Deleting Whole Volume ACEs

You cannot remove ACEs that have been set. If you must remove ACEs, use the empty string ("") to deny specific types of access. If the empty string is used to deny a specific type of access, that type of access is denied to all users. To deny access to specific users only, use the negation operator (!).