Howard,

The WinNT provider did/does not understand Universal Groups. In this case not an issue as Jose says he is running NT 4.0

However, if you perform IF INGROUP calls to a Universal group using WinNT provider information your call will always fail, as it can not get that information.

I can't find the link, but Microsoft does have a good page that shows the commands that can be used by WinNT and those they require LDAP calls.

Another example is that you can add a user to a group with WinNT provider, but I don't think you can do an IsMember I've not done a lot of testing with this yet, but preliminary testing I've done comes back invalid. i.e. always returns TRUE even if it is FALSE.