OK, nobody wants to tell me if it's possible to enumerate the global user
groups without logging on to the domain. I assume then that this time the
documentation is right this time and it's impossible. It still looks
suspicious to me.
Now, who knows why there is NetUserGetLocalGroups API, but no
Do I have to delete the user from each group I don't want him to be a member
of and then add to those I do?