This is one of those KB articles I stumbled across on Metabase ACL's.  I know IIS 7 doesn't formally have the metabase except for compat reasons, but this is handy for IIS 6 and below.

http://support.microsoft.com/kb/326902

Cheers,

Steve