s4-s3upgrade: Do not ever set a domain-wide maxPwdAge of 0