r23471: Here's a rough patch for expanding domain group membership