s4:fill_netlogon_samlogon_response - some rework of the detection code