r12915: protect against changing the SCM security descriptor