Before you can change an ACL, you must get the current one. There are two ways to do this with PowerShell. Learn how to get the current ACL and modify it.

I am investigating the feasibility of this. Quick answer looks like no because the default WinPE of the installer may not have network drivers. If this turns out to be the case, we recommend Rufus, or ...