Command option Sample:icacls /deny

Search command sample in the internet.It is the result.

icacls /deny option

icacls /deny :F "%f"	Ignoring .svn directories under IIS - Server Fault : http://serverfault.com/questions/23340/ignoring-svn-directories-under-iis
Icacls /deny Sid:permission can deny Simple or Specific rights)	Rootkit Removal from a Windows System : http://www.technibble.com/how-to-remove-a-rootkit-from-a-windows-system/