OK, I think I may have found your solution. Here's a new function that gets a Dacl containing all aces, including the inherited ones: Func _GetObjectDaclIncludeInherit($oName, $_SE_OBJECT_TYPE = $SE_FILE_OBJECT) Local $sSD = _GetObjectStringSecurityDescriptor($oName,$_SE_OBJECT_TYPE ) $sSD = StringReplace($sSD,'ID;',';') Local $pSD = _ConvertStringSecurityDescriptorToSecurityDescriptor($sSD) Return _GetSecurityDescriptorDacl($pSD) EndFunc ;==> _GetObjectDaclIncludeInherit Now, an import