From: "Peña, Botp" <botp@...>
Date: 2007-04-25T14:59:05+09:00
Subject: Re: Retrieving Groups from a DSQUERY

From: Clifford Heath [mailto:no.spam@please.net] 
# You need to enumerate the Access Control Entries for
# the mailbox (and potentially the mbox's ancestors)
# and for each relevant ACE that pertains to a group,
# establish the transitive closure of the group's
# membership. Do this separately across all ACEs for
# both the allowed members and the denied members, then
# subtract the denied set from the allowed set. Either
# set may be a wild-card (like World, or Authenticated
# Users), so you must handle that.
# This is thousands of lines of code, and cannot be done
# efficiently using ADSI (or ADO/ADSI) because the ADSI
# ACE's hide the SID, exposing only the SAM name of the
# ACE, which is obtained by a remote directory lookup.
# LDAP is the way to go. Even that's not easy, since you
# can't get the ACL via LDAP unless you send a special
# custom LDAP control with the query, saying you don't
# want the sACL when you fetch the ntSecurityDescriptor.

Clifford, this great info. 
Many thanks again,
-botp