But I think I already mentioned this to you Howard - the number one thing I think would be most usefull is a simplified version of the ADsSecurity snapin. Like a COMable XCACLS with an interface that makes sense (for a change).