Rewritten table generation of AD objects (multi-root-search for UMRA 1679), added pwd must change at next logon