server: Setting a security descriptor should not replace an existing owner or group if only a DACL is being set.