Jooel - about two years ago there was a discussion about Universal groups not being recognized in InGroup(). I even created a Universal Group just to verify this. The result was using the EnumGroup() plus the LDAP query to combine the list of groups for complete detection, as I posted above. There were also issues with Security groups having email addresses...
I'm not sure what changed since then, but when I now go back to run the test script, both InGroup() and fInGroup() return true for membership in all groups, including Universal groups and mail-enabled security groups. I ran the test with all reasonable versions of Kix, from 4.53 to 4.64 with identical results. (I'm on AD 2012r2 native here.) I recall also that this was an issue at the AD consolidation project I was on about 18 months ago - they were AD 2008r2 at the time.
Could the issue have been resolved by a MS patch since then? I haven't made any significant changes to my environment since then.
I can't find the original discussion or I'd reference it.
Glenn
_________________________
Actually I
am a Rocket Scientist!
