Add next to a Server.csproj file to influence ACLs during a WebDeploy package building by MSBuild. Note that we have specific paths in mind (based on this being for the Nuget server code)

Server.wpp.targets

<!--********************************************************************-->
<!-- RunCommand reference: http://technet.microsoft.com/en-us/library/ee619740(WS.10).aspx -->
<!-- http://blogs.msdn.com/b/webdevtools/archive/2010/02/09/how-to-extend-target-file-to-include-registry-settings-for-web-project-package.aspx -->
<!--********************************************************************-->
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <PropertyGroup>
    <AfterAddContentPathToSourceManifest Condition="'$(AfterAddContentPathToSourceManifest)'==''">
      $(AfterAddContentPathToSourceManifest);
      ModifySiteManifest;
    </AfterAddContentPathToSourceManifest>
  </PropertyGroup>
  <ItemGroup>
    <CustomDirAcl Include="Packages">
      <AclAccess>Read,Write,Modify</AclAccess>
      <AclResourceType>Directory</AclResourceType>
    </CustomDirAcl>
  </ItemGroup>

  <Target Name="ModifySiteManifest">
    <Message Text="Adding Additional Information to Manifest" />
    <ItemGroup>
        <!--
          <MsDeploySourceManifest Include="runCommand">
        <Path>c:\windows\system32\inetsrv\appcmd set config "Default Web Site/" -section:system.webServer/httpRedirect -enabled:false -destination:"/NuGet/nuget" -childOnly:true</Path>
        </MsDeploySourceManifest>
      -->
    </ItemGroup>
  </Target>

  <!-- http://stackoverflow.com/questions/6861990/can-web-deploys-setacl-provider-be-used-on-a-sub-directory -->
  <Target Name="SetupCustomAcls" AfterTargets="AddIisSettingAndFileContentsToSourceManifest">   
    <!-- This must be declared inside of a target because the property 
    $(_MSDeployDirPath_FullPath) will not be defined at that time. -->
    <ItemGroup>
      <MsDeploySourceManifest Include="setAcl">
        <Path>$(_MSDeployDirPath_FullPath)\%(CustomDirAcl.Identity)</Path>
        <setAclAccess Condition="%(CustomDirAcl.AclAccess) != ''">%(CustomDirAcl.AclAccess)</setAclAccess>
        <setAclAccess Condition="%(CustomDirAcl.AclAccess) == ''">FullControl</setAclAccess>
        <setAclResourceType Condition="%(CustomDirAcl.AclResourceType) != ''">%(CustomDirAcl.AclResourceType)</setAclResourceType>
        <setAclResourceType Condition="%(CustomDirAcl.AclResourceType) == ''">Directory</setAclResourceType>
        <AdditionalProviderSettings>setAclResourceType;setAclAccess</AdditionalProviderSettings>
      </MsDeploySourceManifest>
        <!--
        <setAclUser>anonymousAuthenticationUser</setAclUser>
        <AdditionalProviderSettings>setAclResourceType;setAclAccess;setAclUser</AdditionalProviderSettings>    
      -->
    </ItemGroup>
  </Target>

  <Target Name="DeclareCustomParameters" AfterTargets="AddIisAndContentDeclareParametersItems">
    <!-- This must be declared inside of a target because the property 
    $(_EscapeRegEx_MSDeployDirPath) will not be defined at that time. -->
    <ItemGroup>
      <MsDeployDeclareParameters Include="SetAcl %(CustomDirAcl.Identity)">
        <Kind>ProviderPath</Kind>
        <Scope>setAcl</Scope>
        <Match>^$(_EscapeRegEx_MSDeployDirPath)\\@(CustomDirAcl)$</Match>
        <DefaultValue>{$(_MsDeployParameterNameForContentPath)}/@(CustomDirAcl)</DefaultValue>        
        <Value>$(_DestinationContentPath)/@(CustomDirAcl)</Value>
        <Tags>Hidden</Tags>
        <Priority>$(VsSetAclPriority)</Priority>
        <ExcludeFromSetParameter>True</ExcludeFromSetParameter>
      </MsDeployDeclareParameters>
    </ItemGroup>
  </Target>
</Project>

A deployment batch file would look like

REM more info can be munged into the sitemanifest.xml by changing the .wpp.targets file
REM more details on the keys here http://technet.microsoft.com/en-us/library/dd569040(WS.10).aspx
REM samples here http://blogs.msdn.com/b/webdevtools/archive/2010/02/09/how-to-extend-target-file-to-include-registry-settings-for-web-project-package.aspx

msbuild NuGetServer.Host\NuGetServer.Host.csproj /P:Configuration=Release /P:DeployOnBuild=True   /P:DeployTarget=MSDeployPublish /P:MsDeployServiceUrl=https://nuget.mydomain.com:8172/MsDeploy.axd /P:AllowUntrustedCertificate=True /P:MSDeployPublishMethod=WMSvc /P:CreatePackageOnPublish=True   /P:UserName=.\Administrator /P:Password=Password