I appear to be doing something wrong for this Icacls command icacls c:\Test\ /Grant "Domain\SecurityGroup":(OI)(CI)(M,X,DC) /T /C to add a security group. When I run it appears twice in the security permissions of all the subfolders and files. One entry properly shows the group with modify rights inherited from the parent folder. Then second entry, which I do not want has the same permissions but is not inherited. I am sure it is something small I am overlooking.