Also just glancing at it...Shouldnt the CN=users be OU=users? Or does it matter?