Bryce - yes, that is what I am wanting to do. Exchange 2003 recommends that you restrict internet access based on a deny rather than an allow.

With 5.5, I denied all internet email with an exception allowing Internet Mail group users. With 2003, it is recommended that I create a group that allows all with the exception of denying to a group, Internet Mail Denied. I have it working by using the 5.5 method, but was trying to implement the recommended method.

I have 1,000+ users and less than half have internet mail. I didn't want to click through each user in AD Users & Computers and if they weren't in Internet Mail, add them to Internet Mail Denied. Although, with my scripting skills, I could have done it manually three times over before getting my script to work.

Thanks for everyone's input. I'm away from work but will give this a run tomorrow with recommended changes.

tjcarst