We don't handle nested groups, and if LDAP is flat and only lists
users in the parent group, we'll try and fail to remove the recursively
found users from the RT group, rather than removing the nested group.