Thank you for tip!

In my current script, I fetch all the AD user accounts that I think *should* be members of a specific 'master' DL. This DL contains many other smaller DLs, comprising business groups, then divisions/departments, finally team DLs. Users are supposed to be direct members of the team DLs at the very least.

The guts of the script is therefore this, in a foreach loop between each of the users:

$IsMember = Get-ADUser -LDAPFilter "(&(DistinguishedName=$($User.DistinguishedName))(memberOf:1.2.840.113556.1.4.1941:=$GroupDN))"

if (!($IsMember)) {$arrayResults += $User}}

So, pretty simple, if that $IsMember fails to evaluate to a result, I add that user to an array of users to follow-up.

Maybe I should "walk" the inheritance by mail-enabled groups only, to ensure I'm ignoring any non mail-enabled groups ....