GeezerVison

If you prefer to use "CURRENT_USER", you could just move it to the end of the array. Then the SetEntriesInAclW() call would use a count of 2 or 3 depending on whether the current user is an elevated administrator. The latter is determined by querying TokenElevationType. For example:

    ULONG entry_count = 3;

    TOKEN_ELEVATION_TYPE elevation_type;
    DWORD return_length;
    if (GetTokenInformation(GetCurrentProcessToken(), TokenElevationType,
            &elevation_type, sizeof(elevation_type), &return_length) &&
        elevation_type == TokenElevationTypeFull)
    {
        entry_count = 2;
    }

GetCurrentProcessToken() returns the pseudohandle (HANDLE)-4, which has been supported since Windows 8.

Thanks, but I definitely don't want to try to detect anything about the user's current state. That feels brittle (e.g. if more things are added that ought to be detected).

OWNER RIGHTS is good, and it's actually what I tried to find first. The fallback is just for completeness - I don't expect CreateWellKnownSid to ever fail here, but at least if it does, we're probably not doing anything too bad.