Handle the case where ou=Groups exist in OpenLDAP and a Windows AD, so we map both on provision time instead of breaking