After a bunch of trial-and-error, this powershell script seems to do it:
$worm="C:\WORM"
mkdir -Force $worm
cd $worm
<# https://serverfault.com/a/17869
SYSTEM - Full Control - Apply onto: This folder, subfolders, and files
Administrators - Full Control - Apply onto: This folder, subfolders, and files
Authenticated Users - Read - Apply onto: This folder, subfolders, and files
Authenticated Users - Create Files / Write Data - Apply onto: This folder and subfolders
#>
$acl = Get-Acl $worm
$ace1 = New-Object Security.AccessControl.FileSystemAccessRule 'Users', `
'CreateDirectories, CreateFiles, ListDirectory, Read', `
'ContainerInherit, ObjectInherit', `
'None', `
'Allow'
$acl.AddAccessRule($ace1)
Set-Acl -AclObject $acl -Path $worm
$acl = Get-Acl $worm
$ace1 = New-Object Security.AccessControl.FileSystemAccessRule 'Users', `
'DeleteSubdirectoriesAndFiles,Delete', `
'ContainerInherit, ObjectInherit', `
'None', `
'Deny'
$acl.AddAccessRule($ace1)
Set-Acl -AclObject $acl -Path $worm
$acl = Get-Acl $worm
$ace1 = New-Object Security.AccessControl.FileSystemAccessRule 'Users', `
'WriteData', `
'ObjectInherit', `
'InheritOnly', `
'Deny'
$acl.AddAccessRule($ace1)
Set-Acl -AclObject $acl -Path $worm
It is not fool-proof though since an admin can take back control with:
icacls C:\WORM /T /Q /C /RESET
I will say that if you need an industrial grade solution for SEC-compliance or whatever, you may have to invest in NetApp and SnapLock:
https://library.netapp.com/ecmdocs/ECMP1196889/html/GUID-7334EEB5-94E9-4500-BA40-681DEC572420.html