To facilitate consistent application of ACLs to support the capabilities you implement in your organization, create scripts to ensure the correct permissions are applied. For example, the following script creates a Contribute capability for a folder by giving a group the correct permissions:


Folder_Capability_Contribute.bat
Code:
@echo off
Set GROUP=%1
Set FOLDER=%2
icacls.exe %FOLDER% /grant %GROUP%:(CI)(WD,AD) %GROUP%:(CI)(OI)R
icacls.exe %FOLDER% /grant "Creator Owner":(CI)(OI)(IO)M
@echo on
The script can be called with two parameters, the first specifying the group that should be given the Contribute capability and the second specifying the folder—for example:

Folder_Capability_Contribute.bat ACL_MyFolder_Contribute
"\\server01.contoso.com\departments$\finance\t eam a"

Similar scripts, each using the icacls.exe commands described in this solution, can be prepared to implement capabilities you require.