r12174: Simple patch to work around the current lack of BUILTIN

r12174: Simple patch to work around the current lack of BUILTIN
nested group support.  Always add the BUILTIN\Administrators
SID to a Domain Admins token.

This solves the extra steps of establishing a group map for
the local Administrators SID in order to control services.
Windows also tends to expect the Administrators group to be
usable when setting up security permissions on shares.

Volker's work will probably fix this long term, but this
gets us past some of the setup hurdles for 3.0.21.
(This used to be commit 170b6a68bcbd66bae322c5b1b8c8501ca96acab2)