Sorry, I forgot to say what the different behavior was.
When the user name is specified with the domain name, in the format domainname\userid, then the ACLS are changed on every key directly under Classes but not on Classes. If the username is specified without a domain name, then the behavior is as expected and is only changed on Classes.
If I change the ACL in a subkey under Classes, the it...
2009-06-11 18:50:40 UTC in SetACL: Windows ACL manipulation