Once applied, any security descriptors for registry or file system objects in these security templates cannot be removed ...