There are many ways to do this sort of thing... but this isn't primarily a technical decision. Unrestricted querying of AD infrastructures slows and crashes them, shutting down critical services and making many people sad, not to mention the additional complexity of determining if the user in Splunk really has rights to access that information. You'll notice the identities system in DB Connect 2, which is intended to make it clear which Splunk groups are getting what levels of access to which databases. We would need to add something like that to AD support before this would make sense; not saying that we will or won't, but just saying what the complexity level is.
