Group section

Valid arguments

literal group names
distinguished names of groups with or without \* wildcard in the canonical name
groups in Active Directory Users & Computers object location syntax with or without * wildcards in canonical names

Purpose

Refer to one or more directory service groups.

Supported wildcards and quoting

"…" — Quoting references in the section header with double quote marks is supported. If you need a literal double quote mark, escape the double quote mark by prefixing with a backslash (\"). Backslashes can be listed literally and do not need to be escaped. If your reference contains a space, or if you want to list multiple references in the section header, you should quote each reference.
\* (in a distinguished name) use only in the canonical name, or CN, portion. (Why are asterisks escaped for wildcards in DNs/ADUC references?)
\* (in an Active Directory Users & Computers object location syntax) use in the group name.

Notes

This section may be repeated as many times as needed.

Multiple groups in the same section header should be quoted with double quotes.

Suggested minimal permissions

Read-only permission (the default for any AD user account) is recommended. If you intend to read groups that aren't normally available to an AD user account (such as course roster groups in AD), you will also need to grant your Martinet service account permission to read those groups.

Example sections

# These references each point to one AD group because there are no wildcards in any of these references.
[group:"MyUnit All Users"]
[group:"CN=MyUnit All users,OU=Groups,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu"]
[group:"ad.uillinois.edu/Urbana/MyUnit/Groups/MyUnit All users"]
[group:"ad.uillinois.edu/Urbana/MyUnit/Groups/MyUnit All users" "MyUnit All Users 2"]

# This reference might match multiple groups due to the "*" wildcard.
[group:"CN=MyUnit All \*,OU=Groups,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu"]

# The following group section references multiple groups including a wildcard reference.
[group:"MyUnit All Users" "MyUnit Staff Users" "MyUnit Denied Users" "CN=MyUnit All \*,OU=Groups,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu"]

# The following group section references a group named "*" (asterisk) --- it's the same group reference in DN and ADUC format, respectively.
[group:"CN=*,OU=test\,\+\"\;\<\>,OU=J.B. Nicholson,OU=FC Computers,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "ad.uillinois.edu/Urbana/TechServices/Delegated/Field Consulting/FC Computers/J.B. Nicholson/test,+";<>/*"]