Trying to prevent a security group from applying to other folders/files

Question

I'm trying to make it so that $ADNameRO and $ADNameRW (that I've created below) don't get applied to folders below it but let the rest of the permissions be inherited.

I've tried to change the propagation flag for those two strings so that it only applied to the Folder and Files that it is added to, but it still get's added to the sub files and folders...

I thought that I might need to change the InheritanceFlags to Object for both of those strings, but when I changed that manually (through Windows GUI) it didn't seem to work correctly...

Any help with this would be appreciated.

function New-Ace {
  [CmdletBinding()]
  Param(
    [Parameter(Mandatory=$true, Position=0)]
    [Security.Principal.NTAccount]$Account,
    [Parameter(Mandatory=$false, Position=1)]
    [Security.AccessControl.FileSystemRights]$Permissions = 'ReadAndExecute',
    [Parameter(Mandatory=$false, Position=2)]
    [Security.AccessControl.InheritanceFlags]$InheritanceFlags = 'ContainerInherit,ObjectInherit',
    [Parameter(Mandatory=$false, Position=3)]
    [Security.AccessControl.PropagationFlags]$PropagationFlags = 'None',
    [Parameter(Mandatory=$false, Position=4)]
    [Security.AccessControl.AccessControlType]$Type = 'Allow'
  )

  New-Object Security.AccessControl.FileSystemAccessRule(
    $Account, $Permissions, $InheritanceFlags, $PropagationFlags, $Type
  )
}

$domain = 'ESG.INTL'
$administrators = ([wmi]"Win32_Sid.Sid='S-1-5-32-544'").AccountName
$ADDomainUsers = "$domain\Domain Users"

$acl = Get-Acl $path

$administrators, "$domain\Domain Admins" | ForEach-Object {
  $acl.AddAccessRule((New-Ace $_ 'FullControl'))
}
$acl.AddAccessRule((New-Ace $ADNameRW 'Modify'))
$acl.AddAccessRule((New-Ace $ADNameRO 'ReadAndExecute'))
$acl.AddAccessRule((New-Ace $ADDomainUsers 'ReadAndExecute'))

Answer 1

Setting access permissions to folders and files without inheritance requires two ACEs: one for "this folder only" and one for "files only". For the former set both inheritance and propagation flags to None , for the latter set inheritance flags to ObjectInherit and propagation flags to InheritOnly :

$acl.AddAccessRule((New-Ace $ADNameRW 'Modify' 'None'))
$acl.AddAccessRule((New-Ace $ADNameRW 'Modify' 'ObjectInherit' 'InheritOnly'))
$acl.AddAccessRule((New-Ace $ADNameRO 'ReadAndExecute' 'None'))
$acl.AddAccessRule((New-Ace $ADNameRO 'ReadAndExecute' 'ObjectInherit' 'InheritOnly'))