Deleting Whole Volume ACEs

You cannot remove ACEs that have been set; instead, if necessary, use the empty string ("") to deny specific types of access. If the empty string is used to deny a specific type of access, that type of access is denied to all users. To deny access to specific users only, use the negation operator (!).