It turns out that there is a different, but closely related technique for getting to the same result, if all you are interested in is the narrow goal of listing AD group direct membership. Instead of using LDAPGROUP, use the LDAPFETCH function. | ldapsearch search="(&(objectClass=Group)(cn=Remote Desktop Users)" | mvexpand member | ldapfetch dn=member attrs="cn" | table cn This returns the direct members of the group using their CN or any alternate attribute. It leaves me wondering what the best cases are for using the LDAPGROUP function.  The official documentation on it is fairly light and I was only able to find a small handful of examples online. ... View more