I vaguely remember the way I had done it wasnt ideal - and a lock or handle would have better mapped to something like an NTFS attribute, but I digress