s4:dsdb/acl: only give administrators access to attributes marked as confidential...