* condense AD 'unsupported record type' warnings * active directory provider can create/modify/delete NS records! * ad passes more of the tests now * skip root NS records for safety * clarifying comment