r5385: when operating in security = domain, allow domain admins to manage rigths...