s4:provision: set the correct nTSecurityDescriptor on CN=Builtin,... (bug #9481)