fixed issue where some accounts don't have a default group cn