s4:samba-tool/gpo: fix 'aclcheck' against a Windows 2008R2 DC