Hello. I have been working on enumerating group memberships in Active Directory, and invariably one comes across member and memberOf, the former being an attribute on security group objects and the latter being an attribute on user and computer objects.

While it generally seems straight-forward, we notice some inconsistencies for our Builtin Groups, when we look at them on different DCs. I was wondering why this might be so.

Has anyone else on this forum noticed such inconsistencies as well, and if so, have you found any explanation for why these might be different on different DCs?

I would appreciate a simple explanation of member and memberOf work in Active Directory.