Preserving file rights when copying a folder on Windows Server

The XCOPY command will copy permissions when the "/O" or "/X" switches are set. You can accomplish most simple file/folder/permission migrations just by doing:

XCOPY "source" "destination" /E /X /C /H /K

If you have deep folder hierarchies with long paths you'll need a "heavier duty" tool.

While you are asking for a script, I think that using the GUI to just recursively reset all filesystem permissions on a directory would be a much simpler approach if you just have a handful of directories to reset. The basic outline (stolen from a MSDN blog):

1. Launch an instance of Windows Explorer
2. Navigate to the parent of the folder that you want to reset permissions for
3. Right-click on the folder and choose Sharing and Security...
4. Click on the Security tab
5. Click the Advanced button
6. Set the permissions you want - typically you will want to allow Administrators, System, 7. and Creator Owner to have full control
7. Check the box labeled Replace permission entries on all child objects with entries shown here that apply to child objects
8. Click OK
9. Click Yes in the dialog box that appears asking if you are sure
10. Wait while Windows recursively applies the specified permissions to all sub-folders and files

The crucial part is obviously the checkbox to replace permission entries on all child objects:

Also, the idea of having folder permissions narrow down from more restrictive to less restrictive is always an excellent one from the system management standpoint - it is much easier to document and manage this way. However, your observation that

they will never gain appropriate access to the folder inside due to the resultant rule of most restrictive permissions being that they have no rights to parent folder

is inaccurate. Windows does not care about the parent directories when checking access controls. If your users would not click through \server -> \accounting -> document approval in Windows Explorer but simply type (or use a link opening) \\server\accounting\document approval you would see it magically open even when the permissions only allow access for the subdirectory. So don't let it give you a false sense of security, should you ever create such a setup deliberately.