s4-provision: Extract security descriptors in separate file