Puppet ACL Deny

acl_deny.pp

file { ['c:/bob'
  ,'c:/bob/somedir'
  ,'c:/bob/somedir/grandchild']:
  ensure => directory,
}

file { ['c:/bob/file.txt'
  ,'c:/bob/somedir/filetoo.txt'
  ,'c:/bob/somedir/grandchild/anotherfile.txt']:
  ensure => file,
  content => 'yup',
}

acl { 'c:/bob':
  permissions => [
    { identity => 'SYSTEM', rights => ['read'], type=> 'deny'}, #, affects => 'self_and_direct_children_only'
    { identity => 'Administrators', rights=> ['full'] }
  ],
  inherit_parent_permissions => false,
  purge => true,
}