We have our AD setup as company.internal, then machines and users under their own OUs by location. For distribution groups, query-based groups works great. But what about security groups? I want to ...