Setting ACLs in C# + ASPX

[cameron]

What is the absolute minimum permissions required to set permissions?
The following code works if the user is a member of 'Domain Admins',
(not too pumped about giving a web user those kind of privileges). Both
user are identical except that one of them is a 'Domain Admin'. They
have full control over the object they are attempting to modify and the
effective permissions tab under advanced in ADSI Edit shows that they
both have permission to read and modify the permissions on the object in
question.

Both users can modify the permissions in ASP, (basically the same
'logic' just in ASP verses ASPX), which implies that there is something
different about my ASPX code, (or the ASPX environment).

I have been banging my head against the wall on this one for a while now
so anything and everything would be appreciated.

Thanks

-Cam

------------------------------------------
The ASPX code I am attempting to use:
------------------------------------------

string DocDN = "LDAP://<some dn>";
DirectoryEntry oDE = null;

try
{
Response.Write("Attempting to retrieve - " +
DocDN + "<br>\n");
// USER 1
//oDE = new DirectoryEntry(DocDN, "APPDEPOT\\<SAM1>",
"<Password 1>"); //user 1

// USER 2
//oDE = new DirectoryEntry(DocDN, "APPDEPOT\\<SAM 2>",
"<Password 2>"); //IDX\cam user
Response.Write("Title = " +
oDE.Properties["appdepot-adxTitle"][0].ToString()+
"<br>\n");

ActiveDs.IADsSecurityDescriptor SD =
(ActiveDs.IADsSecurityDescriptor)
oDE.Properties["ntSecurityDescriptor"].Value;

/*
* Don't do anything but attempt to set it, exactly as
* you got it
*/
oDE.Properties["ntSecurityDescriptor"].Value = SD;
oDE.CommitChanges();

Response.Write("Good<br>\n");
}
catch(Exception e)
{
Response.Write("Blew Up<br><br>" + e.Message + "<br>" +
e.Source + "<br>" + e.StackTrace);
}
finally
{
oDE.Dispose();
}