Odd PowerShell Get-ACL permission translations -

i have powershell script matches get-acl access control entries standard windows permissions using access mask. oddly, aces "readandexecute, synchronize" seem yield permission of "fullcontrol". here script:

 #match current ace permissions regular permissions via access mask comparison (binary , / -band)     $acl = get-acl "c:\program files (x86)"                  $accesses = $acl.access     #enumerate current directory's access rights     foreach ($access in $accesses) {             $enumeration = $access.filesystemrights             $keys = @()             [system.enum]::getvalues($enumeration.gettype()) | where-object { $enumeration -band $_; write-host ($enumeration -band $_) -foregroundcolor red} | % {write-host -foregroundcolor green $_;} | select-object -unique | foreach-object { write-host -foregroundcolor cyan $_; $keys += $_ }                          $keys     } 

perhaps not understand how appropriately translate these access control entries. seems odd me "modify, synchronize" somehow end in permission setting of "fullcontrol".

also, if script run on own system note rather messy debug format portrays. "0"'s non-matching results binary "and". green values resultant windows permissions aces had matching access masks specified windows permission (supposedly).

i hope not repeating question; i've dug , haven't found answer explains me @ current level of understanding.

i have credit petseral giving me comment led answer. it's been 2 days , has not provided comment in answer form self answer.

the odd results seeing result of "collision" speak between binary "and" operation intended validate permission , permission type being tested against.

the initial value (permission) cannot directly compared permission type being checked objects apparently incompatible. running binary , on permission value , value being tested can checked see if tested value permission being checked for. reason binary , operation results in object can directly tested.

after binary , has been completed result needs compared permission type passed binary "and" operator. here modified code:

 #match current ace permissions regular permissions via access mask comparison (binary , / -band)     $acl = get-acl "c:\program files (x86)"                  $accesses = $acl.access     #enumerate current directory's access rights     foreach ($access in $accesses) {             $enumeration = $access.filesystemrights             $keys = @()             [system.enum]::getvalues($enumeration.gettype()) | where-object { ($enumeration -band $_) -eq $_; write-host ($enumeration -band $_) -foregroundcolor red} | % {write-host -foregroundcolor green $_;} | select-object -unique | foreach-object { write-host -foregroundcolor cyan $_; $keys += $_ }                             $keys     } 

this comparison verify resultant permission value being checked , type being checked against represent value being checked , not collision of binary values resulting in different permission altogether.

for example, "readandexecute, modify" when represented $enumeration & anded "fullcontrol" result in "readandexecute, modify" - collision. while "readandexecute, modify" permission valid, check see whether or not binary , result in "fullcontrol". second check verify result "fullcontrol" , not other valid permission type. inability compare without "-band" operation leads addition of -eq $_ in line where-object { ($enumeration -band $_) -eq $_ }