This seems like a kind of trivial thing to test... wouldn't it be better if we (also) verified that the ACE(s) in the DACL changed as a result?

```ruby
sd.dacl.any? { |ace| ace.sid == owner_sid }.should be_false
sd.dacl.any? { |ace| ace.sid == new_sid }.should be_true
```