How can I filter Group DN's to only have the value of the CN?