> how its inheritance worked

So I never worked with Novell, but I remember reading somewhere that child objects didn't contain a full ACL, so on every object load the FS tree would be walked and each parent ACL checked? Is that the case? So in direct contrast to the ntSecurityDescriptor storing the entire ACL on every object.

If so, with SSDs now, I can't see it being a massive performance problem nowadays no? I do certainly dislike sitting at the Windows ACL screen for 20 minutes while it goes through recursively to update child ACLs.