The Administrators group entry should show as being inherited from the Test folder.

 cls  
 $StartingDir = 'c:\temp\PermTest'   
 $usrs = 'NT AUTHORITY\Authenticated Users'  
   
 remove-item $StartingDir -Recurse  
 md "$StartingDir\New Folder1" | Out-Null  
 md "$StartingDir\New Folder2" | Out-Null  
  
 md "$StartingDir\New Folder1\userdata" | Out-Null  
 md "$StartingDir\New Folder2\userdata" | Out-Null  
      
 icacls.exe $StartingDir  /reset /t  
 icacls.exe $StartingDir   /grant "$($usrs):(CI)(RX)" /grant "BUILTIN\Administrators:(OI)(CI)(F)" /inheritance:r   
   
   
 Get-ChildItem -Path $StartingDir | foreach {  
    "Processing {0}" -f $_.fullname  
    icacls.exe $_.fullname   /grant "$($usrs):(OI)(CI)(M)"  
   
 }  
 ""  
 "icacls.exe $StartingDir"  
 icacls.exe $StartingDir    
 ""  
 "icacls.exe ""$StartingDir\New Folder1"""  
 icacls.exe "$StartingDir\New Folder1"  
  

--------------------------------------------------------

remove-item : Cannot find path 'C:\temp\PermTest' because it does not exist.  
At line:5 char:2  
+  remove-item $StartingDir -Recurse  
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
    + CategoryInfo          : ObjectNotFound: (C:\temp\PermTest:String) [Remove-Item], ItemNotFoundException  
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.RemoveItemCommand  
   
processed file: c:\temp\PermTest  
processed file: c:\temp\PermTest\New Folder1  
processed file: c:\temp\PermTest\New Folder2  
processed file: c:\temp\PermTest\New Folder1\userdata  
processed file: c:\temp\PermTest\New Folder2\userdata  
Successfully processed 5 files; Failed processing 0 files  
processed file: c:\temp\PermTest  
Successfully processed 1 files; Failed processing 0 files  
Processing C:\temp\PermTest\New Folder1  
processed file: C:\temp\PermTest\New Folder1  
Successfully processed 1 files; Failed processing 0 files  
Processing C:\temp\PermTest\New Folder2  
processed file: C:\temp\PermTest\New Folder2  
Successfully processed 1 files; Failed processing 0 files  
  
icacls.exe c:\temp\PermTest  
c:\temp\PermTest NT AUTHORITY\Authenticated Users:(CI)(RX)  
                 BUILTIN\Administrators:(OI)(CI)(F)  
  
Successfully processed 1 files; Failed processing 0 files  
  
icacls.exe "c:\temp\PermTest\New Folder1"  
c:\temp\PermTest\New Folder1 NT AUTHORITY\Authenticated Users:(OI)(CI)(M)  
                             NT AUTHORITY\Authenticated Users:(I)(CI)(RX)  
                             BUILTIN\Administrators:(I)(OI)(CI)(F)  
  
Successfully processed 1 files; Failed processing 0 files  
  
PS C:\Temp>   

In the above output, note the 2 ACLs on the PermTest folder and the 3 ACLs on the New Folder1.

If you create a New Folder3 after you run the script, you will be missing the Modify ACL but you will still get the inherited ACLs.

Effective access should look like this.

Ok, how about this?

$StartingDir = 'c:\temp\PermTest' 
 $usrs = 'NT AUTHORITY\Authenticated Users'

 icacls.exe $StartingDir  /reset /t
 icacls.exe $StartingDir   /grant "$($usrs):(CI)(RX)" /grant "BUILTIN\Administrators:(OI)(CI)(F)" /inheritance:r 


 Get-ChildItem -Path $StartingDir | foreach {
    icacls.exe $_.fullname   /grant "$($usrs):(OI)(CI)(M)"

 }

Hi @MotoX80

thanks for the response. I tried your script, but it still does not do what I want.
what I am trying to achieve, is example

Main folder DATA. read access to this folder. Then the subfolders, will
Folder 1
Folder 2
Folder 3
Folder 4
Folder 5, so on,

Users can access the folders only, and within the folders, they have, Modify access;

So when a user accesses the Data folder they cant delete, move, add, or change the folders. Only the users will fill rights can...

what, you have does not allow the user to delete the folders in the subfolders when you create them, it created multiple folders at once.

cheers

I don't like using deny ACL's. I've always thought it best to use grant's. Try this and see if it works for you.

Replace authenticated users with your ___domain group if that works better for you.

$StartingDir = 'c:\temp\PermTest' 
$usrs = 'NT AUTHORITY\Authenticated Users'

# If the permissions are all messed up, uncomment this takeown command 
#takeown.exe /d Y /a /r /f $StartingDir 

icacls.exe $StartingDir  /reset /t
icacls.exe $StartingDir  /grant "$($usrs):(OI)(IO)(F)" /grant "$($usrs):(CI)(RX,WD,AD)" /grant "BUILTIN\Administrators:(OI)(CI)(F)" /inheritance:r 
icacls.exe $StartingDir  /verify /t