It's a b*tch and hard to work with.  

The following posting end up being what I needed.
http://groups.google.ca/groups?hl=en&lr=lang_en&ie=UTF-8&safe=off&threadm=033401
c30554%24deccc7a0%24a401280a%40phx.gbl&rnum=3&prev=/groups%3Fhl%3Den%26ie%3DUTF-
8%26safe%3Doff%26q%3Dadsi%2Bsearch%2Borganizationalunit%26spell%3D1

IIRC after I got the logic working I discovered VB6 allowed you to run
LDAP queries within it natively.  Rather than just being allowed to
use them in code.   But that was over a year or two ago and my memory
is rather hazy.

I created the VB app so that a client in the construction field could
create folders by job and subfolders within the job.  However those
sub folders would each have different security depending on the
persons function.  That is foremen could see the drawings folder but
not the invoices folder.

I kept a page of notes when I was working on this topic.   Below is
every link I found useful or not.  Some may or may not be useful to
you.

Internet resources
Programmatically Set NTFS File System Folder Permissions

Enumerating Local Groups and Descriptions with NetLocalGroupEnum
Pasted from
<http://vbnet.mvps.org/code/network/netlocalgroupenumdesc.htm>

Enumerating Members of a Group with NetLocalGroupGetMembers
Pasted from
<http://vbnet.mvps.org/code/network/netgocalgroupgetmembers.htm>

Xcacls.exe
Pasted from
<http://support.microsoft.com/default.aspx?scid=KB;EN-US;825751>

How To Use High-Level Access Control APIs from Visual Basic
Pasted from
<http://support.microsoft.com/default.aspx?scid=kb;EN-US;295004>

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adsi/adsi/iadsg
roup.asp

ldap

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnanchor/html/a
nch_activediradsi.asp

Active Directory Service Interfaces Quick-start Tutorials

<http://msdn.microsoft.com/library/en-us/adsi/adsi/adsi_quick-start_tutorials.asp
?frame=true>

IADsAccessControlEntry
<http://msdn.microsoft.com/library/en-us/adsi/adsi/iadsaccesscontrolentry.asp?fra
me=true>

An ADSI Primer, Part 11: More on Scripting Permissions and Auditing
(Windows Scripting though)
<http://www.windowsitpro.com/WindowsScripting/Article/ArticleID/7456/7456.html>

HOWTO: Use ADsSecurity.dll to Remotely Add Local Account ACEs to an
NTFS File
<http://support.microsoft.com/default.aspx?scid=kb;en-us;Q285998>

How To Use ADSI to Set Automatic Inheritance of File/Folder
Permissions
Pasted from <http://support.microsoft.com/kb/266461/EN-US/>

http://groups.google.ca/groups?q=group+dacl+security+permissions+group:*vb*&hl=e
n&lr=lang_en&safe=off&selm=3A42D078.3ED7F611%40hotmail.com&rnum=10

Various constants are at the following:
http://www.serverwatch.com/tutorials/article.php/1476721

Security and Access Rights
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/fil
e_security_and_access_rights.asp

How To Use ADSI to Set Automatic Inheritance of File/Folder
Permissions
<http://support.microsoft.com/default.aspx?scid=kb;en-us;266461>
VBScript recursive changing of subfolders

IADsAccessControlEntry Property Methods
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adsi/adsi/iadsa
ccesscontrolentry_property_methods.asp

HOWTO: Use ADsSecurity.dll to Remotely Add Local Account ACEs to an
NTFS File
<http://support.microsoft.com/default.aspx?scid=kb;en-us;Q285998>

How To Use ADsSecurity.dll to Add an Access Control Entry to an NTFS
Folder
<http://support.microsoft.com/default.aspx?scid=kb;en-us;Q279682>

Tony