dn: cn=behind-the-firewall,ou=internal-network-groups,ou=policy1, ou=tdatroot,dc=domain1,dc=com objectClass: groupOfNames cn: behind-the-firewall member: ou=internal-network-groups,ou=policy1,ou=tdatrootP,dc=domain1, dc=com
The preceding example includes the definition of a member attribute, which points to the internal network groups container, only because member is a required attribute of groupOfNames and it must have at least one value.
The DN of the internal network group container is not used but it is recommended because use of the DN of the parent cannot result in a “group loop.”