s4:kdc - use "userAccountControl" always unsigned