Ok... you've confused me.
This picture illustrates what we've done.

As you can see, the organizational units are setup as objects in mallory.local/Mallory
But the groups that declared in the INGROUP() statement are under mallory.local/Users
How do I query by the containers under mallory.local/Mallory?