[389-users] AD group/user sync question