LDAP not returning users for query of Users or Domain Users

I'm doing an LDAP query using C# and the DirectoryServices.DirectorySearcher class. But, the same holds true of raw queries using the LDP tool that comes with Windows.

I present the user of my program to say during the installer that users from "X" group should have their LDAP information transmitted (display name, email, account name, objectguid) to a management tool. The tool gives the user a list of groups and then saves the group selected in the registry for later use. For whatever group is selected, I want to query for all enabled users in the group.

If I create a group and add users, when I query for users, all in the group are returned. If I put a user in Group 1, create a Group 2 and put Group 1 in Group 2, then when I query for users, the user in Group 1 is returned. It works.

The problem is when they select just the Users group or the Domain Users group. When I use those to query for users, zero users are returned. If I look in AD management tools, of course all users are in Domain Users or Users.

public IList<UserInfo> GetGroupUsers(string dn)
{
    var users = new List<UserInfo>();

    using (var de = new DirectoryEntry(RootDomainName))
    {
        using (var searcher = new DirectorySearcher(de))
        {
            string filter = $"(&(memberof:1.2.840.113556.1.4.1941:={dn})(objectCategory=person)(objectClass=user))";
            searcher.Filter = filter;

            searcher.PropertiesToLoad.Add(DISTINGUISHEDNAME_PROP);
            searcher.PropertiesToLoad.Add(SAMACCOUNTNAME_PROP);
            searcher.PropertiesToLoad.Add(MAIL_PROP);
            searcher.PropertiesToLoad.Add(DISPLAYNAME_PROP);
            searcher.PropertiesToLoad.Add(OBJECTGUID_PROP);

            SearchResultCollection AllResults = searcher.FindAll();
            //MessageBox.Show($"Filter: {filter}\r\nResult count: {AllResults.Count}");
            foreach (SearchResult sr in AllResults)
            {
                var userInfo = new UserInfo()
                {
                    DisplayName = sr.GetProperty(DISPLAYNAME_PROP),
                    DistinguishedName = sr.GetProperty(DISTINGUISHEDNAME_PROP),
                    Account = sr.GetProperty(SAMACCOUNTNAME_PROP),
                    Mail = sr.GetProperty(MAIL_PROP),
                    Guid = new Guid((byte[]) sr.Properties[OBJECTGUID_PROP][0]),
                    Path = sr.Path
                };
                users.Add(userInfo);
            }
        }
    }

    return users;
}

Most of the magic (poison) sauce is in the filter which I gleaned from other articles: string filter = $"(&(memberof:1.2.840.113556.1.4.1941:={dn})(objectCategory=person)(objectClass=user))";

Is there any way to tweak my query, or is this a known issue, or do I just have to be smarter about the Domain User or User groups?