anchor.diff: +@ECHO OFF
   REM Run this in a folder full of roaming profiles (of format username.v2)
   REM This script will process each folder and if the context under which it is running is unable to view ACLs of the folder, it will add the BUILTIN\Administrators group to the ACL
   
  -@ECHO OFF
   setlocal EnableDelayedExpansion
   set DOMAIN=%USERDOMAIN%
   
  
positive.code:     echo    Enabling inheritance on sub-folders of %%D
      icacls %%D\* /inheritance:e /T 1> nul 2> nul
      
      echo    Setting owner back to %%U
      icacls %%D /setowner %DOMAIN%\%%U
    )
  )
negative.code:   echo Processing %%D
    
    REM Find the user to whom the profile belongs (so we can set ownership back once done)
    FOR /F "delims=." %%U in ('echo %%D') DO set USER=%%U
    
    REM Try to find permissions; if ERRORLEVEL 0 then all is good; 5 implies Access Denied
    icacls %%D /Q 1> nul 2> nul
  