s4-provision UTF16 encode the password in sam.ldb, not secrets.ldb