s4:dsdb/operational: fix stripping of the nTSecurityDescriptor attribute