I would use something like this;

Shell('cmd /c cacls "$dirinstallto" /t /e /c /g $localgroup:R administrators:F system:F /r $everyone Users %username%')

the /g grants permissions and /r removes them

See http://www.ss64.com/nt/cacls.html for full details of useage

Regards