Partially address #7385

Here is one option.

This does not fully work on Windows - ACLs are ignored - but is no worse than the current situation.