s3-samr Explian better the use of two privileges in this call