Thanks for the info.. I still don't understand this though. I can run it under a domain admin account but not a regular user account so it does work but seems to needing some rights somewhere. I also tried to get group memberships via WSH and a script and had the same exact results - worked under admin but not under a domain user account. Puzzling.