Can we make the assumption that GID 400 will be available? I can't recall what LDAP start allocating from (though I think it's higher)