I don't think we can assume this is a user entry just because we see an attribute with this name... if a group has the same attribute, we could get a false positive here. We need to know whether we have to drill down into Get-User queries based on their LDAP config