KCC: use KccError, simplify logic in NTDSConn.commit_modified