OK, it seems to be working, if I uncheck inheritance from the folder (C:\Temp in your example). I didn't have to uncheck anything or manually change perms on the files (?).

Can you use Cacls to uncheck the inheritance box? I'm looking at the help page, not sure if i can use something like CI, OI or IO?