Microsoft Knowledge Base Article 926639 contains the following INTRODUCTION:

This article describes how to reset an empty discretionary access control list (DACL) in a service security descriptor on a Microsoft Windows Server 2003-based computer.