You want to change the default ACL for an object class in the schema.
18.104.22.168 Using a graphical user interface
Each instantiated object in Active Directory has an associated structural class that defines a default security descriptor (defaultSecurityDescriptor attribute). When an object is created, the default security descriptor is applied to it. This, along with inheritable permissions from the parent container, determines how an object's security descriptor is initially defined.
14.11.4 See Also
Recipe 14.12 for comparing the ACL of an object to the default defined in the schema, Recipe 14.13 for resetting the ACL of an object to that defined in the schema, and MS KB 265399 (HOW TO: Change Default Permissions for Objects That Are Created in the Active Directory)