attempting to fix "domain user map" up, but it's a bit complicated.