http://blogs.technet.com/b/askds/archive/2009/09/21/understanding-ldap-security-processing.aspx