For posterity's sake, if you dare to try configuring a linked server like Eric described above, below is how you can do it using MSSQL and SQL Management Studio. Familiarity with SQL helps, and familiarity with the structure of Active Directory you wish to query is required. Tools like ADExplorer from SysInternals can help with that.

Step One: Create a Linked Server

1. In SQL Management Studio, connect to the SQL server. In the Object Explorer, expand the "Server Objects" node and right-click on "Linked Servers" to add a new one. You will get the "New Linked Server" dialog.
2. Give the Linked Server a name. In the attached example 1-LinkedServerGeneral.png, I named mine "ADQUERY".
3. For "Provider", select "OLE DB Provider for Microsoft Directory Services".
4. For "Product Name", enter "Active Directory Services 2.5".
5. For "Data Source", enter "adsdatasource".
6. Go to the Security page in the left pane. By default connections will not be made with any security context, which in most cases will cause errors when trying to make the query. If using Windows authentication with an account that has rights to query AD, you can choose "Be made using the login's current security context". (2-LinkedServerSecurity.png) To be safe, you can specify a security context and provide the credentials to use to query AD.
7. Click OK and you've got yourself a linked server!

Step Two: Structure of Query for this Linked Server

You can use SQL-style queries to query this new linked server:

SELECT * FROM OpenQuery(
	<LinkedServerName>,
	'SELECT <ADAttribute1>, <ADAttribute2>, ..., <ADAttributeN>
	FROM ''LDAP://<domain>.<ext>/<BaseDistinguishedName>''
	WHERE objectClass = ''User''
	')

There are a lot of variables to play with here:

• <LinkedServerName>: the name of the linked server from Step One above.
• <ADAttribute#>: attributes in Active Directory; for example displayName, cn, sn, mail, memberOf, etc.
  • A good reference for user attributes in Active Directory is available online here.
  • Note that you must specify attributes here for the results to be meaningful; if you try to use wildcard (*) the results will not be useful values, but instead LDAP:// URIs for the returned users.
• <domain>.<ext>: the domain of Active Directory you are querying
• <BaseDistinguishedName>: the distinguished name of the "maximum" organizational unit you will be querying; at minimum this will probably include "DC=<domain>,DC=<ext>"

Here's an example:

SELECT * FROM OpenQuery(
	ADQUERY,
	'SELECT displayName, mail
	FROM ''LDAP://mydomain.com/OU=Users,DC=mydomain,DC=com''
	WHERE objectClass = ''User''
	')

This returns SQL results in two columns: 'displayName' and 'mail'.

You can actually extend the query to include more WHERE and ORDER BY just like in SQL, using attribute names as though they were SQL column names. A useful example for the use case in this thread could be as follows:

SELECT * FROM OpenQuery(
	ADQUERY,
	'SELECT displayName, mail
	FROM ''LDAP://mydomain.com/OU=Users,DC=mydomain,DC=com''
	WHERE objectClass = ''User''
	AND memberOf = ''CN=Sample Group,OU=My Group,OU=Users,DC=mydomain,DC=com''
	ORDER BY displayName
	')

This example returns all users from my fictitious Active Directory setup who are part of a group "Sample Group", ordered by their display names. Note the additional "memberOf" clause. The value is the distinguished name of the Windows group. How to find this? You'll have to get familiar with Active Directory. The tool I use is ADExplorer from SysInternals, mentioned previously.

One final note, for those following along in SQL Management Studio, is that when the query results are returned, the columns will be in the reverse order as specified in the query. So for example, if running the above query, the 'mail' column will be shown first, then the 'displayName' column.

Now to prepare this for use with Forms.

Step Three: Write a Stored Procedure to Query Active Directory

SQL-savvy folks can come up with queries that will take in parameters, etc. For now, here's code that will create a stored procedure that will run the Active Directory query from before:

SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
CREATE PROCEDURE sp_adquery
AS
BEGIN
	SET NOCOUNT ON;
	-- here's the query from before
	SELECT * FROM OpenQuery(
		ADQUERY,
		'SELECT displayName, mail
		FROM ''LDAP://mydomain.com/OU=Users,DC=mydomain,DC=com''
		WHERE objectClass = ''User''
		AND memberOf = ''CN=Sample Group,OU=My Group,OU=Users,DC=mydomain,DC=com''
		ORDER BY displayName
		')
END
GO

In SQL Management Studio's Object Explorer, expand the Databases node, navigating to the database used as an external data source in Forms, then expand the Programmability node. Right-click on "Stored Procedures" to create a new one. Replace the code in the query tab with the code above.

Now if you set up the external data source in Forms and configure a lookup rule (nothing fancy here, just treat it like any other stored procedure), you should be able to set up something like 3-LookupRulesConfig.png. Then when viewing the form you should be able to get the results of the stored procedure querying Active Directory.

For an extra step, one could create a "dictionary" of Windows groups and their distinguished names, then use that as an intermediate step to pass a parameter to the stored procedure so one could select a Windows group by its display name in one field, that then populates another with a list of users in that group.

Apologies for the wall of content, and I hope this helps!