@echo off

set folder=TestFolder
mkdir %folder%

net localgroup foo /add /comment:"Foo Group"
net localgroup foo %USERNAME% /add

REM Workaround to get SID of foo group into variable:
for /f "delims=" %%i in ('psgetsid.exe foo ^| findstr /v "DONOTMATCHTHIS"') do @set trustee=%%i
for /f "delims=" %%i in ('psgetsid.exe %USERNAME% ^| findstr /v "DONOTMATCHTHIS"') do @set usersid=%%i

REM Prideleni prava cist opravneni
setacl.exe -on "%folder%" -ot file -actn ace -ace "n:%usersid%;p:read_dacl;s:y;i:np;m:grant;w:dacl"

REM Plna opravneni pro skupinu foo, odebrani zdedenych opravneni a vlastnictvi pro foo
setacl.exe -on "%folder%" -ot file -actn ace -ace "n:%trustee%;p:full;s:y;i:np;m:grant;w:dacl"
setacl.exe -on "%folder%" -ot file -actn setprot -op "dacl:p_nc;sacl:p_nc"
setacl.exe -on "%folder%" -ot file -actn setowner -ownr "n:%trustee%;s:y"

cls
echo Slozka vytvorena. Vratit zmeny?
pause
net localgroup foo %USERNAME% /delete
net localgroup foo /delete
setacl.exe -on "%folder%" -ot file -actn setowner -ownr "n:%usersid%;s:y"
setacl.exe -on "%folder%" -ot file -actn ace -ace "n:%usersid%;p:full;s:y;i:np;m:grant;w:dacl"
rmdir /Q %folder%
pause