If you poke at this stuff long enough it starts to make sense.

So, is this the correct way of approaching a mixed XP/2K/NT environment something like this pseudocode?

If OpSys is XP or OpSys is 2K
$Group=getobject("LDAP://" + $CN + "," + $DN)
Else
$Group=getobject("WinNT://<domain>/<group>")
Endif

or is there a more elegant way? Or should I just always use the "WinNT://" method since it seems to work on all platforms?