Icacls protect binary from system

removes all inherited rights and adds specific grant. remember to view permissions to ensure a grant isnt already allowed that isnt inherited. set owner ensures you dont lock yourself out of the file.

icacls shell.exe /setowner megacorp.local\tushikikatomo
icacls nc.exe /inheritance:r
icacls shell.exe /grant megacorp.local\tushikikatomo:F