gpo the nTSecurityDescriptor may not be visible for the current user