If the user has an empty dn and a valid uid, the cleanup job will wrongly remove the user even if he is part of the included groups.