Yesterday I was surprised to realize that ADUC won't report complete group membership, dsget and ldp report results ok.
This is explained in KB833883 and supposedly fixed in Windows 2003 sp1. However, while this hotfix is included in sp1, it's still needed to make the registry changes outlined in the same KB to make the hotfix work. Not entirely know why couldn't MS include that registry change altogether in sp1.
Please see the usernet thread I raised in details.