s4:SID handling - always encode the SID using "ldap_encode_ndr_dom_sid" for LDAP...