https://didoniama.blogspot.com/2023/07/domain-admins-nested-groups.html