Pretty sure you can create a TEMPLATE security descriptor to pass to the function - but it doesn't work:

$sd = GetObject("winmgmts:Win32_SecurityDescriptor")