设置文件权限的问题

[xiluoyou]

在使用BuildExplicitAccessWithName的时候，用SET_ACCESS可使用户获得完全权限！
但使用DENY_ACCESS的时候，虽然拒绝项全部打勾了，而且不能访问，但允许项里也是全部打勾的，而且是灰色不能改变！要怎么样才能设成拒绝项全部打勾，而允许项不打勾？

BOOL ChangeAccountPrivilege(LPCTSTR lpPath,LPCTSTR lpAccount,BOOL Access)
{
DWORD dwSuccess;
EXPLICIT_ACCESS ea;
ACCESS_MODE AccessMode;
PACL lpNewDacl=NULL,lpOldDacl=NULL;

if(Access) AccessMode=SET_ACCESS; else AccessMode=DENY_ACCESS;
do
{

dwSuccess=GetNamedSecurityInfo((LPTSTR)lpPath,SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,&lpOldDacl,NULL,NULL);
if(dwSuccess!=ERROR_SUCCESS) return FALSE;
ZeroMemory(&ea,sizeof(EXPLICIT_ACCESS));
BuildExplicitAccessWithName(&ea,(LPTSTR)lpAccount,GENERIC_ALL,AccessMode,SUB_CONTAINERS_AND_OBJECTS_INHERIT);
dwSuccess=SetEntriesInAcl(1,&ea,lpOldDacl,&lpNewDacl);
if(dwSuccess!=ERROR_SUCCESS) return FALSE;
dwSuccess=SetNamedSecurityInfo((LPTSTR)lpPath,SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,lpNewDacl,NULL);
if(dwSuccess!=ERROR_SUCCESS) { LocalFree(lpNewDacl); return FALSE; }
} while(FALSE);
LocalFree(lpNewDacl);
return TRUE;
}

[xiluoyou]

晕，真的没有人知道吗？