Summary

Report NTFS ACEs without inheritance using the srs.current_ntfs_aces view, with an optional path-scoped variant.

Details

The srs.current_ntfs_aces view includes a field called ace_flags, which is a value mask.

If the bit with a value of 16 is set, the ACE is inherited. To filter out inherited ACEs, check that this bit is not set.

The “By Path” variant uses the Custom Query File System Paths feature. Paths are added or removed in the Report Designer rather than by modifying the query directly.

Code

SELECT * FROM srs.current_ntfs_aces WHERE ace_flags & 16 <> 16

By Path — SQL Server

SELECT *
FROM srs.current_ntfs_aces as ace
JOIN #tmp_cq_fs_paths as cp on cp.scan_id = ace.scan_id
	and cp.ns_left <= ace.ns_left
	and cp.ns_right >= ace.ns_right
WHERE ace.ace_flags & 16 <> 16

By Path — PostgreSQL

SELECT *
FROM srs.current_ntfs_aces as ace
JOIN tmp_cq_fs_paths as cp on cp.scan_id = ace.scan_id
	and cp.ns_left <= ace.ns_left
	and cp.ns_right >= ace.ns_right
WHERE ace.ace_flags & 16 <> 16