Damn, giving me flashbacks of slowly moving through ACLs then hitting domain groups, domain local groups, global groups, then eventually universal groups as AD moved forward in complex situations.

Got to admit it worked well though.