To prevent this error from occurring again, the following UCRV can be set and then the S4 connector restarted. This adds the group cn=Pre-Windows 2000 Compatible Access to the ignorelist.
ucr set connector/s4/mapping/group/ignorelist="$(ucr get connector/s4/mapping/group/ignorelist),Pre-Windows 2000 Compatible Access"