cacls

http://social.technet.microsoft.com/Forums/windows/en-US/430f61ee-b278-4cfe-8697-f085f9842d00/windows-7-icacls-deny-delete-also-denies-read?forum=w7itprosecurity

When you want to deny modify and allow read for Users, somehow the read permission not work if just using:

> icacls test /deny Users:m /grant Users:rx

Need to use cacls for read permission instead:
> icacls test /deny Users:m
> cacls test /E /G Users:R