Les, you're right. This was a quick and dirty way of doing this until we moved to Active Directory. I will then try to manage this with a policy.