you can do a "net group" on a domain controller, and a "net localgroup" on the workstations.

a kix4.0/ADSI option would be...

code:

$domain = getobject("WinNT://@domain")
if vartype($domain) <> 9 ? "unable to connect to @domain" exit(0) endif
for each $group in $domain
	if $group.class = "group"
		? $group.name
	endif
next