This is one of those KB articles I stumbled across on Metabase ACL's. I know IIS 7 doesn't formally have the metabase except for compat reasons, but this is handy for IIS 6 and below.
http://support.microsoft.com/kb/326902
Cheers,
Steve