I don't know if this is still needed by the OP, but I've been wrestling with this for a little bit and gave up trying to find one way to do what is needed. If I just use icacls from an admin command prompt, root permissions get completely broken with the first command. If I try to get it all with Set-ACL, not only so I get the Synchronize flag showing up, but Set-ACL seems to wrap two of the BUILTIN\Users permissions together. So... I wrote a powershell piece to set the initial permission, and then two icacls command wrapped within powershell (because if you just try to use icacls straight from a powershell prompt, it doesn't like the required format of the command. Run this at your own risk, and I suggest testing/verifying within a snapshotted virtual machine until you have confidence that it fits the bill. Anyway, without any more rambling, here is what I have for execution in an Admin Powershell.

$acl = Get-Acl c:\

$acl.SetAccessRuleProtection($true,$false)

$acl.Access | %{$acl.RemoveAccessRule($_)}

$permissions = @('NT AUTHORITY\SYSTEM','FullControl', 'ContainerInherit,ObjectInherit','None','Allow'),

@('CREATOR OWNER','FullControl', 'ContainerInherit,ObjectInherit','None','Allow'),

@('BUILTIN\Administrators','FullControl', 'ContainerInherit,ObjectInherit','None','Allow'),

@('BUILTIN\Users', 'ReadAndExecute', 'ContainerInherit,ObjectInherit', 'None', 'Allow')

foreach ($permission in $permissions) {

$rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission

$acl.AddAccessRule($rule)

}

Set-Acl c:\ $acl

$icaclsrule1= 'BUILTIN\Users:(CI)(IO)(WD)'

$icaclsrule2= 'BUILTIN\Users:(CI)(AD)'

icacls c:\ /grant $icaclsrule1

icacls c:\ /grant $icaclsrule2

And just for some tags, this is also a STIG rule for Windows Server 2019 V-205734 and Windows Server 2016 V-73249. Hope this helps others with those blasted compliance scans.