How are you changing the permissions?  If it's anything in the base then that folder will get "pulled" out of the layer to the base, this is the same behavior as editing a text file in a layer with notepad.

If there's a specific GUI tool you're using, that isn't explorer, run it from the layer (right-click on the layer and select run from layer) if it's a command line tool run cmd.exe from the layer and then call the tool.

Am changing the permissions through explorer. Right click the folder -> Properties -> Security tab.

Not sure what you mean by "anything in the base". Do you mean the base layer...? 

How do I self-contain the permissions w/in the layer? Or is it by design that the folder gets pulled out after any modifications to the layer? 

makes changes to a layer, the changes "fall out" of the layer onto / into the Base. There are two ways around this, the one that jordan suggested, or by making the permission changes to the RO layers redirection area on importing.

Cheers

Phil

Runing cacls.exe w/in the layer

Works. Now the folder disappears when the layer is disabled. Check MSFT's documentation on cacls for more specific info.

Thanks guys!

in SWV terminology base means non-virtualized apps, OS and so on.

When ever something is changed by something in the base then those changes get saved in the base and not in the virtual layer.

To make changes to permissions in the layer you can try flagging the layer for "Keep Changes in Layer" but I don't know if that will work with ACLs.

The other method is what I mentioned in my previous post.

Edit: Phil beat me too it, that's what I get for half typing a response before going into a meeting.