There is an excellent rundown of how to do it in PowerShell here.
Essentially, you can use Get-Acl
and Set-Acl
in PowerShell like you would for any other path.
$acl = Get-Acl HKLM:\SOFTWARE\stuff
$rule = New-Object System.Security.AccessControl.RegistryAccessRule ("Domain\user","FullControl","Allow")
$acl.SetAccessRule($rule)
$acl |Set-Acl -Path HKLM:\SOFTWARE\stuff