don't assume that the CN is right, look up the samaccountname so it's consistent with other parts of the code