LDAP syncing scripts + AD: OU selective sync?