---
title: Explanation of the TreeSecInfoAction options when setting permissions using File
slug: explanation-of-the-treesecinfoaction-options-when-setting-permissions-using-file
createdAt: 2025-06-11T20:26:20.406Z
---

Out of the box, Activate uses the [FileUtilities](https://activate.activatelive.com/Activate/api/html/T_Innovation_Activate_Utilities_FileUtilities.htm).SetDirectoryACLEx method to set permissions when applying security to NTFS Folders.

SetDirectoryACLEx(*path*, *accessControlList, action*)

When SetDirectoryACLEx is run against a target folder that has existing permissions defined:

- the *accessControlList* parameter defines what happens to existing permissions defined directly on the target folder.
  e.g.
  - Prefixing with “-all;” overwrites any existing permissions and blocks inheritance
  - No prefix “adds” the specific permissions to the folder ACL and does not block inheritance
- The optional *action *parameter defines the changes that Activate will make to sub-folders that have permissions explicitly defined or inheritance disabled.
  The *action* parameter is a TreeSecInfoAction enumeration, the values for which are:

|                  |           |                                                               |                                    |
| --------------------- | --------- | ------------------------------------------------------------- | ---------------------------------- |
| **Member name**       | **Value** | **Description**                                               | Action                             |
| **Set**               | 1         | An enum constant representing the set option.                 | Adds new permissions to folders:   |
| **Reset**             | 2         | An enum constant representing the reset option.               | Overwrites existing permissions:   |
| **ResetKeepExplicit** | 3         | An enum constant representing the reset keep explicit option. | A combination of the previous two: |

- Existing ACEs are not removed.
- Inheritance is not re-enabled.
- Existing ACEs are removed. 
- Inheritance is re-enabled.
- Existing ACEs are not removed.
- Inheritance is re-enabled.

 

## Example

When SetDirectoryACLEx is used against the folder structure

|               |                                                                            |
| ------------------ | -------------------------------------------------------------------------- |
| **Folder name**    | **Description**                                                            |
| **Additional ACE** | Has a permission defined explicitly on the folder to grant a group access. |
| **No inheritance** | Has inheritance blocked and a new set of permissions defined.              |
| **Same as Test1**  | Only permissions inherited from Test1 apply.                               |

 The results of the TreeSecInfoAction options are:

1.  Sets permissions on the folder supplied in *path* without altering existing ACES on sub-folders.
   The default if *action *is not specified.
   - Additional ACE; The permission granting access to the group remains set.
   - No inheritance; No change, i.e. inheritance is blocked and a new set of permissions defined.
   - Same as Test1; No change, i.e. Only permissions inherited from Test1 apply.
2.  Sets permissions on the folder supplied in *path *and resets all permissions on sub-folders, including re-enabling inheritance.
   - Additional ACE; The permission granting access to the group is removed and only permissions inherited from Test1 apply.
   - No inheritance; Inheritance is re-enabled and only permissions inherited from Test1 apply.
   - Same as Test1; No change, i.e. Only permissions inherited from Test1 apply.
3.  Sets permissions on the folder supplied in *path*, re-enables inheritance on sub-folders, DOES NOT remove existing ACEs from sub-folders.
   - Additional ACE; The permission granting access to the group remains set.
   - No inheritance; Inheritance is re-enabled and only permissions inherited from Test1 apply.
   - Same as Test1; No change, i.e. Only permissions inherited from Test1 apply.