Getting the `ntSecurityDescriptor` with an LDAP query

TL;DR I found out how to retrieve the ntSecurityDescriptor in Active Directory, via LDAP. Active Directory is a… beast and it’s not always easy to get what’s needed. This took me… some time. One configuration that is supported for an account is the possibility to set a flag for preventing a user to change password. I’m not sure why there’s such a flag; I can only imagine that’s an easy way to lock…