Reliably copy files on Windows, whatever the ACLs

You will want to use robocopy with the /B switch, as an administrator or another account that has backup operator privileges.

The /B switch makes robocopy use the backup operator method of copying the files, letting pass over ACLs.

The default setting /COPY:DAT is to ignore ACLs on the destination.
To mirror the ACLs, you have to use /COPY:DATSO (or /COPY:DATSOU to also copy audit informations).