Currently, only the `sophomorix:school:$SCHOOL` GPO is processed. It would be better to find all applicable GPOs by traversing the LDAP tree.