Some folders in a DFS Replication tree have incorrectly ordered NTFS permissions. The Security dialog can reorder them, but there are too many folders to check manually and I don't know which ones are affected.
icacls /verify can't reliably traverse the whole tree, and saving and restoring an ACL didn't fix a test folder. Is there a way to scan and reorder the existing entries without replacing them with inherited permissions?
For finding candidates, PowerShell's Get-Acl exposes AreAccessRulesCanonical. Enumerate the tree, check that property on each item's ACL, and record the paths where it is false.
Don't silently ignore errors, though. Enumeration or Get-Acl can fail on inaccessible paths, so keep a separate list of failures and treat those parts of the scan as incomplete. This identifies candidates, not a fix by itself.
Have a look at repacls as a possible bulk repair tool. Check its documentation and test it on a copy of an affected folder first. Confirm what it changes and compare the ACL, owner, and inheritance settings before and after. The recommendation alone doesn't establish that it will reproduce the Security dialog's behavior in every case.
A custom PowerShell or C# tool using Windows security APIs is another option if the available tools don't do the right thing. The difficult part is safely reading and rewriting the existing security descriptor, not just walking the tree.
Test against representative affected folders and retain a restorable backup before making changes. Also check effective access: changing ACE order can change how access is evaluated, so preserving every entry doesn't automatically guarantee identical access.
icacls is worth keeping around for verification and backups, but your tests already show its limits here. A save and restore is not necessarily a reorder, and a scan with traversal errors can't prove the rest of the tree is clean.
Answers are reviewed before publication.
u34+paperweight_6:
That sounds useful for scoping it. The inaccessible paths are the tricky part, so I'd need to account for those separately.