I guess there's two questions here: a) why is my SID match failing and b) why does Kix bail if my SID match fails.

I'd love to hear Ruud's input on b) . As for a), I think it may have something to do with some of the groups. They were migrated from an NT domain to the AD domain. I'm testing this now and will post results.

Steve