Well, I've added some debug statements and at this point in your ChangeACLS function:
Code:
  udfDEBUG("About to GetSecurityDescriptor")
  $sd = $sec.GetSecurityDescriptor("FILE://" + $file)
  If @ERROR "Failed to get DACL" Exit @ERROR EndIf
  udfDEBUG("Past GetSecurityDescriptor")


I get the "About to GetSecurityDescriptor" message, but then nothing. KiXtart exits in the GetSecurityDescriptor call with no error message.