Ldappc uses "GroupAttributeFilter" but that internally calls code that will generate a full table scan.
GRP-9 Group attribute queries generate full table scans