Disallow @UAC on replica unless running DR v2