The following example shows that the member has one group, Domain Guests, as one of the user's ldap attributes. Once this group is imported, anyone users who have the an LDAP attribute as "memberOf" Domain Guests, and meets conditions set at the LDAP setting will automatically join the group. If the group is given any permissions to it, then the users will automatically inherit the permissions. Since this is Dynamic mapping, the user, joshua, is aware of what groups it belongs to, but the group object, Domain Guest, is not aware of their members (;although, Windows have cross-reference at the group also by using 'member' attribute, it is not required).