dsacls "OU=coyote,DC=acme,DC=com" /I:T /G ThisDomThisGroup:CCDC;computer
dsacls "OU=coyote,DC=acme,DC=com" /I:S /G ThisDomThisGroup:WO;;computer
dsacls "OU=coyote,DC=acme,DC=com" /I:S /G ThisDomThisGroup:WP;userAccountControl;computer

C:WindowsSystem32>dsacls /?
Displays or modifies permissions (ACLS) of an Active Directory Domain Services (AD DS) Object

DSACLS object [/I:TSP] [/N] [/P:YN] [/G <group/user>:<perms> [...]]
              [/R <group/user> [...]] [/D <group/user>:<perms> [...]]
              [/S] [/T] [/A] [/resetDefaultDACL] [/resetDefaultSACL]
              [/takeOwnership] [/user:<userName>] [/passwd:<passwd> | *]
              [/simple]
<... skipped lines...>
   /I               Inheritance flags:
                        T: This object and sub objects
                        S: Sub objects only
                        P: Propagate inheritable permissions one level only.
<... skipped lines...>
   /G  <group/user>:<perms>
                    Grant specified group (or user) specified permissions.
                    See below for format of <group/user> and <perms>
<... skipped lines...>
            CC      Create child object
            DC      Delete a child object
            WO      Change owner information
            WP      Write property