diff --git a/daemonlifecycle/privacy_windows.go b/daemonlifecycle/privacy_windows.go
index acebfd6..960b4a5 100644
--- a/daemonlifecycle/privacy_windows.go
+++ b/daemonlifecycle/privacy_windows.go
@@ -42,8 +42,8 @@ func protectOwnerOnly(path string) error {
 		return err
 	}
 	return windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
-		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
-		sid, nil, acl, nil)
+		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
+		nil, nil, acl, nil)
 }
 
 func protectOwnerOnlyFile(file *os.File) error {
@@ -56,8 +56,8 @@ func protectOwnerOnlyFile(file *os.File) error {
 		return err
 	}
 	return windows.SetSecurityInfo(windows.Handle(file.Fd()), windows.SE_FILE_OBJECT,
-		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
-		sid, nil, acl, nil)
+		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
+		nil, nil, acl, nil)
 }
 
 func ownerOnlyACL(sid *windows.SID, inheritance uint32) (*windows.ACL, error) {
diff --git a/spec/features/daemon-lifecycle/README.md b/spec/features/daemon-lifecycle/README.md
index 4cf5c29..1bc1970 100644
--- a/spec/features/daemon-lifecycle/README.md
+++ b/spec/features/daemon-lifecycle/README.md
@@ -19,7 +19,9 @@ recovery decisions in the consuming CLI.
 
 `ProtectOwnerOnly` MUST make a regular file or directory accessible only to the
 current user. On Windows it MUST install a protected DACL with one current-user
-allow entry; it MUST NOT treat Unix mode bits as proof of Windows privacy.
+allow entry without rewriting an already-correct owner, which can require an
+unavailable privilege; it MUST NOT treat Unix mode bits as proof of Windows
+privacy.
 
 `ValidateOwnerOnly` MUST reject symlinks, special files, other owners, group or
 world Unix permissions, and Windows ACLs that grant another principal access.