s4 provision: Remove hard coded ACL for GPO objects