SetACL.exe 0.904 中文帮助:

示例:
SetACL.exe E:\WxDesktop /dir /set everyone /read_ex

               设置E:\wxDesktop 文件夹 everyone 用户为读取和运行权限
           
SetACL.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run _
               /registry /set everyone /full

               设置注册表键值Run 为完全控制权限

------------------------------------------------------------------------------           

SetACL.exe 0.904 中文帮助:

用法：SetACL.exe <object name> <object type> <action> <trustee> <permissions>
                     [/i:<inheritance>] [/p:<inh. from parent>] [/r:<recursion>]
                     [/sid] [/silent]

注意：<> 中的参数是必需的,[] 中的参数是可选
==============================================================================

<object name>       = 任意本地或远程对象的有效路径

------------------------------------------------------------------------------

<object type>       = 对象类型,以下任意参数:
                        /file             文件
                        /dir              目录
                        /printer          打印机
                        /registry         注册表
                        /service          服务
                        /share            共享
                  
------------------------------------------------------------------------------

<action>            = 操作,以下任意参数
                        /deny             拒绝指定用户的访问
                        /grant            赋予指定用户的访问权限
                        /set              设置指定用户的访问权限
                        /revoke           撤销指定用户的访问权限
                    
------------------------------------------------------------------------------

<trustee>           = 用户

------------------------------------------------------------------------------

<permissions>       = 权限,以下任意参数

          /file           = 文件对象的可用参数:
                          /read                      读取
                          /write                     写入
                          /read_ex                   读取和运行
                          /change                    修改
                          /full                      完全控制
                      
                          以下为特别的权限:
                          /traverse  
                          /list_dir                  读取数据
                          /read_attributes           读取属性
                          /read_ea                   读取扩展属性
                          /add_file                  写入数据
                          /add_subdir            
                          /write_attributes          写入属性
                          /write_ea                  写入扩展属性
                          /delete_child          
                          /delete                    删除
                          /read_dacl                 记取权限
                          /write_dacl                写入权限
                          /write_owner               取得所有权

          ........................................................................
      
          /dir            = 目录对象的可用参数:
                          /read                      读取
                          /write                     写入
                          /list_folder               列出文件夹目录
                          /read_ex                   读取和运行
                          /change                    修改
                          /full                      完全控制
                      
                          以下为特别的权限:
                          /traverse  
                          /list_dir                  读取数据
                          /read_attributes           读取属性
                          /read_ea                   读取扩展属性
                          /add_file                  写入数据
                          /add_subdir            
                          /write_attributes          写入属性
                          /write_ea                  写入扩展属性
                          /delete_child          
                          /delete                    删除
                          /read_dacl                 记取权限
                          /write_dacl                写入权限
                          /write_owner               取得所有权
                      
          ........................................................................
      
          /printer        = 打印机对象的可用参数:
                          /print                     打印
                          /man_printer               管理打印机
                          /man_docs                  管理文档
                          /full                      完全控制
                      
          ........................................................................
      
          /registry       = 注册表对象的可用参数:
                          /read                      读取
                          /full                      完全控制
                      
                          以下为特别的权限
                          /query_val                 查询数值
                          /set_val                   设置数值
                          /create_subkey             创建子项
                          /enum_subkeys              枚举子项
                          /notify                    通知
                          /create_link               创建链接
                          /delete                    删除
                          /write_dacl                写入 DAC
                          /write_owner               写入所有者
                          /read_access               读取控制
                      
          ........................................................................
      
          /service        = 服务对象的可用参数
                          {/read | /start_stop | /full}
                      
          ........................................................................
      
          /share          = 共享对象的可用参数
                          /read                      读取
                          /change                    更改
                          /full                      完全控制
                      
------------------------------------------------------------------------------
原英文帮助:

SetACL.exe 0.904       by Helge Klein             www.helge.mynetcologne.de/setacl

Usage: SetACL.exe <object name> <object type> <action> <trustee> <permissions>
                      [/i:<inheritance>] [/p:<inh. from parent>] [/r:<recursion>]
                      [/sid] [/silent]

==============================================================================

<object name>       = Any valid path to local or remote object

------------------------------------------------------------------------------

<object type>       = {/file | /dir | /printer | /registry | /service | /share |
                       /ds_obj | /ds_obj_all}

------------------------------------------------------------------------------

<action>            = {/deny | /grant | /set | /revoke}

------------------------------------------------------------------------------

<trustee>           = User/group to grant/deny permissions for, ie. 'machine\user'

------------------------------------------------------------------------------

<permissions>

          /file           = {/read | /write | /read_ex | /change | /full | /traverse |
                         /list_dir | /read_attributes | /read_ea | /add_file |
                         /add_subdir | /write_attributes | /write_ea |
                         /delete_child | /delete | /read_dacl | /write_dacl |
                         /write_owner}

          ........................................................................

          /dir            = {/read | /write | /list_folder | /read_ex | /change |
                         /profile | /full | /traverse | /list_dir |
                         /read_attributes | /read_ea | /add_file | /add_subdir |
                         /write_attributes | /write_ea | /delete_child |/delete |
                         /read_dacl | /write_dacl | /write_owner}

          ........................................................................

          /printer        = {/print | /man_printer | /man_docs | /full}

          ........................................................................

          /registry       = {/read | /full | /query_val | /set_val | /create_subkey |
                         /enum_subkeys | /notify | /create_link | /delete |
                         /write_dacl | /write_owner | /read_access}

          ........................................................................

          /service        = {/read | /start_stop | /full}

          ........................................................................

          /share          = {/read | /change | /full}

------------------------------------------------------------------------------

<inheritance>      = {cont_obj_inh | cont_inh | obj_inh | no_prop_inh |
                      inh_only_obj | inh_only_cont | inh_only_cont_obj}

------------------------------------------------------------------------------

<inh. from parent>
                   = {yes | no_copy | no_dont_copy}

------------------------------------------------------------------------------

<recursion>        = {cont_obj | cont | obj}

(Only for reg keys and directories) Walk down the tree and set permissions on
every key, directory and every file {cont_obj}, on every key and directory
{cont}, or on every file {obj}. Only needed on NT4 and in special cases.

------------------------------------------------------------------------------

/sid               : <trustee> parameter is a SID, not an account/group name.
                     Well-known SIDs can be used.

------------------------------------------------------------------------------

/silent            : No output whatsoever is displayed if the number of
                     parameters passed is correct.

==============================================================================

If not specified, inheritance is always set to values which suit the cause.
Using your own settings can result in undesired permissions. Beware!

Also, 'inherit from parent' is set to 'yes' if not specified.