SetSecurityDescriptorControl can't modify SE_DACL_PRESENT
or SE_SELF_RELATIVE. It should work if you remove them
from the bitmask. And since it's a bitmask, they should be combined
with a bitwise or instead of +, eg
SE_DACL_PROTECTED | SE_DACL_AUTO_INHERITED
hth
Roger