This is what the SECDESC in NTUSER.DAT looks like

[Richard Sharpe]

 ./profiles ~rsharpe/profile/NTUSER.DAT 
Number of ACEs: 8
Type: 00, Flags: 00, Len: 36, Perms: 000F003F
S-1-5-21-129735678-430395340-1080627117-2002
Type: 00, Flags: 00, Len: 20, Perms: 000F003F
S-1-5-18
Type: 00, Flags: 00, Len: 24, Perms: 000F003F
S-1-5-32-544
Type: 00, Flags: 00, Len: 20, Perms: 00020019
S-1-5-12
Type: 00, Flags: 0B, Len: 36, Perms: 10000000
S-1-5-21-129735678-430395340-1080627117-2002
Type: 00, Flags: 0B, Len: 20, Perms: 10000000
S-1-5-18
Type: 00, Flags: 0B, Len: 24, Perms: 10000000
S-1-5-32-544
Type: 00, Flags: 0B, Len: 20, Perms: 80000000
S-1-5-12

The last four are container inherit ACEs ... 

To FIX the SIDs for Profiles, we only need to change two SIDs, I reckon.

Regards
-----
Richard Sharpe, rsharpe at ns.aus.com, rsharpe at samba.org, 
sharpe at ethereal.com, http://www.richardsharpe.com