Suppose I had one folder in the root of C: on a domain controller (server 2012 std) that I want everybody (domain users) to have full control over except 2 sub-folders that I only want certain users ...