subinacl /service W3SVC /display subinacl /service W3SVC /grant=NT AUTHORITY\SYSTEM=F subinacl /service W3SVC /grant=Administrators=F | SubInACL | Newer Alternative | |----------|-------------------| | No longer actively updated | icacls (for files/folders – built into Windows) | | Slower on thousands of objects | Set-Acl in PowerShell (more flexible) | | Works on services, registry, printers | sc sdset (services), regini (registry) |