtzlilmi:(OI)(CI)(W,Rc)
                                                            BUILTIN\Administrators:(F)
                                                            BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                                            NT AUTHORITY\SYSTEM:(F)
                                                            NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                                            BUILTIN\Users:(OI)(CI)(RX)
                                                            NT AUTHORITY\Authenticated Users:(M)
                                                            NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
</code></pre>

<p>The folder being monitored by the service is called center, the folder I created within is called test. The service then creates "request" within test, and I created "test folder" within request (yes, I'm brilliant at naming folders, I know. It's a bit more coherent in production.)</p>

<p>EDITED AGAIN:</p>

<p>Copied the wrong bit of code. I used AddAccessAllowedAceEx and NOT AddAccessAllowedAce. Many apologies...</p>

<p>So the problem here is in the win32security.SetFileSecurity() function. As per MSDN, this function is obsolete (see: <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa379577(v=vs.85).aspx" rel="nofollow">https://msdn.microsoft.com/en-us/library/windows/desktop/aa379577(v=vs.85).aspx</a>) and has been replaced by SetNamedSecurityInfo. I switched, and everything appears to work well. Thanks anyway! </p>

python windows file-permissions pywin32