Wonder if the script-friendly ADsSecurity DLL can be of any assistance here. It's pretty sophisticated.