On Windows, use well-known SIDs to set ownership

This is per the recommendation of Josh Cooper. We want to ensure that
non-privileged users don't have access to the directory. This should be
the rough equivalent of setting owner=root group=root on Unix.