NetLabel: use SECINITSID_UNLABELED for a base SID