On Windows, use well-known SIDs to set ownership

[nanliu]

This is per the recommendation of Josh Cooper. We want to ensure that non-privileged users don't have access to the directory. This should be the rough equivalent of setting owner=root group=root on Unix.