Active Directory allows administrators to add a group as a member of another group. When a group is a member of a parent group, Directory Services Connector synchronizes the users in the member group as well as users within the group explicitly identified within Directory Services Connector. The Control Console therefore includes all members of a parent group in its membership list, including those in any member groups.
Domain Local and Universal groups in Active Directory can contain members or groups who reside in other AD domains. In the case where group members reside in AD domains different from that of a group being synchronized, a synchronization includes only group members in that group's AD domain. To synchronize all members in a group when some members exist in different AD domains, you must synchronize all AD domains that contain members for the group.
When a group is moved, or migrated, in Active Directory from one AD domain to another, the subsequent synchronization records this change in the Control Console. The migrated group retains the members that it previously had in the Control Console. However, the group's members continue to reside in the AD domain that they resided in prior to the migration.