I have since worked out the reason for this myself - it was a dumb mistake. Just in case anyone else has the same issue, I was using the wrong DN format - I was using "CN=<username>,OU=..." rather than "CN=<displayname>,OU=..."
To verify the correct DN to use, run "dsquery user -samid <username>" from the command line of a domain controller, and the full DN will be returned.
Clik here to view.
