You're doing a lot more than you have to. Just/deny the right to synchronize on the file for users (*BU).CreateFileW() always requestsSYNCHRONIZE access because it's in the API contract that File handles are waitable. OTOH,DeleteFileW() only needsDELETE access, so you can still delete the file without having to reset the security on it.

It's only slightly more work, and this is a better emulation of the user report. It should be more robust if something else changes in the future (either failing hard, so we notice, or not failing at all). Being too targeted here could leave us open to the test passing being a false positive based on the environment, so I'd rather just go hard at it and be sure we're testing the right thing.