Getting ACL’s from a Windows 2003 server

Make sure that you use /G and /E (edit mode) together (and most likely /T as well).

For reference, here is the complete usage information from the command CACLS /?

CACLS filename [/T] [/E] [/C] [/G user:perm] [/R user [...]]
               [/P user:perm [...]] [/D user [...]]
   filename      Displays ACLs.
   /T            Changes ACLs of specified files in
                 the current directory and all subdirectories.
   /E            Edit ACL instead of replacing it.
   /C            Continue on access denied errors.
   /G user:perm  Grant specified user access rights.
                 Perm can be: R  Read
                              W  Write
                              C  Change (write)
                              F  Full control
   /R user       Revoke specified user's access rights (only valid with /E).
   /P user:perm  Replace specified user's access rights.
                 Perm can be: N  None
                              R  Read
                              W  Write
                              C  Change (write)
                              F  Full control
   /D user       Deny specified user access.
Wildcards can be used to specify more that one file in a command.
You can specify more than one user in a command.

Abbreviations:
   CI - Container Inherit.
        The ACE will be inherited by directories.
   OI - Object Inherit.
        The ACE will be inherited by files.
   IO - Inherit Only.
        The ACE does not apply to the current file/directory.

The script gets placed in "domain\sysvol\domain\policies\policy guid\machine\scripts\startup" folder. The easiest and recommended way to add a script is to edit the GPO that applies to the computer(s) in question using GPMC, expand Computer Configuration, Expand Windows Settings, select the Scripts item in the left pane, double-click the Startup item in the right pane, click the Show Files button, and paste your script into the windows explorer window that opens, close the explorer window, click the Add button, type the name of the script in the "Script Name" field, click OK, click OK again, and close the GPMC.