In Window, I’m trying to create a key in the TPM with the help of the NCrypt library and restrict the access to only my application in C++, but I get the error: “The security descriptor structure is invalid”

To help with readability I’ve removed all error controls from the code

// Get App SID
DWORD pid = GetCurrentProcessId();
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);

HANDLE hToken;
OpenProcessToken(hProcess, TOKEN_QUERY, &hToken);

DWORD bufferSize = 0;
GetTokenInformation(hToken, TokenUser, NULL, 0, &bufferSize);

PTOKEN_USER tokenUser = reinterpret_cast<PTOKEN_USER>(malloc(bufferSize));

// I suspect that the tokenUser->User.Sid is related to the current user logged in,
// but I couldn't find any other way to get and identifier related to the running
// process that is consistent across multiple executions
GetTokenInformation(hToken, TokenUser, tokenUser, bufferSize, &bufferSize);

EXPLICIT_ACCESS ea[1];
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
ea[0].grfAccessPermissions = WRITE_OWNER;
ea[0].grfAccessMode = SET_ACCESS;
ea[0].grfInheritance = NO_INHERITANCE;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_USER;
ea[0].Trustee.ptstrName = (LPTSTR)tokenUser->User.Sid;

PACL pACL = NULL;
SetEntriesInAcl(1, ea, NULL, &pACL);

PSECURITY_DESCRIPTOR pSD = NULL;
pSD = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, SECURITY_DESCRIPTOR_MIN_LENGTH);
InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);

SetSecurityDescriptorDacl(pSD, TRUE, pACL, FALSE);
SECURITY_ATTRIBUTES sa;
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = pSD;
sa.bInheritHandle = FALSE;

NCryptSetProperty(hKey, NCRYPT_SECURITY_DESCR_PROPERTY, reinterpret_cast<PBYTE>(&sa), sizeof(SECURITY_ATTRIBUTES), NCRYPT_PERSIST_FLAG | DACL_SECURITY_INFORMATION);

I also tried the approach suggested here: https://forums.codeguru.com/showthread.php?301326-CreateDirectory-and-SECURITY_ATTRIBUTES

Is the flag NCRYPT_SECURITY_DESCR_PROPERTY not supported yet?