Возможно, через WMI:

var OBJECT_INHERIT_ACE = 1;
var CONTAINER_INHERIT_ACE = 2;
var CUSTCON_ACE_INHERIT = 3;

//ACE types
var ACETYPE_ACCESS_ALLOWED = 0;
var ACETYPE_ACCESS_DENIED = 1;

//Access masks
var CUSTCON_FULL_CONTROL = 2032127;
var CUSTCON_CHANGE = 1245631;
var CUSTCON_READ = 1179785;

//Security descriptor control flag
var SE_DACL_PRESENT = 4;
var SE_DACL_AUTO_INHERITED = 1024;
var SE_SELF_RELATIVE = 32768;
var CUSTCON_ALLOW_INHERIT = 33796;

var CHANGE_DACL_SECURITY_INFORMATION = 4;

var dir_str=path;

var trustee = serv.Get("Win32_Trustee").SpawnInstance_();
trustee.Domain = domain; // domain name
trustee.Name = user_name;
trustee.SID = objUser.objectSid; // SID, можно взять из AD

var ACE = serv.Get("Win32_Ace").SpawnInstance_();
ACE.AccessMask = CUSTCON_FULL_CONTROL;
ACE.AceFlags = CUSTCON_ACE_INHERIT;
ACE.AceType = ACETYPE_ACCESS_ALLOWED;
ACE.Trustee = trustee;

var SD = serv.Get("Win32_SecurityDescriptor").SpawnInstance_();
SD.ControlFlags = CUSTCON_ALLOW_INHERIT;
SD.DACL = new Array(ACE);
trustee=null;
ACE=null;

var SS = serv.Get("Win32_LogicalFileSecuritySetting='" + dir_str + "'")

SS.SetSecurityDescriptor(SD);

SD=null;
SS=null;

типа того...
Хелпы ищите в MSDN, в reference по WMI