Removing advanced ntfs permissions in powershell

Question

Hi,
I am trying to remove special permissions of a folder
I found a technet article that helps me understand the concept but couldn't get it to
work for special permissions. 
I am trying to remove create files special permissions for c:\temp
$colRights = [System.Security.AccessControl.FileSystemRights]"CreateFiles" 
$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::None 
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None 
$objType =[System.Security.AccessControl.AccessControlType]::Allow 
$objUser = New-Object System.Security.Principal.NTAccount("BUILTIN\Users") 
$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType) 
$objACL = Get-ACL "c:\temp" 
$objACL.RemoveAccessRule($objACE) 
Set-ACL "C:\temp" $objACL

Answer 1

Thank you for your time to explain and provide sample code
The cool thing about your code is no matter how many special permissions I give, it removes them all though I pass one right, like AppendData.
After running the code like
$acl = get-acl C:\temp
$rules=$acl.GetAccessRules($true,$true,[Security.Principal.NTAccount])|?{$_.IdentityReference -eq 'BUILTIN\Users'}
$rules|%{$acl.RemoveAccessRule($_)}
$newrules=$rules|Remove-AcePermission -FileSystemRight 'AppendData'
I run $acl | set-acl
Then it removes all the special permissions and keeps only the standard ones. Works as expected
But when I tried this for C:\, for some reason it didn't work as I get the error when I run Set-Acl
Set-Acl : The security identifier is not allowed to be the owner of this object.
At line:20 char:8
+ $Acl | Set-Acl
+        ~~~~~~~
    + CategoryInfo          : InvalidOperation: (C:\:String) [Set-Acl], InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.SetAclCommand
But the rule modification does work as expected like shown here:
Without special permissions:
PS C:\WINDOWS\system32> $rules
FileSystemRights  : ReadAndExecute, Synchronize
AccessControlType : Allow
IdentityReference : BUILTIN\Users
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None
With Special permissions CreateFiles and AppendData:
PS C:\WINDOWS\system32> $rules
FileSystemRights  : CreateFiles, AppendData, ReadAndExecute, Synchronize
AccessControlType : Allow
IdentityReference : BUILTIN\Users
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None
After using the code:
PS C:\WINDOWS\system32> $newrules
FileSystemRights  : CreateFiles, ReadAndExecute, Synchronize
AccessControlType : Allow
IdentityReference : BUILTIN\Users
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None
But only thing is that I couldn't set this new rule on C:\ ...
Am I missing anything while setting it on C:
I've seen that you did mention "The above makes some assumptions and is not designed to work with
all scenarios. "  But was wondering what I was missing