Windows Server / File Services, Storage & Backup
Investigate unexpected NTFS access after a folder move
A moved or restored folder can have explicit or inherited entries that differ from its intended parent. Inspect its ACL rather than replacing it wholesale.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-Acl -LiteralPath 'D:\Shares\Department' | Format-List Owner, AreAccessRulesProtected, AccessToStringRead the result
The PowerShell output shows ownership, inheritance protection and a readable access-rule summary. It is not a complete effective-access calculation for every group combination.
Resolve and verify
Compare the folder and intended parent's approved ACL design, including denies and service identities. Correct only the demonstrated inheritance or entry problem and test representative access.
Before changing production
Do not recursively reset permissions across a file server without a reviewed recovery and impact plan.