Group/User memberships do not obey the tree scope or object filters

When identifying the user/group members of a group, the user/group filter and subtree scope are not applied to the members. They are simply retrieved by their DN/UID and their objectClass attribute determines whether they are a user member or a group member.

Similarly, if the memberOf field is used to determine the group memberships of a user, the group filter and group subtree scope are not applied.

The result is that more memberships/members are displayed because the extra filter/subtree restrictions are not applied.