s4:provision: set the correct nTSecurityDescriptor on CN=Partitions,CN=Configuration...