provision: fix nTSecurityDescriptor of CN={LostAndFound,System},${DOMAINDN} (bug...