Windows Vista (or later) stores the mandatory integrity label ACEs (if any) in the SACL. To view or manipulate the integrity ACEs requires that the flag LABEL_SECURITY_INFORMATION be set for both the GetXxxSecurity and the SetXxxSecurity functions. Without the flag the GetXxxSecurity functions will elide the mandatory integrity label ACEs from the SACL of the returned security descriptor.