Changed GroupScope for new shadowgroups to Global.

For use with Fine Grained Password Policies the group scope should be
Global. Thanks to Dmitry (dzobnin 'at' yandex.ru).

If you are using this script with child domains, the GroupScope may need
to be changed to Universal for some memberships to work.