s4:dsdb/descriptor: the old nTSecurityDescriptor is always expected there on modify