编写程序，创建了一个C:\MyDir的目录，并设置了下面的ACE： Guests（拒绝访问） SYSTEM（完全控制） Adminstor（完全控制） Interactive Users（读、写和执行） 创建者（完全控制） 备份者（只读）

以下是一个示例代码，它会创建一个目录 C:\MyDir，并为该目录添加指定的访问控制项：

#include <windows.h>
#include <stdio.h>
#include <aclapi.h>

int main() {
    DWORD dwRes;
    PACL pDacl = NULL;
    PSECURITY_DESCRIPTOR pSD = NULL;
    SECURITY_ATTRIBUTES sa = {0};
    EXPLICIT_ACCESS ea[6];
    SID_IDENTIFIER_AUTHORITY sidAuth = SECURITY_NT_AUTHORITY;
    PSID pGuestSid = NULL, pSystemSid = NULL, pAdminSid = NULL, pInteractiveSid = NULL, pCreatorSid = NULL, pBackupSid = NULL;

    // 创建 SID
    if (!AllocateAndInitializeSid(&sidAuth, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pGuestSid)) {
        printf("AllocateAndInitializeSid error: %u\n", GetLastError());
        goto cleanup;
    }

    if (!AllocateAndInitializeSid(&sidAuth, 1, SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0, &pSystemSid)) {
        printf("AllocateAndInitializeSid error: %u\n", GetLastError());
        goto cleanup;
    }

    if (!AllocateAndInitializeSid(&sidAuth, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &pAdminSid)) {
        printf("AllocateAndInitializeSid error: %u\n", GetLastError());
        goto cleanup;
    }

    if (!AllocateAndInitializeSid(&sidAuth, 1, SECURITY_INTERACTIVE_RID, 0, 0, 0, 0, 0, 0, 0, &pInteractiveSid)) {
        printf("AllocateAndInitializeSid error: %u\n", GetLastError());
        goto cleanup;
    }

    if (!AllocateAndInitializeSid(&sidAuth, 1, SECURITY_CREATOR_OWNER_RID, 0, 0, 0, 0, 0, 0, 0, &pCreatorSid)) {
        printf("AllocateAndInitializeSid error: %u\n", GetLastError());
        goto cleanup;
    }

    if (!AllocateAndInitializeSid(&sidAuth, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_BACKUP_OPS, 0, 0, 0, 0, 0, 0, &pBackupSid)) {
        printf("AllocateAndInitializeSid error: %u\n", GetLastError());
        goto cleanup;
    }

    // 初始化访问控制项
    ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS) * 6);
    ea[0].grfAccessPermissions = GENERIC_READ | GENERIC_EXECUTE;
    ea[0].grfAccessMode = DENY_ACCESS;
    ea[0].grfInheritance = NO_INHERITANCE;
    ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[0].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
    ea[0].Trustee.ptstrName = (LPTSTR)pGuestSid;

    ea[1].grfAccessPermissions = GENERIC_ALL;
    ea[1].grfAccessMode = GRANT_ACCESS;
    ea[1].grfInheritance = NO_INHERITANCE;
    ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[1].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
    ea[1].Trustee.ptstrName = (LPTSTR)pSystemSid;

    ea[2].grfAccessPermissions = GENERIC_ALL;
    ea[2].grfAccessMode = GRANT_ACCESS;
    ea[2].grfInheritance = NO_INHERITANCE;
    ea[2].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[2].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
    ea[2].Trustee.ptstrName = (LPTSTR)pAdminSid;

    ea[3].grfAccessPermissions = GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE;
    ea[3].grfAccessMode = GRANT_ACCESS;
    ea[3].grfInheritance = NO_INHERITANCE;
    ea[3].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[3].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
    ea[3].Trustee.ptstrName = (LPTSTR)pInteractiveSid;

    ea[4].grfAccessPermissions = GENERIC_ALL;
    ea[4].grfAccessMode = GRANT_ACCESS;
    ea[4].grfInheritance = NO_INHERITANCE;
    ea[4].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[4].Trustee.TrusteeType = TRUSTEE_IS_OWNER;
    ea[4].Trustee.ptstrName = (LPTSTR)pCreatorSid;

    ea[5].grfAccessPermissions = GENERIC_READ;
    ea[5].grfAccessMode = GRANT_ACCESS;
    ea[5].grfInheritance = NO_INHERITANCE;
    ea[5].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[5].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
    ea[5].Trustee.ptstrName = (LPTSTR)pBackupSid;

    // 创建安全描述符
    dwRes = SetEntriesInAcl(6, ea, NULL, &pDacl);
    if (dwRes != ERROR_SUCCESS) {
        printf("SetEntriesInAcl error: %u\n", dwRes);
        goto cleanup;
    }

    pSD = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, SECURITY_DESCRIPTOR_MIN_LENGTH);
    if (!pSD) {
        printf("LocalAlloc error: %u\n", GetLastError());
        goto cleanup;
    }

    if (!InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION)) {
        printf("InitializeSecurityDescriptor error: %u\n", GetLastError());
        goto cleanup;
    }

    if (!SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE)) {
        printf("SetSecurityDescriptorDacl error: %u\n", GetLastError());
        goto cleanup;
    }

    sa.nLength = sizeof(SECURITY_ATTRIBUTES);
    sa.lpSecurityDescriptor = pSD;

    // 创建目录
    if (!CreateDirectory(TEXT("C:\\MyDir"), &sa)) {
        printf("CreateDirectory error: %u\n", GetLastError());
        goto cleanup;
    }

    // 清理资源
cleanup:
    if (pGuestSid) FreeSid(pGuestSid);
    if (pSystemSid) FreeSid(pSystemSid);
    if (pAdminSid) FreeSid(pAdminSid);
    if (pInteractiveSid) FreeSid(pInteractiveSid);
    if (pCreatorSid) FreeSid(pCreatorSid);
    if (pBackupSid) FreeSid(pBackupSid);
    if (pDacl) LocalFree(pDacl);
    if (pSD) LocalFree(pSD);

    return 0;
}

上述代码中，我们使用了 Windows API 中的一些函数来创建指定的访问控制项，并将这些访问控制项应用到 C:\MyDir 目录上。其中，AllocateAndInitializeSid 函数用于创建 SID，SetEntriesInAcl 函数用于初始化访问控制项，InitializeSecurityDescriptor 函数用于创建安全描述符，SetSecurityDescriptorDacl 函数用于将访问控制列表关联到安全描述符上，CreateDirectory 函数用于创建目录。