server: Setting a security descriptor should not replace an existing owner or group with a default, if only a DACL is being set.