gistfile1.txt

irb(main):008:0> (Puppet::FileSystem.stat('c:/target.txt').mode & 0777).to_s(8)
=> "644"
irb(main):009:0> (Puppet::Util::Windows::Security.get_mode('c:/target.txt') & 0777).to_s(8)
=> "700"
...
irb(main):018:0> sd = Puppet::Util::Windows::Security.get_security_descriptor('c:/target.txt')
=> BUILTIN\Administrators
WIN-QP47VOHA2P4\None
  BUILTIN\Administrators:                       0x1f01ff
  NT AUTHORITY\SYSTEM:(I)                       0x1f01ff
  BUILTIN\Administrators:(I)                    0x1f01ff
  BUILTIN\Users:(I)                             0x1200a9
irb(main):019:0> puts sd.inspect
BUILTIN\Administrators
WIN-QP47VOHA2P4\None
  BUILTIN\Administrators:                       0x1f01ff
  NT AUTHORITY\SYSTEM:(I)                       0x1f01ff
  BUILTIN\Administrators:(I)                    0x1f01ff
  BUILTIN\Users:(I)                             0x1200a9
=> nil

It's too bad we don't have anything that pretty prints the 0x1f01ff ;0

For the sake of others looking at this, 0x1F01FF is equivalent to FILE_ALL_ACCESS

0x1200A9 is equal to

FILE_READ_DATA (file) or FILE_LIST_DIRECTORY (directory)
1 (0x1)

FILE_READ_EA
8 (0x8)

FILE_EXECUTE (file) or FILE_TRAVERSE (directory)
32 (0x20)

FILE_READ_ATTRIBUTES
128 (0x80)

READ_CONTROL
131072 (0x20000)

SYNCHRONIZE
1048576 (0x100000)