-Fail immediately if the full security descriptor of any file or directory cannot
-be set exactly as specified in the WIM file. The default behavior without this
-option is to fall back to setting a security descriptor with the SACL omitted,
-then only the default inherited security descriptor, if we do not have
-permission to set the desired one.