Subinacl.exe to grant and deny

Hello

We are using SMS 2003 to deploy Office 2000 to a standard group of users who
do not have rights to access C:\Windows. This poses a problem when trying to
create Org Charts within Powerpoint 2000. Microsoft has listed this as a
problem and a solution to fix it here.

http://support.microsoft.com/defaul...b;EN-US;Q218571

There are two files that I need to script permissions too. I cannot use
xcopy because when I refresh SMS and it copies these files out to all
distribution points the rights that I create from the source location are
lost. With that said I would like to use a tool called subinacl.exe. I need
to give the BUILTIN\Users group Read,Write, and Execute rights, but deny
delete rights in the special permissions box. I cannot seem to get it to
work. Here's my command line:

subinacl /outputlog=c:\subinacl.txt /file %windir%\mso*.232
/grant=BUILTIN\Users=xew /deny=BUILTIN\Users=D

Notice that my /deny switch is last, this does work, but removes my (xew)
line. I think you can only do one at a time so I split the code up into two
lines and that still did not work. I cannot get this to create "Access" and
"Deny".

Xcacls.exe, cacls.exe, and xcacls.vbs also don't seem to work. Any
thoughts???