AD Group-Based Sync and Sub-OU Handling in Domino DirSync

AD users that should be synchronized with Domino must be members of the defined Active Directory group G_DominoADSync.

This group contains multiple assigned users, and each of these users has a corresponding Domino account.

Currently, it appears that Directory Synchronization (DirSync) only searches one level below the defined base, which in our case is the Sub-OU HDH2.0, and only identifies person objects directly within that branch.

However, our understanding is that if a user (for example, CN=John Doe/OU=HDH/OU=ACME) is a member of a group located within the subtree (e.g., */OU=HDH2.0/OU=ACME), that user should also be returned during the LDAP search — even if the user object itself resides in a different OU branch.

From our perspective, Domino DirSync should honor and process all available sub-OUs starting from the defined root of the directory tree, ensuring that all eligible group members are properly discovered and synchronized.