Can I create a rule that applies to all members of an AD container, but only to their primary address?