s4-samba-tool: fixed the gpo command to use the right DN for access checks