Make "net sam [add|del]mem" work for domain groups