properly handle Active Directory Domain Users group