Shadow groups are closely related to organizational units (OUs) in Active Directory. But what exactly can these “shadow groups” do...