Give users access to read non-inherited folder permissions

If you have a Windows folder structure with many non-inherited folders, it may be necessary to give a group of users access to read permissions only, to meet requirements from help desk or staff monitoring compliance. Assuming that you have administrator access to the Windows computer, the Powershell-based recipe below may help you:

Pre-work:

• Download Powershell module NTFSSecurity 
• Install files in %USERPROFILE%\Documents\WindowsPowershell\Modules\NTFSSecurity
• Unblock each file in the directory above (Right click --> Properties)
• Create a domain group to manage users which will have the permissions (GRP-ReadPermissions in our example)

• Start Powershell as administrator
• Assign your user privileges to be able to perform operations on all files even if your user don't have access (backup+restore+security)

Enable-Privileges

• You may consider to log the state before the operation:

Get-ChildItem -Path root-folder  -Dir -Recurse | Get-NTFSAccess -ExcludeInherited > log-file-before.txt

Get-ChildItem -Path root-folder -Dir -Recurse | Get-NTFSAccess -ExcludeInherited | Add-NTFSAccess -Account GRP-ReadPermissions -AccessRights ListDirectory,ReadPermissions

Get-ChildItem -Path root-folder -Dir -Recurse | Get-NTFSAccess -ExcludeInherited > log-file-after.txt

Disable-Privileges