We decided that in the case that the old group was `SYSTEM`, and we've now reassigned the group to a different sid, so `SYSTEM` has no permissions, then we do want to prepend a `SYSTEM` ace.