This message was deleted.

Domain Users is often/usually the primary group for most users, and membership of that is stored separately in AD, and primary group is excluded from some AD membership queries. Don’t use that for delivery group restrictions - make some other group and add domain users to that. Follow AGDLP.

I was able to test this, Primary Group was the issue and it was excluded from membership queries. I changed Primary Group for a test user from Domain Users to a different group and enumeration worked fine. I created a new group and added domain users group to it, still no luck. Because Primary group (Domain Users) doesn't show users as its members.

So does that mean nested groups don’t work either, even if they’re not Primary?

As we are nesting Primary group to another group, NetScaler doesn’t show that as user’s membership. User is not member directly.

Yeah what I mean is if they’re using memberof (which means no primary group) then I’m assuming that even regular (not primary) groups won’t work if the membership is indirect / nested.

Yes, I tested by changing primary group and was able to get all resources enumerated. Better to avoid Domain Users which will be Primary Group in most cases.