Andrey Turkin : user32: GetUserObjectSecurity should return a valid security descriptor.