I would be very happy if we can get away without doing these by looking at Windows ACLs more closely :)