SE_GROUP_USE_FOR_DENY_ONLY
const win32security.SE_GROUP_USE_FOR_DENY_ONLY;