It might be that you have more Aces then the 2 you are specifying (previous admins who don't know what they're doing etc.)
If so, keep in mind that you have to reorder the Aces before you put the DACL back.
Deny aces go first, then just LIFO (Last in first out).