Move root/administrator locking after domain setup complete

There was an issue with automatic locking of the administrator and root
accounts where if domain setup failed after locking, then those accounts
would become unusable to recover the system.