Nested groups can cause some unpleasant surprises when you are auditing membership in Active Directory Builtin Groups. BuiltInGroupsEnum.vbs will enumerate those groups recursively so you can determine exactly who is an administrator in your domain.
BuiltInGroupsEnum.vbs v 1.2 (updated 10/1/2009) fixes an issue with enumeration of other domains, and adds Enterprise and Schema Admins to list of groups.