I think that with the changes I made in the first commit here, the underlying code supports this if using SIDs to identify users / groups.  However, the ADSI queries that tack on a `,user` or `,group` will not work properly AFAIK.

We should ferret out what we want for behavior here.