Best practices for auditing and bulk-remediating broken NTFS ACL inheritance post-migration

Question

Best practices for auditing and bulk-remediating broken NTFS ACL inheritance post-migration

Lin 20

Hi everyone,

We recently completed a large-scale file server migration, but we’re now observing widespread NTFS ACL corruption across the shared drive. Specifically, permission inheritance is behaving incorrectly on several nested directory levels, inadvertently exposing highly sensitive departmental folders to unauthorized domain users.

Given the sheer scale of this file share and the active production load, we want to avoid invasive, manual intervention. We are currently evaluating the safest, most non-disruptive method to audit the entire directory tree for these specific inheritance anomalies, followed by a controlled bulk-remediation of the ACLs.

If anyone has run into this post-migration headache before, I’d highly appreciate hearing what approach you took—whether you relied on robust PowerShell wrapper scripts using Get-Acl/Set-Acl, direct icacls execution, or specific enterprise-grade utility tools that can safely handle this at scale.

0 comments

1 answer

Your answer

Answer 1

Hi Lin

NTFS ACLs can get messy fast, especially with inheritance breaking at multiple nested levels. I think the safest way to tackle it at scale is to start with a full audit using Get-Acl in PowerShell, wrapped in a script that crawls the directory tree and flags where inheritance is disabled or misapplied. Once you’ve got that baseline, you can use icacls or Set-Acl to apply controlled fixes in bulk. I’d strongly recommend running the remediation in “report mode” first (icacls has a /verify option) so you can see what would change before actually committing.

For really large shares, some teams lean on enterprise tools like AccessChk or third‑party permission auditors, but honestly, a well‑written PowerShell wrapper is usually enough if you stage it carefully. The key is to avoid manual folder‑by‑folder edits automation ensures consistency and minimizes disruption. Also, don’t forget to snapshot or back up the ACLs before you touch them, so you’ve got a rollback path if something goes sideways.