pub fn is_protected(descriptor: &str) -> bool
Whether a DACL carries SE_DACL_PROTECTED, so that nothing is inherited into it from the volume root.
SE_DACL_PROTECTED