s3:net ads join: interpret return code of ads_kinit_password() in dns update block