Inconsistent information in Active Directory Members and Member Of properties

Question

I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:

A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.

However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.

How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?

_{(note that the group G is not any user's primary group)}

(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)

Answer 1

There can be an issue getting complete results if you are querying a group that contains entries from mulltiple AD domains (global vs universal groups). There is more on the topic here

(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:
- At a DC for the domain that contains the user, memberOf for the user is complete with respect to membership for groups in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.
- At a GC server, memberOf for the user is complete with respect to all universal group memberships. )