s4:samba-tool/gpo: set the same security.descriptor type as the Windows GUI