user32: GetUserObjectSecurity should return a valid security descriptor.