test: cover the GetInheritedFrom setting, deny entries and an empty DACL

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: AI Assistant <ai@example.com>

Tests/Access.Tests.ps1

@@ -953,6 +953,22 @@ Describe 'InheritedFrom of access entries' {
         $inherited[0].InheritedFrom | Should -Be $parent
     }
 
+    # The module setting GetInheritedFrom turns off the lookup of the sources, which costs a call for each item.
+    It 'Should leave InheritedFrom empty when the module setting GetInheritedFrom is off' {
+        $saved = $privateData['GetInheritedFrom']
+        $privateData['GetInheritedFrom'] = $false
+        try {
+            $result = @(Get-NTFSAccess -Path $inheritedFromFile -ErrorAction Stop)
+        }
+        finally {
+            $privateData['GetInheritedFrom'] = $saved
+        }
+
+        $inherited = @($result | Where-Object -FilterScript { $_.IsInherited })
+        $inherited | Should -Not -BeNullOrEmpty
+        $inherited | ForEach-Object -Process { $_.InheritedFrom | Should -BeNullOrEmpty }
+    }
+
     It 'Should read a security descriptor with audit entries and name the same folders' -Skip:(-not $holdsSecurityPrivilege) {
         $file = New-TestSandboxItem -Sandbox $sandbox -Name 'InheritedFromAudit'
         Add-NTFSAccess -Path $file -Account 'S-1-1-0' -AccessRights ReadData

Tests/Audit.Tests.ps1

@@ -511,7 +511,29 @@ Describe 'InheritedFrom of audit entries' {
         $inherited | Should -HaveCount 1
         $inherited[0].InheritedFrom | Should -Be $folder
     }
+
+    # The module setting GetInheritedFrom turns off the lookup of the sources, which costs a call for each item.
+    It 'Should leave InheritedFrom empty when the module setting GetInheritedFrom is off' -Skip:(-not $canReadAudit) {
+        $folder = New-TestSandboxItem -Sandbox $sandbox -Name 'InheritedFromOff' -Directory
+        Add-NTFSAudit -Path $folder -Account 'S-1-1-0' -AccessRights ReadData -InheritanceFlags 'ContainerInherit, ObjectInherit' -PropagationFlags None
+        $file = Join-Path -Path $folder -ChildPath 'File.txt'
+        Assert-TestSandboxPath -Sandbox $sandbox -Path $file
+        Set-Content -LiteralPath $file -Value 'File'
+        $saved = $privateData['GetInheritedFrom']
+        $privateData['GetInheritedFrom'] = $false
+        try {
+            $result = @(Get-NTFSAudit -Path $file -ErrorAction Stop)
+        }
+        finally {
+            $privateData['GetInheritedFrom'] = $saved
+        }
+
+        $inherited = @($result | Where-Object -FilterScript { $_.IsInherited })
+        $inherited | Should -HaveCount 1
+        $inherited[0].InheritedFrom | Should -BeNullOrEmpty
+    }
 }
+
 Describe 'Audit changes with the Security privilege disabled' {
     BeforeAll {
         $holdsSecurityForOperations = Test-PrivilegeHeld -Name 'SeSecurityPrivilege'

Tests/ObjectApis.Tests.ps1

@@ -395,6 +395,35 @@ Describe 'Access rule helpers that take a path' {
         @(Get-ExplicitEntries -Path $path -Account 'S-1-5-32-545') | Should -HaveCount 1
     }
 
+    It 'Should add and remove a deny entry by its path without adding Synchronize' {
+        $path = New-TestSandboxItem -Sandbox $sandbox -Name 'DenyByPath'
+        $deny = [System.Security.AccessControl.AccessControlType]::Deny
+
+        [void] [Security2.FileSystemAccessRule2]::AddFileSystemAccessRule(
+            $path, $identity, [Security2.FileSystemRights2]::ReadData, $deny, $noInheritance, $noPropagation
+        )
+
+        $entries = @(Get-ExplicitEntries -Path $path)
+        $entries | Should -HaveCount 1
+        $entries[0].AccessControlType | Should -Be 'Deny'
+        $entries[0].FileSystemRights | Should -Be ([System.Security.AccessControl.FileSystemRights]::ReadData)
+
+        [Security2.FileSystemAccessRule2]::RemoveFileSystemAccessRule(
+            $path, $identity, [Security2.FileSystemRights2]::ReadData, $deny, $noInheritance, $noPropagation
+        )
+
+        @(Get-ExplicitEntries -Path $path) | Should -BeNullOrEmpty
+    }
+
+    It 'Should return no entries for an empty DACL when the sources of inherited entries are requested' {
+        $path = New-TestSandboxItem -Sandbox $sandbox -Name 'EmptyDacl'
+        Clear-NTFSAccess -Path $path -DisableInheritance -ErrorAction Stop
+
+        $rules = @([Security2.FileSystemAccessRule2]::GetFileSystemAccessRules($path, $true, $true, $true))
+
+        $rules | Should -BeNullOrEmpty
+    }
+
     It 'Should add the entry of a rule that carries its path' {
         $path = New-TestSandboxItem -Sandbox $sandbox -Name 'AddRule'
         $raw = New-Object -TypeName 'System.Security.AccessControl.FileSystemAccessRule' -ArgumentList (